{"updated_at":"2026-10-21T10:55:56.102401+00:00","v2": {"week": "2026-10-12", "sides": {"host": {"mu0": -1.624, "phi": {"urlhaus": 0.6992, "threatfox": 0.1293, "phishing_db": 0.2671}, "tau": 2.145, "gini": 0.955, "alpha": {"urlhaus": 0.4893, "threatfox": 0.4285, "phishing_db": -0.1675}, "feeds": ["threatfox", "urlhaus", "phishing_db"], "kappa": 0.000791343281006257, "notes": {"grid": 73, "checks": {"spearman_sides": 0.1767, "auc_asndrop_host": 0.8239, "asndrop_positives": 118, "evidence_networks": 3473, "auc_asndrop_attack": 0.7165}, "networks": 79061, "prev_week": "2026-10-05", "time_capped": false, "unique_rows": 2749, "routed_sizes": "stored", "union_run_id": "5f2ac8a1-88ad-482d-ae3a-dbdf57f634f2", "union_source": "side", "rho_union_24s": 8881.0, "unrouted_dropped": {"urlhaus": 0, "threatfox": 0, "phishing_db": 0}, "rho_denominator_ip_24s": 8975.0}, "absent": [], "listed": 2, "seconds": 61.0, "networks": 79061, "type_ref": {"Other": 1.7801, "Hosting & VPS": 4.6448, "CDN & platforms": 0.2639, "Hyperscale cloud": 2.5067, "Broadband & mobile": 0.7176, "Transit & backbone": 0.5046, "Enterprise, edu & gov": 0.4254}, "converged": true, "rho_union": 0.990, "iterations": 416, "mass_total": 9685, "provisional": false, "top10_share": 0.361, "top100_share": 0.610, "feed_total_24s": {"urlhaus": 1130, "threatfox": 1875, "phishing_db": 5970}}, "attack": {"mu0": -1.392, "phi": {"cins": 0.8543, "dshield": 0.6855, "crowdsec": 2.6364, "vulncheck": 0.1943, "blocklist_de": 3.4883}, "tau": 2.288, "gini": 0.959, "alpha": {"cins": -0.4693, "dshield": 0.1806, "crowdsec": -0.0354, "vulncheck": 0.5326, "blocklist_de": 0.2589}, "feeds": ["crowdsec", "dshield", "blocklist_de", "cins", "vulncheck"], "kappa": 0.00488458986729219, "notes": {"grid": 73, "checks": {"spearman_sides": 0.1767, "auc_asndrop_host": 0.8239, "asndrop_positives": 118, "evidence_networks": 3473, "auc_asndrop_attack": 0.7165}, "networks": 79061, "prev_week": "2026-10-05", "time_capped": false, "unique_rows": 7445, "routed_sizes": "stored", "union_run_id": "5f2ac8a1-88ad-482d-ae3a-dbdf57f634f2", "union_source": "side", "rho_union_24s": 54064.0, "unrouted_dropped": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "rho_denominator_ip_24s": 63727.0}, "absent": [], "listed": 21, "seconds": 111.4, "networks": 79061, "type_ref": {"Other": 2.01, "Hosting & VPS": 5.7709, "CDN & platforms": 0.564, "Hyperscale cloud": 2.7508, "Broadband & mobile": 0.7355, "Transit & backbone": 0.3621, "Enterprise, edu & gov": 0.2025}, "converged": true, "rho_union": 0.848, "iterations": 162, "mass_total": 59778, "provisional": false, "top10_share": 0.367, "top100_share": 0.636, "feed_total_24s": {"cins": 5161, "dshield": 6592, "crowdsec": 32473, "vulncheck": 6409, "blocklist_de": 13092}}}, "weeks": [{"week": "2026-10-05", "host_mass": 6736, "attack_mass": 44323, "host_listed": 2, "provisional": false, "attack_listed": 17}, {"week": "2026-10-12", "host_mass": 9685, "attack_mass": 59778, "host_listed": 2, "provisional": false, "attack_listed": 21}]}, "cves": {"CVE-2002-1131": {"cvss": 7.5, "year": 2002, "title": "Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attac", "vendor": null}, "CVE-2007-0885": {"cvss": 6.8, "year": 2007, "title": "Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with", "vendor": null}, "CVE-2008-2398": {"cvss": 4.3, "year": 2008, "title": "Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and e", "vendor": null}, "CVE-2009-1558": {"cvss": 7.8, "year": 2009, "title": "Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless v", "vendor": null}, "CVE-2010-2861": {"cvss": 9.8, "year": 2010, "title": "Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFus", "vendor": null}, "CVE-2011-3600": {"cvss": 7.5, "year": 2019, "title": "The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to Externa", "vendor": "OFBiz"}, "CVE-2012-0392": {"cvss": 6.8, "year": 2012, "title": "The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter", "vendor": null}, "CVE-2012-3153": {"cvss": 6.4, "year": 2012, "title": "Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middl", "vendor": null}, "CVE-2013-3827": {"cvss": 5.0, "year": 2013, "title": "Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middle", "vendor": null}, "CVE-2014-2383": {"cvss": 6.8, "year": 2014, "title": "dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-depen", "vendor": null}, "CVE-2014-8739": {"cvss": 9.8, "year": 2020, "title": "Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File ", "vendor": null}, "CVE-2015-4455": {"cvss": 9.8, "year": 2017, "title": "Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor A", "vendor": null}, "CVE-2015-9406": {"cvss": 7.5, "year": 2019, "title": "Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows", "vendor": null}, "CVE-2015-9415": {"cvss": 7.5, "year": 2019, "title": "The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.", "vendor": null}, "CVE-2016-1555": {"cvss": 9.8, "year": 2017, "title": "(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and ", "vendor": null}, "CVE-2016-2389": {"cvss": 7.5, "year": 2016, "title": "Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Int", "vendor": null}, "CVE-2017-3506": {"cvss": 7.4, "year": 2017, "title": "Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomp", "vendor": "Oracle Corporation"}, "CVE-2017-8046": {"cvss": 9.8, "year": 2018, "title": "Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6", "vendor": "Pivotal"}, "CVE-2017-9805": {"cvss": 8.1, "year": 2017, "title": "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13", "vendor": "Apache Software Foundation"}, "CVE-2017-9841": {"cvss": 9.8, "year": 2017, "title": "Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attack", "vendor": null}, "CVE-2018-1207": {"cvss": 9.8, "year": 2018, "title": "Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability ", "vendor": null}, "CVE-2018-2392": {"cvss": 7.5, "year": 2018, "title": "Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.5", "vendor": "SAP SE"}, "CVE-2018-6530": {"cvss": 9.8, "year": 2018, "title": "OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L", "vendor": null}, "CVE-2018-9206": {"cvss": 9.8, "year": 2018, "title": "Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22", "vendor": "Blueimp"}, "CVE-2019-5418": {"cvss": 7.5, "year": 2019, "title": "There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7", "vendor": "Rails"}, "CVE-2019-7254": {"cvss": 7.5, "year": 2019, "title": "Linear eMerge E3-Series devices allow File Inclusion.", "vendor": null}, "CVE-2019-8318": {"cvss": 8.8, "year": 2019, "title": "An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Co", "vendor": null}, "CVE-2019-9082": {"cvss": 8.8, "year": 2019, "title": "ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote", "vendor": null}, "CVE-2019-9194": {"cvss": 9.8, "year": 2019, "title": "elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.", "vendor": null}, "CVE-2020-2096": {"cvss": 6.1, "year": 2020, "title": "Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_no", "vendor": "Jenkins project"}, "CVE-2020-5902": {"cvss": 9.8, "year": 2020, "title": "In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and", "vendor": null}, "CVE-2020-8656": {"cvss": 9.8, "year": 2020, "title": "An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL ", "vendor": null}, "CVE-2021-0027": {"cvss": null, "year": null, "title": null, "vendor": null}, "CVE-2021-3129": {"cvss": 9.8, "year": 2021, "title": "Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remot", "vendor": null}, "CVE-2021-3152": {"cvss": 5.3, "year": 2021, "title": "Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent d", "vendor": null}, "CVE-2022-1388": {"cvss": 9.8, "year": 2022, "title": "On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x ", "vendor": "F5"}, "CVE-2022-3124": {"cvss": 5.3, "year": 2022, "title": "Frontend File Manager < 21.3 - Unauthenticated File Renaming", "vendor": "Unknown"}, "CVE-2022-3236": {"cvss": 9.8, "year": 2022, "title": "A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to", "vendor": "Sophos"}, "CVE-2023-0297": {"cvss": 9.8, "year": 2023, "title": " Code Injection in pyload/pyload", "vendor": "pyload"}, "CVE-2023-1389": {"cvss": 8.8, "year": 2023, "title": "TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a com", "vendor": null}, "CVE-2023-3519": {"cvss": 9.8, "year": 2023, "title": "Unauthenticated remote code execution", "vendor": "Citrix"}, "CVE-2023-5074": {"cvss": 9.8, "year": 2023, "title": "Authentication Bypass in D-Link D-View 8", "vendor": "D-Link"}, "CVE-2023-7028": {"cvss": 10.0, "year": 2024, "title": "Weak Password Recovery Mechanism for Forgotten Password in GitLab", "vendor": "GitLab"}, "CVE-2024-0012": {"cvss": 9.3, "year": 2024, "title": "PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)", "vendor": "Palo Alto Networks"}, "CVE-2024-0204": {"cvss": 9.8, "year": 2024, "title": "Authentication Bypass in GoAnywhere MFT", "vendor": "Fortra"}, "CVE-2024-2053": {"cvss": 7.5, "year": 2024, "title": "Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability", "vendor": "Artica Tech"}, "CVE-2024-2473": {"cvss": 5.3, "year": 2024, "title": "WPS Hide Login <= 1.9.15.2 - Login Page Disclosure", "vendor": "tabrisrp"}, "CVE-2024-2782": {"cvss": 7.5, "year": 2024, "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation", "vendor": "techjewel"}, "CVE-2024-3272": {"cvss": 9.8, "year": 2024, "title": "D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials", "vendor": "D-Link"}, "CVE-2024-3273": {"cvss": 7.3, "year": 2024, "title": "D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection", "vendor": "D-Link"}, "CVE-2024-3721": {"cvss": 6.3, "year": 2024, "title": "TBK DVR-4104/DVR-4216 os command injection", "vendor": "TBK"}, "CVE-2024-3804": {"cvss": 6.3, "year": 2024, "title": "Vesystem Cloud Desktop fileupload2.php unrestricted upload", "vendor": "Vesystem"}, "CVE-2024-4040": {"cvss": 9.8, "year": 2024, "title": "Unauthenticated arbitrary file read and remote code execution in CrushFTP", "vendor": "CrushFTP"}, "CVE-2024-4577": {"cvss": 9.8, "year": 2024, "title": "Argument Injection in PHP-CGI", "vendor": "PHP Group"}, "CVE-2024-6387": {"cvss": 8.1, "year": 2024, "title": "Openssh: regresshion - race condition in ssh allows rce/dos", "vendor": "None"}, "CVE-2024-6569": {"cvss": 5.3, "year": 2024, "title": "Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure", "vendor": "vibhorchhabra"}, "CVE-2024-6587": {"cvss": 7.5, "year": 2024, "title": "SSRF in berriai/litellm", "vendor": "berriai"}, "CVE-2025-0282": {"cvss": 9.0, "year": 2025, "title": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Pol", "vendor": "Ivanti"}, "CVE-2025-3248": {"cvss": 9.8, "year": 2025, "title": "Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code", "vendor": "langflow-ai"}, "CVE-2025-3605": {"cvss": 9.8, "year": 2025, "title": "Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover", "vendor": "arkenon"}, "CVE-2025-4396": {"cvss": 7.5, "year": 2025, "title": "Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection", "vendor": "Relevanssi"}, "CVE-2025-4427": {"cvss": 5.3, "year": 2025, "title": "Authentication Bypass", "vendor": "Ivanti"}, "CVE-2025-4428": {"cvss": 7.2, "year": 2025, "title": "Remote Code Execution", "vendor": "Ivanti"}, "CVE-2025-5777": {"cvss": 9.3, "year": 2025, "title": "NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread", "vendor": "NetScaler"}, "CVE-2025-8943": {"cvss": 9.8, "year": 2025, "title": "Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers", "vendor": "None"}, "CVE-2026-1581": {"cvss": 7.5, "year": 2026, "title": "wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection", "vendor": "tomdever"}, "CVE-2026-1731": {"cvss": 9.9, "year": 2026, "title": "Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)", "vendor": "BeyondTrust"}, "CVE-2026-2652": {"cvss": 8.6, "year": 2026, "title": "Authentication Bypass in mlflow/mlflow", "vendor": "mlflow"}, "CVE-2026-4020": {"cvss": 7.5, "year": 2026, "title": "Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API", "vendor": "RocketGenius"}, "CVE-2026-8181": {"cvss": 9.8, "year": 2026, "title": "Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover", "vendor": "burstbv"}, "CVE-2016-10924": {"cvss": 7.5, "year": 2019, "title": "The ebook-download plugin before 1.2 for WordPress has directory traversal.", "vendor": null}, "CVE-2016-15043": {"cvss": 9.8, "year": 2025, "title": "WP Mobile Detector <= 3.5 - Arbitrary File Upload", "vendor": "Websitez.com, LLC"}, "CVE-2017-12149": {"cvss": 9.8, "year": 2017, "title": "In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, i", "vendor": "Red Hat, Inc."}, "CVE-2017-16894": {"cvss": 7.5, "year": 2017, "title": "In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (su", "vendor": null}, "CVE-2017-17762": {"cvss": 7.5, "year": 2018, "title": "XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote a", "vendor": null}, "CVE-2017-18362": {"cvss": 9.8, "year": 2019, "title": "ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthe", "vendor": null}, "CVE-2018-10562": {"cvss": 9.8, "year": 2018, "title": "An issue was discovered on Dasan GPON home routers. Command Injection can occur via the de", "vendor": null}, "CVE-2018-11511": {"cvss": 9.8, "year": 2018, "title": "The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has", "vendor": null}, "CVE-2018-11776": {"cvss": 8.1, "year": 2018, "title": "Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Ex", "vendor": "Apache Software Foundation"}, "CVE-2018-12031": {"cvss": 9.8, "year": 2018, "title": "Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include", "vendor": null}, "CVE-2018-13379": {"cvss": 9.1, "year": 2019, "title": "An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Forti", "vendor": "Fortinet"}, "CVE-2018-20062": {"cvss": 9.8, "year": 2018, "title": "An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote atta", "vendor": null}, "CVE-2019-11510": {"cvss": 9.9, "year": 2019, "title": "In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.", "vendor": null}, "CVE-2019-12989": {"cvss": 9.8, "year": 2019, "title": "Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Inj", "vendor": null}, "CVE-2019-17050": {"cvss": 7.2, "year": 2019, "title": "An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with", "vendor": null}, "CVE-2019-17233": {"cvss": 6.1, "year": 2019, "title": "Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress all", "vendor": null}, "CVE-2019-18935": {"cvss": 9.8, "year": 2019, "title": "Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization v", "vendor": null}, "CVE-2019-18952": {"cvss": 9.8, "year": 2019, "title": "SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can b", "vendor": null}, "CVE-2019-19781": {"cvss": 9.8, "year": 2019, "title": "An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, ", "vendor": null}, "CVE-2019-25246": {"cvss": 7.1, "year": 2025, "title": "Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure", "vendor": "Beward R&D Co., Ltd"}, "CVE-2020-10987": {"cvss": 9.8, "year": 2020, "title": "The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote at", "vendor": null}, "CVE-2020-11515": {"cvss": 6.1, "year": 2020, "title": "The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attacker", "vendor": null}, "CVE-2020-11738": {"cvss": 7.5, "year": 2020, "title": "The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.", "vendor": null}, "CVE-2020-13640": {"cvss": 9.8, "year": 2020, "title": "A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allo", "vendor": null}, "CVE-2020-15415": {"cvss": 9.8, "year": 2020, "title": "On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.", "vendor": null}, "CVE-2020-17496": {"cvss": 9.8, "year": 2020, "title": "vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data ", "vendor": null}, "CVE-2020-25078": {"cvss": 7.5, "year": 2020, "title": "An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.", "vendor": null}, "CVE-2020-27866": {"cvss": 8.8, "year": 2021, "title": "This vulnerability allows network-adjacent attackers to bypass authentication on affected ", "vendor": "NETGEAR"}, "CVE-2020-29390": {"cvss": 9.8, "year": 2020, "title": "Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartS", "vendor": null}, "CVE-2020-36723": {"cvss": 5.3, "year": 2023, "title": "ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure", "vendor": null}, "CVE-2020-36836": {"cvss": 8.0, "year": 2024, "title": "WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion", "vendor": "emrevona"}, "CVE-2020-37123": {"cvss": 9.3, "year": 2026, "title": "Pinger 1.0 - Remote Code Execution", "vendor": "wcchandler"}, "CVE-2021-20124": {"cvss": 7.5, "year": 2021, "title": "A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file d", "vendor": null}, "CVE-2021-21234": {"cvss": 7.7, "year": 2021, "title": "Directory Traversal", "vendor": "lukashinsch"}, "CVE-2021-21307": {"cvss": 8.6, "year": 2021, "title": "Remote Code Exploit in Lucee Admin", "vendor": "lucee"}, "CVE-2021-21978": {"cvss": 9.8, "year": 2021, "title": "VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vul", "vendor": null}, "CVE-2021-22175": {"cvss": 6.8, "year": 2021, "title": "When requests to the internal network for webhooks are enabled, a server-side request forg", "vendor": "GitLab"}, "CVE-2021-23394": {"cvss": 8.1, "year": 2021, "title": "Remote Code Execution (RCE)", "vendor": null}, "CVE-2021-24931": {"cvss": 9.8, "year": 2021, "title": "Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection", "vendor": "Unknown"}, "CVE-2021-26084": {"cvss": 9.8, "year": 2021, "title": "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability", "vendor": "Atlassian"}, "CVE-2021-26086": {"cvss": 5.3, "year": 2021, "title": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read ", "vendor": "Atlassian"}, "CVE-2021-26294": {"cvss": 7.5, "year": 2021, "title": "An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. ", "vendor": null}, "CVE-2021-26295": {"cvss": 9.8, "year": 2021, "title": "RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI", "vendor": "Apache Software Foundation"}, "CVE-2021-32648": {"cvss": 8.2, "year": 2021, "title": "Account Takeover in Octobercms", "vendor": "octobercms"}, "CVE-2021-33044": {"cvss": 9.8, "year": 2021, "title": "The identity authentication bypass vulnerability found in some Dahua products during the l", "vendor": null}, "CVE-2021-33690": {"cvss": 9.9, "year": 2021, "title": "Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver De", "vendor": "SAP SE"}, "CVE-2021-34427": {"cvss": 9.8, "year": 2021, "title": "In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create", "vendor": "The Eclipse Foundation"}, "CVE-2021-36260": {"cvss": 9.8, "year": 2021, "title": "A command injection vulnerability in the web server of some Hikvision product. Due to the ", "vendor": null}, "CVE-2021-40655": {"cvss": 7.5, "year": 2021, "title": "An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An a", "vendor": null}, "CVE-2021-41277": {"cvss": 10.0, "year": 2021, "title": "GeoJSON URL validation can expose server files and environment variables to unauthorized users", "vendor": "metabase"}, "CVE-2021-41714": {"cvss": 7.7, "year": 2022, "title": "In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading ", "vendor": null}, "CVE-2021-41773": {"cvss": 9.8, "year": 2021, "title": "Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49", "vendor": "Apache Software Foundation"}, "CVE-2021-42013": {"cvss": 9.8, "year": 2021, "title": "Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)", "vendor": "Apache Software Foundation"}, "CVE-2021-43798": {"cvss": 7.5, "year": 2021, "title": "Grafana path traversal", "vendor": "grafana"}, "CVE-2021-44228": {"cvss": 10.0, "year": 2021, "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints", "vendor": "Apache Software Foundation"}, "CVE-2022-22947": {"cvss": 10.0, "year": 2022, "title": "In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable ", "vendor": null}, "CVE-2022-22954": {"cvss": 9.8, "year": 2022, "title": "VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerabi", "vendor": null}, "CVE-2022-22956": {"cvss": 9.8, "year": 2022, "title": "VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 ", "vendor": null}, "CVE-2022-22965": {"cvss": 9.8, "year": 2022, "title": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote c", "vendor": null}, "CVE-2022-26134": {"cvss": 9.8, "year": 2022, "title": "In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability", "vendor": "Atlassian"}, "CVE-2022-35914": {"cvss": 9.8, "year": 2022, "title": "/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 ", "vendor": null}, "CVE-2022-39290": {"cvss": 8.0, "year": 2022, "title": "CSRF key bypass using HTTP methods in zoneminder", "vendor": "ZoneMinder"}, "CVE-2022-40684": {"cvss": 9.8, "year": 2022, "title": "An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS ", "vendor": "Fortinet"}, "CVE-2022-41082": {"cvss": 8.0, "year": 2022, "title": "Microsoft Exchange Server Remote Code Execution Vulnerability", "vendor": "Microsoft"}, "CVE-2022-42889": {"cvss": 9.8, "year": 2022, "title": "Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "vendor": "Apache Software Foundation"}, "CVE-2022-44877": {"cvss": 9.8, "year": 2023, "title": "login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 all", "vendor": null}, "CVE-2022-46169": {"cvss": 9.8, "year": 2022, "title": "Unauthenticated Command Injection", "vendor": "Cacti"}, "CVE-2022-46604": {"cvss": 8.8, "year": 2023, "title": "An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the", "vendor": null}, "CVE-2022-47501": {"cvss": 7.5, "year": 2023, "title": "Apache OFBiz: Arbitrary file reading vulnerability", "vendor": "Apache Software Foundation"}, "CVE-2023-22515": {"cvss": 10.0, "year": 2023, "title": "Atlassian has been made aware of an issue reported by a handful of customers where externa", "vendor": "Atlassian"}, "CVE-2023-22527": {"cvss": 10.0, "year": 2024, "title": "A template injection vulnerability on older versions of Confluence Data Center and Server ", "vendor": "Atlassian"}, "CVE-2023-23752": {"cvss": 5.3, "year": 2023, "title": "[20230201] - Core - Improper access check in webservice endpoints", "vendor": "Joomla! Project"}, "CVE-2023-26258": {"cvss": 9.8, "year": 2023, "title": "Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at W", "vendor": null}, "CVE-2023-27351": {"cvss": 8.2, "year": 2023, "title": "This vulnerability allows remote attackers to bypass authentication on affected installati", "vendor": "PaperCut"}, "CVE-2023-27372": {"cvss": 9.8, "year": 2023, "title": "SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because ", "vendor": null}, "CVE-2023-28121": {"cvss": 9.8, "year": 2023, "title": "An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an", "vendor": null}, "CVE-2023-30625": {"cvss": 8.8, "year": 2023, "title": "rudder-server vulnerable to SQL Injection", "vendor": "rudderlabs"}, "CVE-2023-35078": {"cvss": 10.0, "year": 2023, "title": "An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access ", "vendor": "Ivanti"}, "CVE-2023-38950": {"cvss": 7.5, "year": 2023, "title": "A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthent", "vendor": null}, "CVE-2023-39780": {"cvss": 8.8, "year": 2023, "title": "On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command ", "vendor": "ASUS"}, "CVE-2023-42793": {"cvss": 9.8, "year": 2023, "title": "In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Se", "vendor": "JetBrains"}, "CVE-2023-44982": {"cvss": 5.3, "year": 2023, "title": "WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure", "vendor": "Jordy Meow"}, "CVE-2023-45878": {"cvss": 9.8, "year": 2023, "title": "GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_vis", "vendor": null}, "CVE-2023-46805": {"cvss": 8.2, "year": 2024, "title": "An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Iv", "vendor": "Ivanti"}, "CVE-2023-49103": {"cvss": 10.0, "year": 2023, "title": "An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before ", "vendor": null}, "CVE-2023-50164": {"cvss": 9.8, "year": 2023, "title": "Apache Struts: File upload component had a directory traversal vulnerability", "vendor": "Apache Software Foundation"}, "CVE-2023-54391": {"cvss": 9.3, "year": 2026, "title": "Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter", "vendor": "Proxmox Server Solutions GmbH"}, "CVE-2024-12008": {"cvss": 5.3, "year": 2025, "title": "W3 Total Cache <= 2.8.1 Information Exposure via Log Files", "vendor": "boldgrid"}, "CVE-2024-12847": {"cvss": 9.8, "year": 2025, "title": "NETGEAR DGN setup.cgi OS Command Injection", "vendor": "NETGEAR"}, "CVE-2024-20767": {"cvss": 7.4, "year": 2024, "title": "ColdFusion | Improper Access Control (CWE-284)", "vendor": "Adobe"}, "CVE-2024-25600": {"cvss": 10.0, "year": 2024, "title": "WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability", "vendor": "Codeer Limited"}, "CVE-2024-27956": {"cvss": 9.9, "year": 2024, "title": "WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability", "vendor": "ValvePress"}, "CVE-2024-28000": {"cvss": 9.8, "year": 2024, "title": "WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability", "vendor": "LiteSpeed Technologies"}, "CVE-2024-29973": {"cvss": 9.8, "year": 2024, "title": "** UNSUPPORTED WHEN ASSIGNED **\nThe command injection vulnerability in the “setCookie” par", "vendor": "Zyxel"}, "CVE-2024-34102": {"cvss": 9.8, "year": 2024, "title": "XXE can expose crypt key and other secrets granting full admin access", "vendor": "Adobe"}, "CVE-2024-34351": {"cvss": 7.5, "year": 2024, "title": "Next.js Server-Side Request Forgery in Server Actions", "vendor": "vercel"}, "CVE-2024-35694": {"cvss": 7.1, "year": 2024, "title": "WordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerability", "vendor": "Amauri"}, "CVE-2024-36401": {"cvss": 9.8, "year": 2024, "title": "Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver", "vendor": "geoserver"}, "CVE-2024-38475": {"cvss": 9.1, "year": 2024, "title": "Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.", "vendor": "Apache Software Foundation"}, "CVE-2024-38856": {"cvss": 9.8, "year": 2024, "title": "Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code", "vendor": "Apache Software Foundation"}, "CVE-2024-48914": {"cvss": 9.1, "year": 2024, "title": "Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy", "vendor": "vendure-ecommerce"}, "CVE-2024-51978": {"cvss": 9.8, "year": 2025, "title": "Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.", "vendor": "Brother Industries, Ltd"}, "CVE-2024-55591": {"cvss": 9.6, "year": 2025, "title": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affect", "vendor": "Fortinet"}, "CVE-2024-56159": {"cvss": 7.8, "year": 2024, "title": "Server source code is exposed to the public if sourcemaps are enabled", "vendor": "withastro"}, "CVE-2024-57046": {"cvss": 8.8, "year": 2025, "title": "A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier ", "vendor": null}, "CVE-2025-10353": {"cvss": 9.3, "year": 2025, "title": "Missing Authorization vulnerability in Melis Platform", "vendor": "Melis Technology"}, "CVE-2025-11368": {"cvss": 5.3, "year": 2025, "title": "LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure", "vendor": "thimpress"}, "CVE-2025-12480": {"cvss": 9.1, "year": 2025, "title": "Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control f", "vendor": "TrioFox"}, "CVE-2025-13315": {"cvss": 9.3, "year": 2025, "title": "Unauthenticated log access in Twonky Server", "vendor": "Lynxtechnology"}, "CVE-2025-13801": {"cvss": 7.5, "year": 2026, "title": "Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read", "vendor": "yocoadmin"}, "CVE-2025-22457": {"cvss": 9.0, "year": 2025, "title": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Pol", "vendor": "Ivanti"}, "CVE-2025-25257": {"cvss": 9.6, "year": 2025, "title": "An improper neutralization of special elements used in an SQL command ('SQL Injection') vu", "vendor": "Fortinet"}, "CVE-2025-26399": {"cvss": 9.8, "year": 2025, "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability", "vendor": "SolarWinds"}, "CVE-2025-27007": {"cvss": 9.8, "year": 2025, "title": "WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability", "vendor": "Brainstorm Force"}, "CVE-2025-29925": {"cvss": 8.7, "year": 2025, "title": "XWiki allows unregistered users to access private pages information through REST endpoint", "vendor": "xwiki"}, "CVE-2025-29927": {"cvss": 9.1, "year": 2025, "title": "Authorization Bypass in Next.js Middleware", "vendor": "vercel"}, "CVE-2025-30208": {"cvss": 5.3, "year": 2025, "title": "Vite bypasses server.fs.deny when using `?raw??`", "vendor": "vitejs"}, "CVE-2025-31324": {"cvss": 10.0, "year": 2025, "title": "Missing Authorization check in SAP NetWeaver (Visual Composer development server)", "vendor": "SAP_SE"}, "CVE-2025-32355": {"cvss": 7.9, "year": 2026, "title": "Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming conne", "vendor": null}, "CVE-2025-32395": {"cvss": 6.0, "year": 2025, "title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`", "vendor": "vitejs"}, "CVE-2025-36604": {"cvss": 7.3, "year": 2025, "title": "Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Ele", "vendor": "Dell"}, "CVE-2025-52970": {"cvss": 7.7, "year": 2025, "title": "A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions ", "vendor": "Fortinet"}, "CVE-2025-54236": {"cvss": 9.1, "year": 2025, "title": "Adobe Commerce | Improper Input Validation (CWE-20)", "vendor": "Adobe"}, "CVE-2025-55182": {"cvss": 10.0, "year": 2025, "title": "A pre-authentication remote code execution vulnerability exists in React Server Components", "vendor": "Meta"}, "CVE-2025-57819": {"cvss": 10.0, "year": 2025, "title": "FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE", "vendor": "FreePBX"}, "CVE-2025-63387": {"cvss": 7.5, "year": 2025, "title": "Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directl", "vendor": null}, "CVE-2026-21859": {"cvss": 5.8, "year": 2026, "title": "Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)", "vendor": "axllent"}, "CVE-2026-23483": {"cvss": 6.9, "year": 2026, "title": "Blinko: Unauthorized Arbitrary File Read - /plugins", "vendor": "blinkospace"}, "CVE-2026-27771": {"cvss": 8.2, "year": 2026, "title": "Gitea Composer package source links use insufficient permission checks", "vendor": "Gitea"}, "CVE-2026-41940": {"cvss": 9.3, "year": 2026, "title": "WebPros cPanel and WHM Authentication Bypass via Login Flow", "vendor": "WebPros"}, "CVE-2026-53787": {"cvss": 9.3, "year": 2026, "title": "Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload", "vendor": "Amasty"}, "CVE-2026-56290": {"cvss": 10.0, "year": 2026, "title": "Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0", "vendor": "joomlack.fr"}, "CVE-2026-60137": {"cvss": 5.9, "year": 2026, "title": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query", "vendor": "WordPress"}, "CVE-2026-61511": {"cvss": 9.3, "year": 2026, "title": "vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php", "vendor": "vBulletin"}, "CVE-2026-63030": {"cvss": 9.8, "year": 2026, "title": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution", "vendor": "WordPress"}, "CVE-2026-67208": {"cvss": 9.3, "year": 2026, "title": "Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console", "vendor": "somta"}, "CVE-2026-72898": {"cvss": 10.0, "year": 2026, "title": "Metabase SQL injection via password reset endpoint", "vendor": "Metabase"}, "CVE-2026-75650": {"cvss": 10.0, "year": 2026, "title": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "vendor": "Adobe"}, "CVE-2026-85706": {"cvss": 10.0, "year": 2026, "title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab", "vendor": "GitLab"}, "CVE-2026-87902": {"cvss": 8.1, "year": 2026, "title": "An unauthenticated attacker can make `get_page_template()` page-template resolution includ", "vendor": "WordPress"}, "CVE-2017-1000170": {"cvss": 7.5, "year": 2017, "title": "jqueryFileTree 2.1.5 and older Directory Traversal", "vendor": null}, "CVE-2019-1003030": {"cvss": 9.9, "year": 2019, "title": "A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier ", "vendor": "Jenkins project"}}, "week": "2026-10-12", "model": [{"ff": 0.013744521263151, "hit": 0.463593190072897, "group": "sensors", "pairs": 10760, "flagged": 1192, "networks": 4980, "p_cutoff": 0.79251268823991, "prevalence": 0.0301539531516922}, {"ff": 0.00131867643488229, "hit": 0.0374984142571968, "group": "cloudflare", "pairs": 10760, "flagged": 1192, "networks": 4980, "p_cutoff": 0.79251268823991, "prevalence": 0.0301539531516922}, {"ff": 0.00798070776204626, "hit": 0.369286377740991, "group": "vulncheck", "pairs": 10760, "flagged": 1192, "networks": 4980, "p_cutoff": 0.79251268823991, "prevalence": 0.0301539531516922}, {"ff": 0.00680078216653709, "hit": 0.393917965677089, "group": "abusech", "pairs": 10760, "flagged": 1192, "networks": 4980, "p_cutoff": 0.79251268823991, "prevalence": 0.0301539531516922}, {"ff": 0.00662107176572716, "hit": 0.319786818720379, "group": "phishing", "pairs": 10760, "flagged": 1192, "networks": 4980, "p_cutoff": 0.79251268823991, "prevalence": 0.0301539531516922}, {"ff": 0.0423042291429228, "hit": 0.723713276116058, "group": "shodan", "pairs": 10760, "flagged": 1192, "networks": 4980, "p_cutoff": 0.79251268823991, "prevalence": 0.0301539531516922}], "nodes": [{"a": 3, "h": "MIT-GATEWAYS", "n": "Massachusetts Institute of Technology", "t": "Enterprise, edu & gov", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2015-9415": 1, "cve:CVE-2017-3506": 1, "cve:CVE-2018-13379": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.24, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.008, 0.005, 0, false], ["2026-10-12", 0.008, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.697, "ts": null, "map": 0.066, "obs": 0, "own": 0.497, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.008, "se": 0.952, "ts": 1.000, "map": 0.036, "obs": 1, "own": 0.215, "comp": {"cins": -0.3333, "dshield": -0.7074, "crowdsec": 1.3856, "vulncheck": -0.5541, "blocklist_de": -1.7146}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.360, "det": {"shodan": {"compromised": 1}}, "oid": "MIT-2-ARIN", "org": "Massachusetts Institute of Technology", "pdb": {"t": "Educational/Research", "sc": "North America", "tr": null, "pol": "Restrictive", "web": "http://mit.edu"}, "pfx": 88, "reg": null, "rir": "arin", "s24": 7173, "sib": 3, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1850624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9, "h": "CMU-ROUTER", "n": "Carnegie Mellon University", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-43798": 1, "cve:CVE-2021-44228": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0063, "hi": 1.99, "lo": 0.15, "ips": 1, "mean": 0.84, "above": false}, "vulncheck": {"n": 1, "p": 0.1056, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.056, 0.009, 0, false], ["2026-10-12", 0.134, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.888, "ts": null, "map": 0.151, "obs": 0, "own": 0.330, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.134, "se": 0.860, "ts": 0.500, "map": 0.483, "obs": 2, "own": 0.289, "comp": {"cins": -0.3242, "dshield": -0.6905, "crowdsec": 1.4767, "vulncheck": 1.8734, "blocklist_de": -1.6686}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.296, "det": {"vulncheck": {"c2_server": 1}}, "oid": "CARNEG-Z-ARIN", "org": "Carnegie Mellon University", "pdb": null, "pfx": 8, "reg": "1984-04-17", "rir": "arin", "s24": 522, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 133632, "abuse": "abuse@andrew.cmu.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17, "h": "PURDUE", "n": "PURDUE", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0014, "hi": 1.61, "lo": 0.12, "ips": 1, "mean": 0.68, "above": false}}, "h2": [["2026-10-05", 0.039, 0.008, 0, false], ["2026-10-12", 0.005, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.844, "ts": null, "map": 0.134, "obs": 0, "own": 0.270, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.518, "ts": null, "map": 0.057, "obs": 0, "own": 0.044, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.127, "det": {"shodan": {"compromised": 1}}, "oid": "PURDUE-Z-ARIN", "org": "Purdue University", "pdb": null, "pfx": 12, "reg": "1984-08-01", "rir": "arin", "s24": 914, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 264448, "abuse": "abuse@purdue.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18, "h": "UTEXAS", "n": "UTEXAS", "t": "Broadband & mobile", "w": 17, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 17, "web_exploit": 17, "bad_crawling": 1, "web_bruteforce": 17, "home_connection": 15, "cve:CVE-2015-4455": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2019-5418": 3, "cve:CVE-2025-4396": 6, "cve:CVE-2024-34351": 2}, "n": 17}, "ev": {"crowdsec": {"n": 1, "p": 0.0001, "hi": 1.15, "lo": 0.09, "ips": 17, "mean": 0.49, "above": false}}, "h2": [["2026-10-05", 0.032, 0.008, 0, false], ["2026-10-12", 0.032, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.825, "ts": null, "map": 0.125, "obs": 0, "own": 0.612, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.032, "se": 1.039, "ts": 1.000, "map": 0.166, "obs": 1, "own": 0.274, "comp": {"cins": -0.2539, "dshield": -0.5565, "crowdsec": 2.2023, "vulncheck": -0.4803, "blocklist_de": -1.3129}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.220, "det": null, "oid": "UTAA-ARIN", "org": "University of Texas at Austin", "pdb": null, "pfx": 8, "reg": "1984-07-27", "rir": "arin", "s24": 1170, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 299520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52, "h": "UCLA", "n": "University of California, Los Angeles", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.27, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.818, "ts": null, "map": 0.122, "obs": 0, "own": 0.238, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.477, "ts": null, "map": 0.046, "obs": 0, "own": 0.035, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.130, "det": {"shodan": {"compromised": 1}}, "oid": "UCLA-Z-ARIN", "org": "University of California, Los Angeles", "pdb": null, "pfx": 10, "reg": "1985-10-24", "rir": "arin", "s24": 1285, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 328960, "abuse": "abuse@ucla.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 81, "h": "NCREN", "n": "MCNC", "t": "Enterprise, edu & gov", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.27, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.93, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.95, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}}, "h2": [["2026-10-05", 0.002, 0.005, 0, false], ["2026-10-12", 0.014, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.694, "ts": null, "map": 0.064, "obs": 0, "own": 0.484, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.014, "se": 0.798, "ts": 0.500, "map": 0.045, "obs": 2, "own": 0.268, "comp": {"cins": -0.4341, "dshield": 3.0555, "crowdsec": -3.4883, "vulncheck": 1.3878, "blocklist_de": -2.2193}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.313, "det": {"shodan": {"c2": 1}, "vulncheck": {"c2_server": 1}}, "oid": "MCNC-Z-ARIN", "org": "MCNC", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.mcnc.org"}, "pfx": 134, "reg": "1986-08-07", "rir": "arin", "s24": 7646, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2056448, "abuse": "abuse@mcnc.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01021230185464}, {"a": 137, "h": "ASGARR", "n": "GARR", "t": "Enterprise, edu & gov", "w": 4, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 2}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.20, "lo": 0.01, "ips": 1, "mean": 0.08, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.26, "lo": 0.05, "ips": 3, "mean": 0.14, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.72, "lo": 0.05, "ips": 1, "mean": 0.30, "above": false}}, "h2": [["2026-10-05", 0.038, 0.005, 0, false], ["2026-10-12", 0.026, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.675, "ts": null, "map": 0.055, "obs": 0, "own": 0.420, "comp": null, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.026, "se": 0.640, "ts": 0.750, "map": 0.062, "obs": 4, "own": 0.357, "comp": {"cins": -0.7653, "dshield": -1.3862, "crowdsec": 4.0821, "vulncheck": 0.5184, "blocklist_de": -3.8332}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.256, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-GIRA1-RIPE", "org": "Consortium GARR", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.garr.it"}, "pfx": 81, "reg": "1993-09-01", "rir": "ripencc", "s24": 10724, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2763008, "abuse": "cert@garr.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0048790169945}, {"a": 174, "h": "COGENT-174", "n": "Cogent Communications, Inc.", "t": "Transit & backbone", "w": 173, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 1.15, "waf": 2.51}, "cs": {"c": {"http_flood": 32, "data_centre": 4, "web_exploit": 100, "bad_crawling": 21, "proxy_or_vpn": 49, "first_seen_30d": 1, "ssh_bruteforce": 25, "web_bruteforce": 58, "home_connection": 3, "mail_bruteforce": 18, "router_or_botnet": 6, "cve:CVE-2017-9841": 5, "cve:CVE-2025-4396": 5, "cve:CVE-2017-16894": 4, "cve:CVE-2018-20062": 7, "cve:CVE-2019-17050": 4}, "n": 123}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.15, "lo": 0.02, "ips": 19, "mean": 0.07, "above": false}, "shodan": {"n": 11, "p": 0.0000, "hi": 0.09, "lo": 0.03, "ips": 11, "mean": 0.06, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 0.17, "lo": 0.04, "ips": 16, "mean": 0.09, "above": false}, "crowdsec": {"n": 29, "p": 0.0000, "hi": 0.15, "lo": 0.08, "ips": 123, "mean": 0.12, "above": false}, "threatfox": {"n": 2, "p": 0.0000, "hi": 0.40, "lo": 0.05, "ips": 2, "mean": 0.19, "above": false}, "vulncheck": {"n": 9, "p": 0.0000, "hi": 0.30, "lo": 0.11, "ips": 21, "mean": 0.19, "above": false}, "phishing_db": {"n": 10, "p": 0.0000, "hi": 0.35, "lo": 0.13, "ips": 14, "mean": 0.23, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.13, "lo": 0.04, "ips": 9, "mean": 0.08, "above": false}}, "h2": [["2026-10-05", 0.064, 0.038, 0, false], ["2026-10-12", 0.053, 0.039, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 10}, "lo": 0.039, "se": 1.047, "ts": 0.833, "map": 0.104, "obs": 12, "own": 0.548, "comp": {"urlhaus": -2.1974, "threatfox": -0.0847, "phishing_db": 1.6405}, "mass": 21.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 29, "vulncheck": 9, "blocklist_de": 7}, "lo": 0.053, "se": 0.401, "ts": 0.569, "map": 0.084, "obs": 51, "own": 0.265, "comp": {"cins": -0.2047, "dshield": -0.7451, "crowdsec": 4.8674, "vulncheck": 0.2429, "blocklist_de": -5.2459}, "mass": 45.2, "listed": false}}, "abq": false, "bot": 0.476, "det": {"shodan": {"malware": 1, "compromised": 9, "doublepulsar": 1}, "threatfox": {"family:PureRAT": 1, "family:RansomHub": 1}, "vulncheck": {"botnet_node": 21}, "blocklist_de": {"ftp": 5, "imap": 2, "mail": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "COGC-ARIN", "org": "Cogent Communications, LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "100+Tbps", "pol": "No", "web": "http://www.cogentco.com/"}, "pfx": 3837, "reg": "1996-05-16", "rir": "arin", "s24": 96341, "sib": 91, "tor": 0, "w24": 54, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 37684480, "abuse": "abuse@cogentco.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.117318}, {"a": 209, "h": "CENTURYLINK-US-LEGACY-QWEST", "n": "Lumen AS209", "t": "Transit & backbone", "w": 18, "cc": "US", "cf": {"rb": "", "wb": "hi", "rep": 0.54, "waf": 0.37}, "cs": {"c": {"ssh_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.05, "lo": 0.01, "ips": 2, "mean": 0.02, "above": false}, "dshield": {"n": 6, "p": 0.0000, "hi": 0.35, "lo": 0.10, "ips": 6, "mean": 0.21, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.71, "lo": 0.05, "ips": 7, "mean": 0.30, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.04, "lo": 0.00, "ips": 2, "mean": 0.02, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.14, "lo": 0.01, "ips": 1, "mean": 0.06, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.09, "lo": 0.01, "ips": 2, "mean": 0.04, "above": false}}, "h2": [["2026-10-05", 0.013, 0.003, 0, false], ["2026-10-12", 0.018, 0.015, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.015, "se": 1.319, "ts": 1.000, "map": 0.076, "obs": 1, "own": 0.406, "comp": {"urlhaus": 0.6665, "threatfox": -0.5325, "phishing_db": -1.08}, "mass": 10.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.018, "se": 0.489, "ts": 0.545, "map": 0.033, "obs": 11, "own": 0.106, "comp": {"cins": -1.7377, "dshield": 8.3202, "crowdsec": -5.7103, "vulncheck": -0.4188, "blocklist_de": -2.4577}, "mass": 11.6, "listed": false}}, "abq": false, "bot": 0.154, "det": {"shodan": {"c2": 1, "compromised": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "CCL-534-ARIN", "org": "CenturyLink Communications, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "No", "web": "http://www.lumen.com"}, "pfx": 1587, "reg": "1998-11-13", "rir": "arin", "s24": 61374, "sib": 91, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26233344, "abuse": "abuse@aup.lumen.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.174574}, {"a": 278, "h": "", "n": "Universidad Nacional Autonoma de Mexico", "t": "Enterprise, edu & gov", "w": 1, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.5591, "hi": 5.64, "lo": 1.57, "ips": 6, "mean": 3.34, "above": false}, "urlhaus": {"n": 1, "p": 0.1788, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.058, 0.207, 0, false], ["2026-10-12", 0.006, 0.226, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.226, "se": 1.429, "ts": 1.000, "map": 1.790, "obs": 1, "own": 8.674, "comp": {"urlhaus": 3.3037, "threatfox": -0.3728, "phishing_db": -0.7223}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.590, "ts": null, "map": 0.078, "obs": 0, "own": 0.641, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.099, "det": {"shodan": {"compromised": 5, "doublepulsar": 1}}, "oid": "@aut-278-LACNIC", "org": "Universidad Nacional Autonoma de Mexico", "pdb": {"t": "Educational/Research", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.unam.mx"}, "pfx": 160, "reg": "1989-03-31", "rir": "lacnic", "s24": 514, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 236544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0012945393024}, {"a": 376, "h": "RISQ-AS", "n": "RISQ Network", "t": "Enterprise, edu & gov", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.003, 0.006, 0, false], ["2026-10-12", 0.002, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.742, "ts": null, "map": 0.087, "obs": 0, "own": 0.662, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.002, "se": 1.359, "ts": null, "map": 0.024, "obs": 0, "own": 0.164, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.273, "det": null, "oid": "RISQ-Z-ARIN", "org": "Reseau d'Informations Scientifiques du Quebec (RISQ Inc.)", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.risq.quebec"}, "pfx": 278, "reg": "1989-07-27", "rir": "arin", "s24": 3599, "sib": 2, "tor": 0, "w24": 0, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1884416, "abuse": "abuse@risq.qc.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00455293141926}, {"a": 559, "h": "Switch", "n": "SWITCH", "t": "Enterprise, edu & gov", "w": 2, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2022-26134": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.25, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.20, "lo": 0.02, "ips": 2, "mean": 0.08, "above": false}}, "h2": [["2026-10-05", 0.007, 0.005, 0, false], ["2026-10-12", 0.007, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.687, "ts": null, "map": 0.061, "obs": 0, "own": 0.462, "comp": null, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.007, "se": 0.945, "ts": 1.000, "map": 0.031, "obs": 1, "own": 0.185, "comp": {"cins": -0.3413, "dshield": -0.722, "crowdsec": 1.3065, "vulncheck": -0.5605, "blocklist_de": -1.7547}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.682, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-SG2-RIPE", "org": "SWITCH", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.switch.ch/"}, "pfx": 117, "reg": "1993-09-01", "rir": "ripencc", "s24": 8535, "sib": 3, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2185216, "abuse": "abuse@switch.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00483148235719}, {"a": 577, "h": "BACOM", "n": "Bell Canada Backbone", "t": "Broadband & mobile", "w": 48, "cc": "CA", "cf": {"rb": "", "wb": "", "rep": 1.27, "waf": 0.40}, "cs": {"c": {"http_flood": 4, "web_exploit": 5, "proxy_or_vpn": 4, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 6, "home_connection": 6, "mail_bruteforce": 4, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2025-55182": 1}, "n": 9}, "ev": {"shodan": {"n": 6, "p": 0.0000, "hi": 0.20, "lo": 0.06, "ips": 6, "mean": 0.12, "above": false}, "dshield": {"n": 30, "p": 0.0070, "hi": 2.63, "lo": 1.45, "ips": 30, "mean": 2.01, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 0.22, "lo": 0.08, "ips": 9, "mean": 0.14, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.34, "lo": 0.03, "ips": 1, "mean": 0.14, "above": false}, "blocklist_de": {"n": 10, "p": 0.0000, "hi": 0.57, "lo": 0.21, "ips": 10, "mean": 0.37, "above": false}}, "h2": [["2026-10-05", 0.054, 0.013, 0, false], ["2026-10-12", 0.205, 0.014, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.014, "se": 1.342, "ts": 1.000, "map": 0.068, "obs": 1, "own": 0.271, "comp": {"urlhaus": -0.9068, "threatfox": -0.4569, "phishing_db": 0.2991}, "mass": 4.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 30, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.205, "se": 0.392, "ts": 0.612, "map": 0.320, "obs": 49, "own": 0.496, "comp": {"cins": -3.2482, "dshield": 14.0629, "crowdsec": -7.2897, "vulncheck": -0.9915, "blocklist_de": -2.2785}, "mass": 47.8, "listed": false}}, "abq": false, "bot": 0.124, "det": {"shodan": {"malware": 2, "compromised": 3, "doublepulsar": 1}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 7, "mail": 7}}, "oid": "LINX-ARIN", "org": "Bell Canada", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Restrictive", "web": "http://www.bell.ca"}, "pfx": 16111, "reg": "1999-03-03", "rir": "arin", "s24": 26776, "sib": 19, "tor": 0, "w24": 48, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11186944, "abuse": "abuse@bell.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.332532}, {"a": 680, "h": "DFN", "n": "DFN Deutsches Forschungsnetz e.V.", "t": "Hosting & VPS", "w": 12, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 11, "web_exploit": 6, "bad_crawling": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 5, "web_bruteforce": 6, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2021-26086": 1, "cve:CVE-2024-34351": 1}, "n": 11}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.46, "lo": 0.06, "ips": 2, "mean": 0.22, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.10, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.16, "lo": 0.05, "ips": 11, "mean": 0.10, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.14, "lo": 0.01, "ips": 3, "mean": 0.06, "above": false}}, "h2": [["2026-10-05", 0.040, 0.003, 0, false], ["2026-10-12", 0.037, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.628, "ts": null, "map": 0.035, "obs": 0, "own": 0.025, "comp": null, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.037, "se": 0.495, "ts": 0.700, "map": 0.070, "obs": 10, "own": 0.014, "comp": {"cins": 4.6079, "dshield": -2.3788, "crowdsec": 2.8432, "vulncheck": -0.9207, "blocklist_de": -5.4239}, "mass": 11.7, "listed": false}}, "abq": false, "bot": 0.231, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-DV1-RIPE", "org": "Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.dfn.de"}, "pfx": 295, "reg": "1993-09-01", "rir": "ripencc", "s24": 29964, "sib": 1, "tor": 2, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7979008, "abuse": "abuse@dfn.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01123936139985}, {"a": 701, "h": "UUNET", "n": "Verizon", "t": "Broadband & mobile", "w": 55, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.70, "waf": 0.41}, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 6, "web_bruteforce": 5, "home_connection": 9, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2021-3129": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2024-12847": 1}, "n": 11}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.13, "lo": 0.03, "ips": 4, "mean": 0.07, "above": false}, "shodan": {"n": 6, "p": 0.0000, "hi": 0.03, "lo": 0.01, "ips": 6, "mean": 0.02, "above": false}, "dshield": {"n": 15, "p": 0.0000, "hi": 0.27, "lo": 0.12, "ips": 15, "mean": 0.18, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.30, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 0.04, "lo": 0.02, "ips": 11, "mean": 0.03, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.19, "lo": 0.01, "ips": 1, "mean": 0.08, "above": false}, "vulncheck": {"n": 7, "p": 0.0000, "hi": 0.16, "lo": 0.05, "ips": 7, "mean": 0.10, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.10, "lo": 0.02, "ips": 3, "mean": 0.05, "above": false}, "blocklist_de": {"n": 16, "p": 0.0000, "hi": 0.14, "lo": 0.06, "ips": 16, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.061, 0.025, 0, false], ["2026-10-12", 0.043, 0.018, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 3}, "lo": 0.018, "se": 1.161, "ts": 0.600, "map": 0.059, "obs": 5, "own": 0.240, "comp": {"urlhaus": -0.6334, "threatfox": -0.3079, "phishing_db": -0.2609}, "mass": 21.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 15, "crowdsec": 11, "vulncheck": 7, "blocklist_de": 16}, "lo": 0.043, "se": 0.400, "ts": 0.302, "map": 0.067, "obs": 53, "own": 0.104, "comp": {"cins": 1.4414, "dshield": 3.8399, "crowdsec": -7.5231, "vulncheck": -0.2642, "blocklist_de": 1.1981}, "mass": 59.6, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"c2": 1, "compromised": 3, "doublepulsar": 2}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 4, "attack_tooling": 1, "other_infrastructure": 2}, "blocklist_de": {"ssh": 4, "bots": 4, "imap": 7, "mail": 7, "apache": 1, "bruteforcelogin": 1}}, "oid": "MCICS-ARIN", "org": "Verizon Business", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Restrictive", "web": "https://www.verizon.com/business/"}, "pfx": 959, "reg": "1990-08-03", "rir": "arin", "s24": 158587, "sib": 229, "tor": 0, "w24": 55, "drop": 7, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43604992, "abuse": "abuse-mail@verizonbusiness.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.80916}, {"a": 714, "h": "APPLE-ENGINEERING", "n": "Apple Inc.", "t": "Hosting & VPS", "w": 11, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 3.07, "waf": 1.36}, "cs": null, "ev": {"dshield": {"n": 5, "p": 0.0000, "hi": 0.29, "lo": 0.07, "ips": 9, "mean": 0.16, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.09, "lo": 0.01, "ips": 2, "mean": 0.04, "above": false}}, "h2": [["2026-10-05", 0.009, 0.002, 0, false], ["2026-10-12", 0.012, 0.003, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.003, "se": 1.606, "ts": null, "map": 0.024, "obs": 0, "own": 0.018, "comp": null, "mass": 4.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.012, "se": 0.534, "ts": 0.714, "map": 0.023, "obs": 7, "own": 0.005, "comp": {"cins": -1.4353, "dshield": 8.5998, "crowdsec": -8.2512, "vulncheck": -0.8901, "blocklist_de": -0.3979}, "mass": 8.6, "listed": false}}, "abq": false, "bot": 0.671, "det": {"blocklist_de": {"bots": 2}}, "oid": "APPLEC-1-Z-ARIN", "org": "Apple Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.apple.com/support/systemstatus/"}, "pfx": 1564, "reg": null, "rir": "arin", "s24": 66091, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44855296, "abuse": "abuse@apple.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.098723}, {"a": 719, "h": "ELISA-AS", "n": "Elisa Finland", "t": "Broadband & mobile", "w": 7, "cc": "FI", "cf": {"rb": "hi", "wb": "hi", "rep": 1.49, "waf": 1.30}, "cs": {"c": {"web_exploit": 4, "bad_crawling": 1, "web_bruteforce": 3, "home_connection": 4, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-12847": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.0000, "hi": 0.27, "lo": 0.07, "ips": 5, "mean": 0.15, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.56, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}}, "h2": [["2026-10-05", 0.030, 0.033, 0, false], ["2026-10-12", 0.042, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.660, "ts": null, "map": 0.049, "obs": 0, "own": 0.220, "comp": null, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.042, "se": 0.544, "ts": 0.714, "map": 0.084, "obs": 7, "own": 0.132, "comp": {"cins": -1.2195, "dshield": -1.9139, "crowdsec": 4.5346, "vulncheck": -0.0665, "blocklist_de": -2.413}, "mass": 6.8, "listed": false}}, "abq": false, "bot": 0.104, "det": {"vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-EO1-RIPE", "org": "Elisa Oyj", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.elisa.fi"}, "pfx": 154, "reg": "1993-09-01", "rir": "ripencc", "s24": 14341, "sib": 5, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3677952, "abuse": "abuse@elisa.fi", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.049173}, {"a": 786, "h": "JANET", "n": "Janet", "t": "Enterprise, edu & gov", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.08, "lo": 0.01, "ips": 1, "mean": 0.03, "above": false}}, "h2": [["2026-10-05", 0.001, 0.003, 0, false], ["2026-10-12", 0.001, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.632, "ts": null, "map": 0.036, "obs": 0, "own": 0.284, "comp": null, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.001, "se": 1.153, "ts": null, "map": 0.006, "obs": 0, "own": 0.035, "comp": null, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.176, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-UA23-RIPE", "org": "Jisc Services Limited", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.jisc.ac.uk/janet"}, "pfx": 209, "reg": "1993-09-01", "rir": "ripencc", "s24": 26895, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6971136, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0239436888105}, {"a": 803, "h": "SASKTEL", "n": "Saskatchewan Telecommunications", "t": "Broadband & mobile", "w": 3, "cc": "CA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0254, "hi": 2.56, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "dshield": {"n": 1, "p": 0.0139, "hi": 2.27, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.75, "lo": 0.06, "ips": 1, "mean": 0.31, "above": false}, "blocklist_de": {"n": 1, "p": 0.0008, "hi": 1.50, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.058, 0.007, 0, false], ["2026-10-12", 0.163, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.784, "ts": null, "map": 0.106, "obs": 0, "own": 0.496, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.163, "se": 0.640, "ts": 0.250, "map": 0.395, "obs": 4, "own": 0.618, "comp": {"cins": 3.3148, "dshield": 1.449, "crowdsec": -3.0785, "vulncheck": -0.7987, "blocklist_de": -0.4223}, "mass": 4.5, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "SASK-ARIN", "org": "Saskatchewan Telecommunications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.sasktel.com/"}, "pfx": 44, "reg": "2002-01-15", "rir": "arin", "s24": 2015, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 526848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01977339003836}, {"a": 812, "h": "ROGERS-COMMUNICATIONS", "n": "Rogers Cable", "t": "Broadband & mobile", "w": 26, "cc": "CA", "cf": {"rb": "", "wb": "", "rep": 0.72, "waf": 0.36}, "cs": {"c": {"http_flood": 1, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 3, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 10}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.45, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.13, "lo": 0.02, "ips": 2, "mean": 0.06, "above": false}, "dshield": {"n": 10, "p": 0.0000, "hi": 1.29, "lo": 0.47, "ips": 10, "mean": 0.84, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.28, "lo": 0.10, "ips": 10, "mean": 0.18, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 0.42, "lo": 0.10, "ips": 5, "mean": 0.24, "above": false}}, "h2": [["2026-10-05", 0.177, 0.004, 0, false], ["2026-10-12", 0.130, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.639, "ts": null, "map": 0.040, "obs": 0, "own": 0.182, "comp": null, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 10, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.130, "se": 0.419, "ts": 0.385, "map": 0.214, "obs": 26, "own": 0.331, "comp": {"cins": -0.5662, "dshield": 6.5276, "crowdsec": -2.141, "vulncheck": -0.9726, "blocklist_de": -2.9975}, "mass": 26.8, "listed": false}}, "abq": false, "bot": 0.115, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1, "imap": 2, "mail": 2}}, "oid": "RCC-182-ARIN", "org": "Rogers Communications Canada Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.rogers.com"}, "pfx": 1464, "reg": "2002-07-24", "rir": "arin", "s24": 22442, "sib": 6, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10221568, "abuse": "abuse@rogers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.270865}, {"a": 834, "h": "IPXO", "n": "IPXO LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1332, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 0.574, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.166, "obs": 0, "own": 0.198, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.667, "det": {"shodan": {"c2": 1}}, "oid": "IL-845-ARIN", "org": "IPXO LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.ipxo.com/"}, "pfx": 73, "reg": "2021-04-14", "rir": "arin", "s24": 82, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21504, "abuse": "abuse@ipxo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 852, "h": "ASN852", "n": "TELUS Communications", "t": "Broadband & mobile", "w": 35, "cc": "CA", "cf": {"rb": "", "wb": "", "rep": 0.94, "waf": 0.39}, "cs": {"c": {"http_flood": 1, "web_exploit": 8, "bad_crawling": 1, "proxy_or_vpn": 3, "first_seen_30d": 2, "ssh_bruteforce": 14, "web_bruteforce": 13, "home_connection": 13, "mail_bruteforce": 12, "router_or_botnet": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 18}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.70, "lo": 0.09, "ips": 2, "mean": 0.34, "above": false}, "shodan": {"n": 7, "p": 0.0000, "hi": 0.32, "lo": 0.10, "ips": 7, "mean": 0.19, "above": false}, "dshield": {"n": 12, "p": 0.0000, "hi": 1.75, "lo": 0.69, "ips": 12, "mean": 1.17, "above": false}, "crowdsec": {"n": 16, "p": 0.0000, "hi": 0.48, "lo": 0.21, "ips": 18, "mean": 0.33, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.44, "lo": 0.03, "ips": 1, "mean": 0.18, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.62, "lo": 0.08, "ips": 2, "mean": 0.29, "above": false}, "blocklist_de": {"n": 9, "p": 0.0000, "hi": 0.74, "lo": 0.26, "ips": 10, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 0.210, 0.064, 0, false], ["2026-10-12", 0.252, 0.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.031, "se": 1.201, "ts": 1.000, "map": 0.122, "obs": 2, "own": 0.441, "comp": {"urlhaus": -1.0643, "threatfox": -0.4799, "phishing_db": 1.0654}, "mass": 4.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 12, "crowdsec": 16, "vulncheck": 1, "blocklist_de": 9}, "lo": 0.252, "se": 0.399, "ts": 0.400, "map": 0.393, "obs": 40, "own": 0.607, "comp": {"cins": 0.0795, "dshield": 4.7527, "crowdsec": -1.8781, "vulncheck": -0.8378, "blocklist_de": -1.6579}, "mass": 41.0, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 7}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 1, "ssh": 1, "bots": 1, "imap": 4, "mail": 7}}, "oid": "TACE-ARIN", "org": "TELUS Communications Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.telus.com"}, "pfx": 676, "reg": "1998-04-16", "rir": "arin", "s24": 18775, "sib": 16, "tor": 0, "w24": 33, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5048064, "abuse": "abuse@telus.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.239533}, {"a": 855, "h": "CANET-ASN-4", "n": "Bell Aliant Inc.", "t": "Broadband & mobile", "w": 3, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.63, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "dshield": {"n": 2, "p": 0.0145, "hi": 2.38, "lo": 0.31, "ips": 2, "mean": 1.13, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.52, "lo": 0.04, "ips": 1, "mean": 0.22, "above": false}}, "h2": [["2026-10-05", 0.017, 0.007, 0, false], ["2026-10-12", 0.066, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.754, "ts": null, "map": 0.092, "obs": 0, "own": 0.420, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.066, "se": 0.696, "ts": 0.667, "map": 0.179, "obs": 3, "own": 0.282, "comp": {"cins": -0.6466, "dshield": 5.6862, "crowdsec": -1.3753, "vulncheck": -0.7274, "blocklist_de": -3.2625}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"compromised": 1}}, "oid": "LINX-ARIN", "org": "Bell Canada", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Restrictive", "web": "http://www.bellaliant.ca"}, "pfx": 829, "reg": "1990-08-07", "rir": "arin", "s24": 3046, "sib": 19, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1704704, "abuse": "abuse@bell.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01941639467509}, {"a": 903, "h": "UNIFIED-COMMUNICATIONS-TECHNOLOGIES", "n": "UCT", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 2.491, 0.012, 0, false]], "sh": false, "uc": 1450.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.491, "se": 0.994, "ts": 0.500, "map": 11.491, "obs": 2, "own": 19.235, "comp": {"cins": -0.2122, "dshield": -0.4732, "crowdsec": -1.8703, "vulncheck": 2.573, "blocklist_de": 3.818}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.168, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "UCTL-2-ARIN", "org": "Unified Communications Technologies, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.uct-usa.com/"}, "pfx": 18, "reg": "2022-06-08", "rir": "arin", "s24": 14, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "Abuse@flhsi.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 906, "h": "DMIT", "n": "DMIT Cloud Infrastructure", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.7547, "hi": 7.03, "lo": 1.95, "ips": 6, "mean": 4.16, "above": false}, "dshield": {"n": 1, "p": 0.1340, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "phishing_db": {"n": 1, "p": 0.1392, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "blocklist_de": {"n": 1, "p": 0.0895, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.080, 0.168, 0, false], ["2026-10-12", 0.273, 0.176, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.176, "se": 1.397, "ts": 1.000, "map": 1.256, "obs": 1, "own": 0.577, "comp": {"urlhaus": -0.2571, "threatfox": -0.2517, "phishing_db": 2.3629}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.273, "se": 0.864, "ts": 0.500, "map": 1.010, "obs": 2, "own": 0.205, "comp": {"cins": -0.4069, "dshield": 3.1708, "crowdsec": -3.3051, "vulncheck": -0.6082, "blocklist_de": 2.5529}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.706, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 4}, "blocklist_de": {"ssh": 1}}, "oid": "DMITI-ARIN", "org": "DMIT Cloud Services", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "http://DMIT.com"}, "pfx": 231, "reg": "2022-06-10", "rir": "arin", "s24": 320, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 122880, "abuse": "abuse@dmit.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01751982195484}, {"a": 924, "h": "CLOUDIE", "n": "Cloudie Networks", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2021-20124": 1, "cve:CVE-2021-26086": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 3.494, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.900, "det": null, "oid": "CNL-171-ARIN", "org": "Cloudie Networks LLC", "pdb": {"t": "Network Services", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.924.network"}, "pfx": 3, "reg": "2022-06-16", "rir": "arin", "s24": 3, "sib": 5, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "admin@cloudie.sh", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 931, "h": "HYONIX", "n": "Hyonix", "t": "Enterprise, edu & gov", "w": 15, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 1}, "n": 3}, "ev": {"urlhaus": {"n": 1, "p": 0.1885, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 3, "p": 0.2517, "hi": 4.56, "lo": 0.80, "ips": 3, "mean": 2.35, "above": false}, "threatfox": {"n": 11, "p": 0.9999, "hi": 17.50, "lo": 6.66, "ips": 11, "mean": 11.53, "above": true}, "vulncheck": {"n": 1, "p": 0.1453, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 1.494, 6.427, 0, false], ["2026-10-12", 0.748, 7.542, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 11, "phishing_db": 0}, "lo": 7.542, "se": 0.799, "ts": 0.917, "map": 17.473, "obs": 12, "own": 68.281, "comp": {"urlhaus": 0.705, "threatfox": 4.8592, "phishing_db": -1.0774}, "mass": 6.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.748, "se": 0.668, "ts": 0.750, "map": 1.915, "obs": 4, "own": 10.940, "comp": {"cins": -0.6033, "dshield": -1.1564, "crowdsec": 5.9891, "vulncheck": 0.8659, "blocklist_de": -3.0521}, "mass": 2.9, "listed": false}}, "abq": true, "bot": 0.773, "det": {"threatfox": {"family:Remcos": 2, "family:PureRAT": 7, "family:Evilginx": 1, "family:Unknown RAT": 1}, "vulncheck": {"c2_server": 1}}, "oid": "KPL-87-ARIN", "org": "Hyonix", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Open", "web": "https://hyonix.com/"}, "pfx": 263, "reg": "2022-06-16", "rir": "arin", "s24": 263, "sib": 2, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 67328, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00205936997565}, {"a": 932, "h": "XNNET", "n": "XNNET", "t": "Transit & backbone", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9441, "hi": 10.54, "lo": 2.92, "ips": 6, "mean": 6.23, "above": true}, "threatfox": {"n": 2, "p": 0.4172, "hi": 6.24, "lo": 0.81, "ips": 3, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.221, 0.355, 0, false], ["2026-10-12", 0.010, 1.795, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.795, "se": 1.158, "ts": 1.000, "map": 8.402, "obs": 2, "own": 30.045, "comp": {"urlhaus": -0.3065, "threatfox": 4.5899, "phishing_db": -0.5287}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.181, "obs": 0, "own": 1.325, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.931, "det": {"shodan": {"compromised": 6}, "threatfox": {"family:Cobalt Strike": 2, "family:Unknown malware": 1}}, "oid": "XL-94-ARIN", "org": "XNNET LLC", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "https://xn.net/"}, "pfx": 50, "reg": "2022-06-16", "rir": "arin", "s24": 58, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 84224, "abuse": "noc@xn.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00035937701772}, {"a": 947, "h": "RUDIO", "n": "Desk2", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.950, "det": {"shodan": {"doublepulsar": 1}}, "oid": "EL-1138-ARIN", "org": "Desk2", "pdb": null, "pfx": 4, "reg": "2022-06-21", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 963, "h": "N963-AS-AP", "n": "N963", "t": "Transit & backbone", "w": 1, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3046, "hi": 5.26, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}, "threatfox": {"n": 1, "p": 0.1929, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.168, 0.290, 0, false], ["2026-10-12", 0.009, 0.302, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.302, "se": 1.464, "ts": 1.000, "map": 2.548, "obs": 1, "own": 10.641, "comp": {"urlhaus": -0.1551, "threatfox": 3.0439, "phishing_db": -0.3275}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.160, "obs": 0, "own": 1.030, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.866, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}}, "oid": "ORG-NA170-AP-APNIC", "org": "N963", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://n963.com"}, "pfx": 99, "reg": "2022-06-22", "rir": "apnic", "s24": 92, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": "noc@n963.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00100774468925}, {"a": 965, "h": "WEBHOSTINGHOLDINGS", "n": "Webhosting Holdings LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.397, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.144, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.882, "det": {"shodan": {"compromised": 1}}, "oid": "WH-156-ARIN", "org": "Webhosting Holdings LLC", "pdb": null, "pfx": 18, "reg": "2022-06-22", "rir": "arin", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "admin@webhostingholdings.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 967, "h": "VMISS-CA", "n": "VMISS Inc.", "t": "Other", "w": 8, "cc": "CA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1858, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1408, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "phishing_db": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 6, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.221, 0.367, 0, false], ["2026-10-12", 2.352, 0.384, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.384, "se": 1.503, "ts": 1.000, "map": 3.581, "obs": 1, "own": 4.214, "comp": {"urlhaus": -0.1359, "threatfox": -0.1615, "phishing_db": 3.1993}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.352, "se": 0.762, "ts": 0.333, "map": 7.171, "obs": 3, "own": 4.113, "comp": {"cins": -0.5025, "dshield": 2.7766, "crowdsec": -0.1885, "vulncheck": -0.664, "blocklist_de": 1.9423}, "mass": 2.3, "listed": false}}, "abq": true, "bot": 0.912, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "VMISS-ARIN", "org": "VMISS Inc.", "pdb": null, "pfx": 57, "reg": "2022-06-22", "rir": "arin", "s24": 57, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034746127536}, {"a": 979, "h": "NETLAB-SDN", "n": "NETLAB-SDN", "t": "Broadband & mobile", "w": 11, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2024-3804": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-43798": 1}, "n": 1}, "ev": {"shodan": {"n": 42, "p": 1.0000, "hi": 23.61, "lo": 14.26, "ips": 42, "mean": 18.69, "above": true}, "crowdsec": {"n": 1, "p": 0.0034, "hi": 1.81, "lo": 0.14, "ips": 1, "mean": 0.76, "above": false}, "threatfox": {"n": 5, "p": 0.8852, "hi": 9.61, "lo": 2.39, "ips": 6, "mean": 5.49, "above": true}, "phishing_db": {"n": 2, "p": 0.2542, "hi": 4.85, "lo": 0.63, "ips": 3, "mean": 2.31, "above": false}, "blocklist_de": {"n": 1, "p": 0.0419, "hi": 2.87, "lo": 0.22, "ips": 1, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.773, 1.482, 0, false], ["2026-10-12", 0.161, 1.722, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 2}, "lo": 1.722, "se": 0.875, "ts": 0.714, "map": 4.347, "obs": 7, "own": 10.916, "comp": {"urlhaus": -1.1707, "threatfox": 3.4515, "phishing_db": 0.8149}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.161, "se": 0.844, "ts": 0.500, "map": 0.572, "obs": 2, "own": 0.911, "comp": {"cins": -0.4352, "dshield": -0.8877, "crowdsec": 0.4123, "vulncheck": -0.6262, "blocklist_de": 2.3712}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.654, "det": {"shodan": {"c2": 9, "malware": 1, "compromised": 32}, "threatfox": {"family:Havoc": 1, "family:AdaptixC2": 1, "family:ValleyRAT": 1, "family:Cobalt Strike": 1, "family:Unknown malware": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "HOSTH-5-ARIN", "org": "NetLab Global", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.as979.net"}, "pfx": 577, "reg": "2022-06-24", "rir": "arin", "s24": 609, "sib": 3, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8755]], "ipv4": 233216, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.01591621032978}, {"a": 984, "h": "OWS-NETWORK", "n": "OWS", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1120, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "crowdsec": {"n": 1, "p": 0.0097, "hi": 2.13, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.0620, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.192, 0.009, 0, false], ["2026-10-12", 0.378, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.897, "ts": null, "map": 0.155, "obs": 0, "own": 0.855, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.378, "se": 0.725, "ts": 0.333, "map": 1.080, "obs": 3, "own": 1.695, "comp": {"cins": -0.5972, "dshield": 2.413, "crowdsec": -0.9827, "vulncheck": -0.7079, "blocklist_de": 1.3449}, "mass": 2.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "OWS-40-ARIN", "org": "OCTOPUS WEB SOLUTION INC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.ows-networks.com"}, "pfx": 305, "reg": "2022-06-27", "rir": "arin", "s24": 461, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 168448, "abuse": "support@ows-networks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00181893897242}, {"a": 1101, "h": "IP-EEND-AS", "n": "Not SURF Net", "t": "Enterprise, edu & gov", "w": 2, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 1, "cve:CVE-2024-55591": 1, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.24, "lo": 0.02, "ips": 2, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.008, 0.005, 0, false], ["2026-10-12", 0.009, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.700, "ts": null, "map": 0.067, "obs": 0, "own": 0.505, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.009, "se": 0.953, "ts": 1.000, "map": 0.037, "obs": 1, "own": 0.221, "comp": {"cins": -0.3317, "dshield": -0.7044, "crowdsec": 1.4016, "vulncheck": -0.5528, "blocklist_de": -1.7065}, "mass": 1.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SB3-RIPE", "org": "SURF B.V.", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://as1101.net/"}, "pfx": 16, "reg": "1993-09-01", "rir": "ripencc", "s24": 6926, "sib": 75, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1773568, "abuse": "cert@surfcert.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 1133, "h": "UTWENTE-AS", "n": "University of Twente", "t": "Hosting & VPS", "w": 8, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 8, "web_exploit": 8}, "n": 8}, "ev": {"crowdsec": {"n": 1, "p": 0.0391, "hi": 2.82, "lo": 0.21, "ips": 8, "mean": 1.19, "above": false}}, "h2": [["2026-10-12", 0.093, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.160, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.093, "se": 1.133, "ts": 1.000, "map": 0.569, "obs": 1, "own": 0.122, "comp": {"cins": -0.1931, "dshield": -0.4339, "crowdsec": 2.8673, "vulncheck": -0.4083, "blocklist_de": -1.002}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.226, "det": null, "oid": "ORG-SB3-RIPE", "org": "SURF B.V.", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.utwente.nl/en/"}, "pfx": 1, "reg": "1993-09-01", "rir": "ripencc", "s24": 256, "sib": 75, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "cert@surfcert.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 1136, "h": "KPN", "n": "KPN NL", "t": "Broadband & mobile", "w": 42, "cc": "NL", "cf": {"rb": "", "wb": "", "rep": 0.42, "waf": 0.44}, "cs": {"c": {"http_flood": 5, "web_exploit": 10, "bad_crawling": 2, "proxy_or_vpn": 5, "ssh_bruteforce": 1, "web_bruteforce": 14, "home_connection": 13, "mail_bruteforce": 5, "router_or_botnet": 1, "cve:CVE-2024-28000": 3, "cve:CVE-2026-53787": 1, "cve:CVE-2026-63030": 2}, "n": 16}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.37, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.10, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "dshield": {"n": 5, "p": 0.0000, "hi": 0.64, "lo": 0.16, "ips": 5, "mean": 0.37, "above": false}, "urlhaus": {"n": 5, "p": 0.0404, "hi": 2.90, "lo": 0.72, "ips": 5, "mean": 1.66, "above": false}, "crowdsec": {"n": 15, "p": 0.0000, "hi": 0.30, "lo": 0.13, "ips": 16, "mean": 0.21, "above": false}, "blocklist_de": {"n": 11, "p": 0.0000, "hi": 0.58, "lo": 0.22, "ips": 17, "mean": 0.38, "above": false}}, "h2": [["2026-10-05", 0.103, 0.180, 0, false], ["2026-10-12", 0.142, 0.202, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 0, "phishing_db": 0}, "lo": 0.202, "se": 0.973, "ts": 1.000, "map": 0.549, "obs": 5, "own": 1.605, "comp": {"urlhaus": 2.7818, "threatfox": -0.5746, "phishing_db": -1.1799}, "mass": 25.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 15, "vulncheck": 0, "blocklist_de": 11}, "lo": 0.142, "se": 0.409, "ts": 0.469, "map": 0.230, "obs": 32, "own": 0.356, "comp": {"cins": -1.2552, "dshield": 0.5727, "crowdsec": -1.2379, "vulncheck": -0.9839, "blocklist_de": 2.8261}, "mass": 36.3, "listed": false}}, "abq": false, "bot": 0.124, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"bots": 1, "imap": 16, "mail": 16}}, "oid": "ORG-KOVN1-RIPE", "org": "KPN B.V.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.kpn.com"}, "pfx": 421, "reg": "1993-09-01", "rir": "ripencc", "s24": 28382, "sib": 16, "tor": 0, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7316992, "abuse": "abuse@kpn.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.193956}, {"a": 1221, "h": "ASN-TELSTRA", "n": "Telstra Corporation Ltd", "t": "Broadband & mobile", "w": 62, "cc": "AU", "cf": {"rb": "hi", "wb": "", "rep": 0.29, "waf": 0.26}, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}, "shodan": {"n": 7, "p": 0.0000, "hi": 0.12, "lo": 0.04, "ips": 7, "mean": 0.07, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 0.31, "lo": 0.07, "ips": 4, "mean": 0.17, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.04, "lo": 0.01, "ips": 2, "mean": 0.02, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.17, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "phishing_db": {"n": 49, "p": 0.0002, "hi": 2.34, "lo": 1.47, "ips": 50, "mean": 1.88, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 0.18, "lo": 0.05, "ips": 5, "mean": 0.11, "above": false}}, "h2": [["2026-10-05", 0.029, 0.222, 0, false], ["2026-10-12", 0.030, 0.223, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 49}, "lo": 0.223, "se": 0.895, "ts": 1.000, "map": 0.499, "obs": 49, "own": 1.500, "comp": {"urlhaus": -2.7318, "threatfox": -0.5825, "phishing_db": 4.2444}, "mass": 44.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 5}, "lo": 0.030, "se": 0.473, "ts": 0.385, "map": 0.054, "obs": 13, "own": 0.085, "comp": {"cins": 0.6985, "dshield": 3.0854, "crowdsec": -7.3449, "vulncheck": -0.5717, "blocklist_de": 2.6106}, "mass": 15.9, "listed": false}}, "abq": false, "bot": 0.082, "det": {"shodan": {"c2": 1, "compromised": 6}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TC6-AP-APNIC", "org": "Telstra Limited", "pdb": {"t": null, "sc": "Australia", "tr": null, "pol": "Selective", "web": "https://www.telstra.com.au/"}, "pfx": 279, "reg": "2000-01-31", "rir": "apnic", "s24": 52294, "sib": 15, "tor": 0, "w24": 61, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13402368, "abuse": "abuse@telstra.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.252884}, {"a": 1237, "h": "KREONET-AS-KR", "n": "KREONET", "t": "Enterprise, edu & gov", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0004, "hi": 1.38, "lo": 0.10, "ips": 1, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.126, "obs": 0, "own": 1.041, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.491, "ts": null, "map": 0.050, "obs": 0, "own": 0.373, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.235, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://kreonet.net"}, "pfx": 212, "reg": "2002-08-01", "rir": "apnic", "s24": 1143, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 306944, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00048054342}, {"a": 1246, "h": "TLL-WEST", "n": "Zito Media", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.733, 0.011, 0, false], ["2026-10-12", 0.364, 0.012, 0, false]], "sh": false, "uc": 892.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.364, "se": 1.326, "ts": 1.000, "map": 3.258, "obs": 1, "own": 2.163, "comp": {"cins": -0.1229, "dshield": -0.2846, "crowdsec": -1.1265, "vulncheck": -0.3008, "blocklist_de": 4.4095}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.290, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "TLL-10-ARIN", "org": "Zito Media", "pdb": null, "pfx": 9, "reg": "2009-07-23", "rir": "arin", "s24": 28, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "abuse@zitomedia.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 1257, "h": "SWIPNET", "n": "TELE2", "t": "Broadband & mobile", "w": 39, "cc": "SE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.70, "waf": 0.62}, "cs": {"c": {"http_flood": 5, "web_exploit": 23, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 20, "web_bruteforce": 25, "home_connection": 22, "mail_bruteforce": 21, "cve:CVE-2026-8181": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2025-29927": 1, "cve:CVE-2025-55182": 1}, "n": 28}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.17, "lo": 0.04, "ips": 4, "mean": 0.09, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.53, "lo": 0.09, "ips": 3, "mean": 0.27, "above": false}, "urlhaus": {"n": 2, "p": 0.0028, "hi": 1.89, "lo": 0.25, "ips": 2, "mean": 0.90, "above": false}, "crowdsec": {"n": 26, "p": 0.0000, "hi": 0.53, "lo": 0.28, "ips": 28, "mean": 0.40, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.97, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.33, "lo": 0.02, "ips": 1, "mean": 0.14, "above": false}, "blocklist_de": {"n": 10, "p": 0.0000, "hi": 0.60, "lo": 0.22, "ips": 10, "mean": 0.39, "above": false}}, "h2": [["2026-10-05", 0.229, 0.060, 0, false], ["2026-10-12", 0.177, 0.081, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 1, "phishing_db": 0}, "lo": 0.081, "se": 1.100, "ts": 0.667, "map": 0.280, "obs": 3, "own": 0.877, "comp": {"urlhaus": 1.699, "threatfox": -0.2207, "phishing_db": -1.1258}, "mass": 12.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 26, "vulncheck": 1, "blocklist_de": 10}, "lo": 0.177, "se": 0.400, "ts": 0.650, "map": 0.283, "obs": 40, "own": 0.438, "comp": {"cins": -3.0787, "dshield": -1.0962, "crowdsec": 5.0369, "vulncheck": -0.8322, "blocklist_de": 0.1011}, "mass": 39.8, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"compromised": 4}, "threatfox": {"family:Havoc": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"bots": 2, "imap": 6, "mail": 8}}, "oid": "ORG-TA44-RIPE", "org": "Tele2 Sverige AB", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Tbps", "pol": "Selective", "web": "https://www.tele2.com"}, "pfx": 387, "reg": "1993-09-01", "rir": "ripencc", "s24": 25233, "sib": 11, "tor": 0, "w24": 37, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7504640, "abuse": "abuse@tele2.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.103992}, {"a": 1267, "h": "ASN-WINDTRE", "n": "WINDTRE", "t": "Transit & backbone", "w": 25, "cc": "IT", "cf": {"rb": "hi", "wb": "hi", "rep": 0.44, "waf": 0.38}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 3}, "n": 7}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.48, "lo": 0.06, "ips": 2, "mean": 0.23, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.10, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "dshield": {"n": 7, "p": 0.0000, "hi": 0.79, "lo": 0.24, "ips": 7, "mean": 0.48, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.15, "lo": 0.04, "ips": 7, "mean": 0.09, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.31, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "blocklist_de": {"n": 9, "p": 0.0000, "hi": 0.49, "lo": 0.17, "ips": 9, "mean": 0.31, "above": false}}, "h2": [["2026-10-05", 0.143, 0.021, 0, false], ["2026-10-12", 0.111, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.013, "se": 1.343, "ts": 1.000, "map": 0.065, "obs": 1, "own": 0.370, "comp": {"urlhaus": -0.9241, "threatfox": -0.4597, "phishing_db": 0.2696}, "mass": 4.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 7, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 9}, "lo": 0.111, "se": 0.423, "ts": 0.375, "map": 0.183, "obs": 24, "own": 0.576, "comp": {"cins": 1.196, "dshield": 3.1294, "crowdsec": -6.4455, "vulncheck": -0.9765, "blocklist_de": 2.791}, "mass": 29.5, "listed": false}}, "abq": false, "bot": 0.100, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 6, "bots": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-IA36-RIPE", "org": "WIND TRE S.P.A.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.windtre.it/"}, "pfx": 213, "reg": "1993-09-01", "rir": "ripencc", "s24": 28892, "sib": 2, "tor": 0, "w24": 24, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10201088, "abuse": "abuse@wind.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.167614}, {"a": 1299, "h": "TWELVE99", "n": "Arelion (Twelve99)", "t": "Transit & backbone", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0001, "hi": 1.19, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}}, "h2": [["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.119, "obs": 0, "own": 0.815, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.467, "ts": null, "map": 0.044, "obs": 0, "own": 0.182, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.271, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TCA32-RIPE", "org": "Arelion Sweden AB", "pdb": {"t": "NSP", "sc": "Global", "tr": "100+Tbps", "pol": "Restrictive", "web": "https://www.arelion.com/"}, "pfx": 122, "reg": "1993-09-01", "rir": "ripencc", "s24": 1391, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 380160, "abuse": "abuse@twelve99.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00816459367351}, {"a": 1312, "h": "VA-TECH-AS", "n": "Virginia Polytechnic Institute and State Univ.", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 3.33}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.882, "ts": null, "map": 0.149, "obs": 0, "own": 0.800, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.579, "ts": null, "map": 0.075, "obs": 0, "own": 0.167, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.852, "det": null, "oid": "VPISU-ARIN", "org": "Virginia Polytechnic Institute and State Univ.", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.vt.edu/"}, "pfx": 5, "reg": "1991-07-19", "rir": "arin", "s24": 560, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 147968, "abuse": "abuse@vt.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00589620465606}, {"a": 1341, "h": "ROCKWELLCOLLINS-AS", "n": "Rockwell Collins, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.126, "obs": 0, "own": 0.250, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.492, "ts": null, "map": 0.050, "obs": 0, "own": 0.038, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.377, "det": null, "oid": "ROCKW-11-Z-ARIN", "org": "Rockwell Collins, Inc.", "pdb": null, "pfx": 93, "reg": "1991-08-23", "rir": "arin", "s24": 1132, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 293888, "abuse": "network-admins@rockwellcollins.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 1387, "h": "ANSBB-ASNNET-2", "n": "Verizon Business", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9662, "hi": 11.82, "lo": 3.28, "ips": 6, "mean": 6.99, "above": true}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"doublepulsar": 6}}, "oid": "MCICS-ARIN", "org": "Verizon Business", "pdb": null, "pfx": 1, "reg": "1994-11-23", "rir": "arin", "s24": 1, "sib": 229, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 256, "abuse": "abuse-mail@verizonbusiness.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 1403, "h": "EBOX", "n": "EBOX", "t": "Broadband & mobile", "w": 4, "cc": "CA", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0353, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "blocklist_de": {"n": 3, "p": 0.0676, "hi": 3.19, "lo": 0.56, "ips": 3, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.154, 0.008, 0, false], ["2026-10-12", 0.253, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.121, "obs": 0, "own": 0.582, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.253, "se": 0.642, "ts": 0.750, "map": 0.613, "obs": 4, "own": 0.957, "comp": {"cins": -0.9043, "dshield": 1.3875, "crowdsec": -6.1229, "vulncheck": -0.8036, "blocklist_de": 7.347}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.170, "det": {"shodan": {"c2": 1}, "blocklist_de": {"bots": 3}}, "oid": "QUEBE-50-ARIN", "org": "EBOX", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://ebox.ca"}, "pfx": 231, "reg": "2009-07-28", "rir": "arin", "s24": 1336, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 543232, "abuse": "abuse@ebox.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0138823543544}, {"a": 1410, "h": "CELLONE-IP", "n": "CellularOne of NE Az", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 12, "p": 1.0000, "hi": 18.02, "lo": 7.13, "ips": 12, "mean": 12.05, "above": true}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 1.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.822, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.114, "det": {"shodan": {"compromised": 12}}, "oid": "SMITH-49-ARIN", "org": "SMITH BAGLEY INC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.cellularoneonline.com"}, "pfx": 19, "reg": "2009-07-30", "rir": "arin", "s24": 37, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 13312, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 1547, "h": "IDK-Network", "n": "JSC InterDnestrCom (IDC)", "t": "Broadband & mobile", "w": 3, "cc": "MD", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1474, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 2, "p": 0.1293, "hi": 3.82, "lo": 0.50, "ips": 2, "mean": 1.82, "above": false}, "blocklist_de": {"n": 2, "p": 0.2714, "hi": 4.99, "lo": 0.65, "ips": 2, "mean": 2.38, "above": false}}, "h2": [["2026-10-05", 1.936, 0.010, 0, false], ["2026-10-12", 1.489, 0.011, 0, false]], "sh": false, "uc": 393.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.170, "obs": 0, "own": 1.050, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.489, "se": 0.604, "ts": 0.400, "map": 3.393, "obs": 5, "own": 5.266, "comp": {"cins": -0.9126, "dshield": 1.3627, "crowdsec": -0.369, "vulncheck": -0.8055, "blocklist_de": 3.3398}, "mass": 4.6, "listed": false}}, "abq": true, "bot": 0.244, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "ORG-JI1-RIPE", "org": "INTERDNESTRKOM, Sovmestnoe Zakrytoe Aktsionernoe Obshchestvo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://idknet.com/"}, "pfx": 48, "reg": "2000-11-08", "rir": "ripencc", "s24": 244, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 119808, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00365100315615}, {"a": 1659, "h": "ERX-TANET-ASN1", "n": "Taiwan Academic Network(TANet)", "t": "Enterprise, edu & gov", "w": 3, "cc": "TW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.10, "lo": 0.01, "ips": 1, "mean": 0.04, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.41, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}}, "h2": [["2026-10-05", 0.007, 0.014, 0, false], ["2026-10-12", 0.007, 0.016, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.016, "se": 1.338, "ts": 1.000, "map": 0.078, "obs": 1, "own": 0.517, "comp": {"urlhaus": -0.8579, "threatfox": -0.4487, "phishing_db": 0.3868}, "mass": 3.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.007, "se": 0.760, "ts": 1.000, "map": 0.022, "obs": 2, "own": 0.127, "comp": {"cins": -0.5694, "dshield": -1.1048, "crowdsec": 2.8313, "vulncheck": -0.696, "blocklist_de": -2.8865}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.221, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-1659-APNIC", "org": "Taiwan Academic Network (TANet) Information Center", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Selective", "web": "http://www.edu.tw"}, "pfx": 227, "reg": "2002-08-01", "rir": "apnic", "s24": 21464, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6650368, "abuse": "noc@mail.moe.gov.tw", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00655532046508}, {"a": 1680, "h": "NV-ASN", "n": "Cellcom Israel", "t": "Broadband & mobile", "w": 21, "cc": "IL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 9, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 7, "cve:CVE-2017-9841": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2018-20062": 1}, "n": 13}, "ev": {"cins": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "dshield": {"n": 2, "p": 0.0002, "hi": 1.46, "lo": 0.19, "ips": 2, "mean": 0.70, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 1.19, "lo": 0.49, "ips": 13, "mean": 0.81, "above": false}, "phishing_db": {"n": 2, "p": 0.0005, "hi": 1.57, "lo": 0.20, "ips": 2, "mean": 0.75, "above": false}, "blocklist_de": {"n": 7, "p": 0.0001, "hi": 1.73, "lo": 0.53, "ips": 7, "mean": 1.06, "above": false}}, "h2": [["2026-10-05", 0.252, 0.103, 0, false], ["2026-10-12", 0.436, 0.071, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.071, "se": 1.167, "ts": 1.000, "map": 0.276, "obs": 2, "own": 0.898, "comp": {"urlhaus": -0.8618, "threatfox": -0.4494, "phishing_db": 1.6489}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.436, "se": 0.421, "ts": 0.565, "map": 0.719, "obs": 23, "own": 1.111, "comp": {"cins": -0.3715, "dshield": -0.8685, "crowdsec": 1.6368, "vulncheck": -0.969, "blocklist_de": 1.6356}, "mass": 24.5, "listed": false}}, "abq": true, "bot": 0.213, "det": {"blocklist_de": {"ftp": 1, "ssh": 1, "bots": 2, "imap": 2, "mail": 3}}, "oid": "ORG-NL5-RIPE", "org": "Cellcom Fixed Line Communication L.P", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://internationalcarrierservices.cellcom.co.il/"}, "pfx": 56, "reg": "1993-09-01", "rir": "ripencc", "s24": 6141, "sib": 0, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1584128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04730723898173}, {"a": 1741, "h": "FUNETAS", "n": "CSC/Funet", "t": "Enterprise, edu & gov", "w": 0, "cc": "FI", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.03, "lo": 0.13, "ips": 2, "mean": 0.49, "above": false}}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.771, "ts": null, "map": 0.100, "obs": 0, "own": 0.783, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.405, "ts": null, "map": 0.031, "obs": 0, "own": 0.221, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.261, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "ORG-FF1-RIPE", "org": "CSC - Tieteen tietotekniikan keskus Oy", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.funet.fi"}, "pfx": 40, "reg": "1993-09-01", "rir": "ripencc", "s24": 2382, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 610048, "abuse": "cert@cert.funet.fi", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00183084915111}, {"a": 1756, "h": "Hamyar-AS", "n": "Shiraz Hamyar Co.", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1183, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}}, "h2": [["2026-10-12", 0.184, 0.012, 0, false]], "sh": false, "uc": 381.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.015, "ts": null, "map": 0.186, "obs": 0, "own": 0.568, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.184, "se": 1.217, "ts": 1.000, "map": 1.341, "obs": 1, "own": 0.848, "comp": {"cins": -0.1524, "dshield": -0.3486, "crowdsec": 3.3311, "vulncheck": -0.35, "blocklist_de": -0.7933}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.616, "det": null, "oid": "ORG-SHC1-RIPE", "org": "Shiraz Hamyar Co.", "pdb": null, "pfx": 85, "reg": "2010-05-12", "rir": "ripencc", "s24": 85, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001804455456}, {"a": 1759, "h": "TSF-IP-Core", "n": "Telia Finland", "t": "Broadband & mobile", "w": 11, "cc": "FI", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 7, "proxy_or_vpn": 1, "ssh_bruteforce": 10, "web_bruteforce": 10, "home_connection": 10, "mail_bruteforce": 9}, "n": 10}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.16, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 0.44, "lo": 0.15, "ips": 10, "mean": 0.28, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.61, "lo": 0.05, "ips": 1, "mean": 0.26, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 0.70, "lo": 0.18, "ips": 6, "mean": 0.40, "above": false}}, "h2": [["2026-10-05", 0.127, 0.004, 0, false], ["2026-10-12", 0.124, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.665, "ts": null, "map": 0.051, "obs": 0, "own": 0.229, "comp": null, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 5}, "lo": 0.124, "se": 0.457, "ts": 0.600, "map": 0.217, "obs": 15, "own": 0.337, "comp": {"cins": -2.0837, "dshield": -2.6077, "crowdsec": 2.4588, "vulncheck": -0.5696, "blocklist_de": 2.6674}, "mass": 15.7, "listed": false}}, "abq": false, "bot": 0.108, "det": {"shodan": {"compromised": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 6, "mail": 6}}, "oid": "ORG-SA28-RIPE", "org": "Telia Finland Oyj", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.telia.fi"}, "pfx": 117, "reg": "1993-09-01", "rir": "ripencc", "s24": 12992, "sib": 3, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3345920, "abuse": "abuse@telia.fi", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0349299389932}, {"a": 1764, "h": "NEXTLAYER-AS", "n": "next layer", "t": "Transit & backbone", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0394, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 1.375, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.652, "ts": null, "map": 0.099, "obs": 0, "own": 0.490, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.847, "det": {"shodan": {"c2": 1}}, "oid": "ORG-NLTU1-RIPE", "org": "Next Layer Telekommunikationsdienstleistungs- und Beratungs GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.nextlayer.at/"}, "pfx": 70, "reg": "1993-09-01", "rir": "ripencc", "s24": 317, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 97280, "abuse": "abuse@nextlayer.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00167088443652}, {"a": 1916, "h": "", "n": "Rede Nacional de Ensino e Pesquisa - RNP", "t": "Enterprise, edu & gov", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.73, "lo": 0.05, "ips": 1, "mean": 0.31, "above": false}, "blocklist_de": {"n": 1, "p": 0.0002, "hi": 1.26, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.019, 0.007, 0, false], ["2026-10-12", 0.020, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.765, "ts": null, "map": 0.098, "obs": 0, "own": 0.758, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.020, "se": 1.005, "ts": 1.000, "map": 0.094, "obs": 1, "own": 0.559, "comp": {"cins": -0.3114, "dshield": -0.6667, "crowdsec": -2.6305, "vulncheck": -0.5356, "blocklist_de": 3.1695}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.276, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-1916-LACNIC", "org": "Rede Nacional de Ensino e Pesquisa", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.rnp.br"}, "pfx": 227, "reg": "1999-11-16", "rir": "lacnic", "s24": 2581, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 870400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00535365466671}, {"a": 2018, "h": "TENET-1", "n": "Tertiary Education and Research Network of South Africa", "t": "Enterprise, edu & gov", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.45, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}}, "h2": [["2026-10-05", 0.002, 0.006, 0, false], ["2026-10-12", 0.002, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.727, "ts": null, "map": 0.080, "obs": 0, "own": 0.605, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.002, "se": 1.335, "ts": null, "map": 0.021, "obs": 0, "own": 0.139, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.121, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-UP1-AFRINIC", "org": "Tertiary Education and Research Network of South Africa", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.tenet.ac.za"}, "pfx": 375, "reg": "2001-03-07", "rir": "afrinic", "s24": 4485, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2139648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0052356852984}, {"a": 2027, "h": "MilkyWan", "n": "MilkyWan", "t": "Broadband & mobile", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 12.706, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.648, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MA1574-RIPE", "org": "MilkyWan Association", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://milkywan.fr"}, "pfx": 5, "reg": "2011-01-12", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "abuse@milkywan.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2116, "h": "GlobalConnect-AS2116", "n": "GlobalConnect AS2116", "t": "Broadband & mobile", "w": 8, "cc": "NO", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.57, "lo": 0.12, "ips": 4, "mean": 0.31, "above": false}, "urlhaus": {"n": 1, "p": 0.0419, "hi": 2.87, "lo": 0.22, "ips": 1, "mean": 1.21, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.39, "lo": 0.07, "ips": 4, "mean": 0.20, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 1.01, "lo": 0.08, "ips": 1, "mean": 0.43, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.07, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.74, "lo": 0.10, "ips": 2, "mean": 0.35, "above": false}}, "h2": [["2026-10-05", 0.045, 0.096, 0, false], ["2026-10-12", 0.073, 0.104, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.104, "se": 1.168, "ts": 0.500, "map": 0.431, "obs": 2, "own": 1.309, "comp": {"urlhaus": 1.4987, "threatfox": -0.504, "phishing_db": -0.2092}, "mass": 5.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.073, "se": 0.570, "ts": 0.500, "map": 0.153, "obs": 6, "own": 0.240, "comp": {"cins": -1.1196, "dshield": -1.8104, "crowdsec": 0.5837, "vulncheck": 0.0305, "blocklist_de": 1.8314}, "mass": 6.1, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-BNA1-RIPE", "org": "GLOBALCONNECT AS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.globalconnect.net/"}, "pfx": 167, "reg": "1993-02-03", "rir": "ripencc", "s24": 7054, "sib": 12, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1817600, "abuse": "abuse@globalconnect.no", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01423925421654}, {"a": 2119, "h": "TELENOR-NEXTEL", "n": "Telenor Norway", "t": "Broadband & mobile", "w": 7, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-44228": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.17, "lo": 0.02, "ips": 2, "mean": 0.08, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.63, "lo": 0.08, "ips": 2, "mean": 0.30, "above": false}, "urlhaus": {"n": 1, "p": 0.0043, "hi": 1.87, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.14, "lo": 0.02, "ips": 2, "mean": 0.07, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.41, "lo": 0.07, "ips": 3, "mean": 0.21, "above": false}}, "h2": [["2026-10-05", 0.014, 0.030, 0, false], ["2026-10-12", 0.045, 0.034, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.034, "se": 1.314, "ts": 1.000, "map": 0.186, "obs": 1, "own": 0.612, "comp": {"urlhaus": 1.4684, "threatfox": -0.5053, "phishing_db": -1.0166}, "mass": 5.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.045, "se": 0.535, "ts": 0.429, "map": 0.090, "obs": 7, "own": 0.141, "comp": {"cins": -1.4176, "dshield": 2.231, "crowdsec": -3.937, "vulncheck": -0.888, "blocklist_de": 3.001}, "mass": 8.4, "listed": false}}, "abq": false, "bot": 0.105, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-NA38-RIPE", "org": "Telenor Norge AS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.telenor.com"}, "pfx": 94, "reg": "1993-02-25", "rir": "ripencc", "s24": 16591, "sib": 5, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4247296, "abuse": "abuse@telenor.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04566396030049}, {"a": 2200, "h": "FR-RENATER", "n": "RENATER", "t": "Enterprise, edu & gov", "w": 2, "cc": "FR", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2022-39290": 1, "cve:CVE-2026-75650": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.17, "lo": 0.01, "ips": 2, "mean": 0.07, "above": false}}, "h2": [["2026-10-05", 0.006, 0.005, 0, false], ["2026-10-12", 0.007, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.679, "ts": null, "map": 0.058, "obs": 0, "own": 0.435, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.007, "se": 0.939, "ts": 1.000, "map": 0.028, "obs": 1, "own": 0.164, "comp": {"cins": -0.3478, "dshield": -0.734, "crowdsec": 1.2418, "vulncheck": -0.5657, "blocklist_de": -1.7877}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-RA8-RIPE", "org": "Renater", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.renater.fr"}, "pfx": 69, "reg": "1993-09-01", "rir": "ripencc", "s24": 9847, "sib": 306, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2552064, "abuse": "certsvp@renater.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00897389245184}, {"a": 2280, "h": "OCBHoney", "n": "Orange S.A.", "t": "Broadband & mobile", "w": 1, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1450, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "phishing_db": {"n": 1, "p": 0.1854, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.213, 0.349, 0, false], ["2026-10-12", 0.010, 0.364, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.364, "se": 1.493, "ts": 1.000, "map": 3.323, "obs": 1, "own": 9.684, "comp": {"urlhaus": -0.1435, "threatfox": -0.1682, "phishing_db": 3.1385}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.860, "ts": null, "map": 0.176, "obs": 0, "own": 0.614, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.978, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FT2-RIPE", "org": "Orange S.A.", "pdb": null, "pfx": 34, "reg": "1993-09-01", "rir": "ripencc", "s24": 65, "sib": 60, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32000, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2497, "h": "IIJ", "n": "Internet Initiative Japan", "t": "Transit & backbone", "w": 2, "cc": "JP", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.26, "lo": 0.06, "ips": 4, "mean": 0.14, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}}, "h2": [["2026-10-05", 0.024, 0.004, 0, false], ["2026-10-12", 0.009, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.654, "ts": null, "map": 0.046, "obs": 0, "own": 0.299, "comp": null, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.009, "se": 0.766, "ts": 0.500, "map": 0.029, "obs": 2, "own": 0.093, "comp": {"cins": -0.5567, "dshield": 2.5653, "crowdsec": -0.6503, "vulncheck": -0.6903, "blocklist_de": -2.8246}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.177, "det": {"shodan": {"c2": 3, "compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-2497-JPNIC", "org": "Internet Initiative Japan Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Restrictive", "web": "http://www.iij.ad.jp/en/"}, "pfx": 250, "reg": "2002-04-05", "rir": "apnic", "s24": 15989, "sib": 1, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4162560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03100418733555}, {"a": 2500, "h": "WIDE-BB", "n": "WIDE Project", "t": "Enterprise, edu & gov", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 9, "p": 0.9794, "hi": 10.15, "lo": 3.51, "ips": 9, "mean": 6.46, "above": true}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.746, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.110, "obs": 0, "own": 1.003, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.825, "det": {"shodan": {"doublepulsar": 9}}, "oid": "@aut-23634-JPNIC", "org": "WIDE Project", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.wide.ad.jp/"}, "pfx": 3, "reg": "2002-04-05", "rir": "apnic", "s24": 256, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 65536, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 2514, "h": "InfoSphere", "n": "NTT PC Communications (InfoSphere)", "t": "Transit & backbone", "w": 16, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 2, "cve:CVE-2014-8739": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2016-15043": 1, "cve:CVE-2018-20062": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 1.07, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}, "shodan": {"n": 8, "p": 0.0000, "hi": 0.79, "lo": 0.26, "ips": 8, "mean": 0.49, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "urlhaus": {"n": 1, "p": 0.0327, "hi": 2.71, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.41, "lo": 0.09, "ips": 4, "mean": 0.22, "above": false}, "phishing_db": {"n": 9, "p": 0.0730, "hi": 3.16, "lo": 1.09, "ips": 9, "mean": 2.01, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}}, "h2": [["2026-10-05", 0.108, 0.342, 0, false], ["2026-10-12", 0.084, 0.353, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 9}, "lo": 0.353, "se": 0.926, "ts": 0.900, "map": 0.895, "obs": 10, "own": 3.597, "comp": {"urlhaus": -0.1769, "threatfox": -0.5531, "phishing_db": 2.2456}, "mass": 11.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.084, "se": 0.537, "ts": 0.571, "map": 0.170, "obs": 7, "own": 0.538, "comp": {"cins": 2.3295, "dshield": 0.2443, "crowdsec": 1.0219, "vulncheck": -0.8783, "blocklist_de": -3.0971}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.145, "det": {"shodan": {"compromised": 6, "doublepulsar": 2}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-2514-JPNIC", "org": "NTT PC Communications, Inc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.nttpc.co.jp/"}, "pfx": 468, "reg": "2002-04-05", "rir": "apnic", "s24": 8121, "sib": 1, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2635776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01989950886885}, {"a": 2516, "h": "KDDI", "n": "KDDI", "t": "Broadband & mobile", "w": 25, "cc": "JP", "cf": {"rb": "hi", "wb": "", "rep": 0.12, "waf": 0.11}, "cs": {"c": {"ssh_bruteforce": 6, "web_bruteforce": 1, "home_connection": 7, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 7}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 0.25, "lo": 0.04, "ips": 3, "mean": 0.13, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.07, "lo": 0.02, "ips": 5, "mean": 0.04, "above": false}, "dshield": {"n": 14, "p": 0.0000, "hi": 0.56, "lo": 0.24, "ips": 14, "mean": 0.38, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.07, "lo": 0.02, "ips": 7, "mean": 0.04, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.13, "lo": 0.01, "ips": 1, "mean": 0.06, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 0.12, "lo": 0.03, "ips": 4, "mean": 0.07, "above": false}}, "h2": [["2026-10-05", 0.026, 0.007, 0, false], ["2026-10-12", 0.048, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.007, "se": 1.368, "ts": 1.000, "map": 0.036, "obs": 1, "own": 0.162, "comp": {"urlhaus": -1.1458, "threatfox": -0.4899, "phishing_db": -0.0553}, "mass": 6.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 14, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.048, "se": 0.419, "ts": 0.500, "map": 0.078, "obs": 28, "own": 0.122, "comp": {"cins": 2.9686, "dshield": 8.7728, "crowdsec": -5.899, "vulncheck": -0.9782, "blocklist_de": -6.0183}, "mass": 30.9, "listed": false}}, "abq": false, "bot": 0.050, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 2}}, "oid": "@aut-2516-JPNIC", "org": "KDDI CORPORATION", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.kddi.com/english/index.html"}, "pfx": 560, "reg": "2002-04-05", "rir": "apnic", "s24": 70595, "sib": 3, "tor": 0, "w24": 25, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18152192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.612983}, {"a": 2518, "h": "BIGLOBE", "n": "BIGLOBE", "t": "Broadband & mobile", "w": 6, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.52, "waf": 0.46}, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-22457": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.67, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.29, "lo": 0.06, "ips": 4, "mean": 0.16, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.72, "lo": 0.09, "ips": 2, "mean": 0.34, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.20, "lo": 0.03, "ips": 3, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.038, 0.004, 0, false], ["2026-10-12", 0.039, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.660, "ts": null, "map": 0.049, "obs": 0, "own": 0.220, "comp": null, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.039, "se": 0.558, "ts": 0.500, "map": 0.082, "obs": 6, "own": 0.129, "comp": {"cins": 2.6336, "dshield": 3.0551, "crowdsec": -0.0871, "vulncheck": -0.8589, "blocklist_de": -5.8451}, "mass": 6.7, "listed": false}}, "abq": false, "bot": 0.062, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-2518-JPNIC", "org": "BIGLOBE Inc.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.biglobe.co.jp/"}, "pfx": 33, "reg": "2002-04-05", "rir": "apnic", "s24": 14336, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3670272, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.140066}, {"a": 2519, "h": "Vectant", "n": "ARTERIA Networks Corporation (Vectant)", "t": "Transit & backbone", "w": 4, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 1.11, "waf": 0.97}, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.48, "lo": 0.06, "ips": 2, "mean": 0.23, "above": false}, "dshield": {"n": 1, "p": 0.0001, "hi": 1.16, "lo": 0.09, "ips": 1, "mean": 0.49, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.39, "lo": 0.05, "ips": 2, "mean": 0.19, "above": false}, "phishing_db": {"n": 1, "p": 0.0001, "hi": 1.25, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.67, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}}, "h2": [["2026-10-05", 0.057, 0.033, 0, false], ["2026-10-12", 0.058, 0.035, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.035, "se": 1.328, "ts": 1.000, "map": 0.188, "obs": 1, "own": 0.930, "comp": {"urlhaus": -0.6069, "threatfox": -0.3941, "phishing_db": 0.9564}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.058, "se": 0.630, "ts": 0.500, "map": 0.137, "obs": 4, "own": 0.437, "comp": {"cins": -0.8737, "dshield": 1.4804, "crowdsec": -0.0439, "vulncheck": -0.7962, "blocklist_de": -0.3601}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.071, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-2519-APNIC", "org": "ARTERIA Networks Corporation", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.arteria-net.com/en/"}, "pfx": 182, "reg": "2002-04-05", "rir": "apnic", "s24": 5720, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1464832, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.066107}, {"a": 2527, "h": "So-net", "n": "Sony Network Communications", "t": "Broadband & mobile", "w": 10, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.46, "waf": 0.40}, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 5, "mail_bruteforce": 2}, "n": 5}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.19, "lo": 0.02, "ips": 2, "mean": 0.09, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.85, "lo": 0.15, "ips": 3, "mean": 0.44, "above": false}, "urlhaus": {"n": 2, "p": 0.0256, "hi": 2.63, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.26, "lo": 0.06, "ips": 5, "mean": 0.15, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.37, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}}, "h2": [["2026-10-05", 0.067, 0.088, 0, false], ["2026-10-12", 0.067, 0.098, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.098, "se": 1.135, "ts": 1.000, "map": 0.382, "obs": 2, "own": 1.142, "comp": {"urlhaus": 2.3112, "threatfox": -0.5432, "phishing_db": -1.105}, "mass": 9.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.067, "se": 0.491, "ts": 0.500, "map": 0.124, "obs": 10, "own": 0.194, "comp": {"cins": -1.6441, "dshield": 3.3675, "crowdsec": 0.3246, "vulncheck": -0.9113, "blocklist_de": -1.8282}, "mass": 10.5, "listed": false}}, "abq": false, "bot": 0.085, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-2527-JPNIC", "org": "Sony Network Communications Inc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.so-net.ne.jp/"}, "pfx": 74, "reg": "2002-04-05", "rir": "apnic", "s24": 15108, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3867648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.159556}, {"a": 2601, "h": "RADIOLINK-AS", "n": "Pitline Ltd", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.238, "det": null, "oid": "ORG-LA684-RIPE", "org": "Pitline Ltd", "pdb": null, "pfx": 2, "reg": "2015-11-24", "rir": "ripencc", "s24": 2, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@pitline.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2607, "h": "SANET", "n": "SANET", "t": "Enterprise, edu & gov", "w": 1, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "phishing_db": {"n": 1, "p": 0.0172, "hi": 2.37, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}}, "h2": [["2026-10-05", 0.021, 0.061, 0, false], ["2026-10-12", 0.003, 0.064, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.064, "se": 1.337, "ts": 1.000, "map": 0.372, "obs": 1, "own": 2.033, "comp": {"urlhaus": -0.456, "threatfox": -0.3464, "phishing_db": 1.4395}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.422, "ts": null, "map": 0.035, "obs": 0, "own": 0.246, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.215, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-SAN1-RIPE", "org": "Zdruzenie pouzivatelov Slovenskej akademickej datovej siete SANET", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.sanet.sk"}, "pfx": 33, "reg": "1993-10-21", "rir": "ripencc", "s24": 2055, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1051648, "abuse": "abuse@sanet.sk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00133061709966}, {"a": 2609, "h": "TN-BB-AS", "n": "Tunisie Telecom", "t": "Broadband & mobile", "w": 5, "cc": "TN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 1.14, "lo": 0.20, "ips": 3, "mean": 0.59, "above": false}, "vulncheck": {"n": 1, "p": 0.0117, "hi": 2.21, "lo": 0.17, "ips": 1, "mean": 0.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.0027, "hi": 1.88, "lo": 0.24, "ips": 2, "mean": 0.90, "above": false}}, "h2": [["2026-10-05", 0.180, 0.007, 0, false], ["2026-10-12", 0.213, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.777, "ts": null, "map": 0.103, "obs": 0, "own": 0.479, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.213, "se": 0.573, "ts": 0.500, "map": 0.459, "obs": 6, "own": 0.717, "comp": {"cins": -1.0628, "dshield": -1.7485, "crowdsec": 1.092, "vulncheck": 0.092, "blocklist_de": 2.2419}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.263, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-2609-RIPE", "org": "Tunisia BackBone AS", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.tunisietelecom.tn"}, "pfx": 62, "reg": "1993-11-03", "rir": "ripencc", "s24": 2194, "sib": 0, "tor": 0, "w24": 5, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3231488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0021785285088}, {"a": 2639, "h": "ZOHO-AS", "n": "ZOHO-US", "t": "Enterprise, edu & gov", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.544, 0.011, 0, false], ["2026-10-12", 0.201, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 2.683, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.201, "se": 1.246, "ts": 1.000, "map": 1.486, "obs": 1, "own": 9.813, "comp": {"cins": -0.1025, "dshield": -0.2396, "crowdsec": -0.949, "vulncheck": 3.6161, "blocklist_de": -0.5353}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"c2_server": 1}}, "oid": "ZOHOC-ARIN", "org": "ZOHO", "pdb": {"t": "Enterprise", "sc": "North America", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.zoho.com/"}, "pfx": 33, "reg": "2012-10-01", "rir": "arin", "s24": 51, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "abuse@zohocorp.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2715, "h": "", "n": "Fundacao de Amparo a Pesquisa", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.26, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.031, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.817, "ts": null, "map": 0.122, "obs": 0, "own": 0.238, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.476, "ts": null, "map": 0.046, "obs": 0, "own": 0.034, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.158, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-2715-LACNIC", "org": "Fundação Carlos Chagas Filho de Amparo a Pesquisa", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.rederio.br"}, "pfx": 60, "reg": "2000-02-16", "rir": "lacnic", "s24": 1291, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 354816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2728, "h": "GIGSOUTH", "n": "GIGSOUTH", "t": "Broadband & mobile", "w": 10, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4190, "hi": 6.26, "lo": 0.81, "ips": 10, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 2.371, 0.011, 0, false], ["2026-10-12", 2.161, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.161, "se": 0.991, "ts": 1.000, "map": 9.805, "obs": 2, "own": 16.629, "comp": {"cins": -0.1572, "dshield": -0.3588, "crowdsec": -1.4196, "vulncheck": 6.4302, "blocklist_de": -0.8179}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.146, "det": {"vulncheck": {"botnet_node": 10}}, "oid": "GL-716-ARIN", "org": "Gigsouth, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "http://gigsouth.com"}, "pfx": 14, "reg": "2014-04-08", "rir": "arin", "s24": 12, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "abuse@gigsouth.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2764, "h": "AAPT", "n": "Vocus (PIPE/AAPT)", "t": "Transit & backbone", "w": 6, "cc": "AU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 4, "mail_bruteforce": 4, "router_or_botnet": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0023, "hi": 1.71, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}, "dshield": {"n": 1, "p": 0.0006, "hi": 1.45, "lo": 0.11, "ips": 1, "mean": 0.61, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.64, "lo": 0.11, "ips": 4, "mean": 0.33, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 2, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.221, 0.006, 0, false], ["2026-10-12", 0.132, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.732, "ts": null, "map": 0.082, "obs": 0, "own": 0.524, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.132, "se": 0.561, "ts": 0.500, "map": 0.279, "obs": 6, "own": 0.885, "comp": {"cins": 2.649, "dshield": 0.5994, "crowdsec": -0.0274, "vulncheck": -0.8578, "blocklist_de": -2.2456}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.170, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-AL1-AP-APNIC", "org": "AAPT Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.vocus.com.au"}, "pfx": 1439, "reg": "2002-08-01", "rir": "apnic", "s24": 4198, "sib": 86, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1165824, "abuse": "abuse1@aapt.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.016392409243}, {"a": 2828, "h": "XO-AS15", "n": "XO Communications", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.001, 0.004, 0, false], ["2026-10-12", 0.001, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.634, "ts": null, "map": 0.037, "obs": 0, "own": 0.245, "comp": null, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.001, "se": 1.158, "ts": null, "map": 0.006, "obs": 0, "own": 0.020, "comp": null, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.185, "det": null, "oid": "MCICS-ARIN", "org": "Verizon Business", "pdb": {"t": "NSP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.verizon.com/business/"}, "pfx": 85, "reg": "2001-12-19", "rir": "arin", "s24": 25529, "sib": 229, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6650112, "abuse": "abuse-mail@verizonbusiness.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2843, "h": "LIUnet", "n": "Linköpings universitet", "t": "Other", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0586, "hi": 3.13, "lo": 0.23, "ips": 1, "mean": 1.32, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.946, "ts": null, "map": 0.170, "obs": 0, "own": 0.424, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.688, "ts": null, "map": 0.112, "obs": 0, "own": 0.105, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.194, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-UOL66-RIPE", "org": "Linkopings universitet", "pdb": null, "pfx": 1, "reg": "1993-11-29", "rir": "ripencc", "s24": 242, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "abuse@liu.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006193874792}, {"a": 2852, "h": "CESNET2", "n": "CESNET", "t": "Enterprise, edu & gov", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.59, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.748, "ts": null, "map": 0.089, "obs": 0, "own": 0.684, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.368, "ts": null, "map": 0.025, "obs": 0, "own": 0.174, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CA9-RIPE", "org": "CESNET z.s.p.o.", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.cesnet.cz"}, "pfx": 26, "reg": "1993-12-20", "rir": "ripencc", "s24": 3320, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 858112, "abuse": "abuse@cesnet.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00244580790965}, {"a": 2856, "h": "BT-UK-AS", "n": "BTnet (BT's UK IP Network - AS2856)", "t": "Transit & backbone", "w": 21, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 0.41, "waf": 0.51}, "cs": {"c": {"web_exploit": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 3}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.26, "lo": 0.03, "ips": 2, "mean": 0.13, "above": false}, "shodan": {"n": 7, "p": 0.0000, "hi": 0.11, "lo": 0.03, "ips": 7, "mean": 0.07, "above": false}, "dshield": {"n": 6, "p": 0.0000, "hi": 0.39, "lo": 0.11, "ips": 6, "mean": 0.23, "above": false}, "urlhaus": {"n": 2, "p": 0.0000, "hi": 1.05, "lo": 0.14, "ips": 2, "mean": 0.50, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.06, "lo": 0.01, "ips": 4, "mean": 0.03, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.16, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.17, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "blocklist_de": {"n": 6, "p": 0.0000, "hi": 0.20, "lo": 0.06, "ips": 6, "mean": 0.12, "above": false}}, "h2": [["2026-10-05", 0.040, 0.041, 0, false], ["2026-10-12", 0.045, 0.046, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 1}, "lo": 0.046, "se": 1.124, "ts": 0.667, "map": 0.157, "obs": 3, "own": 0.759, "comp": {"urlhaus": 1.1544, "threatfox": -0.5588, "phishing_db": -0.8182}, "mass": 16.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 6}, "lo": 0.045, "se": 0.443, "ts": 0.316, "map": 0.076, "obs": 19, "own": 0.239, "comp": {"cins": 2.1182, "dshield": 3.6069, "crowdsec": -6.833, "vulncheck": -0.7017, "blocklist_de": 0.621}, "mass": 22.9, "listed": false}}, "abq": false, "bot": 0.111, "det": {"shodan": {"malware": 1, "compromised": 5, "doublepulsar": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 4, "imap": 1, "mail": 2}}, "oid": "ORG-BPIS1-RIPE", "org": "British Telecommunications Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.bt.net"}, "pfx": 539, "reg": "1993-12-22", "rir": "ripencc", "s24": 54102, "sib": 8, "tor": 0, "w24": 21, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18471424, "abuse": "abuse@bt.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.597776}, {"a": 2860, "h": "NOS_COMUNICACOES", "n": "NOS", "t": "Broadband & mobile", "w": 18, "cc": "PT", "cf": {"rb": "hi", "wb": "", "rep": 0.92, "waf": 1.07}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 8, "web_bruteforce": 6, "home_connection": 7, "mail_bruteforce": 3, "router_or_botnet": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 10}, "ev": {"dshield": {"n": 2, "p": 0.0001, "hi": 1.33, "lo": 0.17, "ips": 2, "mean": 0.63, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.88, "lo": 0.32, "ips": 10, "mean": 0.57, "above": false}, "threatfox": {"n": 1, "p": 0.0148, "hi": 2.30, "lo": 0.17, "ips": 1, "mean": 0.97, "above": false}, "blocklist_de": {"n": 9, "p": 0.0002, "hi": 1.87, "lo": 0.65, "ips": 9, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.207, 0.028, 0, false], ["2026-10-12", 0.364, 0.030, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.030, "se": 1.333, "ts": 1.000, "map": 0.157, "obs": 1, "own": 0.561, "comp": {"urlhaus": -0.6099, "threatfox": 1.1512, "phishing_db": -0.7698}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 9}, "lo": 0.364, "se": 0.427, "ts": 0.476, "map": 0.612, "obs": 21, "own": 0.946, "comp": {"cins": -2.5361, "dshield": -0.7746, "crowdsec": -0.891, "vulncheck": -0.967, "blocklist_de": 6.0709}, "mass": 23.5, "listed": false}}, "abq": false, "bot": 0.136, "det": {"threatfox": {"family:AsyncRAT": 1}, "blocklist_de": {"ssh": 1, "bots": 3, "imap": 4, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TPS1-RIPE", "org": "NOS COMUNICACOES, S.A.", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.nos.pt"}, "pfx": 135, "reg": "1994-01-18", "rir": "ripencc", "s24": 6916, "sib": 3, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3318784, "abuse": "abuse@nos.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.079741}, {"a": 2900, "h": "WN-AZ-AS", "n": "Arizona Tri University Network", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2021-26086": 1, "cve:CVE-2021-43798": 1, "cve:CVE-2021-44228": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0102, "hi": 2.25, "lo": 0.29, "ips": 2, "mean": 1.07, "above": false}}, "h2": [["2026-10-05", 0.132, 0.009, 0, false], ["2026-10-12", 0.137, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.143, "obs": 0, "own": 0.302, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.137, "se": 0.838, "ts": 1.000, "map": 0.482, "obs": 2, "own": 0.281, "comp": {"cins": -0.4095, "dshield": -0.8435, "crowdsec": 4.6236, "vulncheck": -0.6099, "blocklist_de": -2.0966}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.123, "det": null, "oid": "ATUN-ARIN", "org": "Arizona Tri University Network", "pdb": null, "pfx": 20, "reg": "1996-09-26", "rir": "arin", "s24": 675, "sib": 0, "tor": 2, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 345600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 2907, "h": "SINET-AS", "n": "National Institute of Informatics", "t": "Enterprise, edu & gov", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.06, "lo": 0.00, "ips": 1, "mean": 0.03, "above": false}}, "h2": [["2026-10-05", 0.001, 0.003, 0, false], ["2026-10-12", 0.001, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.624, "ts": null, "map": 0.032, "obs": 0, "own": 0.257, "comp": null, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.001, "se": 1.129, "ts": null, "map": 0.005, "obs": 0, "own": 0.029, "comp": null, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-2907-JPNIC", "org": "Research Organization of Information and Systems, National Institute of Informatics", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.sinet.ad.jp/"}, "pfx": 605, "reg": "2002-08-01", "rir": "apnic", "s24": 34256, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960512, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01202522626305}, {"a": 2914, "h": "NTT-DATA-2914", "n": "NTT Global IP Network", "t": "Transit & backbone", "w": 50, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 47, "web_exploit": 49, "bad_crawling": 13, "proxy_or_vpn": 47, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 1, "router_or_botnet": 47, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 50}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.18, "lo": 0.04, "ips": 50, "mean": 0.10, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.22, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}}, "h2": [["2026-10-05", 0.026, 0.004, 0, false], ["2026-10-12", 0.024, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.646, "ts": null, "map": 0.043, "obs": 0, "own": 0.277, "comp": null, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.024, "se": 0.585, "ts": 0.800, "map": 0.053, "obs": 5, "own": 0.170, "comp": {"cins": -1.0698, "dshield": -1.7563, "crowdsec": 3.6591, "vulncheck": -0.8376, "blocklist_de": -1.5344}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.472, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "NTTAM-1-ARIN", "org": "NTT America, Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Restrictive", "web": "https://www.gin.ntt.net/"}, "pfx": 1652, "reg": "1998-12-07", "rir": "arin", "s24": 19063, "sib": 29, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6712064, "abuse": "abuse@ntt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02021240571523}, {"a": 3064, "h": "AFFINITY-FTL", "n": "Affinity Internet, Inc.", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1469, "hi": 3.97, "lo": 0.52, "ips": 2, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.331, 0.010, 0, false], ["2026-10-12", 0.344, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 0.167, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.344, "se": 0.871, "ts": 1.000, "map": 1.292, "obs": 2, "own": 0.262, "comp": {"cins": -0.3617, "dshield": -0.7591, "crowdsec": 5.2044, "vulncheck": -0.5764, "blocklist_de": -1.8576}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "WCP32-ARIN", "org": "HDC/HW Enterprise, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.affinity.com"}, "pfx": 52, "reg": "1993-10-29", "rir": "arin", "s24": 220, "sib": 15, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 71168, "abuse": "abuse@hostmysite.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3132, "h": "", "n": "Red Cientifica Peruana", "t": "Transit & backbone", "w": 30, "cc": "PE", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 6, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 12, "ssh_bruteforce": 12, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-27771": 1}, "n": 20}, "ev": {"cins": {"n": 1, "p": 0.1745, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "shodan": {"n": 1, "p": 0.1004, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "crowdsec": {"n": 13, "p": 0.9999, "hi": 15.12, "lo": 6.19, "ips": 20, "mean": 10.24, "above": true}, "vulncheck": {"n": 7, "p": 0.9827, "hi": 12.26, "lo": 3.71, "ips": 9, "mean": 7.46, "above": true}, "blocklist_de": {"n": 6, "p": 0.9390, "hi": 10.32, "lo": 2.86, "ips": 6, "mean": 6.10, "above": true}}, "h2": [["2026-10-05", 18.470, 0.010, 1, false], ["2026-10-12", 15.938, 0.011, 1, false]], "sh": false, "uc": 78.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 1.765, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 13, "vulncheck": 7, "blocklist_de": 6}, "lo": 15.938, "se": 0.412, "ts": 0.481, "map": 26.333, "obs": 27, "own": 81.921, "comp": {"cins": 0.0943, "dshield": -2.7782, "crowdsec": 4.2195, "vulncheck": 1.1054, "blocklist_de": 2.0235}, "mass": 20.0, "listed": false}}, "abq": true, "bot": 0.661, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 9}, "blocklist_de": {"ftp": 1, "ssh": 5}}, "oid": "@aut-3132-LACNIC", "org": "Red Cientifica Peruana", "pdb": {"t": "NSP", "sc": "South America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.rcp.pe"}, "pfx": 115, "reg": "1993-11-19", "rir": "lacnic", "s24": 138, "sib": 0, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.8538], ["2026-10-12", 0.8493]], "ipv4": 127232, "abuse": null, "score": 0.8493, "groups": ["sensors", "vulncheck"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00175374279198}, {"a": 3175, "h": "CITYTELECOM-MSK", "n": "DataHouse AS3175", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-12", 0.250, 0.012, 0, false]], "sh": false, "uc": 1423, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.250, "se": 1.262, "ts": 1.000, "map": 1.972, "obs": 1, "own": 3.476, "comp": {"cins": -0.1479, "dshield": -0.3389, "crowdsec": -1.3408, "vulncheck": -0.3428, "blocklist_de": 4.2431}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.829, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-SO181-RIPE", "org": "Citytelecom LLC", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://datahouse.ru"}, "pfx": 42, "reg": "2012-04-26", "rir": "ripencc", "s24": 56, "sib": 13, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "abuse@citytelecom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3188, "h": "alastyr", "n": "Alastyr Telekomunikasyon", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7955, "hi": 8.81, "lo": 1.90, "ips": 4, "mean": 4.81, "above": true}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.975, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-ATIB1-RIPE", "org": "Alastyr Telekomunikasyon A.S.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.alastyr.com"}, "pfx": 18, "reg": "2012-05-01", "rir": "ripencc", "s24": 18, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 4608, "abuse": "abuse@alastyr.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0001651213724}, {"a": 3209, "h": "VODANET", "n": "Vodafone Germany", "t": "Broadband & mobile", "w": 64, "cc": "DE", "cf": {"rb": "", "wb": "", "rep": 0.39, "waf": 0.30}, "cs": {"c": {"http_flood": 7, "web_exploit": 10, "bad_crawling": 4, "proxy_or_vpn": 5, "first_seen_30d": 1, "ssh_bruteforce": 8, "web_bruteforce": 11, "home_connection": 19, "mail_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2025-4396": 3, "cve:CVE-2021-44228": 2, "cve:CVE-2024-28000": 1}, "n": 22}, "ev": {"shodan": {"n": 6, "p": 0.0000, "hi": 0.11, "lo": 0.03, "ips": 6, "mean": 0.07, "above": false}, "dshield": {"n": 8, "p": 0.0000, "hi": 0.52, "lo": 0.17, "ips": 8, "mean": 0.32, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.85, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "crowdsec": {"n": 22, "p": 0.0000, "hi": 0.24, "lo": 0.12, "ips": 22, "mean": 0.17, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.17, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.19, "lo": 0.01, "ips": 1, "mean": 0.08, "above": false}, "blocklist_de": {"n": 37, "p": 0.0000, "hi": 0.89, "lo": 0.52, "ips": 38, "mean": 0.70, "above": false}}, "h2": [["2026-10-05", 1.133, 0.023, 0, false], ["2026-10-12", 0.203, 0.026, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.026, "se": 1.215, "ts": 0.500, "map": 0.104, "obs": 2, "own": 0.375, "comp": {"urlhaus": 0.4779, "threatfox": -0.5377, "phishing_db": -0.5812}, "mass": 10.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 22, "vulncheck": 1, "blocklist_de": 37}, "lo": 0.203, "se": 0.384, "ts": 0.544, "map": 0.311, "obs": 68, "own": 0.481, "comp": {"cins": -3.6992, "dshield": -0.6761, "crowdsec": -5.779, "vulncheck": -0.9302, "blocklist_de": 11.3086}, "mass": 86.2, "listed": false}}, "abq": false, "bot": 0.121, "det": {"shodan": {"compromised": 2, "doublepulsar": 4}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 8, "bots": 1, "imap": 29, "mail": 29}}, "oid": "ORG-MAT1-RIPE", "org": "Vodafone GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "http://www.vodafone.de"}, "pfx": 300, "reg": "1994-04-06", "rir": "ripencc", "s24": 49825, "sib": 1, "tor": 0, "w24": 63, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15878656, "abuse": "abuse.de@vodafone.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.449267}, {"a": 3214, "h": "XTOM", "n": "xTom GmbH", "t": "Broadband & mobile", "w": 10, "cc": "DE", "cf": null, "cs": {"c": {}, "n": 2}, "ev": {"shodan": {"n": 6, "p": 0.9222, "hi": 9.72, "lo": 2.70, "ips": 6, "mean": 5.75, "above": true}, "urlhaus": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2668, "hi": 4.95, "lo": 0.64, "ips": 2, "mean": 2.36, "above": false}, "vulncheck": {"n": 1, "p": 0.1764, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "phishing_db": {"n": 2, "p": 0.3905, "hi": 6.00, "lo": 0.78, "ips": 5, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1552, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.611, 3.798, 0, false], ["2026-10-12", 1.888, 3.925, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 2}, "lo": 3.925, "se": 1.030, "ts": 0.667, "map": 14.233, "obs": 3, "own": 34.534, "comp": {"urlhaus": 2.7335, "threatfox": -0.4318, "phishing_db": 1.9801}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.888, "se": 0.681, "ts": 0.500, "map": 4.897, "obs": 4, "own": 7.705, "comp": {"cins": -0.5991, "dshield": -1.15, "crowdsec": 2.5219, "vulncheck": 0.8766, "blocklist_de": 1.333}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.782, "det": {"shodan": {"c2": 4, "compromised": 2}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-XG42-RIPE", "org": "xTom GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://xtom.com/"}, "pfx": 102, "reg": "2015-11-16", "rir": "ripencc", "s24": 102, "sib": 9, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 27136, "abuse": "abuse@xtom.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0014299778098}, {"a": 3215, "h": "AS3215", "n": "Orange France", "t": "Broadband & mobile", "w": 78, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 0.41, "waf": 0.34}, "cs": {"c": {"http_flood": 6, "web_exploit": 9, "bad_crawling": 3, "proxy_or_vpn": 4, "first_seen_30d": 2, "ssh_bruteforce": 12, "web_bruteforce": 10, "home_connection": 21, "mail_bruteforce": 7, "router_or_botnet": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 24}, "ev": {"cins": {"n": 5, "p": 0.0000, "hi": 0.31, "lo": 0.08, "ips": 5, "mean": 0.18, "above": false}, "shodan": {"n": 9, "p": 0.0000, "hi": 0.09, "lo": 0.03, "ips": 9, "mean": 0.06, "above": false}, "dshield": {"n": 7, "p": 0.0000, "hi": 0.30, "lo": 0.09, "ips": 7, "mean": 0.18, "above": false}, "urlhaus": {"n": 6, "p": 0.0000, "hi": 1.43, "lo": 0.40, "ips": 6, "mean": 0.85, "above": false}, "crowdsec": {"n": 24, "p": 0.0000, "hi": 0.16, "lo": 0.08, "ips": 24, "mean": 0.12, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 0.15, "lo": 0.02, "ips": 2, "mean": 0.07, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.20, "lo": 0.03, "ips": 3, "mean": 0.10, "above": false}, "blocklist_de": {"n": 37, "p": 0.0000, "hi": 0.57, "lo": 0.33, "ips": 37, "mean": 0.45, "above": false}}, "h2": [["2026-10-05", 0.102, 0.105, 0, false], ["2026-10-12", 0.148, 0.117, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 6, "threatfox": 0, "phishing_db": 3}, "lo": 0.117, "se": 0.979, "ts": 0.667, "map": 0.301, "obs": 9, "own": 0.949, "comp": {"urlhaus": 1.835, "threatfox": -0.5813, "phishing_db": -0.8287}, "mass": 42.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 7, "crowdsec": 24, "vulncheck": 2, "blocklist_de": 37}, "lo": 0.148, "se": 0.383, "ts": 0.493, "map": 0.226, "obs": 75, "own": 0.350, "comp": {"cins": 0.2505, "dshield": -1.3199, "crowdsec": -6.1683, "vulncheck": -0.8777, "blocklist_de": 8.0213}, "mass": 98.8, "listed": false}}, "abq": true, "bot": 0.118, "det": {"shodan": {"compromised": 7, "doublepulsar": 2}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 4, "bots": 11, "imap": 19, "mail": 20, "apache": 2, "bruteforcelogin": 1}}, "oid": "ORG-FT2-RIPE", "org": "Orange S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Tbps", "pol": "Restrictive", "web": "https://wholesale.orange.com/france/fr/"}, "pfx": 925, "reg": "1994-04-15", "rir": "ripencc", "s24": 78446, "sib": 60, "tor": 0, "w24": 78, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20127488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.576246}, {"a": 3216, "h": "SOVAM-AS", "n": "VimpelCom", "t": "Transit & backbone", "w": 32, "cc": "RU", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 6, "proxy_or_vpn": 1, "ssh_bruteforce": 12, "web_bruteforce": 9, "home_connection": 4, "mail_bruteforce": 13, "router_or_botnet": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2024-6387": 3, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2025-22457": 1}, "n": 18}, "ev": {"cins": {"n": 1, "p": 0.0061, "hi": 1.98, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.59, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}, "dshield": {"n": 4, "p": 0.0808, "hi": 3.29, "lo": 0.71, "ips": 4, "mean": 1.79, "above": false}, "urlhaus": {"n": 1, "p": 0.0977, "hi": 3.63, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "crowdsec": {"n": 18, "p": 0.0168, "hi": 2.72, "lo": 1.27, "ips": 18, "mean": 1.94, "above": false}, "vulncheck": {"n": 5, "p": 0.1727, "hi": 3.84, "lo": 0.95, "ips": 7, "mean": 2.19, "above": false}, "blocklist_de": {"n": 12, "p": 0.3944, "hi": 4.28, "lo": 1.69, "ips": 12, "mean": 2.86, "above": false}}, "h2": [["2026-10-05", 1.137, 0.007, 0, false], ["2026-10-12", 1.286, 0.087, 0, false]], "sh": false, "uc": 139.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.087, "se": 1.344, "ts": 1.000, "map": 0.550, "obs": 1, "own": 2.329, "comp": {"urlhaus": 2.3927, "threatfox": -0.4572, "phishing_db": -0.9073}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 18, "vulncheck": 5, "blocklist_de": 12}, "lo": 1.286, "se": 0.395, "ts": 0.450, "map": 2.055, "obs": 40, "own": 6.429, "comp": {"cins": -1.3488, "dshield": -0.2863, "crowdsec": 0.3508, "vulncheck": -0.1765, "blocklist_de": 3.575}, "mass": 37.7, "listed": false}}, "abq": false, "bot": 0.525, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 6}, "blocklist_de": {"ssh": 3, "imap": 4, "mail": 9}}, "oid": "ORG-ES15-RIPE", "org": "PJSC \"Vimpelcom\"", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Selective", "web": "http://beeline.ru"}, "pfx": 542, "reg": "1994-04-15", "rir": "ripencc", "s24": 3311, "sib": 32, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1131264, "abuse": "abuse-b2b@beeline.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0036575863863}, {"a": 3223, "h": "VOXILITY", "n": "VOXILITY", "t": "Transit & backbone", "w": 7, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.1869, "hi": 4.13, "lo": 0.73, "ips": 3, "mean": 2.13, "above": false}, "threatfox": {"n": 5, "p": 0.8958, "hi": 9.89, "lo": 2.46, "ips": 5, "mean": 5.64, "above": true}, "vulncheck": {"n": 2, "p": 0.2945, "hi": 5.18, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}}, "h2": [["2026-10-05", 0.367, 2.234, 0, false], ["2026-10-12", 0.132, 1.590, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 0}, "lo": 1.590, "se": 0.918, "ts": 1.000, "map": 4.382, "obs": 5, "own": 15.756, "comp": {"urlhaus": -0.9013, "threatfox": 4.9096, "phishing_db": -0.9046}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.132, "se": 0.872, "ts": 1.000, "map": 0.478, "obs": 2, "own": 1.620, "comp": {"cins": -0.2563, "dshield": -0.5612, "crowdsec": -2.2161, "vulncheck": 5.0133, "blocklist_de": -1.325}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.777, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Remcos": 2, "family:PureRAT": 1, "family:AsyncRAT": 2}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-VL241-RIPE", "org": "Voxility LLP", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.voxility.com"}, "pfx": 381, "reg": "2009-07-23", "rir": "ripencc", "s24": 411, "sib": 0, "tor": 0, "w24": 7, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 108800, "abuse": "abuse@voxility.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00059209543498}, {"a": 3226, "h": "MARK-ITT-AS", "n": "MARK-ITT", "t": "Broadband & mobile", "w": 6, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 4, "cve:CVE-2025-22457": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.5641, "hi": 5.95, "lo": 1.48, "ips": 5, "mean": 3.40, "above": false}, "blocklist_de": {"n": 4, "p": 0.6433, "hi": 6.99, "lo": 1.51, "ips": 4, "mean": 3.82, "above": false}}, "h2": [["2026-10-05", 2.598, 0.010, 0, false], ["2026-10-12", 2.883, 0.011, 0, false]], "sh": false, "uc": 614.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.933, "ts": null, "map": 0.167, "obs": 0, "own": 0.997, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.883, "se": 0.502, "ts": 0.556, "map": 5.516, "obs": 9, "own": 8.503, "comp": {"cins": -1.4746, "dshield": -2.1529, "crowdsec": 1.8847, "vulncheck": -0.8944, "blocklist_de": 5.7386}, "mass": 8.8, "listed": false}}, "abq": false, "bot": 0.493, "det": {"blocklist_de": {"imap": 3, "mail": 4}}, "oid": "ORG-CCM1-RIPE", "org": "OOO \"NI\"", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://mark.ru/"}, "pfx": 10, "reg": "1994-07-17", "rir": "ripencc", "s24": 288, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 73728, "abuse": "abuse@mark-itt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006865502952}, {"a": 3236, "h": "SERVER", "n": "SERVER.UA", "t": "Hosting & VPS", "w": 3, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2013-3827": 1, "cve:CVE-2024-2053": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-21307": 1, "cve:CVE-2024-48914": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.6214, "hi": 7.47, "lo": 1.32, "ips": 3, "mean": 3.85, "above": false}, "crowdsec": {"n": 2, "p": 0.3918, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 2.309, 0.011, 0, false], ["2026-10-12", 4.750, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 4.750, "se": 0.798, "ts": 0.667, "map": 15.385, "obs": 3, "own": 3.131, "comp": {"cins": -0.3533, "dshield": -0.7438, "crowdsec": 5.3097, "vulncheck": 1.7296, "blocklist_de": -1.8151}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.892, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-SL1055-RIPE", "org": "SERVER.UA LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://server.ua"}, "pfx": 14, "reg": "2015-11-16", "rir": "ripencc", "s24": 18, "sib": 3, "tor": 1, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@server.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3242, "h": "ASN-ITNET", "n": "ITNET Italia", "t": "Broadband & mobile", "w": 4, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 4, "web_exploit": 4, "proxy_or_vpn": 4, "first_seen_30d": 1, "web_bruteforce": 4, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.0766, "hi": 3.31, "lo": 0.43, "ips": 4, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.460, 0.010, 0, false], ["2026-10-12", 0.242, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.921, "ts": null, "map": 0.163, "obs": 0, "own": 0.947, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.242, "se": 0.858, "ts": 1.000, "map": 0.884, "obs": 2, "own": 1.408, "comp": {"cins": -0.3799, "dshield": -0.7916, "crowdsec": 4.9806, "vulncheck": -0.5897, "blocklist_de": -1.9487}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.969, "det": null, "oid": "ORG-SS695-RIPE", "org": "REEVO S.P.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.it.net"}, "pfx": 64, "reg": "1994-07-28", "rir": "ripencc", "s24": 339, "sib": 1, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 134144, "abuse": "abuse@reevo.cloud", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000088192504}, {"a": 3243, "h": "MEO-RESIDENCIAL", "n": "MEO Residential", "t": "Broadband & mobile", "w": 10, "cc": "PT", "cf": {"rb": "", "wb": "", "rep": 0.93, "waf": 1.49}, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "home_connection": 5, "mail_bruteforce": 3}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.0001, "hi": 1.18, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}, "dshield": {"n": 2, "p": 0.0001, "hi": 1.29, "lo": 0.17, "ips": 2, "mean": 0.62, "above": false}, "urlhaus": {"n": 1, "p": 0.0408, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.66, "lo": 0.20, "ips": 7, "mean": 0.40, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 1.05, "lo": 0.23, "ips": 4, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.274, 0.050, 0, false], ["2026-10-12", 0.217, 0.056, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.056, "se": 1.325, "ts": 1.000, "map": 0.329, "obs": 1, "own": 1.018, "comp": {"urlhaus": 1.9613, "threatfox": -0.4826, "phishing_db": -0.9648}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.217, "se": 0.458, "ts": 0.500, "map": 0.384, "obs": 14, "own": 0.596, "comp": {"cins": 0.7642, "dshield": 0.3133, "crowdsec": -0.1161, "vulncheck": -0.9424, "blocklist_de": 0.4183}, "mass": 15.4, "listed": false}}, "abq": false, "bot": 0.192, "det": {"blocklist_de": {"ssh": 3, "imap": 1, "mail": 1}}, "oid": "ORG-TCIS1-RIPE", "org": "MEO - SERVICOS DE COMUNICACOES E MULTIMEDIA S.A.", "pdb": null, "pfx": 16, "reg": "1994-07-29", "rir": "ripencc", "s24": 7172, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1876992, "abuse": "abuse.lir@meo.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.080703}, {"a": 3244, "h": "BANKNET", "n": "3c. Kft.", "t": "Other", "w": 4, "cc": "HU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.482, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.482, "se": 1.395, "ts": 1.000, "map": 4.736, "obs": 1, "own": 3.377, "comp": {"cins": -0.0646, "dshield": -0.1536, "crowdsec": -0.6088, "vulncheck": 4.1141, "blocklist_de": -0.3383}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.317, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-BK1-RIPE", "org": "3c. Kft.", "pdb": null, "pfx": 7, "reg": "1994-07-29", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@3ctelecom.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001013311873}, {"a": 3249, "h": "ESTPAK", "n": "Telia Eesti", "t": "Broadband & mobile", "w": 8, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 4}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.0000, "hi": 1.45, "lo": 0.36, "ips": 5, "mean": 0.83, "above": false}, "vulncheck": {"n": 3, "p": 0.0982, "hi": 3.47, "lo": 0.61, "ips": 3, "mean": 1.79, "above": false}, "blocklist_de": {"n": 5, "p": 0.0482, "hi": 2.98, "lo": 0.74, "ips": 5, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.367, 0.095, 0, false], ["2026-10-12", 0.498, 0.008, 0, false]], "sh": false, "uc": 87, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.772, "ts": null, "map": 0.101, "obs": 0, "own": 0.466, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 5}, "lo": 0.498, "se": 0.476, "ts": 0.385, "map": 0.905, "obs": 13, "own": 1.402, "comp": {"cins": -1.7785, "dshield": -2.3973, "crowdsec": -0.815, "vulncheck": 0.5278, "blocklist_de": 5.7565}, "mass": 11.9, "listed": false}}, "abq": false, "bot": 0.164, "det": {"vulncheck": {"c2_server": 1, "botnet_node": 2}, "blocklist_de": {"imap": 4, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-EEA1-RIPE", "org": "Telia Eesti AS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.telia.ee"}, "pfx": 31, "reg": "1994-08-18", "rir": "ripencc", "s24": 2357, "sib": 2, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 603392, "abuse": "abuse@telia.ee", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0240591732521}, {"a": 3255, "h": "UARNET-AS", "n": "UARNet", "t": "Transit & backbone", "w": 47, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 7, "router_or_botnet": 3, "cve:CVE-2025-4396": 1}, "n": 9}, "ev": {"shodan": {"n": 3, "p": 0.2696, "hi": 4.68, "lo": 0.83, "ips": 3, "mean": 2.42, "above": false}, "dshield": {"n": 7, "p": 0.9734, "hi": 11.28, "lo": 3.42, "ips": 8, "mean": 6.86, "above": true}, "crowdsec": {"n": 4, "p": 0.3657, "hi": 5.04, "lo": 1.08, "ips": 9, "mean": 2.75, "above": false}, "blocklist_de": {"n": 8, "p": 0.9790, "hi": 10.86, "lo": 3.53, "ips": 31, "mean": 6.77, "above": true}}, "h2": [["2026-10-05", 3.813, 0.010, 0, false], ["2026-10-12", 6.736, 0.011, 0, false]], "sh": false, "uc": 1351, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.928, "ts": null, "map": 0.165, "obs": 0, "own": 1.390, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 7, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 8}, "lo": 6.736, "se": 0.425, "ts": 0.421, "map": 11.237, "obs": 19, "own": 35.010, "comp": {"cins": -2.3097, "dshield": 5.8581, "crowdsec": -5.8363, "vulncheck": -0.9565, "blocklist_de": 7.0573}, "mass": 19.0, "listed": false}}, "abq": false, "bot": 0.283, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 2, "imap": 28, "mail": 28, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-LE141-RIPE", "org": "LLC EKSINTECH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.uar.net"}, "pfx": 275, "reg": "1994-09-21", "rir": "ripencc", "s24": 307, "sib": 2, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 168704, "abuse": "abuse@eksintech.net", "score": 0.0719, "groups": ["sensors"], "sensors": ["dshield", "blocklist_de"], "traffic": 0.00878828645352}, {"a": 3257, "h": "GTT-BACKBONE", "n": "GTT Communications", "t": "Transit & backbone", "w": 29, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 2.67, "waf": 2.58}, "cs": {"c": {"http_flood": 4, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 8, "web_bruteforce": 13, "home_connection": 7, "mail_bruteforce": 9, "cve:CVE-2017-9841": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1, "cve:CVE-2021-44228": 1, "cve:CVE-2022-26134": 1}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.61, "lo": 0.05, "ips": 1, "mean": 0.26, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 0.33, "lo": 0.11, "ips": 15, "mean": 0.21, "above": false}, "threatfox": {"n": 2, "p": 0.0021, "hi": 1.83, "lo": 0.24, "ips": 9, "mean": 0.87, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 0.80, "lo": 0.26, "ips": 10, "mean": 0.50, "above": false}}, "h2": [["2026-10-05", 0.093, 0.004, 0, false], ["2026-10-12", 0.146, 0.033, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 0.033, "se": 1.205, "ts": 1.000, "map": 0.128, "obs": 2, "own": 0.658, "comp": {"urlhaus": -0.9826, "threatfox": 1.4833, "phishing_db": -0.9329}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.146, "se": 0.440, "ts": 0.444, "map": 0.248, "obs": 18, "own": 0.780, "comp": {"cins": -0.1054, "dshield": -1.7222, "crowdsec": -2.3153, "vulncheck": -0.9637, "blocklist_de": 5.1045}, "mass": 22.0, "listed": false}}, "abq": false, "bot": 0.380, "det": {"threatfox": {"family:DanaBot": 9}, "blocklist_de": {"ssh": 1, "imap": 7, "mail": 9}}, "oid": "ORG-GCI2-RIPE", "org": "GTT Communications Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "100+Tbps", "pol": "Restrictive", "web": "http://www.gtt.net"}, "pfx": 1860, "reg": "1994-09-30", "rir": "ripencc", "s24": 15940, "sib": 15, "tor": 0, "w24": 14, "drop": 11, "hist": [["2026-10-05", 0.0274], ["2026-10-12", 0.0355]], "ipv4": 9295360, "abuse": "abuse@gtt.net", "score": 0.0355, "groups": ["cloudflare"], "sensors": [], "traffic": 0.055079}, {"a": 3258, "h": "XTOM-JAPAN", "n": "xTom Tokyo", "t": "Broadband & mobile", "w": 10, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 11, "p": 0.9993, "hi": 13.99, "lo": 5.32, "ips": 11, "mean": 9.22, "above": true}, "dshield": {"n": 1, "p": 0.1676, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 3, "p": 0.4096, "hi": 5.64, "lo": 0.99, "ips": 3, "mean": 2.91, "above": false}, "threatfox": {"n": 2, "p": 0.4088, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "vulncheck": {"n": 2, "p": 0.3754, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "phishing_db": {"n": 2, "p": 0.3785, "hi": 5.89, "lo": 0.76, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.951, 3.131, 0, false], ["2026-10-12", 2.150, 3.119, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 2}, "lo": 3.119, "se": 0.935, "ts": 0.500, "map": 9.199, "obs": 4, "own": 22.299, "comp": {"urlhaus": -0.7044, "threatfox": 2.3142, "phishing_db": 2.2355}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.150, "se": 0.588, "ts": 0.500, "map": 4.778, "obs": 6, "own": 7.461, "comp": {"cins": -0.7719, "dshield": 1.8035, "crowdsec": 4.009, "vulncheck": 1.7817, "blocklist_de": -3.8647}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.786, "det": {"shodan": {"c2": 3, "compromised": 8}, "threatfox": {"family:Remcos": 1, "family:AdaptixC2": 1}, "vulncheck": {"c2_server": 2}}, "oid": "ORG-XJCL1-RIPE", "org": "xTom Japan Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://xtom.com/"}, "pfx": 135, "reg": "2011-06-17", "rir": "ripencc", "s24": 141, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 36096, "abuse": "abuse@xtom.co.jp", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00483626538395}, {"a": 3267, "h": "niks", "n": "RUNNet", "t": "Enterprise, edu & gov", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0177, "hi": 2.38, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.897, "ts": null, "map": 0.155, "obs": 0, "own": 1.439, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.603, "ts": null, "map": 0.083, "obs": 0, "own": 0.686, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.518, "det": {"shodan": {"c2": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-CR1-RIPE", "org": "SCIENTIFIC RESEARCH INSTITUTE FOR SYSTEM ANALYSIS OF THE NATIONAL RESEARCH CENTRE \"KURCHATOV INSTITUTE\"", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://niks.su/"}, "pfx": 88, "reg": "1994-10-28", "rir": "ripencc", "s24": 464, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 124416, "abuse": "abuse@rasnet.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3269, "h": "ASN-IBSNAZ", "n": "Telecom Italia S.p.a.", "t": "Broadband & mobile", "w": 66, "cc": "IT", "cf": {"rb": "", "wb": "", "rep": 0.49, "waf": 0.47}, "cs": {"c": {"http_flood": 2, "data_centre": 16, "web_exploit": 9, "proxy_or_vpn": 4, "first_seen_30d": 4, "ssh_bruteforce": 16, "web_bruteforce": 11, "home_connection": 6, "mail_bruteforce": 9, "router_or_botnet": 3, "cve:CVE-2017-9841": 4, "cve:CVE-2019-9082": 3, "cve:CVE-2021-0027": 1, "cve:CVE-2018-20062": 3, "cve:CVE-2021-41773": 1}, "n": 25}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.19, "lo": 0.02, "ips": 2, "mean": 0.09, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.06, "lo": 0.02, "ips": 5, "mean": 0.04, "above": false}, "dshield": {"n": 12, "p": 0.0000, "hi": 0.45, "lo": 0.18, "ips": 12, "mean": 0.30, "above": false}, "urlhaus": {"n": 5, "p": 0.0000, "hi": 1.29, "lo": 0.32, "ips": 5, "mean": 0.73, "above": false}, "crowdsec": {"n": 25, "p": 0.0000, "hi": 0.17, "lo": 0.09, "ips": 25, "mean": 0.13, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.16, "lo": 0.02, "ips": 2, "mean": 0.08, "above": false}, "blocklist_de": {"n": 27, "p": 0.0000, "hi": 0.44, "lo": 0.24, "ips": 27, "mean": 0.33, "above": false}}, "h2": [["2026-10-05", 0.094, 0.086, 0, false], ["2026-10-12", 0.121, 0.095, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 0, "phishing_db": 2}, "lo": 0.095, "se": 1.004, "ts": 0.714, "map": 0.256, "obs": 7, "own": 0.822, "comp": {"urlhaus": 1.7427, "threatfox": -0.5788, "phishing_db": -0.9001}, "mass": 36.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 12, "crowdsec": 25, "vulncheck": 0, "blocklist_de": 27}, "lo": 0.121, "se": 0.387, "ts": 0.409, "map": 0.185, "obs": 66, "own": 0.286, "comp": {"cins": -1.7202, "dshield": 0.9884, "crowdsec": -4.1167, "vulncheck": -1.0014, "blocklist_de": 5.5543}, "mass": 79.8, "listed": false}}, "abq": false, "bot": 0.135, "det": {"shodan": {"compromised": 2, "doublepulsar": 3}, "threatfox": {"family:Mirai": 1}, "blocklist_de": {"ftp": 1, "ssh": 11, "bots": 8, "imap": 3, "mail": 7}}, "oid": "ORG-IA34-RIPE", "org": "Telecom Italia S.p.A.", "pdb": null, "pfx": 315, "reg": "1994-11-14", "rir": "ripencc", "s24": 77454, "sib": 1, "tor": 0, "w24": 65, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21476096, "abuse": "abuse@business.telecomitalia.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.185752}, {"a": 3292, "h": "TDC", "n": "TDC A/S", "t": "Broadband & mobile", "w": 5, "cc": "DK", "cf": {"rb": "hi", "wb": "hi", "rep": 1.23, "waf": 1.07}, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.0000, "hi": 0.24, "lo": 0.06, "ips": 5, "mean": 0.14, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.53, "lo": 0.07, "ips": 2, "mean": 0.25, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}}, "h2": [["2026-10-05", 0.012, 0.004, 0, false], ["2026-10-12", 0.023, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.644, "ts": null, "map": 0.042, "obs": 0, "own": 0.190, "comp": null, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.023, "se": 0.584, "ts": 0.400, "map": 0.051, "obs": 5, "own": 0.079, "comp": {"cins": -1.0769, "dshield": 3.5564, "crowdsec": -1.6549, "vulncheck": -0.8389, "blocklist_de": -1.5765}, "mass": 5.8, "listed": false}}, "abq": true, "bot": 0.101, "det": {"shodan": {"doublepulsar": 5}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TD1-RIPE", "org": "TDC Holding A/S", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.tdcgroup.com"}, "pfx": 170, "reg": "1995-01-17", "rir": "ripencc", "s24": 20254, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5188096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.05967}, {"a": 3300, "h": "BT", "n": "British Telecom GIIB", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.784, "ts": null, "map": 0.106, "obs": 0, "own": 0.497, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.425, "ts": null, "map": 0.035, "obs": 0, "own": 0.069, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.321, "det": null, "oid": "ORG-CNS3-RIPE", "org": "British Telecommunications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Selective", "web": "http://www.bt.net"}, "pfx": 123, "reg": "1994-10-28", "rir": "ripencc", "s24": 2003, "sib": 3, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 604416, "abuse": "abuse@eu.bt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3301, "h": "TELIANET-SWEDEN", "n": "Telia Sweden", "t": "Broadband & mobile", "w": 65, "cc": "SE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.79, "waf": 0.69}, "cs": {"c": {"http_flood": 5, "web_exploit": 41, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 47, "web_bruteforce": 46, "home_connection": 48, "mail_bruteforce": 39, "router_or_botnet": 5, "cve:CVE-2017-9841": 2, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 4, "cve:CVE-2025-22457": 6, "cve:CVE-2026-63030": 2}, "n": 53}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.54, "lo": 0.07, "ips": 2, "mean": 0.25, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.14, "lo": 0.02, "ips": 3, "mean": 0.07, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.43, "lo": 0.06, "ips": 2, "mean": 0.20, "above": false}, "urlhaus": {"n": 7, "p": 0.2137, "hi": 3.92, "lo": 1.19, "ips": 7, "mean": 2.38, "above": false}, "crowdsec": {"n": 51, "p": 0.0000, "hi": 0.94, "lo": 0.59, "ips": 53, "mean": 0.76, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.97, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.33, "lo": 0.02, "ips": 1, "mean": 0.14, "above": false}, "blocklist_de": {"n": 23, "p": 0.0000, "hi": 1.15, "lo": 0.58, "ips": 25, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.362, 0.257, 0, false], ["2026-10-12", 0.376, 0.336, 0, false]], "sh": false, "uc": 53.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 7, "threatfox": 1, "phishing_db": 0}, "lo": 0.336, "se": 0.919, "ts": 0.875, "map": 0.836, "obs": 8, "own": 2.352, "comp": {"urlhaus": 3.1037, "threatfox": -0.4645, "phishing_db": -1.1925}, "mass": 34.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 51, "vulncheck": 1, "blocklist_de": 23}, "lo": 0.376, "se": 0.379, "ts": 0.646, "map": 0.581, "obs": 79, "own": 0.897, "comp": {"cins": -1.797, "dshield": -2.6497, "crowdsec": 4.3941, "vulncheck": -0.9263, "blocklist_de": 1.8292}, "mass": 82.3, "listed": false}}, "abq": false, "bot": 0.113, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:DanaBot": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1, "imap": 17, "mail": 24}}, "oid": "ORG-TA45-RIPE", "org": "Telia Company AB", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Restrictive", "web": "http://www.telia.se"}, "pfx": 303, "reg": "1994-10-28", "rir": "ripencc", "s24": 25490, "sib": 4, "tor": 1, "w24": 62, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6530304, "abuse": "abuse@telia.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.092402}, {"a": 3303, "h": "SWISSCOM", "n": "Swisscom", "t": "Broadband & mobile", "w": 23, "cc": "CH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.75, "waf": 0.66}, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 2, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2025-22457": 1, "cve:CVE-2026-63030": 2}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.16, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.75, "lo": 0.10, "ips": 2, "mean": 0.36, "above": false}, "urlhaus": {"n": 2, "p": 0.0348, "hi": 2.78, "lo": 0.36, "ips": 2, "mean": 1.33, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.21, "lo": 0.04, "ips": 3, "mean": 0.11, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 0.95, "lo": 0.17, "ips": 3, "mean": 0.49, "above": false}, "blocklist_de": {"n": 13, "p": 0.0000, "hi": 1.32, "lo": 0.54, "ips": 13, "mean": 0.90, "above": false}}, "h2": [["2026-10-05", 0.055, 0.095, 0, false], ["2026-10-12", 0.200, 0.106, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.106, "se": 1.133, "ts": 1.000, "map": 0.413, "obs": 2, "own": 1.224, "comp": {"urlhaus": 2.3852, "threatfox": -0.542, "phishing_db": -1.1023}, "mass": 9.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 13}, "lo": 0.200, "se": 0.433, "ts": 0.619, "map": 0.333, "obs": 21, "own": 0.515, "comp": {"cins": -2.6132, "dshield": -0.9301, "crowdsec": -8.3611, "vulncheck": -0.254, "blocklist_de": 12.452}, "mass": 25.3, "listed": false}}, "abq": false, "bot": 0.119, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 2}, "blocklist_de": {"imap": 12, "mail": 12, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SI1-RIPE", "org": "Swisscom (Schweiz) AG", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.swisscom.com"}, "pfx": 341, "reg": "1994-10-28", "rir": "ripencc", "s24": 13644, "sib": 6, "tor": 0, "w24": 23, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8161280, "abuse": "abuse@ip-plus.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.097401}, {"a": 3319, "h": "URAN", "n": "User Association of Ukrainian Research and Academic Network URAN", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.651, "det": null, "oid": "ORG-COEI1-RIPE", "org": "User Association of Ukrainian Research and Academic Network URAN", "pdb": null, "pfx": 40, "reg": "1995-02-22", "rir": "ripencc", "s24": 44, "sib": 4, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": "abuse@uran.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025357257234}, {"a": 3320, "h": "DTAG", "n": "Deutsche Telekom", "t": "Broadband & mobile", "w": 99, "cc": "DE", "cf": {"rb": "", "wb": "", "rep": 0.29, "waf": 0.32}, "cs": {"c": {"http_flood": 29, "web_exploit": 29, "bad_crawling": 10, "proxy_or_vpn": 27, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 6, "home_connection": 30, "mail_bruteforce": 3, "router_or_botnet": 25, "cve:CVE-2025-4396": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 35}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.08, "lo": 0.01, "ips": 1, "mean": 0.03, "above": false}, "shodan": {"n": 16, "p": 0.0000, "hi": 0.08, "lo": 0.04, "ips": 16, "mean": 0.06, "above": false}, "dshield": {"n": 17, "p": 0.0000, "hi": 0.35, "lo": 0.16, "ips": 17, "mean": 0.25, "above": false}, "urlhaus": {"n": 3, "p": 0.0000, "hi": 0.58, "lo": 0.10, "ips": 3, "mean": 0.30, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 0.05, "lo": 0.02, "ips": 35, "mean": 0.03, "above": false}, "threatfox": {"n": 3, "p": 0.0000, "hi": 0.36, "lo": 0.06, "ips": 3, "mean": 0.19, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 1, "mean": 0.03, "above": false}, "blocklist_de": {"n": 41, "p": 0.0000, "hi": 0.37, "lo": 0.22, "ips": 41, "mean": 0.29, "above": false}}, "h2": [["2026-10-05", 0.512, 0.038, 0, false], ["2026-10-12", 0.083, 0.041, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 3, "phishing_db": 1}, "lo": 0.041, "se": 1.074, "ts": 0.429, "map": 0.119, "obs": 7, "own": 0.428, "comp": {"urlhaus": 0.6168, "threatfox": -0.1156, "phishing_db": -1.0015}, "mass": 32.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 17, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 41}, "lo": 0.083, "se": 0.386, "ts": 0.586, "map": 0.129, "obs": 70, "own": 0.201, "comp": {"cins": -2.9407, "dshield": 1.767, "crowdsec": -9.7899, "vulncheck": -1.004, "blocklist_de": 11.3151}, "mass": 96.3, "listed": false}}, "abq": false, "bot": 0.125, "det": {"shodan": {"c2": 1, "compromised": 7, "doublepulsar": 8}, "threatfox": {"family:Mirai": 1, "family:AsyncRAT": 2}, "blocklist_de": {"ftp": 1, "ssh": 3, "bots": 2, "imap": 32, "mail": 34, "apache": 1}}, "oid": "ORG-DTA2-RIPE", "org": "Deutsche Telekom AG", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Tbps", "pol": "Restrictive", "web": "https://wholesale.telekom.com"}, "pfx": 901, "reg": "1995-02-23", "rir": "ripencc", "s24": 133429, "sib": 11, "tor": 0, "w24": 75, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36174848, "abuse": "abuse@telekom.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.698327}, {"a": 3329, "h": "HOL-GR", "n": "VODAFONE-PANAFON HELLENIC TELECOMMUNICATIONS COMPANY SA", "t": "Broadband & mobile", "w": 2, "cc": "GR", "cf": {"rb": "hi", "wb": "hi", "rep": 1.44, "waf": 1.26}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2019-12989": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.37, "lo": 0.03, "ips": 1, "mean": 0.16, "above": false}, "phishing_db": {"n": 1, "p": 0.0008, "hi": 1.50, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.166, 0.038, 0, false], ["2026-10-12", 0.012, 0.041, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.041, "se": 1.329, "ts": 1.000, "map": 0.223, "obs": 1, "own": 0.761, "comp": {"urlhaus": -0.5659, "threatfox": -0.3826, "phishing_db": 1.0744}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.012, "se": 0.973, "ts": 1.000, "map": 0.055, "obs": 1, "own": 0.089, "comp": {"cins": -0.3115, "dshield": -0.6669, "crowdsec": 1.6045, "vulncheck": -0.5357, "blocklist_de": -1.6047}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.097, "det": null, "oid": "ORG-PS3-RIPE", "org": "Vodafone-panafon Hellenic Telecommunications Company SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://statheri.vodafone.gr"}, "pfx": 386, "reg": "1995-03-08", "rir": "ripencc", "s24": 4428, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2471168, "abuse": "abusevfgr@vodafone.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.050872}, {"a": 3342, "h": "Cibicom-IP-Network", "n": "Cibicom", "t": "Transit & backbone", "w": 4, "cc": "DK", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1784, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1790, "hi": 4.53, "lo": 0.34, "ips": 3, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 0.560, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 1.977, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.560, "se": 0.914, "ts": 0.500, "map": 2.227, "obs": 2, "own": 7.437, "comp": {"cins": -0.2614, "dshield": 3.8294, "crowdsec": -2.2552, "vulncheck": 2.2326, "blocklist_de": -1.3509}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.637, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-TA906-RIPE", "org": "Cibicom A/S", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.cibicom.dk"}, "pfx": 17, "reg": "2015-11-02", "rir": "ripencc", "s24": 90, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": "abuseripe@cibicom.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007813512484}, {"a": 3352, "h": "Telefonica_de_EspaNa", "n": "Telefonica de España", "t": "Broadband & mobile", "w": 57, "cc": "ES", "cf": {"rb": "", "wb": "", "rep": 0.33, "waf": 0.41}, "cs": {"c": {"http_flood": 3, "web_exploit": 7, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 6, "web_bruteforce": 11, "home_connection": 12, "mail_bruteforce": 8, "cve:CVE-2024-6387": 1, "cve:CVE-2022-39290": 1, "cve:CVE-2024-28000": 3}, "n": 17}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.35, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.12, "lo": 0.03, "ips": 5, "mean": 0.07, "above": false}, "dshield": {"n": 16, "p": 0.0000, "hi": 1.06, "lo": 0.47, "ips": 16, "mean": 0.74, "above": false}, "urlhaus": {"n": 10, "p": 0.1595, "hi": 3.57, "lo": 1.30, "ips": 10, "mean": 2.32, "above": false}, "crowdsec": {"n": 17, "p": 0.0000, "hi": 0.23, "lo": 0.11, "ips": 17, "mean": 0.17, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.66, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.30, "lo": 0.04, "ips": 2, "mean": 0.14, "above": false}, "blocklist_de": {"n": 10, "p": 0.0000, "hi": 0.38, "lo": 0.14, "ips": 10, "mean": 0.25, "above": false}}, "h2": [["2026-10-05", 0.068, 0.307, 0, false], ["2026-10-12", 0.132, 0.339, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 10, "threatfox": 1, "phishing_db": 2}, "lo": 0.339, "se": 0.898, "ts": 0.769, "map": 0.799, "obs": 13, "own": 2.269, "comp": {"urlhaus": 2.9348, "threatfox": -0.5084, "phishing_db": -1.025}, "mass": 52.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 16, "crowdsec": 17, "vulncheck": 1, "blocklist_de": 10}, "lo": 0.132, "se": 0.397, "ts": 0.370, "map": 0.210, "obs": 46, "own": 0.326, "comp": {"cins": -0.3707, "dshield": 6.052, "crowdsec": -2.7671, "vulncheck": -0.8616, "blocklist_de": -2.2178}, "mass": 47.6, "listed": false}}, "abq": true, "bot": 0.117, "det": {"shodan": {"c2": 1, "compromised": 2, "doublepulsar": 2}, "threatfox": {"family:DanaBot": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2, "bots": 7, "imap": 1, "mail": 1}}, "oid": "ORG-TDE1-RIPE", "org": "TELEFONICA DE ESPANA S.A.U.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.telefonica.es/"}, "pfx": 209, "reg": "1995-05-31", "rir": "ripencc", "s24": 40557, "sib": 1, "tor": 0, "w24": 57, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10464768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.306531}, {"a": 3356, "h": "LEVEL3", "n": "Lumen AS3356", "t": "Transit & backbone", "w": 51, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.94, "waf": 0.82}, "cs": {"c": {"http_flood": 22, "web_exploit": 26, "bad_crawling": 21, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 13, "web_bruteforce": 22, "mail_bruteforce": 8, "router_or_botnet": 2, "cve:CVE-2017-9841": 20, "cve:CVE-2024-4577": 4, "cve:CVE-2019-18935": 11, "cve:CVE-2021-26086": 6, "cve:CVE-2022-39290": 3}, "n": 35}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.14, "lo": 0.02, "ips": 2, "mean": 0.06, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.05, "lo": 0.01, "ips": 5, "mean": 0.03, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.13, "lo": 0.02, "ips": 3, "mean": 0.07, "above": false}, "crowdsec": {"n": 15, "p": 0.0000, "hi": 0.08, "lo": 0.04, "ips": 35, "mean": 0.06, "above": false}, "vulncheck": {"n": 6, "p": 0.0000, "hi": 0.21, "lo": 0.06, "ips": 9, "mean": 0.12, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.12, "lo": 0.02, "ips": 2, "mean": 0.06, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 3, "mean": 0.03, "above": false}}, "h2": [["2026-10-05", 0.027, 0.008, 0, false], ["2026-10-12", 0.027, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.009, "se": 1.281, "ts": 1.000, "map": 0.036, "obs": 2, "own": 0.229, "comp": {"urlhaus": -1.4574, "threatfox": -0.5204, "phishing_db": 0.274}, "mass": 9.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 15, "vulncheck": 6, "blocklist_de": 3}, "lo": 0.027, "se": 0.427, "ts": 0.517, "map": 0.044, "obs": 29, "own": 0.139, "comp": {"cins": 1.6093, "dshield": -0.0431, "crowdsec": 2.7326, "vulncheck": 0.4135, "blocklist_de": -6.444}, "mass": 26.4, "listed": false}}, "abq": false, "bot": 0.283, "det": {"shodan": {"malware": 1, "compromised": 4}, "vulncheck": {"botnet_node": 9}, "blocklist_de": {"ssh": 1, "imap": 2, "mail": 2}}, "oid": "LPL-141-ARIN", "org": "Level 3 Parent, LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "100+Tbps", "pol": "Restrictive", "web": "http://www.lumen.com"}, "pfx": 1015, "reg": "2000-03-10", "rir": "arin", "s24": 107070, "sib": 39, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34447104, "abuse": "abuse@level3.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.078297}, {"a": 3359, "h": "U-ALBERTA", "n": "University of Alberta", "t": "Other", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0132, "hi": 2.25, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.888, "ts": null, "map": 0.151, "obs": 0, "own": 0.331, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.589, "ts": null, "map": 0.078, "obs": 0, "own": 0.064, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.121, "det": {"shodan": {"compromised": 1}}, "oid": "UNIVER-50-Z-ARIN", "org": "University of Alberta", "pdb": null, "pfx": 6, "reg": "1993-12-22", "rir": "arin", "s24": 518, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 132608, "abuse": "abuse@ualberta.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046882896004}, {"a": 3399, "h": "OBE-NET", "n": "Obenet", "t": "Transit & backbone", "w": 1, "cc": "SE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0884, "hi": 3.52, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "blocklist_de": {"n": 1, "p": 0.1445, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 1.061, 0.010, 0, false], ["2026-10-12", 0.561, 0.011, 0, false]], "sh": false, "uc": 414.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 1.790, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.561, "se": 0.893, "ts": 0.500, "map": 2.193, "obs": 2, "own": 7.120, "comp": {"cins": -0.3654, "dshield": -0.7658, "crowdsec": 1.0699, "vulncheck": -0.5792, "blocklist_de": 2.8196}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.192, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OA1021-RIPE", "org": "Obenet AB", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://obe.net"}, "pfx": 27, "reg": "1994-02-02", "rir": "ripencc", "s24": 131, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33536, "abuse": "abuse@obe.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00084391145704}, {"a": 3462, "h": "HINET", "n": "HiNet", "t": "Broadband & mobile", "w": 203, "cc": "TW", "cf": {"rb": "", "wb": "", "rep": 0.28, "waf": 0.92}, "cs": {"c": {"http_flood": 4, "data_centre": 1, "web_exploit": 22, "bad_crawling": 3, "proxy_or_vpn": 19, "first_seen_30d": 4, "ssh_bruteforce": 44, "web_bruteforce": 30, "home_connection": 61, "mail_bruteforce": 26, "router_or_botnet": 2, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2022-39290": 2, "cve:CVE-2024-12847": 1, "cve:CVE-2025-22457": 2}, "n": 69}, "ev": {"cins": {"n": 16, "p": 0.0000, "hi": 1.15, "lo": 0.51, "ips": 16, "mean": 0.80, "above": false}, "shodan": {"n": 84, "p": 0.0000, "hi": 0.98, "lo": 0.68, "ips": 84, "mean": 0.83, "above": false}, "dshield": {"n": 69, "p": 0.1125, "hi": 3.15, "lo": 2.12, "ips": 69, "mean": 2.62, "above": false}, "crowdsec": {"n": 68, "p": 0.0000, "hi": 0.65, "lo": 0.44, "ips": 69, "mean": 0.54, "above": false}, "vulncheck": {"n": 33, "p": 0.0000, "hi": 1.69, "lo": 0.96, "ips": 33, "mean": 1.31, "above": false}, "phishing_db": {"n": 4, "p": 0.0000, "hi": 0.38, "lo": 0.08, "ips": 5, "mean": 0.21, "above": false}, "blocklist_de": {"n": 29, "p": 0.0000, "hi": 0.76, "lo": 0.41, "ips": 29, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.629, 0.033, 0, false], ["2026-10-12", 0.470, 0.029, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 0.029, "se": 1.132, "ts": 1.000, "map": 0.091, "obs": 4, "own": 0.344, "comp": {"urlhaus": -1.5567, "threatfox": -0.5281, "phishing_db": 1.3125}, "mass": 9.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 16, "dshield": 69, "crowdsec": 68, "vulncheck": 33, "blocklist_de": 29}, "lo": 0.470, "se": 0.367, "ts": 0.321, "map": 0.714, "obs": 215, "own": 1.102, "comp": {"cins": 3.1621, "dshield": 7.4023, "crowdsec": -2.9929, "vulncheck": 0.0828, "blocklist_de": -6.5979}, "mass": 189.3, "listed": false}}, "abq": true, "bot": 0.225, "det": {"shodan": {"c2": 6, "malware": 1, "compromised": 75, "doublepulsar": 2}, "threatfox": {"family:Mirai": 10}, "vulncheck": {"c2_server": 4, "attack_tooling": 29}, "blocklist_de": {"ftp": 3, "ssh": 20, "bots": 1, "imap": 4, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "5-10Tbps", "pol": "Restrictive", "web": "https://www.cht.com.tw/"}, "pfx": 218, "reg": "2002-08-01", "rir": "apnic", "s24": 47749, "sib": 0, "tor": 3, "w24": 201, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16359936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.269272}, {"a": 3464, "h": "ASC-NET", "n": "Alabama Research and Education Network", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0118, "hi": 2.30, "lo": 0.30, "ips": 2, "mean": 1.10, "above": false}}, "h2": [["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.853, "ts": null, "map": 0.138, "obs": 0, "own": 1.182, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.533, "ts": null, "map": 0.061, "obs": 0, "own": 0.472, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.185, "det": {"shodan": {"malware": 2}}, "oid": "ASC-Z-ARIN", "org": "Alabama Supercomputer Authority", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.asc.edu"}, "pfx": 99, "reg": "1994-03-04", "rir": "arin", "s24": 811, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 240896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3491, "h": "PCCWG-APAC-HK", "n": "PCCW Global", "t": "Transit & backbone", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "bad_crawling": 2, "ssh_bruteforce": 2}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 0.53, "lo": 0.09, "ips": 4, "mean": 0.27, "above": false}}, "h2": [["2026-10-05", 0.082, 0.006, 0, false], ["2026-10-12", 0.041, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.718, "ts": null, "map": 0.075, "obs": 0, "own": 0.481, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.041, "se": 0.690, "ts": 1.000, "map": 0.110, "obs": 3, "own": 0.352, "comp": {"cins": -0.6678, "dshield": -1.251, "crowdsec": 5.2034, "vulncheck": -0.7351, "blocklist_de": -3.3648}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.776, "det": null, "oid": "ORG-PGL1-AP-APNIC", "org": "PCCW Global (HK) Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Tbps", "pol": "Restrictive", "web": "http://www.pccwglobal.com/"}, "pfx": 514, "reg": "1994-03-21", "rir": "apnic", "s24": 5161, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1716992, "abuse": "support@consoleconnect.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00971683391997}, {"a": 3507, "h": "IPSWAT TEAM", "n": "IPSWAT TEAM", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.247, "det": null, "oid": "IPSWA-ARIN", "org": "IPSwat LLC", "pdb": {"t": "Non-Profit", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://IPSwat.com"}, "pfx": 4, "reg": "2025-01-22", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "noc@IPSwat.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3549, "h": "LVLT-3549", "n": "Lumen AS 3549", "t": "Broadband & mobile", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 5, "web_bruteforce": 5, "home_connection": 5, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.12, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.27, "lo": 0.08, "ips": 7, "mean": 0.17, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.46, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}}, "h2": [["2026-10-05", 0.040, 0.004, 0, false], ["2026-10-12", 0.038, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.650, "ts": null, "map": 0.044, "obs": 0, "own": 0.201, "comp": null, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.038, "se": 0.523, "ts": 0.875, "map": 0.074, "obs": 8, "own": 0.115, "comp": {"cins": -1.2858, "dshield": -1.9794, "crowdsec": 8.418, "vulncheck": -0.1243, "blocklist_de": -6.2415}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.216, "det": {"shodan": {"malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"mail": 1}}, "oid": "LPL-141-ARIN", "org": "Level 3 Parent, LLC", "pdb": {"t": "NSP", "sc": "South America", "tr": "10-20Tbps", "pol": "Restrictive", "web": "http://www.lumen.com/"}, "pfx": 613, "reg": "2000-03-21", "rir": "arin", "s24": 17661, "sib": 39, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5415168, "abuse": "abuse@level3.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00971256693417}, {"a": 3580, "h": "PLANET", "n": "Planet Networks", "t": "Transit & backbone", "w": 5, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 5, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.173, 0.011, 0, false], ["2026-10-12", 0.167, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 2.110, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.167, "se": 1.222, "ts": 1.000, "map": 1.184, "obs": 1, "own": 4.336, "comp": {"cins": -0.1104, "dshield": -0.2571, "crowdsec": -1.0179, "vulncheck": 3.5241, "blocklist_de": -0.5759}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.144, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "PN-108-ARIN", "org": "Planet Networks", "pdb": {"t": "NSP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.planet.net"}, "pfx": 8, "reg": "1994-05-06", "rir": "arin", "s24": 69, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3695, "h": "SPM-TELECOM-1", "n": "SPM TELECOM", "t": "Broadband & mobile", "w": 1, "cc": "PM", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 2.428, 0.011, 0, false], ["2026-10-12", 0.437, 0.012, 0, false]], "sh": false, "uc": 1106.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.437, "se": 1.360, "ts": 1.000, "map": 4.149, "obs": 1, "own": 7.638, "comp": {"cins": -0.1011, "dshield": -0.2364, "crowdsec": 3.9422, "vulncheck": -0.2603, "blocklist_de": -0.5278}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.130, "det": null, "oid": "SPMTE-ARIN", "org": "SPM TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.spmtelecom.com"}, "pfx": 18, "reg": "2009-09-04", "rir": "arin", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@cheznoo.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012315051609}, {"a": 3737, "h": "AS-PTD", "n": "PenTeleData", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 0.95, "lo": 0.17, "ips": 3, "mean": 0.49, "above": false}, "vulncheck": {"n": 2, "p": 0.0251, "hi": 2.62, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.216, 0.007, 0, false], ["2026-10-12", 0.107, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.763, "ts": null, "map": 0.096, "obs": 0, "own": 0.442, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.107, "se": 0.614, "ts": 0.600, "map": 0.247, "obs": 5, "own": 0.390, "comp": {"cins": -0.761, "dshield": -1.3804, "crowdsec": 4.1304, "vulncheck": 1.8183, "blocklist_de": -3.8125}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.153, "det": {"vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"mail": 1}}, "oid": "PENN-Z-ARIN", "org": "PenTeleData Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.penteledata.net"}, "pfx": 27, "reg": "1994-08-01", "rir": "arin", "s24": 2682, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 700928, "abuse": "abuse@ptd.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02997136949364}, {"a": 3786, "h": "LGDACOM", "n": "LG Uplus", "t": "Broadband & mobile", "w": 77, "cc": "KR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.73, "waf": 0.64}, "cs": {"c": {"http_flood": 3, "web_exploit": 9, "bad_crawling": 2, "first_seen_30d": 3, "ssh_bruteforce": 48, "web_bruteforce": 13, "mail_bruteforce": 30, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2025-22457": 2}, "n": 53}, "ev": {"cins": {"n": 5, "p": 0.0000, "hi": 0.74, "lo": 0.18, "ips": 5, "mean": 0.42, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.13, "lo": 0.03, "ips": 4, "mean": 0.07, "above": false}, "dshield": {"n": 7, "p": 0.0000, "hi": 0.73, "lo": 0.22, "ips": 7, "mean": 0.44, "above": false}, "urlhaus": {"n": 2, "p": 0.0007, "hi": 1.61, "lo": 0.21, "ips": 2, "mean": 0.77, "above": false}, "crowdsec": {"n": 44, "p": 0.0000, "hi": 0.67, "lo": 0.41, "ips": 53, "mean": 0.53, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 0.44, "lo": 0.08, "ips": 5, "mean": 0.23, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.47, "lo": 0.08, "ips": 3, "mean": 0.24, "above": false}, "blocklist_de": {"n": 28, "p": 0.0000, "hi": 1.11, "lo": 0.60, "ips": 36, "mean": 0.83, "above": false}}, "h2": [["2026-10-05", 0.431, 0.084, 0, false], ["2026-10-12", 0.356, 0.092, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 3}, "lo": 0.092, "se": 1.048, "ts": 0.600, "map": 0.277, "obs": 5, "own": 0.877, "comp": {"urlhaus": 1.0923, "threatfox": -0.5596, "phishing_db": -0.1918}, "mass": 15.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 7, "crowdsec": 44, "vulncheck": 3, "blocklist_de": 28}, "lo": 0.356, "se": 0.378, "ts": 0.506, "map": 0.549, "obs": 87, "own": 0.848, "comp": {"cins": 0.3519, "dshield": -1.2654, "crowdsec": -0.1182, "vulncheck": -0.8093, "blocklist_de": 2.6349}, "mass": 96.1, "listed": false}}, "abq": false, "bot": 0.262, "det": {"shodan": {"compromised": 4}, "vulncheck": {"botnet_node": 4, "attack_tooling": 1}, "blocklist_de": {"ftp": 2, "ssh": 12, "imap": 7, "mail": 22}}, "oid": "@aut-9688-APNIC", "org": "LG DACOM Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.lguplus.com/"}, "pfx": 852, "reg": "2002-08-01", "rir": "apnic", "s24": 31479, "sib": 3, "tor": 0, "w24": 66, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8723456, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.100124}, {"a": 3790, "h": "", "n": "RADIOGRAFICA COSTARRICENSE", "t": "Other", "w": 2, "cc": "CR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1248, "hi": 3.94, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}, "crowdsec": {"n": 1, "p": 0.0084, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.059, 0.009, 0, false], ["2026-10-12", 0.199, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.894, "ts": null, "map": 0.154, "obs": 0, "own": 0.340, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.199, "se": 0.853, "ts": 0.500, "map": 0.714, "obs": 2, "own": 0.417, "comp": {"cins": 4.3, "dshield": -0.8791, "crowdsec": 0.4589, "vulncheck": -0.6231, "blocklist_de": -2.1994}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.794, "det": null, "oid": "@aut-3790-LACNIC", "org": "RADIOGRAFICA COSTARRICENSE", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.racsa.go.cr/"}, "pfx": 240, "reg": "1994-08-25", "rir": "lacnic", "s24": 481, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 183040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035504022862}, {"a": 3816, "h": "", "n": "COLOMBIA TELECOMUNICACIONES S.A. ESP", "t": "Hosting & VPS", "w": 50, "cc": "CO", "cf": {"rb": "", "wb": "hi", "rep": 0.99, "waf": 0.62}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 11, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 13}, "ev": {"cins": {"n": 4, "p": 0.0001, "hi": 1.49, "lo": 0.32, "ips": 4, "mean": 0.81, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.39, "lo": 0.10, "ips": 5, "mean": 0.22, "above": false}, "dshield": {"n": 8, "p": 0.0004, "hi": 1.91, "lo": 0.62, "ips": 8, "mean": 1.19, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 0.55, "lo": 0.21, "ips": 13, "mean": 0.36, "above": false}, "threatfox": {"n": 5, "p": 0.1418, "hi": 3.66, "lo": 0.91, "ips": 5, "mean": 2.09, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.64, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "blocklist_de": {"n": 24, "p": 0.0017, "hi": 2.40, "lo": 1.24, "ips": 24, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.289, 0.057, 0, false], ["2026-10-12", 0.579, 0.095, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 0}, "lo": 0.095, "se": 1.040, "ts": 1.000, "map": 0.275, "obs": 5, "own": 0.138, "comp": {"urlhaus": -1.3518, "threatfox": 2.719, "phishing_db": -1.0305}, "mass": 6.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 8, "crowdsec": 11, "vulncheck": 1, "blocklist_de": 24}, "lo": 0.579, "se": 0.389, "ts": 0.500, "map": 0.910, "obs": 48, "own": 0.179, "comp": {"cins": 1.2616, "dshield": 0.3777, "crowdsec": -7.7487, "vulncheck": -0.8965, "blocklist_de": 8.3051}, "mass": 61.5, "listed": false}}, "abq": false, "bot": 0.121, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 2, "doublepulsar": 1}, "threatfox": {"family:DCRat": 1, "family:AsyncRAT": 4}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 8, "bots": 16}}, "oid": "@aut-27921-LACNIC", "org": "COLOMBIA TELECOMUNICACIONES S.A. ESP BIC", "pdb": {"t": null, "sc": "South America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.movistar.com.co/"}, "pfx": 1267, "reg": "1994-09-09", "rir": "lacnic", "s24": 12177, "sib": 1, "tor": 0, "w24": 47, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4034048, "abuse": "admininternet.telecom@tigo.com.co", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.102913}, {"a": 3836, "h": "THAISARN-TH-AS-AP", "n": "Thai Social/Scientific, Academic and Research Network", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.318, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.871, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 2, "reg": "2002-08-01", "rir": "apnic", "s24": 33, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "noc@thaisarn.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3842, "h": "RAMNODE", "n": "RamNode", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2307, "hi": 4.66, "lo": 0.61, "ips": 2, "mean": 2.22, "above": false}}, "h2": [["2026-10-05", 0.102, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 0.183, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.739, "ts": null, "map": 0.132, "obs": 0, "own": 0.046, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.648, "det": {"shodan": {"compromised": 2}}, "oid": "INMOT-1-ARIN", "org": "InMotion Hosting, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.ramnode.com"}, "pfx": 43, "reg": "2012-07-26", "rir": "arin", "s24": 164, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43520, "abuse": "abuse@inmotionhosting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 3855, "h": "LOGIC-3855", "n": "LOGIC-3855", "t": "Enterprise, edu & gov", "w": 0, "cc": "BM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0556, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.169, "obs": 0, "own": 1.754, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.682, "ts": null, "map": 0.110, "obs": 0, "own": 1.013, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.164, "det": {"shodan": {"malware": 1}}, "oid": "LCL-67-ARIN", "org": "Logic Communications Ltd", "pdb": {"t": "Enterprise", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://onecomm.bm/"}, "pfx": 85, "reg": "1994-09-26", "rir": "arin", "s24": 252, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 94464, "abuse": "noc@onecomm.bm", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00115369499703}, {"a": 4007, "h": "SUBISU-CABLENET-AS-AP", "n": "Subisu Cablenet", "t": "Broadband & mobile", "w": 6, "cc": "NP", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 7, "p": 0.9674, "hi": 10.83, "lo": 3.28, "ips": 7, "mean": 6.59, "above": true}, "dshield": {"n": 1, "p": 0.1762, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "urlhaus": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2693, "hi": 4.97, "lo": 0.65, "ips": 2, "mean": 2.37, "above": false}, "blocklist_de": {"n": 2, "p": 0.3551, "hi": 5.69, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 5.652, 0.417, 0, false], ["2026-10-12", 3.357, 0.447, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.447, "se": 1.546, "ts": 1.000, "map": 4.509, "obs": 1, "own": 13.510, "comp": {"urlhaus": 3.9064, "threatfox": -0.2685, "phishing_db": -0.5055}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.357, "se": 0.609, "ts": 0.400, "map": 7.810, "obs": 5, "own": 12.098, "comp": {"cins": -0.871, "dshield": 1.4888, "crowdsec": -0.0207, "vulncheck": -0.7956, "blocklist_de": 3.6475}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.236, "det": {"shodan": {"compromised": 7}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-SC25-AP-APNIC", "org": "Subisu Cablenet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.subisu.net.np"}, "pfx": 88, "reg": "2004-12-13", "rir": "apnic", "s24": 100, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 57856, "abuse": "abuse@subisu.net.np", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00612852873276}, {"a": 4134, "h": "CHINANET-BACKBONE", "n": "China Telecom", "t": "Broadband & mobile", "w": 1408, "cc": "CN", "cf": {"rb": "", "wb": "", "rep": 1.37, "waf": 2.64}, "cs": {"c": {"http_flood": 26, "web_exploit": 104, "bad_crawling": 9, "proxy_or_vpn": 54, "first_seen_30d": 59, "ssh_bruteforce": 460, "web_bruteforce": 155, "home_connection": 543, "mail_bruteforce": 231, "router_or_botnet": 11, "cve:CVE-2017-9841": 12, "cve:CVE-2019-8318": 58, "cve:CVE-2019-9082": 10, "cve:CVE-2024-6387": 154, "cve:CVE-2018-20062": 13}, "n": 603}, "ev": {"cins": {"n": 172, "p": 0.0000, "hi": 1.19, "lo": 0.92, "ips": 268, "mean": 1.05, "above": false}, "shodan": {"n": 281, "p": 0.0000, "hi": 0.37, "lo": 0.31, "ips": 281, "mean": 0.34, "above": false}, "dshield": {"n": 365, "p": 0.0000, "hi": 1.90, "lo": 1.60, "ips": 374, "mean": 1.74, "above": false}, "urlhaus": {"n": 29, "p": 0.0000, "hi": 1.07, "lo": 0.59, "ips": 29, "mean": 0.82, "above": false}, "crowdsec": {"n": 540, "p": 0.0000, "hi": 0.56, "lo": 0.49, "ips": 603, "mean": 0.53, "above": false}, "threatfox": {"n": 4, "p": 0.0000, "hi": 0.15, "lo": 0.03, "ips": 4, "mean": 0.08, "above": false}, "phishing_db": {"n": 8, "p": 0.0000, "hi": 0.08, "lo": 0.02, "ips": 8, "mean": 0.05, "above": false}, "blocklist_de": {"n": 374, "p": 0.0000, "hi": 0.98, "lo": 0.83, "ips": 427, "mean": 0.90, "above": false}}, "h2": [["2026-10-05", 0.486, 0.188, 0, false], ["2026-10-12", 0.535, 0.132, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 29, "threatfox": 4, "phishing_db": 8}, "lo": 0.132, "se": 0.931, "ts": 0.707, "map": 0.303, "obs": 41, "own": 0.968, "comp": {"urlhaus": 1.9613, "threatfox": -0.5066, "phishing_db": -1.0209}, "mass": 213.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 172, "dshield": 365, "crowdsec": 540, "vulncheck": 0, "blocklist_de": 374}, "lo": 0.535, "se": 0.359, "ts": 0.372, "map": 0.778, "obs": 1451, "own": 1.201, "comp": {"cins": 5.1255, "dshield": 3.1188, "crowdsec": -4.1535, "vulncheck": -1.0159, "blocklist_de": -1.9322}, "mass": 1672.4, "listed": false}}, "abq": true, "bot": 0.513, "det": {"shodan": {"c2": 5, "malware": 3, "compromised": 273}, "threatfox": {"family:DeimosC2": 2, "family:AdaptixC2": 1, "family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 16, "ssh": 206, "imap": 93, "mail": 202, "apache": 3, "bruteforcelogin": 3}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": "100+Tbps", "pol": "Selective", "web": "http://en.chinatelecom.com.cn/"}, "pfx": 725, "reg": "2002-08-01", "rir": "apnic", "s24": 387003, "sib": 0, "tor": 0, "w24": 1195, "drop": 7, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 111758592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.528649}, {"a": 4181, "h": "TDS-AS", "n": "TDS Telecom", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.39, "lo": 0.05, "ips": 2, "mean": 0.19, "above": false}, "dshield": {"n": 2, "p": 0.0001, "hi": 1.31, "lo": 0.17, "ips": 2, "mean": 0.62, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.07, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}}, "h2": [["2026-10-05", 0.032, 0.029, 0, false], ["2026-10-12", 0.019, 0.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.031, "se": 1.328, "ts": 1.000, "map": 0.164, "obs": 1, "own": 0.578, "comp": {"urlhaus": -0.6423, "threatfox": -0.4033, "phishing_db": 0.8611}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.019, "se": 0.782, "ts": 1.000, "map": 0.060, "obs": 2, "own": 0.096, "comp": {"cins": -0.5191, "dshield": 6.448, "crowdsec": -4.035, "vulncheck": -0.6724, "blocklist_de": -2.6398}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.145, "det": {"shodan": {"compromised": 2}}, "oid": "TDST-Z-ARIN", "org": "TDS TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.tdstelecom.com"}, "pfx": 83, "reg": "1994-12-16", "rir": "arin", "s24": 7058, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1809152, "abuse": "abuse@tds.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04373010728824}, {"a": 4213, "h": "EVOCATIVE-GLOBAL", "n": "Evocative Global", "t": "Transit & backbone", "w": 15, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 7, "bad_crawling": 4, "web_bruteforce": 11, "mail_bruteforce": 7, "cve:CVE-2017-9841": 2, "cve:CVE-2025-4396": 2, "cve:CVE-2018-20062": 6, "cve:CVE-2021-44228": 1, "cve:CVE-2022-22965": 1}, "n": 11}, "ev": {"shodan": {"n": 1, "p": 0.0627, "hi": 3.19, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "dshield": {"n": 1, "p": 0.1502, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 2, "p": 0.1401, "hi": 3.91, "lo": 0.51, "ips": 11, "mean": 1.86, "above": false}, "phishing_db": {"n": 1, "p": 0.1543, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "blocklist_de": {"n": 1, "p": 0.1129, "hi": 3.81, "lo": 0.29, "ips": 2, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.623, 0.199, 0, false], ["2026-10-12", 1.081, 0.208, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.208, "se": 1.413, "ts": 1.000, "map": 1.552, "obs": 1, "own": 6.503, "comp": {"urlhaus": -0.2295, "threatfox": -0.2341, "phishing_db": 2.5295}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.081, "se": 0.656, "ts": 0.500, "map": 2.711, "obs": 4, "own": 8.580, "comp": {"cins": -0.7212, "dshield": 1.9729, "crowdsec": 1.3193, "vulncheck": -0.7533, "blocklist_de": 0.5733}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.778, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 2}}, "oid": "VPLSI-ARIN", "org": "Krypt Technologies", "pdb": {"t": "NSP", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://evocative.com/"}, "pfx": 106, "reg": "2009-09-14", "rir": "arin", "s24": 229, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 77312, "abuse": "abuse@vpls.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 4226, "h": "SUMOFIBER", "n": "SUMOFIBER", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1591, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 2, "p": 0.1782, "hi": 4.24, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}, "blocklist_de": {"n": 1, "p": 0.1268, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.792, 0.010, 0, false], ["2026-10-12", 1.316, 0.011, 0, false]], "sh": false, "uc": 294.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.145, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.316, "se": 0.658, "ts": 0.500, "map": 3.336, "obs": 4, "own": 5.194, "comp": {"cins": -0.711, "dshield": 2.0076, "crowdsec": 1.4155, "vulncheck": -0.75, "blocklist_de": 0.6362}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.174, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "CL-64-ARIN", "org": "Sumofiber", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://sumofiber.com"}, "pfx": 40, "reg": "2024-03-19", "rir": "arin", "s24": 183, "sib": 7, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49920, "abuse": "abuse@sumofiber.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 4229, "h": "ZEN-NET", "n": "Zenlayer IP Backbone", "t": "Hosting & VPS", "w": 598, "cc": "US", "cf": {"rb": "lo", "wb": "lo", "rep": 17.28, "waf": 4.89}, "cs": {"c": {"http_flood": 598, "web_exploit": 585, "bad_crawling": 597, "proxy_or_vpn": 176, "home_connection": 40, "cve:CVE-2022-3124": 1, "cve:CVE-2026-8181": 4, "cve:CVE-2025-30208": 5, "cve:CVE-2025-36604": 552, "cve:CVE-2026-21859": 40}, "n": 598}, "ev": {"crowdsec": {"n": 4, "p": 0.7722, "hi": 8.46, "lo": 1.82, "ips": 598, "mean": 4.62, "above": false}}, "h2": [["2026-10-05", 5.756, 0.011, 0, false], ["2026-10-12", 6.102, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.272, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.102, "se": 0.675, "ts": 1.000, "map": 15.985, "obs": 4, "own": 3.161, "comp": {"cins": -0.595, "dshield": -1.1438, "crowdsec": 9.6226, "vulncheck": -0.707, "blocklist_de": -3.0115}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.998, "det": null, "oid": "ZENLA-7-ARIN", "org": "Zenlayer Inc", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Tbps", "pol": "Selective", "web": "http://www.zenlayer.com"}, "pfx": 27, "reg": "2020-05-20", "rir": "arin", "s24": 31, "sib": 6, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0274], ["2026-10-12", 0.0355]], "ipv4": 9984, "abuse": "abuse@zenlayer.com", "score": 0.0355, "groups": ["cloudflare"], "sensors": [], "traffic": 0.01747012993521}, {"a": 4230, "h": "", "n": "Claro", "t": "Broadband & mobile", "w": 9, "cc": "BR", "cf": {"rb": "hi", "wb": "hi", "rep": 1.11, "waf": 0.97}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.50, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.40, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.19, "lo": 0.05, "ips": 5, "mean": 0.11, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 0.41, "lo": 0.09, "ips": 4, "mean": 0.22, "above": false}}, "h2": [["2026-10-05", 0.068, 0.004, 0, false], ["2026-10-12", 0.065, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.644, "ts": null, "map": 0.042, "obs": 0, "own": 0.190, "comp": null, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.065, "se": 0.483, "ts": 0.455, "map": 0.119, "obs": 11, "own": 0.185, "comp": {"cins": 1.1, "dshield": -0.8836, "crowdsec": -1.8125, "vulncheck": -0.9322, "blocklist_de": 1.792}, "mass": 13.4, "listed": false}}, "abq": false, "bot": 0.065, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-4230-LACNIC", "org": "CLARO S.A.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.embratel.com.br"}, "pfx": 81, "reg": "1999-11-16", "rir": "lacnic", "s24": 20155, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5163776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.066114}, {"a": 4385, "h": "RIT-ASN", "n": "Rochester Institute of Technology", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.3181, "hi": 5.01, "lo": 0.88, "ips": 3, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 1.743, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.109, "obs": 0, "own": 1.001, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.184, "det": {"shodan": {"compromised": 3}}, "oid": "RIT-3-Z-ARIN", "org": "Rochester Institute of Technology", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.rit.edu"}, "pfx": 2, "reg": "1995-02-15", "rir": "arin", "s24": 257, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65792, "abuse": "abuse@rit.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 4434, "h": "ERX-RADNET1-AS", "n": "Rahajasa Media Internet", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1689, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.202, "obs": 0, "own": 0.857, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.608, "det": {"shodan": {"c2": 1}}, "oid": "@aut-4434-APNIC", "org": "PT Rahajasa Media Internet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.rad.net.id"}, "pfx": 44, "reg": "2002-08-01", "rir": "apnic", "s24": 34, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "hostmaster@rad.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 4515, "h": "PCCW-AS-AP", "n": "PCCW IMS", "t": "Broadband & mobile", "w": 8, "cc": "HK", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 6, "web_bruteforce": 5, "home_connection": 5, "mail_bruteforce": 6, "router_or_botnet": 1}, "n": 8}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.14, "lo": 0.15, "ips": 2, "mean": 0.54, "above": false}, "crowdsec": {"n": 7, "p": 0.0008, "hi": 1.98, "lo": 0.60, "ips": 8, "mean": 1.20, "above": false}, "blocklist_de": {"n": 4, "p": 0.0327, "hi": 2.79, "lo": 0.60, "ips": 5, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.537, 0.007, 0, false], ["2026-10-12", 0.535, 0.008, 0, false]], "sh": false, "uc": 466.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.780, "ts": null, "map": 0.104, "obs": 0, "own": 0.486, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.535, "se": 0.479, "ts": 0.636, "map": 0.963, "obs": 11, "own": 1.491, "comp": {"cins": -1.7345, "dshield": -2.3643, "crowdsec": 3.0454, "vulncheck": -0.9191, "blocklist_de": 3.3288}, "mass": 11.4, "listed": false}}, "abq": false, "bot": 0.274, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"mail": 5}}, "oid": "ORG-PILB1-AP-APNIC", "org": "PCCW IMS Ltd (PCCW Business Internet Access)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.hkt-enterprise.com/"}, "pfx": 291, "reg": "2002-08-01", "rir": "apnic", "s24": 2124, "sib": 6, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1011200, "abuse": "noc@imsbiz.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00336937978048}, {"a": 4538, "h": "ERX-CERNET-BKB", "n": "CERNET-CN", "t": "Enterprise, edu & gov", "w": 8, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.16, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.17, "lo": 0.02, "ips": 2, "mean": 0.08, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.04, "lo": 0.00, "ips": 2, "mean": 0.02, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.13, "lo": 0.01, "ips": 1, "mean": 0.06, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.09, "lo": 0.01, "ips": 2, "mean": 0.04, "above": false}}, "h2": [["2026-10-05", 0.006, 0.002, 0, false], ["2026-10-12", 0.013, 0.003, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.003, "se": 1.605, "ts": null, "map": 0.024, "obs": 0, "own": 0.195, "comp": null, "mass": 4.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.013, "se": 0.528, "ts": 0.250, "map": 0.025, "obs": 8, "own": 0.145, "comp": {"cins": 1.9019, "dshield": 1.8307, "crowdsec": -4.6236, "vulncheck": -0.3044, "blocklist_de": -1.0849}, "mass": 9.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ssh": 2}}, "oid": null, "org": null, "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.edu.cn"}, "pfx": 5036, "reg": "2002-08-01", "rir": "apnic", "s24": 66510, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42631936, "abuse": "abuse@cernet.edu.cn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0072881679676}, {"a": 4609, "h": "CTM-MO", "n": "Macau CTM", "t": "Broadband & mobile", "w": 10, "cc": "MO", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 1, "home_connection": 5}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0711, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "shodan": {"n": 2, "p": 0.0037, "hi": 1.96, "lo": 0.25, "ips": 2, "mean": 0.93, "above": false}, "dshield": {"n": 2, "p": 0.1545, "hi": 4.04, "lo": 0.52, "ips": 2, "mean": 1.92, "above": false}, "urlhaus": {"n": 1, "p": 0.1601, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 5, "p": 0.0319, "hi": 2.80, "lo": 0.70, "ips": 5, "mean": 1.60, "above": false}, "vulncheck": {"n": 1, "p": 0.0548, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "blocklist_de": {"n": 5, "p": 0.3937, "hi": 4.98, "lo": 1.24, "ips": 6, "mean": 2.84, "above": false}}, "h2": [["2026-10-05", 0.888, 0.146, 0, false], ["2026-10-12", 1.408, 0.161, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.161, "se": 1.391, "ts": 1.000, "map": 1.162, "obs": 1, "own": 3.350, "comp": {"urlhaus": 2.9853, "threatfox": -0.4089, "phishing_db": -0.8002}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 5}, "lo": 1.408, "se": 0.458, "ts": 0.357, "map": 2.469, "obs": 14, "own": 3.809, "comp": {"cins": 0.9407, "dshield": 0.5236, "crowdsec": -2.3657, "vulncheck": -0.5283, "blocklist_de": 3.7272}, "mass": 14.2, "listed": false}}, "abq": true, "bot": 0.215, "det": {"shodan": {"compromised": 2}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 6}}, "oid": "ORG-CDTD1-AP-APNIC", "org": "Companhia de Telecomunicacoes de Macau", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.ctm.net/"}, "pfx": 80, "reg": "1995-06-15", "rir": "apnic", "s24": 1037, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 747520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00784585644246}, {"a": 4613, "h": "MOS-NP", "n": "Mercantile Office Systems", "t": "Other", "w": 0, "cc": "NP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.222, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-4613-APNIC", "org": "Mercantile Office Systems", "pdb": null, "pfx": 30, "reg": "1995-06-11", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001944068112}, {"a": 4616, "h": "HKPOLYU-HK", "n": "The Hong Kong Polytechnic University", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0379, "hi": 2.80, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.006, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.924, "ts": null, "map": 0.164, "obs": 0, "own": 0.387, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.650, "ts": null, "map": 0.098, "obs": 0, "own": 0.087, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.435, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-THKP2-AP-APNIC", "org": "The Hong Kong Polytechnic University", "pdb": null, "pfx": 8, "reg": "1995-07-07", "rir": "apnic", "s24": 324, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 83456, "abuse": "abuse@polyu.edu.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00063324714076}, {"a": 4618, "h": "INET-TH-AS", "n": "Internet Thailand (INET)", "t": "Broadband & mobile", "w": 11, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 6, "home_connection": 5, "cve:CVE-2026-27771": 1}, "n": 6}, "ev": {"shodan": {"n": 8, "p": 0.5276, "hi": 5.11, "lo": 1.66, "ips": 8, "mean": 3.19, "above": false}, "dshield": {"n": 1, "p": 0.0673, "hi": 3.25, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "crowdsec": {"n": 5, "p": 0.0750, "hi": 3.22, "lo": 0.80, "ips": 6, "mean": 1.84, "above": false}, "vulncheck": {"n": 1, "p": 0.0695, "hi": 3.28, "lo": 0.25, "ips": 1, "mean": 1.38, "above": false}, "phishing_db": {"n": 1, "p": 0.0749, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "blocklist_de": {"n": 5, "p": 0.4879, "hi": 5.49, "lo": 1.37, "ips": 5, "mean": 3.13, "above": false}}, "h2": [["2026-10-05", 1.034, 0.100, 0, false], ["2026-10-12", 1.364, 0.105, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.105, "se": 1.358, "ts": 1.000, "map": 0.665, "obs": 1, "own": 2.056, "comp": {"urlhaus": -0.3514, "threatfox": -0.3026, "phishing_db": 1.8726}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 5}, "lo": 1.364, "se": 0.474, "ts": 0.417, "map": 2.475, "obs": 12, "own": 3.820, "comp": {"cins": -1.7677, "dshield": -0.641, "crowdsec": -0.726, "vulncheck": -0.4339, "blocklist_de": 5.8683}, "mass": 11.7, "listed": false}}, "abq": true, "bot": 0.771, "det": {"shodan": {"compromised": 8}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 1, "ssh": 4}}, "oid": "ORG-ITCL3-AP-APNIC", "org": "Internet Thailand Company Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.inet.co.th"}, "pfx": 430, "reg": "1995-08-10", "rir": "apnic", "s24": 853, "sib": 13, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 760832, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0024237795711}, {"a": 4621, "h": "UNINET-AS-AP", "n": "UniNet Thailand", "t": "Enterprise, edu & gov", "w": 6, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2021-41773": 1}, "n": 4}, "ev": {"shodan": {"n": 3, "p": 0.1518, "hi": 3.88, "lo": 0.68, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 4, "p": 0.1997, "hi": 4.08, "lo": 0.88, "ips": 4, "mean": 2.23, "above": false}, "phishing_db": {"n": 1, "p": 0.1176, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "blocklist_de": {"n": 2, "p": 0.1734, "hi": 4.20, "lo": 0.54, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.555, 0.138, 0, false], ["2026-10-12", 1.016, 0.146, 0, false]], "sh": false, "uc": 62.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.146, "se": 1.380, "ts": 1.000, "map": 0.985, "obs": 1, "own": 5.006, "comp": {"urlhaus": -0.291, "threatfox": -0.2715, "phishing_db": 2.1738}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.016, "se": 0.565, "ts": 0.667, "map": 2.176, "obs": 6, "own": 12.257, "comp": {"cins": -1.0705, "dshield": -1.7571, "crowdsec": 3.6509, "vulncheck": -0.8377, "blocklist_de": 2.1857}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.302, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.uni.net.th"}, "pfx": 78, "reg": "1995-08-16", "rir": "apnic", "s24": 467, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 194048, "abuse": "noc@uni.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00193693560258}, {"a": 4628, "h": "PACIFICINTERNET-AS-AP", "n": "Pacific Internet Singapore", "t": "Broadband & mobile", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0240, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.158, "obs": 0, "own": 0.890, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.619, "ts": null, "map": 0.088, "obs": 0, "own": 0.205, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.204, "det": {"shodan": {"malware": 1}}, "oid": "ORG-PIPL10-AP-APNIC", "org": "Pacific Internet Pte Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.pacificinternet.com"}, "pfx": 561, "reg": "1995-09-12", "rir": "apnic", "s24": 409, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 207872, "abuse": "noc@pacificinternet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00032781492068}, {"a": 4663, "h": "ELIMNET-AS-KR", "n": "ELIMNET, INC.", "t": "Other", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0016, "hi": 1.63, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}, "crowdsec": {"n": 1, "p": 0.0004, "hi": 1.40, "lo": 0.11, "ips": 1, "mean": 0.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.0192, "hi": 2.42, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.111, 0.008, 0, false], ["2026-10-12", 0.117, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.846, "ts": null, "map": 0.134, "obs": 0, "own": 0.272, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.117, "se": 0.834, "ts": 0.500, "map": 0.407, "obs": 2, "own": 0.237, "comp": {"cins": -0.4533, "dshield": -0.9184, "crowdsec": 0.2471, "vulncheck": -0.6371, "blocklist_de": 2.2552}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.637, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-4663-APNIC", "org": "ELIMNET, INC.", "pdb": null, "pfx": 63, "reg": "1995-12-28", "rir": "apnic", "s24": 896, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 268288, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001051207444}, {"a": 4670, "h": "HYUNDAI-KR", "n": "Shinbiro", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 1.04, "lo": 0.08, "ips": 1, "mean": 0.44, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.798, "ts": null, "map": 0.113, "obs": 0, "own": 0.215, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.446, "ts": null, "map": 0.040, "obs": 0, "own": 0.029, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.352, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-4670-APNIC", "org": "Shinbiro", "pdb": null, "pfx": 358, "reg": "1995-06-16", "rir": "apnic", "s24": 1665, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 832256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002255859438}, {"a": 4685, "h": "ASAHI-NET", "n": "ASAHI Net", "t": "Broadband & mobile", "w": 10, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 1.46, "waf": 1.28}, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 5, "mail_bruteforce": 3, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.41, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}, "dshield": {"n": 3, "p": 0.0046, "hi": 2.10, "lo": 0.37, "ips": 3, "mean": 1.08, "above": false}, "urlhaus": {"n": 2, "p": 0.1869, "hi": 4.31, "lo": 0.56, "ips": 2, "mean": 2.05, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.74, "lo": 0.18, "ips": 5, "mean": 0.42, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.99, "lo": 0.13, "ips": 2, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 0.175, 0.062, 0, false], ["2026-10-12", 0.196, 0.220, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.220, "se": 1.123, "ts": 1.000, "map": 0.891, "obs": 2, "own": 2.449, "comp": {"urlhaus": 3.1136, "threatfox": -0.5296, "phishing_db": -1.0731}, "mass": 7.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.196, "se": 0.490, "ts": 0.500, "map": 0.358, "obs": 10, "own": 0.556, "comp": {"cins": -1.594, "dshield": 3.5848, "crowdsec": 0.771, "vulncheck": -0.9066, "blocklist_de": -1.488}, "mass": 10.0, "listed": false}}, "abq": false, "bot": 0.076, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-4685-JPNIC", "org": "Asahi Net", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.asahi-net.or.jp/"}, "pfx": 62, "reg": "1995-08-30", "rir": "apnic", "s24": 4992, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1277952, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.050069}, {"a": 4686, "h": "BEKKOAME", "n": "Bekkoame Internet Inc.", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.856, "ts": null, "map": 0.139, "obs": 0, "own": 0.286, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.537, "ts": null, "map": 0.062, "obs": 0, "own": 0.049, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.054, "det": null, "oid": "@aut-4686-JPNIC", "org": "BEKKOAME INTERNET INC.", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.bekkoame.co.jp/"}, "pfx": 65, "reg": "1995-08-30", "rir": "apnic", "s24": 783, "sib": 0, "tor": 0, "w24": 0, "drop": 17, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 200448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0017809352704}, {"a": 4694, "h": "IDCF", "n": "IDC Frontier Inc.", "t": "Broadband & mobile", "w": 2, "cc": "JP", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 0.53, "lo": 0.07, "ips": 2, "mean": 0.25, "above": false}}, "h2": [["2026-10-05", 0.102, 0.006, 0, false], ["2026-10-12", 0.030, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.734, "ts": null, "map": 0.083, "obs": 0, "own": 0.373, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.030, "se": 0.793, "ts": 1.000, "map": 0.098, "obs": 2, "own": 0.156, "comp": {"cins": -0.4901, "dshield": -0.9792, "crowdsec": 3.692, "vulncheck": -0.6576, "blocklist_de": -2.4969}, "mass": 2.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-4694-JPNIC", "org": "IDC Frontier Inc.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.idcf.jp/english/"}, "pfx": 329, "reg": "1995-08-30", "rir": "apnic", "s24": 4066, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1912064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00302758205425}, {"a": 4713, "h": "OCN", "n": "NTT Communications Corporation (OCN)", "t": "Broadband & mobile", "w": 30, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.21, "waf": 0.18}, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 5, "home_connection": 11, "mail_bruteforce": 4, "cve:CVE-2024-28000": 1}, "n": 12}, "ev": {"shodan": {"n": 6, "p": 0.0000, "hi": 0.05, "lo": 0.01, "ips": 6, "mean": 0.03, "above": false}, "dshield": {"n": 13, "p": 0.0000, "hi": 0.34, "lo": 0.14, "ips": 13, "mean": 0.23, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 0.06, "lo": 0.02, "ips": 12, "mean": 0.04, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.26, "lo": 0.02, "ips": 1, "mean": 0.11, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.14, "lo": 0.02, "ips": 3, "mean": 0.07, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.06, "lo": 0.01, "ips": 3, "mean": 0.03, "above": false}}, "h2": [["2026-10-05", 0.019, 0.014, 0, false], ["2026-10-12", 0.026, 0.014, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 0.014, "se": 1.187, "ts": 0.750, "map": 0.047, "obs": 4, "own": 0.202, "comp": {"urlhaus": -1.7174, "threatfox": -0.108, "phishing_db": 0.4024}, "mass": 12.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 13, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.026, "se": 0.422, "ts": 0.481, "map": 0.042, "obs": 27, "own": 0.066, "comp": {"cins": -2.6604, "dshield": 9.4824, "crowdsec": -1.1063, "vulncheck": -0.9721, "blocklist_de": -6.51}, "mass": 26.6, "listed": false}}, "abq": false, "bot": 0.071, "det": {"shodan": {"c2": 1, "compromised": 4, "doublepulsar": 1}, "threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "@family-53605", "org": "NTT DOCOMO BUSINESS, Inc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.ntt.com/en/index.html"}, "pfx": 183, "reg": "1995-08-30", "rir": "apnic", "s24": 111814, "sib": 6, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28625408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.355735}, {"a": 4725, "h": "ODN", "n": "Softbank Corp. (former Japan Telecom)", "t": "Broadband & mobile", "w": 2, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.28, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.23, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.96, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}}, "h2": [["2026-10-05", 0.008, 0.005, 0, false], ["2026-10-12", 0.014, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.695, "ts": null, "map": 0.065, "obs": 0, "own": 0.289, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.014, "se": 0.798, "ts": 0.500, "map": 0.046, "obs": 2, "own": 0.075, "comp": {"cins": -0.4319, "dshield": -0.8821, "crowdsec": 0.4422, "vulncheck": 1.3961, "blocklist_de": -2.2084}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.170, "det": {"shodan": {"c2": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "@aut-4725-JPNIC", "org": "SoftBank Corp.", "pdb": {"t": "NSP", "sc": "Global", "tr": "200-300Gbps", "pol": "Restrictive", "web": "http://www.softbank.jp/en/"}, "pfx": 136, "reg": "1995-08-30", "rir": "apnic", "s24": 7495, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1931776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00725224384625}, {"a": 4750, "h": "CSLOXINFO-AS-AP", "n": "CS Loxinfo", "t": "Enterprise, edu & gov", "w": 5, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0016, "hi": 1.64, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}, "crowdsec": {"n": 3, "p": 0.0099, "hi": 2.31, "lo": 0.41, "ips": 3, "mean": 1.19, "above": false}, "phishing_db": {"n": 1, "p": 0.0720, "hi": 3.31, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "blocklist_de": {"n": 2, "p": 0.0691, "hi": 3.23, "lo": 0.42, "ips": 2, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 0.551, 0.098, 0, false], ["2026-10-12", 0.448, 0.103, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.103, "se": 1.357, "ts": 1.000, "map": 0.649, "obs": 1, "own": 3.389, "comp": {"urlhaus": -0.3555, "threatfox": -0.3045, "phishing_db": 1.8537}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.448, "se": 0.597, "ts": 0.600, "map": 1.012, "obs": 5, "own": 5.724, "comp": {"cins": -0.9722, "dshield": -1.6455, "crowdsec": 1.9407, "vulncheck": -0.8186, "blocklist_de": 2.9016}, "mass": 5.0, "listed": false}}, "abq": true, "bot": 0.259, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@family-29895", "org": "CS Loxinfo Public Company Limited", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": null}, "pfx": 509, "reg": "1996-03-21", "rir": "apnic", "s24": 886, "sib": 44, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 286720, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00157045385598}, {"a": 4755, "h": "TATACOMM-AS", "n": "Tata Communications AS4755", "t": "Broadband & mobile", "w": 12, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 6, "web_bruteforce": 3, "home_connection": 8, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 9}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.32, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "urlhaus": {"n": 1, "p": 0.0474, "hi": 2.96, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 0.79, "lo": 0.26, "ips": 9, "mean": 0.49, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.97, "lo": 0.17, "ips": 4, "mean": 0.50, "above": false}}, "h2": [["2026-10-05", 0.183, 0.053, 0, false], ["2026-10-12", 0.171, 0.059, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.059, "se": 1.327, "ts": 1.000, "map": 0.351, "obs": 1, "own": 1.080, "comp": {"urlhaus": 2.0163, "threatfox": -0.4797, "phishing_db": -0.9581}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.171, "se": 0.480, "ts": 0.727, "map": 0.314, "obs": 11, "own": 0.487, "comp": {"cins": -1.7339, "dshield": -2.3638, "crowdsec": 4.8006, "vulncheck": -0.9191, "blocklist_de": 0.4512}, "mass": 11.4, "listed": false}}, "abq": true, "bot": 0.250, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 3, "imap": 1, "mail": 1}}, "oid": "ORG-TCL6-AP-APNIC", "org": "Tata Communications Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Restrictive", "web": "http://www.tatacommunications.com"}, "pfx": 2271, "reg": "1996-05-13", "rir": "apnic", "s24": 6514, "sib": 5, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3036160, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01582152056565}, {"a": 4760, "h": "HKTIMS-AP", "n": "HKT Limited", "t": "Broadband & mobile", "w": 108, "cc": "HK", "cf": {"rb": "", "wb": "", "rep": 1.17, "waf": 3.54}, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 12, "bad_crawling": 1, "proxy_or_vpn": 6, "first_seen_30d": 2, "ssh_bruteforce": 50, "web_bruteforce": 30, "home_connection": 60, "mail_bruteforce": 55, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 67}, "ev": {"cins": {"n": 3, "p": 0.0023, "hi": 1.94, "lo": 0.34, "ips": 3, "mean": 1.00, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.65, "lo": 0.16, "ips": 5, "mean": 0.37, "above": false}, "dshield": {"n": 19, "p": 0.9002, "hi": 5.76, "lo": 2.74, "ips": 19, "mean": 4.13, "above": true}, "urlhaus": {"n": 1, "p": 0.0413, "hi": 2.86, "lo": 0.21, "ips": 1, "mean": 1.21, "above": false}, "crowdsec": {"n": 45, "p": 0.0285, "hi": 2.90, "lo": 1.78, "ips": 67, "mean": 2.31, "above": false}, "vulncheck": {"n": 13, "p": 0.4432, "hi": 4.37, "lo": 1.79, "ips": 13, "mean": 2.96, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.06, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}, "blocklist_de": {"n": 37, "p": 0.9850, "hi": 5.64, "lo": 3.30, "ips": 57, "mean": 4.40, "above": true}}, "h2": [["2026-10-05", 1.539, 0.095, 0, false], ["2026-10-12", 1.918, 0.103, 0, false]], "sh": false, "uc": 315.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.103, "se": 1.168, "ts": 0.500, "map": 0.429, "obs": 2, "own": 1.301, "comp": {"urlhaus": 1.4943, "threatfox": -0.5042, "phishing_db": -0.2112}, "mass": 5.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 19, "crowdsec": 45, "vulncheck": 13, "blocklist_de": 37}, "lo": 1.918, "se": 0.367, "ts": 0.385, "map": 2.875, "obs": 117, "own": 4.420, "comp": {"cins": -1.7227, "dshield": 1.4801, "crowdsec": -1.8963, "vulncheck": -0.292, "blocklist_de": 4.8808}, "mass": 113.2, "listed": false}}, "abq": false, "bot": 0.307, "det": {"shodan": {"compromised": 5}, "vulncheck": {"c2_server": 1, "attack_tooling": 12}, "blocklist_de": {"ftp": 1, "ssh": 9, "imap": 22, "mail": 47}}, "oid": "ORG-PIL1-AP-APNIC", "org": "PCCW IMS Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.netvigator.com"}, "pfx": 688, "reg": "1996-06-12", "rir": "apnic", "s24": 7118, "sib": 0, "tor": 0, "w24": 86, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 4014080, "abuse": "noc@imsbiz.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["dshield", "blocklist_de"], "traffic": 0.065225}, {"a": 4761, "h": "INDOSAT-INP-AP", "n": "Indosat Ooredoo", "t": "Transit & backbone", "w": 18, "cc": "ID", "cf": {"rb": "", "wb": "", "rep": 0.35, "waf": 0.35}, "cs": {"c": {"ssh_bruteforce": 3, "home_connection": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0504, "hi": 3.01, "lo": 0.23, "ips": 1, "mean": 1.27, "above": false}, "shodan": {"n": 2, "p": 0.0006, "hi": 1.60, "lo": 0.21, "ips": 2, "mean": 0.76, "above": false}, "dshield": {"n": 9, "p": 0.9597, "hi": 9.04, "lo": 3.12, "ips": 9, "mean": 5.75, "above": true}, "urlhaus": {"n": 1, "p": 0.1492, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 3, "p": 0.0005, "hi": 1.67, "lo": 0.29, "ips": 3, "mean": 0.86, "above": false}, "blocklist_de": {"n": 4, "p": 0.1397, "hi": 3.71, "lo": 0.80, "ips": 6, "mean": 2.03, "above": false}}, "h2": [["2026-10-05", 0.422, 0.126, 0, false], ["2026-10-12", 1.294, 0.140, 0, false]], "sh": false, "uc": 52.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.140, "se": 1.378, "ts": 1.000, "map": 0.975, "obs": 1, "own": 4.017, "comp": {"urlhaus": 2.8509, "threatfox": -0.4216, "phishing_db": -0.8282}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 9, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.294, "se": 0.438, "ts": 0.529, "map": 2.222, "obs": 17, "own": 6.960, "comp": {"cins": 0.527, "dshield": 9.5063, "crowdsec": -6.3544, "vulncheck": -0.9489, "blocklist_de": -0.5378}, "mass": 16.9, "listed": false}}, "abq": false, "bot": 0.073, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"ssh": 2, "bots": 4}}, "oid": "ORG-PIT1-AP-APNIC", "org": "PT. INDOSAT Tbk", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://ioh.co.id/"}, "pfx": 867, "reg": "1996-07-16", "rir": "apnic", "s24": 1368, "sib": 2, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 537088, "abuse": "hostmaster@ioh.co.id", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.271095}, {"a": 4764, "h": "AUSSIEFIBRE-AS-AP", "n": "Aussie Broadband", "t": "Broadband & mobile", "w": 17, "cc": "AU", "cf": {"rb": "hi", "wb": "hi", "rep": 0.69, "waf": 0.60}, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 7, "web_bruteforce": 7, "home_connection": 5, "mail_bruteforce": 5, "cve:CVE-2024-28000": 1}, "n": 9}, "ev": {"shodan": {"n": 3, "p": 0.0012, "hi": 1.82, "lo": 0.32, "ips": 3, "mean": 0.94, "above": false}, "dshield": {"n": 3, "p": 0.2044, "hi": 4.25, "lo": 0.75, "ips": 3, "mean": 2.19, "above": false}, "urlhaus": {"n": 3, "p": 0.5530, "hi": 6.79, "lo": 1.20, "ips": 3, "mean": 3.50, "above": false}, "crowdsec": {"n": 9, "p": 0.0636, "hi": 3.10, "lo": 1.07, "ips": 9, "mean": 1.97, "above": false}, "blocklist_de": {"n": 3, "p": 0.0448, "hi": 2.94, "lo": 0.52, "ips": 3, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.929, 0.967, 0, false], ["2026-10-12", 0.942, 1.077, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 1.077, "se": 0.997, "ts": 1.000, "map": 3.603, "obs": 3, "own": 8.884, "comp": {"urlhaus": 4.5489, "threatfox": -0.541, "phishing_db": -1.0999}, "mass": 7.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.942, "se": 0.448, "ts": 0.600, "map": 1.637, "obs": 15, "own": 2.527, "comp": {"cins": -1.9535, "dshield": 2.143, "crowdsec": 3.8981, "vulncheck": -0.9356, "blocklist_de": -1.2654}, "mass": 13.9, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-WNPL1-AP-APNIC", "org": "Aussie Fibre Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Australia", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.aussiebroadband.com.au"}, "pfx": 382, "reg": "2004-01-22", "rir": "apnic", "s24": 1530, "sib": 3, "tor": 1, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 720640, "abuse": "abuse@aussiebroadband.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.106535}, {"a": 4765, "h": "PACIFICINTERNET-AS-AP", "n": "Pacific Internet Thailand", "t": "Other", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0745, "hi": 3.34, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.961, "ts": null, "map": 0.174, "obs": 0, "own": 0.452, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.716, "ts": null, "map": 0.123, "obs": 0, "own": 0.119, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.533, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PIPL10-AP-APNIC", "org": "Pacific Internet Pte Ltd", "pdb": null, "pfx": 234, "reg": "2003-01-15", "rir": "apnic", "s24": 196, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 92672, "abuse": "noc.th@pacificinternet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009191953632}, {"a": 4766, "h": "KIXS-AS-KR", "n": "KT Corporation (Korea Telecom)", "t": "Broadband & mobile", "w": 1214, "cc": "KR", "cf": {"rb": "", "wb": "", "rep": 0.42, "waf": 2.56}, "cs": {"c": {"http_flood": 22, "data_centre": 3, "web_exploit": 254, "bad_crawling": 15, "proxy_or_vpn": 67, "first_seen_30d": 26, "ssh_bruteforce": 630, "web_bruteforce": 764, "home_connection": 1, "mail_bruteforce": 807, "router_or_botnet": 17, "cve:CVE-2017-9841": 11, "cve:CVE-2019-9082": 10, "cve:CVE-2024-6387": 7, "cve:CVE-2018-20062": 11, "cve:CVE-2024-28000": 9}, "n": 980}, "ev": {"cins": {"n": 29, "p": 0.0000, "hi": 0.51, "lo": 0.28, "ips": 29, "mean": 0.39, "above": false}, "shodan": {"n": 232, "p": 0.0000, "hi": 0.67, "lo": 0.54, "ips": 232, "mean": 0.60, "above": false}, "dshield": {"n": 38, "p": 0.0000, "hi": 0.50, "lo": 0.30, "ips": 38, "mean": 0.39, "above": false}, "urlhaus": {"n": 9, "p": 0.0000, "hi": 0.88, "lo": 0.31, "ips": 9, "mean": 0.56, "above": false}, "crowdsec": {"n": 843, "p": 0.0000, "hi": 1.85, "lo": 1.65, "ips": 980, "mean": 1.75, "above": false}, "threatfox": {"n": 3, "p": 0.0000, "hi": 0.27, "lo": 0.05, "ips": 3, "mean": 0.14, "above": false}, "vulncheck": {"n": 23, "p": 0.0000, "hi": 0.34, "lo": 0.17, "ips": 23, "mean": 0.25, "above": false}, "phishing_db": {"n": 13, "p": 0.0000, "hi": 0.23, "lo": 0.09, "ips": 13, "mean": 0.16, "above": false}, "blocklist_de": {"n": 569, "p": 0.2556, "hi": 3.12, "lo": 2.72, "ips": 648, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 1.143, 0.118, 0, false], ["2026-10-12", 1.122, 0.102, 0, false]], "sh": false, "uc": 119.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 9, "threatfox": 3, "phishing_db": 13}, "lo": 0.102, "se": 0.962, "ts": 0.520, "map": 0.245, "obs": 25, "own": 0.801, "comp": {"urlhaus": 0.9938, "threatfox": -0.4193, "phishing_db": -0.3546}, "mass": 82.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 29, "dshield": 38, "crowdsec": 843, "vulncheck": 23, "blocklist_de": 569}, "lo": 1.122, "se": 0.356, "ts": 0.561, "map": 1.632, "obs": 1502, "own": 2.513, "comp": {"cins": -2.7834, "dshield": -2.8652, "crowdsec": 1.5074, "vulncheck": -0.9276, "blocklist_de": 6.9521}, "mass": 1638.5, "listed": false}}, "abq": false, "bot": 0.232, "det": {"shodan": {"malware": 4, "compromised": 228}, "threatfox": {"family:AsyncRAT": 1, "family:Cobalt Strike": 1, "family:NetSupportManager RAT": 1}, "vulncheck": {"c2_server": 7, "botnet_node": 2, "attack_tooling": 14}, "blocklist_de": {"ftp": 4, "sip": 1, "ssh": 97, "bots": 4, "imap": 383, "mail": 538, "apache": 4, "bruteforcelogin": 3}}, "oid": "@aut-45400-APNIC", "org": "Korea Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Tbps", "pol": "Selective", "web": "http://www.kt.com/eng/main.jsp"}, "pfx": 2157, "reg": "1996-04-22", "rir": "apnic", "s24": 181195, "sib": 11, "tor": 0, "w24": 1034, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 69943552, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.461554}, {"a": 4771, "h": "SPARKNZ", "n": "Spark New Zealand Trading Ltd.", "t": "Other", "w": 6, "cc": "NZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 3, "home_connection": 4, "mail_bruteforce": 3}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.64, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.02, "lo": 0.22, "ips": 4, "mean": 0.56, "above": false}, "blocklist_de": {"n": 2, "p": 0.0003, "hi": 1.49, "lo": 0.19, "ips": 2, "mean": 0.71, "above": false}}, "h2": [["2026-10-05", 0.247, 0.007, 0, false], ["2026-10-12", 0.178, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.754, "ts": null, "map": 0.093, "obs": 0, "own": 0.170, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.178, "se": 0.560, "ts": 0.667, "map": 0.375, "obs": 6, "own": 0.214, "comp": {"cins": -1.1592, "dshield": -1.8522, "crowdsec": 2.7306, "vulncheck": -0.8528, "blocklist_de": 1.5469}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.098, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SV2-AP-APNIC", "org": "Spark Ventures", "pdb": null, "pfx": 415, "reg": "1996-01-04", "rir": "apnic", "s24": 3012, "sib": 18, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 774400, "abuse": "abuse@xtra.co.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0385374965625}, {"a": 4773, "h": "MOBILEONELTD-AS-AP", "n": "M1 Limited", "t": "Broadband & mobile", "w": 7, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 5, "router_or_botnet": 1}, "n": 7}, "ev": {"crowdsec": {"n": 7, "p": 0.0134, "hi": 2.54, "lo": 0.77, "ips": 7, "mean": 1.55, "above": false}, "blocklist_de": {"n": 2, "p": 0.0133, "hi": 2.35, "lo": 0.30, "ips": 2, "mean": 1.12, "above": false}}, "h2": [["2026-10-05", 0.468, 0.008, 0, false], ["2026-10-12", 0.522, 0.009, 0, false]], "sh": false, "uc": 76.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.802, "ts": null, "map": 0.115, "obs": 0, "own": 0.547, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.522, "se": 0.502, "ts": 0.778, "map": 0.985, "obs": 9, "own": 1.526, "comp": {"cins": -1.4473, "dshield": -2.1289, "crowdsec": 6.3271, "vulncheck": -0.8914, "blocklist_de": -0.4812}, "mass": 8.6, "listed": false}}, "abq": false, "bot": 0.105, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-ML7-AP-APNIC", "org": "M1 LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.m1.com.sg"}, "pfx": 69, "reg": "2005-01-10", "rir": "apnic", "s24": 1569, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 748032, "abuse": "abuse@m1.com.sg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02162697903782}, {"a": 4775, "h": "GLOBE-TELECOM-AS", "n": "Globe Telecom", "t": "Broadband & mobile", "w": 13, "cc": "PH", "cf": {"rb": "", "wb": "", "rep": 0.94, "waf": 0.37}, "cs": {"c": {"http_flood": 6, "data_centre": 1, "web_exploit": 6, "bad_crawling": 2, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 3}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.0396, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "dshield": {"n": 3, "p": 0.1921, "hi": 4.16, "lo": 0.73, "ips": 3, "mean": 2.15, "above": false}, "crowdsec": {"n": 7, "p": 0.0117, "hi": 2.51, "lo": 0.76, "ips": 7, "mean": 1.52, "above": false}, "phishing_db": {"n": 1, "p": 0.0303, "hi": 2.66, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "blocklist_de": {"n": 1, "p": 0.0027, "hi": 1.75, "lo": 0.13, "ips": 1, "mean": 0.74, "above": false}}, "h2": [["2026-10-05", 1.212, 0.278, 0, false], ["2026-10-12", 0.706, 0.075, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.075, "se": 1.342, "ts": 1.000, "map": 0.439, "obs": 1, "own": 1.404, "comp": {"urlhaus": -0.424, "threatfox": -0.3341, "phishing_db": 1.5621}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.706, "se": 0.470, "ts": 0.583, "map": 1.261, "obs": 12, "own": 1.951, "comp": {"cins": 1.5036, "dshield": 3.0555, "crowdsec": 3.2154, "vulncheck": -0.9178, "blocklist_de": -5.231}, "mass": 11.2, "listed": false}}, "abq": true, "bot": 0.088, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-GT1-AP-APNIC", "org": "Globe Telecom (GMCR,INC)", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.globe.com.ph/business"}, "pfx": 577, "reg": "1996-08-09", "rir": "apnic", "s24": 1598, "sib": 17, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 893440, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.320828}, {"a": 4780, "h": "SEEDNET", "n": "New Century InfoComm Tech Co.,Ltd.", "t": "Broadband & mobile", "w": 5, "cc": "TW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 0.36, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}, "vulncheck": {"n": 2, "p": 0.0002, "hi": 1.46, "lo": 0.19, "ips": 2, "mean": 0.70, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.81, "lo": 0.11, "ips": 2, "mean": 0.39, "above": false}}, "h2": [["2026-10-05", 0.134, 0.006, 0, false], ["2026-10-12", 0.071, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.705, "ts": null, "map": 0.069, "obs": 0, "own": 0.311, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 2}, "lo": 0.071, "se": 0.582, "ts": 0.333, "map": 0.153, "obs": 6, "own": 0.241, "comp": {"cins": -1.0305, "dshield": -1.7125, "crowdsec": -1.3055, "vulncheck": 1.0886, "blocklist_de": 2.4762}, "mass": 5.5, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"attack_tooling": 2}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.seed.net.tw"}, "pfx": 1544, "reg": "1996-07-09", "rir": "apnic", "s24": 6295, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5156608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00658808967975}, {"a": 4785, "h": "XTOM-AS-JP", "n": "xTom Osaka", "t": "Broadband & mobile", "w": 12, "cc": "GB", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6321, "hi": 7.58, "lo": 1.34, "ips": 12, "mean": 3.91, "above": false}}, "h2": [["2026-10-05", 0.251, 5.100, 0, false], ["2026-10-12", 0.010, 5.145, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 5.145, "se": 1.001, "ts": 1.000, "map": 17.968, "obs": 3, "own": 42.277, "comp": {"urlhaus": -0.4876, "threatfox": -0.3577, "phishing_db": 5.36}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.191, "obs": 0, "own": 0.736, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.633, "det": null, "oid": "ORG-XL1-AP-APNIC", "org": "xTom Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://xtom.com/"}, "pfx": 46, "reg": "2018-02-22", "rir": "apnic", "s24": 46, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": "abuse@xtom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022864875189}, {"a": 4787, "h": "ASN-CBN", "n": "CBN Internet", "t": "Broadband & mobile", "w": 6, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1128, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "shodan": {"n": 3, "p": 0.0970, "hi": 3.46, "lo": 0.61, "ips": 3, "mean": 1.78, "above": false}, "crowdsec": {"n": 4, "p": 0.1221, "hi": 3.59, "lo": 0.77, "ips": 4, "mean": 1.96, "above": false}, "blocklist_de": {"n": 3, "p": 0.2836, "hi": 4.78, "lo": 0.84, "ips": 3, "mean": 2.46, "above": false}}, "h2": [["2026-10-05", 0.821, 0.009, 0, false], ["2026-10-12", 1.313, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.879, "ts": null, "map": 0.148, "obs": 0, "own": 0.789, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.313, "se": 0.519, "ts": 0.500, "map": 2.593, "obs": 8, "own": 4.010, "comp": {"cins": 2.1418, "dshield": -2.1086, "crowdsec": 0.2575, "vulncheck": -0.8888, "blocklist_de": 2.9447}, "mass": 8.4, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.cbn.id"}, "pfx": 434, "reg": "1996-10-15", "rir": "apnic", "s24": 582, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 576512, "abuse": "abuse@cbn.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0049859007374}, {"a": 4788, "h": "TTSSB-MY", "n": "Telekom Malaysia Berhad (TM)", "t": "Broadband & mobile", "w": 78, "cc": "MY", "cf": {"rb": "", "wb": "", "rep": 1.36, "waf": 1.80}, "cs": {"c": {"http_flood": 6, "web_exploit": 9, "bad_crawling": 1, "proxy_or_vpn": 7, "first_seen_30d": 9, "ssh_bruteforce": 24, "web_bruteforce": 11, "home_connection": 25, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2017-16894": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 2}, "n": 29}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 1.22, "lo": 0.21, "ips": 3, "mean": 0.63, "above": false}, "shodan": {"n": 9, "p": 0.0000, "hi": 0.56, "lo": 0.19, "ips": 9, "mean": 0.36, "above": false}, "dshield": {"n": 17, "p": 0.1023, "hi": 3.25, "lo": 1.48, "ips": 18, "mean": 2.29, "above": false}, "crowdsec": {"n": 28, "p": 0.0000, "hi": 1.11, "lo": 0.60, "ips": 29, "mean": 0.84, "above": false}, "vulncheck": {"n": 11, "p": 0.0045, "hi": 2.38, "lo": 0.90, "ips": 13, "mean": 1.57, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.87, "lo": 0.11, "ips": 3, "mean": 0.42, "above": false}, "blocklist_de": {"n": 16, "p": 0.0000, "hi": 1.66, "lo": 0.74, "ips": 16, "mean": 1.16, "above": false}}, "h2": [["2026-10-05", 0.662, 0.040, 0, false], ["2026-10-12", 0.619, 0.042, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.042, "se": 1.188, "ts": 1.000, "map": 0.162, "obs": 2, "own": 0.564, "comp": {"urlhaus": -0.9891, "threatfox": -0.4695, "phishing_db": 1.2639}, "mass": 4.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 17, "crowdsec": 28, "vulncheck": 11, "blocklist_de": 16}, "lo": 0.619, "se": 0.380, "ts": 0.373, "map": 0.961, "obs": 75, "own": 1.483, "comp": {"cins": -0.249, "dshield": 3.8062, "crowdsec": -1.3555, "vulncheck": 0.0078, "blocklist_de": -0.8556}, "mass": 67.7, "listed": false}}, "abq": false, "bot": 0.188, "det": {"shodan": {"compromised": 9}, "threatfox": {"family:Mirai": 2}, "vulncheck": {"c2_server": 2, "botnet_node": 10, "attack_tooling": 1}, "blocklist_de": {"ssh": 6, "bots": 5, "imap": 1, "mail": 1, "apache": 4, "bruteforcelogin": 4}}, "oid": "ORG-WDSB1-AP-APNIC", "org": "TM TECHNOLOGY SERVICES SDN BHD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.tm.com.my"}, "pfx": 370, "reg": "1996-10-20", "rir": "apnic", "s24": 12689, "sib": 6, "tor": 0, "w24": 72, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10163968, "abuse": "abuse@tm.com.my", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.159146}, {"a": 4800, "h": "LINTASARTA-AS-AP", "n": "Lintasarta", "t": "Transit & backbone", "w": 15, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 8, "cve:CVE-2024-28000": 3, "cve:CVE-2026-67208": 1}, "n": 10}, "ev": {"cins": {"n": 4, "p": 0.6494, "hi": 7.05, "lo": 1.52, "ips": 4, "mean": 3.85, "above": false}, "shodan": {"n": 3, "p": 0.0582, "hi": 3.09, "lo": 0.54, "ips": 3, "mean": 1.59, "above": false}, "dshield": {"n": 1, "p": 0.0817, "hi": 3.44, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "urlhaus": {"n": 2, "p": 0.3808, "hi": 5.91, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}, "crowdsec": {"n": 10, "p": 0.7489, "hi": 5.90, "lo": 2.14, "ips": 10, "mean": 3.82, "above": false}, "blocklist_de": {"n": 1, "p": 0.0323, "hi": 2.70, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 1.582, 0.177, 0, false], ["2026-10-12", 2.419, 0.888, 0, false]], "sh": false, "uc": 70.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.888, "se": 1.131, "ts": 1.000, "map": 3.984, "obs": 2, "own": 14.012, "comp": {"urlhaus": 4.5058, "threatfox": -0.4978, "phishing_db": -0.9995}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 1, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.419, "se": 0.443, "ts": 0.625, "map": 4.116, "obs": 16, "own": 12.880, "comp": {"cins": 8.8995, "dshield": -1.2318, "crowdsec": 3.4598, "vulncheck": -0.946, "blocklist_de": -7.373}, "mass": 16.1, "listed": false}}, "abq": false, "bot": 0.611, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@family-37045", "org": "PT Aplikanusa Lintasarta", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.lintasarta.net"}, "pfx": 716, "reg": "1996-12-25", "rir": "apnic", "s24": 706, "sib": 2, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 196608, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0029059326098}, {"a": 4804, "h": "MPX-AS", "n": "Optus Internet", "t": "Broadband & mobile", "w": 4, "cc": "AU", "cf": {"rb": "hi", "wb": "hi", "rep": 0.50, "waf": 0.44}, "cs": {"c": {"web_exploit": 3, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 0.39, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.14, "lo": 0.02, "ips": 3, "mean": 0.07, "above": false}}, "h2": [["2026-10-05", 0.028, 0.004, 0, false], ["2026-10-12", 0.017, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.643, "ts": null, "map": 0.041, "obs": 0, "own": 0.189, "comp": null, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.017, "se": 0.621, "ts": 0.750, "map": 0.039, "obs": 4, "own": 0.061, "comp": {"cins": -0.8863, "dshield": 1.442, "crowdsec": 2.7936, "vulncheck": -0.7993, "blocklist_de": -4.4066}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.076, "det": null, "oid": "ORG-SOPL2-AP-APNIC", "org": "SingTel Optus Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Tbps", "pol": "Selective", "web": "http://optus.com.au"}, "pfx": 283, "reg": "1996-11-07", "rir": "apnic", "s24": 20589, "sib": 60, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9272576, "abuse": "abuse@optusnet.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.145392}, {"a": 4808, "h": "CHINA169-BJ", "n": "China Unicom Beijing Province Network", "t": "Broadband & mobile", "w": 120, "cc": "CN", "cf": {"rb": "lo", "wb": "lo", "rep": 3.45, "waf": 2.36}, "cs": {"c": {"http_flood": 4, "web_exploit": 9, "bad_crawling": 4, "proxy_or_vpn": 5, "first_seen_30d": 9, "ssh_bruteforce": 49, "web_bruteforce": 13, "home_connection": 1, "mail_bruteforce": 20, "cve:CVE-2017-9841": 3, "cve:CVE-2024-6387": 21, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-26134": 1}, "n": 59}, "ev": {"cins": {"n": 14, "p": 0.0000, "hi": 1.70, "lo": 0.72, "ips": 16, "mean": 1.17, "above": false}, "shodan": {"n": 20, "p": 0.0000, "hi": 0.48, "lo": 0.23, "ips": 20, "mean": 0.34, "above": false}, "dshield": {"n": 17, "p": 0.0000, "hi": 1.58, "lo": 0.72, "ips": 17, "mean": 1.11, "above": false}, "urlhaus": {"n": 3, "p": 0.0057, "hi": 2.16, "lo": 0.38, "ips": 3, "mean": 1.11, "above": false}, "crowdsec": {"n": 52, "p": 0.0000, "hi": 0.87, "lo": 0.55, "ips": 59, "mean": 0.70, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.30, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.32, "lo": 0.02, "ips": 1, "mean": 0.14, "above": false}, "blocklist_de": {"n": 48, "p": 0.0000, "hi": 1.96, "lo": 1.22, "ips": 48, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.514, 0.069, 0, false], ["2026-10-12", 0.691, 0.121, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 1}, "lo": 0.121, "se": 1.037, "ts": 0.750, "map": 0.366, "obs": 4, "own": 1.113, "comp": {"urlhaus": 2.0689, "threatfox": -0.5646, "phishing_db": -0.8841}, "mass": 17.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 14, "dshield": 17, "crowdsec": 52, "vulncheck": 1, "blocklist_de": 48}, "lo": 0.691, "se": 0.369, "ts": 0.394, "map": 1.027, "obs": 132, "own": 1.583, "comp": {"cins": 3.3572, "dshield": -0.309, "crowdsec": -3.9718, "vulncheck": -0.9699, "blocklist_de": 3.3134}, "mass": 160.0, "listed": false}}, "abq": true, "bot": 0.458, "det": {"shodan": {"compromised": 20}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 13, "bots": 1, "imap": 25, "mail": 34}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 1183, "reg": "1996-01-09", "rir": "apnic", "s24": 28085, "sib": 25, "tor": 0, "w24": 109, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13276928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03691859246218}, {"a": 4809, "h": "CHINATELECOM-CORE-WAN-CN2", "n": "China Telecom / CN2", "t": "Broadband & mobile", "w": 8, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-20767": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0207, "hi": 2.46, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.83, "lo": 0.06, "ips": 1, "mean": 0.35, "above": false}, "dshield": {"n": 2, "p": 0.0408, "hi": 2.87, "lo": 0.37, "ips": 2, "mean": 1.37, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 1.53, "lo": 0.38, "ips": 5, "mean": 0.87, "above": false}, "blocklist_de": {"n": 3, "p": 0.0097, "hi": 2.30, "lo": 0.41, "ips": 3, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.400, 0.007, 0, false], ["2026-10-12", 0.521, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.777, "ts": null, "map": 0.103, "obs": 0, "own": 0.478, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.521, "se": 0.480, "ts": 0.455, "map": 0.944, "obs": 11, "own": 1.462, "comp": {"cins": 1.4269, "dshield": 1.148, "crowdsec": -0.6113, "vulncheck": -0.9207, "blocklist_de": 0.2936}, "mass": 11.6, "listed": false}}, "abq": true, "bot": 0.370, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "@aut-4809-APNIC", "org": "China Telecom Next Generation Carrier Network", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-200Gbps", "pol": "Selective", "web": "http://en.chinatelecom.com.cn/"}, "pfx": 232, "reg": "1996-01-09", "rir": "apnic", "s24": 2206, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 602112, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00281024045269}, {"a": 4811, "h": "CHINANET-SHANGHAI-MAN", "n": "China Telecom Shanghai IDC Network", "t": "Broadband & mobile", "w": 460, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 154, "data_centre": 5, "web_exploit": 155, "bad_crawling": 7, "proxy_or_vpn": 8, "first_seen_30d": 14, "ssh_bruteforce": 172, "web_bruteforce": 48, "home_connection": 1, "mail_bruteforce": 7, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 4, "cve:CVE-2024-6387": 140, "cve:CVE-2018-20062": 5, "cve:CVE-2021-43798": 1}, "n": 425}, "ev": {"cins": {"n": 5, "p": 0.1553, "hi": 3.74, "lo": 0.93, "ips": 5, "mean": 2.14, "above": false}, "shodan": {"n": 84, "p": 1.0000, "hi": 9.93, "lo": 6.94, "ips": 84, "mean": 8.38, "above": true}, "dshield": {"n": 1, "p": 0.0005, "hi": 1.43, "lo": 0.11, "ips": 1, "mean": 0.60, "above": false}, "crowdsec": {"n": 119, "p": 1.0000, "hi": 11.19, "lo": 8.29, "ips": 425, "mean": 9.69, "above": true}, "threatfox": {"n": 5, "p": 0.6211, "hi": 6.34, "lo": 1.58, "ips": 5, "mean": 3.62, "above": false}, "vulncheck": {"n": 1, "p": 0.0006, "hi": 1.46, "lo": 0.11, "ips": 1, "mean": 0.62, "above": false}, "phishing_db": {"n": 1, "p": 0.0010, "hi": 1.53, "lo": 0.11, "ips": 1, "mean": 0.65, "above": false}, "blocklist_de": {"n": 84, "p": 1.0000, "hi": 18.02, "lo": 12.60, "ips": 116, "mean": 15.21, "above": true}}, "h2": [["2026-10-05", 5.221, 0.317, 0, false], ["2026-10-12", 6.517, 0.273, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 1}, "lo": 0.273, "se": 0.967, "ts": 0.833, "map": 0.741, "obs": 6, "own": 2.148, "comp": {"urlhaus": -1.3087, "threatfox": 2.8794, "phishing_db": -0.2439}, "mass": 5.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 1, "crowdsec": 119, "vulncheck": 1, "blocklist_de": 84}, "lo": 6.517, "se": 0.355, "ts": 0.567, "map": 9.500, "obs": 210, "own": 14.557, "comp": {"cins": -2.218, "dshield": -3.3639, "crowdsec": 1.8659, "vulncheck": -0.9835, "blocklist_de": 8.3444}, "mass": 224.3, "listed": false}}, "abq": true, "bot": 0.604, "det": {"shodan": {"c2": 1, "compromised": 83}, "threatfox": {"family:Cobalt Strike": 4, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 1, "ssh": 113, "apache": 2, "bruteforcelogin": 1}}, "oid": "@aut-4811-APNIC", "org": "China Telecom (Group)", "pdb": null, "pfx": 1508, "reg": "1999-05-12", "rir": "apnic", "s24": 4281, "sib": 1, "tor": 0, "w24": 148, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 1181952, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00797009362526}, {"a": 4812, "h": "CHINANET-SH-AP", "n": "China Telecom Shanghai Province Network", "t": "Broadband & mobile", "w": 121, "cc": "CN", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 2.44}, "cs": {"c": {"web_exploit": 13, "proxy_or_vpn": 8, "first_seen_30d": 7, "ssh_bruteforce": 46, "web_bruteforce": 29, "home_connection": 4, "mail_bruteforce": 32, "router_or_botnet": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2019-8318": 4, "cve:CVE-2024-6387": 12, "cve:CVE-2024-12847": 2, "cve:CVE-2026-63030": 1}, "n": 67}, "ev": {"cins": {"n": 21, "p": 0.0003, "hi": 2.16, "lo": 1.06, "ips": 22, "mean": 1.57, "above": false}, "shodan": {"n": 19, "p": 0.0000, "hi": 0.42, "lo": 0.20, "ips": 19, "mean": 0.30, "above": false}, "dshield": {"n": 25, "p": 0.0000, "hi": 1.98, "lo": 1.03, "ips": 25, "mean": 1.48, "above": false}, "urlhaus": {"n": 3, "p": 0.0033, "hi": 2.02, "lo": 0.36, "ips": 3, "mean": 1.04, "above": false}, "crowdsec": {"n": 64, "p": 0.0000, "hi": 0.95, "lo": 0.63, "ips": 67, "mean": 0.79, "above": false}, "blocklist_de": {"n": 36, "p": 0.0000, "hi": 1.40, "lo": 0.81, "ips": 36, "mean": 1.09, "above": false}}, "h2": [["2026-10-05", 0.538, 0.021, 0, false], ["2026-10-12", 0.661, 0.100, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.100, "se": 1.064, "ts": 1.000, "map": 0.321, "obs": 3, "own": 0.988, "comp": {"urlhaus": 2.2077, "threatfox": -0.5635, "phishing_db": -1.1534}, "mass": 17.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 21, "dshield": 25, "crowdsec": 64, "vulncheck": 0, "blocklist_de": 36}, "lo": 0.661, "se": 0.368, "ts": 0.438, "map": 0.991, "obs": 146, "own": 1.529, "comp": {"cins": 6.4748, "dshield": 0.9216, "crowdsec": -2.4498, "vulncheck": -1.0095, "blocklist_de": -2.5524}, "mass": 169.3, "listed": false}}, "abq": true, "bot": 0.548, "det": {"shodan": {"compromised": 19}, "blocklist_de": {"ftp": 1, "ssh": 15, "imap": 14, "mail": 20}}, "oid": "@aut-4811-APNIC", "org": "China Telecom (Group)", "pdb": null, "pfx": 466, "reg": "1996-01-09", "rir": "apnic", "s24": 30777, "sib": 1, "tor": 0, "w24": 115, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13637376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03803939616776}, {"a": 4816, "h": "CHINANET-IDC-GD", "n": "China Telecom (Group)", "t": "Broadband & mobile", "w": 5, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 1, "cve:CVE-2024-6387": 3, "cve:CVE-2020-11738": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-20767": 1}, "n": 5}, "ev": {"shodan": {"n": 5, "p": 0.7852, "hi": 7.89, "lo": 1.96, "ips": 5, "mean": 4.50, "above": false}, "dshield": {"n": 1, "p": 0.1645, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 4, "p": 0.5813, "hi": 6.47, "lo": 1.39, "ips": 5, "mean": 3.53, "above": false}, "blocklist_de": {"n": 3, "p": 0.5363, "hi": 6.64, "lo": 1.17, "ips": 3, "mean": 3.43, "above": false}}, "h2": [["2026-10-05", 3.940, 0.010, 0, false], ["2026-10-12", 4.277, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.199, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 4.277, "se": 0.519, "ts": 0.500, "map": 8.471, "obs": 8, "own": 13.057, "comp": {"cins": -1.2987, "dshield": 0.3361, "crowdsec": 1.3819, "vulncheck": -0.8732, "blocklist_de": 3.9843}, "mass": 7.3, "listed": false}}, "abq": true, "bot": 0.721, "det": {"shodan": {"malware": 1, "compromised": 4}, "blocklist_de": {"ssh": 3}}, "oid": "@aut-4835-APNIC", "org": "China Telecom (Group)", "pdb": null, "pfx": 42, "reg": "1996-01-09", "rir": "apnic", "s24": 156, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015776135388}, {"a": 4818, "h": "DIGIIX-AP", "n": "CelcomDigi", "t": "Broadband & mobile", "w": 264, "cc": "MY", "cf": {"rb": "hi", "wb": "hi", "rep": 0.75, "waf": 0.65}, "cs": {"c": {"web_exploit": 21, "proxy_or_vpn": 9, "ssh_bruteforce": 156, "web_bruteforce": 97, "mail_bruteforce": 242, "cve:CVE-2019-8318": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2021-41773": 1}, "n": 242}, "ev": {"crowdsec": {"n": 20, "p": 0.9679, "hi": 6.52, "lo": 3.16, "ips": 242, "mean": 4.71, "above": true}, "blocklist_de": {"n": 15, "p": 0.9969, "hi": 9.65, "lo": 4.19, "ips": 63, "mean": 6.69, "above": true}}, "h2": [["2026-10-05", 3.005, 0.008, 0, false], ["2026-10-12", 3.242, 0.009, 0, false]], "sh": false, "uc": 8675.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.817, "ts": null, "map": 0.122, "obs": 0, "own": 0.588, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 20, "vulncheck": 0, "blocklist_de": 15}, "lo": 3.242, "se": 0.394, "ts": 0.571, "map": 5.140, "obs": 35, "own": 7.891, "comp": {"cins": -3.0146, "dshield": -3.097, "crowdsec": 1.9717, "vulncheck": -0.9846, "blocklist_de": 8.1551}, "mass": 36.9, "listed": false}}, "abq": false, "bot": 0.080, "det": {"blocklist_de": {"imap": 29, "mail": 63}}, "oid": "ORG-DTSB1-AP-APNIC", "org": "DiGi Telecommunications Sdn Bhd., Digi Internet Exchange", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Tbps", "pol": "Selective", "web": "https://corporate.celcomdigi.com/news/press"}, "pfx": 13, "reg": "2001-12-07", "rir": "apnic", "s24": 1300, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 599040, "abuse": "abuse@celcomdigi.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0982}, {"a": 4837, "h": "CHINA169-Backbone", "n": "China Unicom", "t": "Broadband & mobile", "w": 1481, "cc": "CN", "cf": {"rb": "", "wb": "", "rep": 1.29, "waf": 2.58}, "cs": {"c": {"http_flood": 297, "web_exploit": 206, "bad_crawling": 83, "proxy_or_vpn": 81, "first_seen_30d": 78, "ssh_bruteforce": 220, "web_bruteforce": 324, "home_connection": 742, "mail_bruteforce": 99, "router_or_botnet": 5, "cve:CVE-2024-6387": 80, "cve:CVE-2025-4396": 149, "cve:CVE-2021-26084": 59, "cve:CVE-2022-26134": 22, "cve:CVE-2024-28000": 80}, "n": 815}, "ev": {"cins": {"n": 124, "p": 0.0000, "hi": 1.51, "lo": 1.12, "ips": 187, "mean": 1.31, "above": false}, "shodan": {"n": 153, "p": 0.0000, "hi": 0.37, "lo": 0.28, "ips": 153, "mean": 0.32, "above": false}, "dshield": {"n": 262, "p": 0.0000, "hi": 2.39, "lo": 1.95, "ips": 278, "mean": 2.16, "above": false}, "urlhaus": {"n": 171, "p": 1.0000, "hi": 8.96, "lo": 6.97, "ips": 172, "mean": 7.94, "above": true}, "crowdsec": {"n": 297, "p": 0.0000, "hi": 0.55, "lo": 0.45, "ips": 815, "mean": 0.50, "above": false}, "threatfox": {"n": 5, "p": 0.0000, "hi": 0.30, "lo": 0.07, "ips": 9, "mean": 0.17, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 3, "mean": 0.03, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.06, "lo": 0.01, "ips": 2, "mean": 0.03, "above": false}, "blocklist_de": {"n": 150, "p": 0.0000, "hi": 0.71, "lo": 0.55, "ips": 156, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.429, 1.540, 0, false], ["2026-10-12", 0.508, 1.063, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 171, "threatfox": 5, "phishing_db": 2}, "lo": 1.063, "se": 0.803, "ts": 0.961, "map": 2.187, "obs": 178, "own": 5.734, "comp": {"urlhaus": 4.192, "threatfox": -0.5683, "phishing_db": -1.2149}, "mass": 728.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 124, "dshield": 262, "crowdsec": 297, "vulncheck": 3, "blocklist_de": 150}, "lo": 0.508, "se": 0.360, "ts": 0.355, "map": 0.753, "obs": 836, "own": 1.162, "comp": {"cins": 7.8343, "dshield": 5.0123, "crowdsec": -4.2901, "vulncheck": -0.9951, "blocklist_de": -6.4517}, "mass": 934.3, "listed": false}}, "abq": true, "bot": 0.645, "det": {"shodan": {"c2": 8, "malware": 7, "compromised": 138}, "threatfox": {"family:DeimosC2": 2, "family:Cobalt Strike": 1, "family:Unknown malware": 6}, "vulncheck": {"c2_server": 1, "other_infrastructure": 2}, "blocklist_de": {"ftp": 3, "ssh": 73, "bots": 1, "imap": 34, "mail": 73, "apache": 6, "bruteforcelogin": 5}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.chinaunicom.cn/"}, "pfx": 1487, "reg": "2001-09-17", "rir": "apnic", "s24": 223415, "sib": 0, "tor": 0, "w24": 864, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 59256320, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.408089}, {"a": 4847, "h": "CNIX-AP", "n": "CNIX-AP", "t": "Other", "w": 28, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2019-8318": 2, "cve:CVE-2024-6387": 2, "cve:CVE-2018-10562": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-36260": 1}, "n": 14}, "ev": {"cins": {"n": 7, "p": 0.0004, "hi": 1.89, "lo": 0.57, "ips": 7, "mean": 1.15, "above": false}, "shodan": {"n": 10, "p": 0.0000, "hi": 0.55, "lo": 0.20, "ips": 10, "mean": 0.35, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.73, "lo": 0.10, "ips": 2, "mean": 0.35, "above": false}, "urlhaus": {"n": 1, "p": 0.0079, "hi": 2.06, "lo": 0.15, "ips": 1, "mean": 0.87, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 0.54, "lo": 0.22, "ips": 14, "mean": 0.36, "above": false}, "threatfox": {"n": 1, "p": 0.0008, "hi": 1.50, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 0.90, "lo": 0.29, "ips": 8, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.265, 0.057, 0, false], ["2026-10-12", 0.300, 0.061, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 0.061, "se": 1.187, "ts": 0.500, "map": 0.253, "obs": 2, "own": 0.328, "comp": {"urlhaus": 1.1966, "threatfox": 0.0967, "phishing_db": -1.0406}, "mass": 6.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 2, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.300, "se": 0.410, "ts": 0.433, "map": 0.487, "obs": 30, "own": 0.276, "comp": {"cins": 8.681, "dshield": -1.7088, "crowdsec": -3.153, "vulncheck": -0.9855, "blocklist_de": -2.1596}, "mass": 38.2, "listed": false}}, "abq": true, "bot": 0.559, "det": {"shodan": {"compromised": 10}, "threatfox": {"family:DanaBot": 1}, "blocklist_de": {"ssh": 6, "imap": 1, "mail": 2}}, "oid": null, "org": null, "pdb": null, "pfx": 808, "reg": "1996-09-10", "rir": "apnic", "s24": 14091, "sib": 0, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4582656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00665679651962}, {"a": 4855, "h": "PI-ID-AS-AP", "n": "Pacific Link Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.920, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-4855-APNIC", "org": "Pacific Link Indonesia", "pdb": null, "pfx": 3, "reg": "1996-12-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@pacific.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 4907, "h": "IENS-AS-AP", "n": "BGPNET PTE. LTD.", "t": "Other", "w": 4, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7194, "hi": 7.77, "lo": 1.67, "ips": 4, "mean": 4.25, "above": false}, "threatfox": {"n": 2, "p": 0.4147, "hi": 6.22, "lo": 0.81, "ips": 4, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.009, 7.985, 0, false], ["2026-10-12", 0.009, 1.408, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.408, "se": 1.151, "ts": 1.000, "map": 6.416, "obs": 2, "own": 6.598, "comp": {"urlhaus": -0.3321, "threatfox": 4.3727, "phishing_db": -0.5556}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.829, "ts": null, "map": 0.165, "obs": 0, "own": 0.197, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.916, "det": {"shodan": {"compromised": 4}, "threatfox": {"family:DCRat": 3, "family:AdaptixC2": 1}}, "oid": "ORG-BP8-AP-APNIC", "org": "IENS TECHNOLOGY PTE. LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://bgpnet.com"}, "pfx": 83, "reg": "2020-09-17", "rir": "apnic", "s24": 83, "sib": 2, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": "abuse@iens.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026537997204}, {"a": 4922, "h": "SHENTEL", "n": "Shentel Service Company", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0677, "hi": 3.25, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "crowdsec": {"n": 2, "p": 0.0033, "hi": 1.93, "lo": 0.25, "ips": 2, "mean": 0.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.0219, "hi": 2.48, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}}, "h2": [["2026-10-12", 0.330, 0.009, 0, false]], "sh": false, "uc": 63.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.850, "ts": null, "map": 0.136, "obs": 0, "own": 0.689, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.330, "se": 0.644, "ts": 0.500, "map": 0.806, "obs": 4, "own": 1.259, "comp": {"cins": -0.7818, "dshield": 1.7711, "crowdsec": 0.76, "vulncheck": -0.7718, "blocklist_de": 0.2002}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.147, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "SCTL-16-ARIN", "org": "Shenandoah Cable Television LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://shentel.com"}, "pfx": 91, "reg": "1995-05-08", "rir": "arin", "s24": 849, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 437248, "abuse": "abuse@shentel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01729559545314}, {"a": 5056, "h": "AUREON-5056", "n": "Aureon Network Services", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0004, "hi": 1.38, "lo": 0.10, "ips": 1, "mean": 0.58, "above": false}, "crowdsec": {"n": 2, "p": 0.0005, "hi": 1.57, "lo": 0.20, "ips": 2, "mean": 0.75, "above": false}}, "h2": [["2026-10-05", 0.086, 0.008, 0, false], ["2026-10-12", 0.089, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.126, "obs": 0, "own": 0.619, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.089, "se": 0.824, "ts": 1.000, "map": 0.304, "obs": 2, "own": 0.484, "comp": {"cins": -0.4323, "dshield": -0.8828, "crowdsec": 4.3536, "vulncheck": -0.6244, "blocklist_de": -2.2104}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"compromised": 1}}, "oid": "INS-50-ARIN", "org": "Aureon Network Services", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.aureon.com/"}, "pfx": 209, "reg": "1995-06-05", "rir": "arin", "s24": 1136, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 496128, "abuse": "abuse@netins.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00667915191794}, {"a": 5065, "h": "BUNNY-COMMUNICATIONS-GLOBAL", "n": "Bunny Communications", "t": "Broadband & mobile", "w": 16, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 16, "web_exploit": 4, "home_connection": 14}, "n": 16}, "ev": {"shodan": {"n": 2, "p": 0.0234, "hi": 2.58, "lo": 0.34, "ips": 2, "mean": 1.23, "above": false}, "crowdsec": {"n": 5, "p": 0.1599, "hi": 3.77, "lo": 0.94, "ips": 16, "mean": 2.15, "above": false}}, "h2": [["2026-10-05", 0.876, 0.009, 0, false], ["2026-10-12", 0.511, 0.010, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.144, "obs": 0, "own": 0.749, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.511, "se": 0.596, "ts": 1.000, "map": 1.148, "obs": 5, "own": 1.785, "comp": {"cins": -0.8634, "dshield": -1.5135, "crowdsec": 9.0008, "vulncheck": -0.7937, "blocklist_de": -4.2986}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.697, "det": {"shodan": {"compromised": 2}}, "oid": "BCL-435-ARIN", "org": "Bunny Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://bunnycommunications.com/"}, "pfx": 612, "reg": "2021-06-07", "rir": "arin", "s24": 673, "sib": 1, "tor": 0, "w24": 5, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 175104, "abuse": "abuse@bunnycommunications.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00123656787362}, {"a": 5089, "h": "NTL", "n": "Virgin Media", "t": "Broadband & mobile", "w": 178, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 0.47, "waf": 0.45}, "cs": {"c": {"http_flood": 153, "data_centre": 1, "web_exploit": 155, "bad_crawling": 46, "proxy_or_vpn": 141, "first_seen_30d": 2, "ssh_bruteforce": 7, "web_bruteforce": 9, "home_connection": 18, "mail_bruteforce": 4, "router_or_botnet": 139, "cve:CVE-2024-6387": 2, "cve:CVE-2025-4396": 3, "cve:CVE-2024-28000": 1}, "n": 162}, "ev": {"shodan": {"n": 5, "p": 0.0000, "hi": 0.15, "lo": 0.04, "ips": 5, "mean": 0.08, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 0.48, "lo": 0.10, "ips": 4, "mean": 0.26, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 0.20, "lo": 0.08, "ips": 162, "mean": 0.13, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.26, "lo": 0.02, "ips": 1, "mean": 0.11, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.28, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "blocklist_de": {"n": 11, "p": 0.0000, "hi": 0.50, "lo": 0.19, "ips": 11, "mean": 0.33, "above": false}}, "h2": [["2026-10-05", 0.107, 0.011, 0, false], ["2026-10-12", 0.101, 0.020, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.020, "se": 1.229, "ts": 0.500, "map": 0.078, "obs": 2, "own": 0.305, "comp": {"urlhaus": -1.1578, "threatfox": 0.309, "phishing_db": -0.0704}, "mass": 5.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 11, "vulncheck": 1, "blocklist_de": 11}, "lo": 0.101, "se": 0.418, "ts": 0.407, "map": 0.166, "obs": 27, "own": 0.258, "comp": {"cins": -2.8205, "dshield": 0.3609, "crowdsec": -2.6063, "vulncheck": -0.78, "blocklist_de": 5.4459}, "mass": 30.8, "listed": false}}, "abq": false, "bot": 0.116, "det": {"shodan": {"compromised": 4, "doublepulsar": 1}, "threatfox": {"family:AsyncRAT": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 4, "bots": 6, "mail": 1}}, "oid": "ORG-NI9-RIPE", "org": "Virgin Media Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Tbps", "pol": "Restrictive", "web": "http://www.virginmedia.com"}, "pfx": 285, "reg": "1993-09-01", "rir": "ripencc", "s24": 33166, "sib": 6, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23024384, "abuse": "abuse@virginmediao2.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.429743}, {"a": 5378, "h": "", "n": "Vodafone UK", "t": "Broadband & mobile", "w": 4, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 0.64, "waf": 0.61}, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.0000, "hi": 0.48, "lo": 0.12, "ips": 5, "mean": 0.27, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 1.22, "lo": 0.22, "ips": 3, "mean": 0.63, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.41, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}}, "h2": [["2026-10-05", 0.002, 0.005, 0, false], ["2026-10-12", 0.035, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.679, "ts": null, "map": 0.057, "obs": 0, "own": 0.258, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.035, "se": 0.627, "ts": 0.750, "map": 0.083, "obs": 4, "own": 0.130, "comp": {"cins": -0.905, "dshield": 7.2867, "crowdsec": -6.126, "vulncheck": -0.8037, "blocklist_de": -0.5491}, "mass": 4.6, "listed": false}}, "abq": true, "bot": 0.121, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 1, "doublepulsar": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-VL225-RIPE", "org": "Vodafone Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.vodafone.co.uk/"}, "pfx": 23, "reg": "1995-06-08", "rir": "ripencc", "s24": 9888, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2793216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.126244}, {"a": 5384, "h": "EMIRATES-INTERNET", "n": "EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC", "t": "Broadband & mobile", "w": 66, "cc": "AE", "cf": {"rb": "", "wb": "", "rep": 1.43, "waf": 0.88}, "cs": {"c": {"http_flood": 8, "data_centre": 1, "web_exploit": 9, "bad_crawling": 4, "proxy_or_vpn": 9, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 9, "home_connection": 7, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 14}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.36, "lo": 0.06, "ips": 3, "mean": 0.19, "above": false}, "dshield": {"n": 8, "p": 0.0054, "hi": 2.35, "lo": 0.76, "ips": 8, "mean": 1.46, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 0.78, "lo": 0.32, "ips": 14, "mean": 0.53, "above": false}, "threatfox": {"n": 2, "p": 0.0220, "hi": 2.55, "lo": 0.33, "ips": 2, "mean": 1.22, "above": false}, "blocklist_de": {"n": 39, "p": 0.8424, "hi": 4.54, "lo": 2.69, "ips": 44, "mean": 3.56, "above": true}}, "h2": [["2026-10-05", 0.666, 0.046, 0, false], ["2026-10-12", 0.958, 0.047, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 0.047, "se": 1.188, "ts": 1.000, "map": 0.185, "obs": 2, "own": 0.638, "comp": {"urlhaus": -0.8881, "threatfox": 1.7261, "phishing_db": -0.8997}, "mass": 3.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 39}, "lo": 0.958, "se": 0.380, "ts": 0.650, "map": 1.487, "obs": 60, "own": 2.290, "comp": {"cins": -3.6425, "dshield": -0.4317, "crowdsec": -8.2804, "vulncheck": -1.0013, "blocklist_de": 15.1465}, "mass": 78.7, "listed": false}}, "abq": false, "bot": 0.150, "det": {"shodan": {"malware": 2, "compromised": 1}, "threatfox": {"family:AsyncRAT": 2}, "blocklist_de": {"ssh": 1, "bots": 36, "apache": 7, "bruteforcelogin": 7}}, "oid": "ORG-ETC1-RIPE", "org": "EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC", "pdb": null, "pfx": 356, "reg": "1998-08-05", "rir": "ripencc", "s24": 9543, "sib": 8, "tor": 0, "w24": 59, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7580672, "abuse": "abuse@emirates.net.ae", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.150795}, {"a": 5391, "h": "T-HT", "n": "Croatian Telecom", "t": "Broadband & mobile", "w": 13, "cc": "HR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 8, "p": 0.3207, "hi": 4.28, "lo": 1.39, "ips": 8, "mean": 2.67, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.37, "lo": 0.03, "ips": 2, "mean": 0.16, "above": false}, "vulncheck": {"n": 1, "p": 0.0005, "hi": 1.44, "lo": 0.11, "ips": 1, "mean": 0.61, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.10, "lo": 0.14, "ips": 2, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.051, 0.006, 0, false], ["2026-10-12", 0.253, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.729, "ts": null, "map": 0.080, "obs": 0, "own": 0.362, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.253, "se": 0.475, "ts": 0.667, "map": 0.452, "obs": 12, "own": 0.701, "comp": {"cins": -1.7019, "dshield": 12.2296, "crowdsec": -7.3108, "vulncheck": -0.4003, "blocklist_de": -2.2176}, "mass": 11.1, "listed": false}}, "abq": false, "bot": 0.120, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-HA7-RIPE", "org": "Hrvatski Telekom d.d.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "http://www.t.ht.hr"}, "pfx": 47, "reg": "1995-08-04", "rir": "ripencc", "s24": 4392, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1312256, "abuse": "abuse@t.ht.hr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04127699279848}, {"a": 5394, "h": "Unidata", "n": "Unidata S.p.A.", "t": "Broadband & mobile", "w": 3, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.1015, "hi": 3.56, "lo": 0.46, "ips": 2, "mean": 1.70, "above": false}, "crowdsec": {"n": 3, "p": 0.1639, "hi": 3.97, "lo": 0.70, "ips": 3, "mean": 2.05, "above": false}}, "h2": [["2026-10-05", 0.221, 0.010, 0, false], ["2026-10-12", 0.439, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.916, "ts": null, "map": 0.161, "obs": 0, "own": 0.929, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.439, "se": 0.726, "ts": 1.000, "map": 1.254, "obs": 3, "own": 1.968, "comp": {"cins": -0.5473, "dshield": -1.0706, "crowdsec": 6.7027, "vulncheck": -0.686, "blocklist_de": -2.7785}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"c2": 1, "malware": 1}}, "oid": "ORG-US4-RIPE", "org": "UNIDATA S.p.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.unidata.it/"}, "pfx": 18, "reg": "1995-08-13", "rir": "ripencc", "s24": 359, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 92160, "abuse": "abuse@unidata.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00201452172}, {"a": 5400, "h": "BT", "n": "BT", "t": "Transit & backbone", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.68, "lo": 0.05, "ips": 1, "mean": 0.29, "above": false}, "threatfox": {"n": 1, "p": 0.0729, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 0.003, 0.048, 0, false], ["2026-10-12", 0.003, 0.051, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.051, "se": 1.336, "ts": 1.000, "map": 0.286, "obs": 1, "own": 1.364, "comp": {"urlhaus": -0.4721, "threatfox": 1.5236, "phishing_db": -0.6786}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.387, "ts": null, "map": 0.028, "obs": 0, "own": 0.110, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.522, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Unknown malware": 1}}, "oid": "ORG-CNS3-RIPE", "org": "British Telecommunications Limited", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Restrictive", "web": "http://www.bt.net"}, "pfx": 85, "reg": "1995-08-15", "rir": "ripencc", "s24": 2787, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 734464, "abuse": "abuse@eu.bt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00066545897345}, {"a": 5408, "h": "GR-NET", "n": "National Infrastructures for Research and Technology (GRNET)", "t": "Enterprise, edu & gov", "w": 3, "cc": "GR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.1321, "hi": 3.66, "lo": 0.79, "ips": 4, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.0086, "hi": 2.20, "lo": 0.29, "ips": 2, "mean": 1.05, "above": false}, "phishing_db": {"n": 1, "p": 0.0895, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.128, 0.111, 0, false], ["2026-10-12", 0.132, 0.118, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.118, "se": 1.365, "ts": 1.000, "map": 0.756, "obs": 1, "own": 3.905, "comp": {"urlhaus": -0.331, "threatfox": -0.2926, "phishing_db": 1.9698}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.132, "se": 0.837, "ts": 1.000, "map": 0.466, "obs": 2, "own": 2.692, "comp": {"cins": -0.4112, "dshield": -0.8465, "crowdsec": 4.6033, "vulncheck": -0.611, "blocklist_de": -2.1051}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.259, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-GRAT1-RIPE", "org": "National Infrastructures for Research and Technology S.A.", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.grnet.gr"}, "pfx": 39, "reg": "1995-09-06", "rir": "ripencc", "s24": 702, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 251904, "abuse": "abuse@grnet.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007666719633}, {"a": 5410, "h": "BOUYGTEL-ISP", "n": "Bouygues Telecom ISP", "t": "Broadband & mobile", "w": 28, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 0.39, "waf": 0.51}, "cs": {"c": {"http_flood": 2, "web_exploit": 7, "bad_crawling": 3, "ssh_bruteforce": 7, "web_bruteforce": 7, "home_connection": 13, "mail_bruteforce": 4, "cve:CVE-2014-8739": 1, "cve:CVE-2015-9415": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.50, "lo": 0.06, "ips": 2, "mean": 0.24, "above": false}, "shodan": {"n": 7, "p": 0.0000, "hi": 0.22, "lo": 0.07, "ips": 7, "mean": 0.13, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 0.57, "lo": 0.12, "ips": 4, "mean": 0.31, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 0.29, "lo": 0.12, "ips": 14, "mean": 0.20, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.90, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.43, "lo": 0.06, "ips": 2, "mean": 0.21, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 0.47, "lo": 0.15, "ips": 8, "mean": 0.29, "above": false}}, "h2": [["2026-10-05", 0.096, 0.041, 0, false], ["2026-10-12", 0.126, 0.033, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 0.033, "se": 1.150, "ts": 0.667, "map": 0.113, "obs": 3, "own": 0.413, "comp": {"urlhaus": -1.2958, "threatfox": 0.1811, "phishing_db": 0.558}, "mass": 6.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.126, "se": 0.416, "ts": 0.500, "map": 0.206, "obs": 28, "own": 0.319, "comp": {"cins": 0.931, "dshield": 0.2545, "crowdsec": -0.514, "vulncheck": -0.9793, "blocklist_de": 0.1209}, "mass": 31.8, "listed": false}}, "abq": false, "bot": 0.135, "det": {"shodan": {"malware": 1, "compromised": 6}, "threatfox": {"family:AsyncRAT": 1}, "blocklist_de": {"ssh": 2, "bots": 2, "imap": 4, "mail": 4}}, "oid": "ORG-BT2-RIPE", "org": "Bouygues Telecom SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.bouyguestelecom.fr"}, "pfx": 20, "reg": "1995-09-08", "rir": "ripencc", "s24": 27686, "sib": 2, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7092224, "abuse": "abuse@bouyguestelecom.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.328455}, {"a": 5413, "h": "Wavenet-AS5413", "n": "Wavenet Limited - AS5413", "t": "Broadband & mobile", "w": 2, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.67, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}, "blocklist_de": {"n": 2, "p": 0.0004, "hi": 1.55, "lo": 0.20, "ips": 2, "mean": 0.74, "above": false}}, "h2": [["2026-10-05", 0.096, 0.007, 0, false], ["2026-10-12", 0.048, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.758, "ts": null, "map": 0.094, "obs": 0, "own": 0.431, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.048, "se": 0.807, "ts": 1.000, "map": 0.158, "obs": 2, "own": 0.252, "comp": {"cins": -0.5494, "dshield": -1.0737, "crowdsec": -4.2211, "vulncheck": -0.6869, "blocklist_de": 6.0801}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"malware": 1}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-WTL1-RIPE", "org": "Wavenet Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.wavenet.co.uk"}, "pfx": 103, "reg": "1995-09-12", "rir": "ripencc", "s24": 2861, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 740608, "abuse": "abuse@wavenet.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01798853256465}, {"a": 5416, "h": "", "n": "Batelco", "t": "Broadband & mobile", "w": 4, "cc": "BH", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1085, "hi": 3.76, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 3, "p": 0.3319, "hi": 5.10, "lo": 0.90, "ips": 3, "mean": 2.63, "above": false}}, "h2": [["2026-10-12", 0.626, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.153, "obs": 0, "own": 0.840, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.626, "se": 0.651, "ts": 0.750, "map": 1.563, "obs": 4, "own": 2.437, "comp": {"cins": -0.8519, "dshield": 1.5479, "crowdsec": -5.8709, "vulncheck": -0.7908, "blocklist_de": 7.8063}, "mass": 4.3, "listed": false}}, "abq": true, "bot": 0.183, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "ORG-BA6-RIPE", "org": "BEYON B.S.C.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://batelco.com/"}, "pfx": 523, "reg": "1995-09-12", "rir": "ripencc", "s24": 486, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 580608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0128236826804}, {"a": 5432, "h": "PROXIMUS-ISP-AS", "n": "Proximus", "t": "Broadband & mobile", "w": 8, "cc": "BE", "cf": {"rb": "hi", "wb": "", "rep": 0.61, "waf": 0.68}, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1}, "n": 3}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.27, "lo": 0.06, "ips": 4, "mean": 0.15, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.84, "lo": 0.15, "ips": 3, "mean": 0.43, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.19, "lo": 0.03, "ips": 3, "mean": 0.10, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.45, "lo": 0.08, "ips": 3, "mean": 0.23, "above": false}}, "h2": [["2026-10-05", 0.062, 0.004, 0, false], ["2026-10-12", 0.062, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.657, "ts": null, "map": 0.047, "obs": 0, "own": 0.214, "comp": null, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.062, "se": 0.504, "ts": 0.333, "map": 0.119, "obs": 9, "own": 0.185, "comp": {"cins": -1.611, "dshield": 3.5103, "crowdsec": -3.1576, "vulncheck": -0.9082, "blocklist_de": 1.4303}, "mass": 10.2, "listed": false}}, "abq": false, "bot": 0.136, "det": {"shodan": {"malware": 1, "compromised": 3}, "threatfox": {"family:NjRAT": 1}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-BA4-RIPE", "org": "Proximus NV", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.proximus.com/"}, "pfx": 81, "reg": "1995-10-23", "rir": "ripencc", "s24": 15301, "sib": 4, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6407424, "abuse": "abuse@proximus.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.120454}, {"a": 5466, "h": "EIRCOM", "n": "eircom", "t": "Broadband & mobile", "w": 2, "cc": "IE", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.41}, "cs": {"c": {"http_flood": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.61, "lo": 0.08, "ips": 2, "mean": 0.29, "above": false}, "dshield": {"n": 1, "p": 0.0005, "hi": 1.42, "lo": 0.11, "ips": 1, "mean": 0.60, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.38, "lo": 0.03, "ips": 1, "mean": 0.16, "above": false}}, "h2": [["2026-10-05", 0.054, 0.006, 0, false], ["2026-10-12", 0.029, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.729, "ts": null, "map": 0.081, "obs": 0, "own": 0.364, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.029, "se": 0.792, "ts": 0.500, "map": 0.093, "obs": 2, "own": 0.147, "comp": {"cins": -0.4947, "dshield": 2.8079, "crowdsec": -0.1201, "vulncheck": -0.66, "blocklist_de": -2.5193}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-EA29-RIPE", "org": "Eircom Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.eir.ie"}, "pfx": 25, "reg": "1995-11-15", "rir": "ripencc", "s24": 4338, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1110784, "abuse": "ripe-support@eir.ie", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03466231652997}, {"a": 5483, "h": "MAGYAR-TELEKOM-MAIN-AS", "n": "Magyar Telekom plc.", "t": "Broadband & mobile", "w": 17, "cc": "HU", "cf": {"rb": "", "wb": "hi", "rep": 1.23, "waf": 0.84}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"shodan": {"n": 12, "p": 0.0000, "hi": 1.33, "lo": 0.52, "ips": 12, "mean": 0.89, "above": false}, "dshield": {"n": 5, "p": 0.0086, "hi": 2.36, "lo": 0.59, "ips": 5, "mean": 1.35, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.58, "lo": 0.15, "ips": 5, "mean": 0.33, "above": false}, "vulncheck": {"n": 2, "p": 0.0002, "hi": 1.45, "lo": 0.19, "ips": 3, "mean": 0.69, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.34, "lo": 0.33, "ips": 5, "mean": 0.76, "above": false}}, "h2": [["2026-10-05", 0.254, 0.006, 0, false], ["2026-10-12", 0.267, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.705, "ts": null, "map": 0.069, "obs": 0, "own": 0.310, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 5}, "lo": 0.267, "se": 0.447, "ts": 0.294, "map": 0.461, "obs": 17, "own": 0.714, "comp": {"cins": -2.1333, "dshield": 4.2796, "crowdsec": -3.4738, "vulncheck": -0.2286, "blocklist_de": 2.1755}, "mass": 16.4, "listed": false}}, "abq": false, "bot": 0.125, "det": {"shodan": {"malware": 1, "compromised": 11}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"bots": 4, "imap": 1, "mail": 1}}, "oid": "ORG-HTM1-RIPE", "org": "Magyar Telekom Plc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.telekom.hu/about_us"}, "pfx": 112, "reg": "1995-12-05", "rir": "ripencc", "s24": 6389, "sib": 6, "tor": 0, "w24": 16, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1697536, "abuse": "abuse@telekom.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.076676}, {"a": 5484, "h": "CIS", "n": "Shabakeh Gostar Shahriyar Co. (Ltd.)", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 11979.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.790, "det": null, "oid": "ORG-SGSC2-RIPE", "org": "Shabakeh Gostar Shahriyar Co. (Ltd.)", "pdb": null, "pfx": 6, "reg": "2012-01-02", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001199032395}, {"a": 5511, "h": "Opentransit", "n": "Orange", "t": "Transit & backbone", "w": 100, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 100, "web_exploit": 100, "bad_crawling": 60, "proxy_or_vpn": 100, "web_bruteforce": 1, "router_or_botnet": 100, "cve:CVE-2025-4396": 8}, "n": 100}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 100, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.064, 0.008, 0, false], ["2026-10-12", 0.025, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.796, "ts": null, "map": 0.112, "obs": 0, "own": 0.753, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.025, "se": 1.019, "ts": 1.000, "map": 0.122, "obs": 1, "own": 0.407, "comp": {"cins": -0.2697, "dshield": -0.5873, "crowdsec": 2.0351, "vulncheck": -0.4966, "blocklist_de": -1.3933}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.471, "det": null, "oid": "ORG-FT2-RIPE", "org": "Orange S.A.", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Tbps", "pol": "Restrictive", "web": "https://wholesale.orange.com/international/en/our-solutions/ip-content-distribution.html"}, "pfx": 717, "reg": "1996-01-08", "rir": "ripencc", "s24": 1702, "sib": 60, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 494592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00566764767951}, {"a": 5533, "h": "CLARANET-PT", "n": "VIA NET.WORKS Portugal", "t": "Broadband & mobile", "w": 1, "cc": "PT", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0390, "hi": 2.82, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "crowdsec": {"n": 1, "p": 0.0256, "hi": 2.57, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}}, "h2": [["2026-10-05", 0.066, 0.010, 0, false], ["2026-10-12", 0.079, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 0.965, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.079, "se": 1.118, "ts": 1.000, "map": 0.478, "obs": 1, "own": 0.802, "comp": {"cins": -0.2015, "dshield": -0.4514, "crowdsec": 2.7726, "vulncheck": -0.4193, "blocklist_de": -1.0455}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.700, "det": {"shodan": {"malware": 1}}, "oid": "ORG-VNPS1-RIPE", "org": "Claranet Portugal S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.vianetworks.pt"}, "pfx": 9, "reg": "1996-01-30", "rir": "ripencc", "s24": 319, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 81664, "abuse": "abuse@claranet.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001128849152}, {"a": 5555, "h": "SOHONETEU-AS", "n": "Sohonet Limited", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0959, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 0.492, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.754, "ts": null, "map": 0.137, "obs": 0, "own": 0.142, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.185, "det": {"shodan": {"malware": 1}}, "oid": "ORG-SL32-RIPE", "org": "Sohonet Limited", "pdb": null, "pfx": 31, "reg": "2004-11-11", "rir": "ripencc", "s24": 147, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47360, "abuse": "abuse@sohonet.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 5578, "h": "AS-BENESTRA", "n": "SWAN / exBENESTRA", "t": "Transit & backbone", "w": 0, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.31, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}}, "h2": [["2026-10-05", 0.085, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.821, "ts": null, "map": 0.124, "obs": 0, "own": 0.854, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.482, "ts": null, "map": 0.048, "obs": 0, "own": 0.198, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.625, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SPA43-RIPE", "org": "SWAN, a.s.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.swan.sk/"}, "pfx": 53, "reg": "1996-03-18", "rir": "ripencc", "s24": 1227, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 329984, "abuse": "ripe-abuse@swan.sk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00702957572298}, {"a": 5606, "h": "GTS-BACKBONE", "n": "GTS Telecom", "t": "Broadband & mobile", "w": 1, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0314, "hi": 2.68, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}, "phishing_db": {"n": 1, "p": 0.1331, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.006, 0.159, 0, false], ["2026-10-12", 0.006, 0.166, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.166, "se": 1.391, "ts": 1.000, "map": 1.167, "obs": 1, "own": 3.483, "comp": {"urlhaus": -0.2671, "threatfox": -0.2577, "phishing_db": 2.3054}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.636, "ts": null, "map": 0.094, "obs": 0, "own": 0.223, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.865, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GTS2-RIPE", "org": "GTS Telecom SRL", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.gts.ro/"}, "pfx": 131, "reg": "1996-04-23", "rir": "ripencc", "s24": 359, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110080, "abuse": "abuse@gtstelecom.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00165188255337}, {"a": 5607, "h": "BSKYB-BROADBAND-AS", "n": "Sky Broadband", "t": "Broadband & mobile", "w": 10, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 0.37, "waf": 0.38}, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.43, "lo": 0.03, "ips": 1, "mean": 0.18, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.56, "lo": 0.10, "ips": 3, "mean": 0.29, "above": false}, "urlhaus": {"n": 1, "p": 0.0007, "hi": 1.48, "lo": 0.11, "ips": 1, "mean": 0.62, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.10, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 0.35, "lo": 0.07, "ips": 4, "mean": 0.19, "above": false}}, "h2": [["2026-10-05", 0.067, 0.004, 0, false], ["2026-10-12", 0.051, 0.027, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.027, "se": 1.313, "ts": 1.000, "map": 0.146, "obs": 1, "own": 0.494, "comp": {"urlhaus": 1.2506, "threatfox": -0.5137, "phishing_db": -1.036}, "mass": 6.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.051, "se": 0.493, "ts": 0.400, "map": 0.095, "obs": 10, "own": 0.148, "comp": {"cins": 1.2399, "dshield": 2.5706, "crowdsec": -6.2158, "vulncheck": -0.9275, "blocklist_de": 2.3714}, "mass": 12.7, "listed": false}}, "abq": false, "bot": 0.094, "det": {"blocklist_de": {"ssh": 2, "bots": 2}}, "oid": "ORG-EL37-RIPE", "org": "Sky UK Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.sky.com/products/broadband-talk/"}, "pfx": 49, "reg": "1996-04-24", "rir": "ripencc", "s24": 23788, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6352128, "abuse": "abuse@sky.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.366115}, {"a": 5610, "h": "O2-CZECH-REPUBLIC", "n": "O2 Czech Republic", "t": "Broadband & mobile", "w": 8, "cc": "CZ", "cf": {"rb": "hi", "wb": "hi", "rep": 1.15, "waf": 1.01}, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 1.12, "lo": 0.08, "ips": 1, "mean": 0.47, "above": false}, "urlhaus": {"n": 1, "p": 0.0531, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.62, "lo": 0.15, "ips": 5, "mean": 0.35, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 1.04, "lo": 0.18, "ips": 3, "mean": 0.54, "above": false}}, "h2": [["2026-10-05", 0.183, 0.056, 0, false], ["2026-10-12", 0.154, 0.062, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.062, "se": 1.328, "ts": 1.000, "map": 0.370, "obs": 1, "own": 1.134, "comp": {"urlhaus": 2.0614, "threatfox": -0.4773, "phishing_db": -0.9526}, "mass": 3.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.154, "se": 0.503, "ts": 0.556, "map": 0.288, "obs": 9, "own": 0.448, "comp": {"cins": -1.5634, "dshield": -0.2455, "crowdsec": 1.0493, "vulncheck": -0.9036, "blocklist_de": 1.8136}, "mass": 9.7, "listed": false}}, "abq": false, "bot": 0.101, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-STAN1-RIPE", "org": "O2 Czech Republic, a.s.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.o2.cz"}, "pfx": 67, "reg": "1996-04-25", "rir": "ripencc", "s24": 6018, "sib": 15, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2327808, "abuse": "abuse@o2.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.063474}, {"a": 5617, "h": "TPNET", "n": "Orange Polska - TPNET", "t": "Broadband & mobile", "w": 29, "cc": "PL", "cf": {"rb": "", "wb": "hi", "rep": 0.45, "waf": 0.33}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 6, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.20, "lo": 0.04, "ips": 4, "mean": 0.11, "above": false}, "dshield": {"n": 11, "p": 0.0000, "hi": 1.45, "lo": 0.55, "ips": 11, "mean": 0.96, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.20, "lo": 0.06, "ips": 6, "mean": 0.12, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 1.11, "lo": 0.08, "ips": 1, "mean": 0.47, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 0.51, "lo": 0.07, "ips": 2, "mean": 0.25, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.55, "lo": 0.17, "ips": 9, "mean": 0.33, "above": false}}, "h2": [["2026-10-05", 0.052, 0.026, 0, false], ["2026-10-12", 0.132, 0.015, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.015, "se": 1.344, "ts": 1.000, "map": 0.075, "obs": 1, "own": 0.296, "comp": {"urlhaus": -0.8256, "threatfox": 0.732, "phishing_db": -0.8752}, "mass": 3.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 11, "crowdsec": 6, "vulncheck": 2, "blocklist_de": 7}, "lo": 0.132, "se": 0.421, "ts": 0.423, "map": 0.218, "obs": 26, "own": 0.338, "comp": {"cins": -2.6423, "dshield": 7.7263, "crowdsec": -5.6484, "vulncheck": -0.506, "blocklist_de": 0.9406}, "mass": 26.0, "listed": false}}, "abq": false, "bot": 0.115, "det": {"shodan": {"doublepulsar": 4}, "threatfox": {"family:RatonRAT": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"bots": 3, "imap": 6, "mail": 6}}, "oid": "ORG-PT1-RIPE", "org": "Orange Polska Spolka Akcyjna", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "http://www.orange.pl"}, "pfx": 77, "reg": "1996-04-29", "rir": "ripencc", "s24": 21400, "sib": 5, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8445184, "abuse": "cert.opl@orange.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.193128}, {"a": 5645, "h": "TEKSAVVY", "n": "TekSavvy Solutions Inc.", "t": "Broadband & mobile", "w": 2, "cc": "CA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.0042, "hi": 1.86, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.55, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}}, "h2": [["2026-10-05", 0.017, 0.007, 0, false], ["2026-10-12", 0.041, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.758, "ts": null, "map": 0.094, "obs": 0, "own": 0.431, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.041, "se": 0.801, "ts": 0.500, "map": 0.134, "obs": 2, "own": 0.213, "comp": {"cins": -0.4755, "dshield": 2.8851, "crowdsec": 0.0491, "vulncheck": -0.6496, "blocklist_de": -2.4244}, "mass": 2.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "TEKSAV-ARIN", "org": "TekSavvy Solutions, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.teksavvy.com"}, "pfx": 84, "reg": "2005-03-10", "rir": "arin", "s24": 2864, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 841472, "abuse": "abuse@teksavvy.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01688033504948}, {"a": 5650, "h": "FRONTIER-FRTR", "n": "Frontier Communications of America (FCA)", "t": "Broadband & mobile", "w": 546, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.69, "waf": 0.66}, "cs": {"c": {"http_flood": 6, "data_centre": 2, "web_exploit": 31, "bad_crawling": 6, "proxy_or_vpn": 12, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 11, "home_connection": 12, "mail_bruteforce": 8, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2021-3129": 5, "cve:CVE-2018-20062": 1, "cve:CVE-2025-22457": 1}, "n": 41}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.34, "lo": 0.04, "ips": 2, "mean": 0.16, "above": false}, "shodan": {"n": 8, "p": 0.0000, "hi": 0.16, "lo": 0.05, "ips": 8, "mean": 0.10, "above": false}, "dshield": {"n": 5, "p": 0.0000, "hi": 0.45, "lo": 0.11, "ips": 5, "mean": 0.26, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.98, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}, "crowdsec": {"n": 26, "p": 0.0000, "hi": 0.32, "lo": 0.17, "ips": 41, "mean": 0.24, "above": false}, "vulncheck": {"n": 5, "p": 0.0000, "hi": 0.46, "lo": 0.11, "ips": 491, "mean": 0.26, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.22, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.29, "lo": 0.09, "ips": 8, "mean": 0.18, "above": false}}, "h2": [["2026-10-05", 0.119, 0.051, 0, false], ["2026-10-12", 0.114, 0.029, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.029, "se": 1.209, "ts": 0.500, "map": 0.118, "obs": 2, "own": 0.418, "comp": {"urlhaus": 0.5755, "threatfox": -0.5351, "phishing_db": -0.5518}, "mass": 9.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 5, "crowdsec": 26, "vulncheck": 5, "blocklist_de": 7}, "lo": 0.114, "se": 0.400, "ts": 0.578, "map": 0.180, "obs": 45, "own": 0.279, "comp": {"cins": 0.0309, "dshield": 0.1004, "crowdsec": 4.272, "vulncheck": -0.2504, "blocklist_de": -4.4755}, "mass": 41.8, "listed": false}}, "abq": false, "bot": 0.177, "det": {"shodan": {"malware": 1, "compromised": 6, "doublepulsar": 1}, "vulncheck": {"c2_server": 2, "botnet_node": 489}, "blocklist_de": {"ssh": 1, "imap": 3, "mail": 5, "apache": 3, "bruteforcelogin": 1}}, "oid": "MCICS-ARIN", "org": "Verizon Business", "pdb": {"t": "NSP", "sc": "North America", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.frontier.com"}, "pfx": 1022, "reg": "1995-07-25", "rir": "arin", "s24": 41636, "sib": 229, "tor": 0, "w24": 42, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13097472, "abuse": "abuse-mail@verizonbusiness.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.310604}, {"a": 5713, "h": "SAIX-NET", "n": "Telkom SA", "t": "Broadband & mobile", "w": 4, "cc": "ZA", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 1.14, "lo": 0.09, "ips": 1, "mean": 0.48, "above": false}, "urlhaus": {"n": 1, "p": 0.0547, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.28, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.65, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}}, "h2": [["2026-10-05", 0.110, 0.056, 0, false], ["2026-10-12", 0.041, 0.064, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.064, "se": 1.329, "ts": 1.000, "map": 0.382, "obs": 1, "own": 1.168, "comp": {"urlhaus": 2.0889, "threatfox": -0.4758, "phishing_db": -0.9491}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.041, "se": 0.691, "ts": 0.333, "map": 0.108, "obs": 3, "own": 0.170, "comp": {"cins": -0.7192, "dshield": 1.9798, "crowdsec": -1.9263, "vulncheck": -0.7526, "blocklist_de": 0.5859}, "mass": 3.5, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TSL2-AFRINIC", "org": "Telkom SA Ltd.", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Selective", "web": "https://openserve.co.za/"}, "pfx": 455, "reg": "1995-09-06", "rir": "afrinic", "s24": 5889, "sib": 6, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2268160, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0169619159181}, {"a": 5769, "h": "VIDEOTRON", "n": "Videotron AS5769", "t": "Broadband & mobile", "w": 28, "cc": "CA", "cf": {"rb": "hi", "wb": "hi", "rep": 0.69, "waf": 0.61}, "cs": {"c": {"http_flood": 9, "web_exploit": 10, "bad_crawling": 6, "proxy_or_vpn": 8, "web_bruteforce": 9, "home_connection": 9, "router_or_botnet": 1, "cve:CVE-2024-28000": 4}, "n": 10}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 1.13, "lo": 0.15, "ips": 2, "mean": 0.54, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.32, "lo": 0.06, "ips": 3, "mean": 0.17, "above": false}, "dshield": {"n": 6, "p": 0.0002, "hi": 1.73, "lo": 0.48, "ips": 6, "mean": 1.02, "above": false}, "urlhaus": {"n": 2, "p": 0.0613, "hi": 3.14, "lo": 0.41, "ips": 2, "mean": 1.50, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.57, "lo": 0.21, "ips": 10, "mean": 0.37, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 1.14, "lo": 0.37, "ips": 8, "mean": 0.71, "above": false}}, "h2": [["2026-10-05", 0.129, 0.005, 0, false], ["2026-10-12", 0.295, 0.125, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.125, "se": 1.130, "ts": 1.000, "map": 0.491, "obs": 2, "own": 1.429, "comp": {"urlhaus": 2.5506, "threatfox": -0.5394, "phishing_db": -1.0961}, "mass": 8.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.295, "se": 0.416, "ts": 0.385, "map": 0.484, "obs": 26, "own": 0.749, "comp": {"cins": 1.2107, "dshield": 2.2758, "crowdsec": -3.0025, "vulncheck": -0.9763, "blocklist_de": 1.1606}, "mass": 29.3, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"c2": 1, "compromised": 2}, "blocklist_de": {"imap": 7, "mail": 7, "apache": 1, "bruteforcelogin": 1}}, "oid": "VL-439-ARIN", "org": "Videotron Ltee", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://videotron.com"}, "pfx": 265, "reg": "1995-10-12", "rir": "arin", "s24": 10863, "sib": 2, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5546496, "abuse": "abuse@fibrenoire.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.105638}, {"a": 6057, "h": "", "n": "ANTEL", "t": "Broadband & mobile", "w": 17, "cc": "UY", "cf": {"rb": "", "wb": "", "rep": 2.48, "waf": 1.24}, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.0001, "hi": 1.38, "lo": 0.18, "ips": 2, "mean": 0.66, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.25, "lo": 0.02, "ips": 1, "mean": 0.11, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.39, "lo": 0.08, "ips": 4, "mean": 0.21, "above": false}, "blocklist_de": {"n": 11, "p": 0.0001, "hi": 1.82, "lo": 0.69, "ips": 11, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.110, 0.005, 0, false], ["2026-10-12", 0.314, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.688, "ts": null, "map": 0.062, "obs": 0, "own": 0.276, "comp": null, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 11}, "lo": 0.314, "se": 0.436, "ts": 0.611, "map": 0.528, "obs": 18, "own": 0.816, "comp": {"cins": 1.812, "dshield": -1.8913, "crowdsec": -7.2869, "vulncheck": -0.9693, "blocklist_de": 9.0908}, "mass": 24.7, "listed": false}}, "abq": false, "bot": 0.221, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 9, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-6057-LACNIC", "org": "Administracion Nacional de Telecomunicaciones", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.antel.com.uy"}, "pfx": 576, "reg": "1995-10-26", "rir": "lacnic", "s24": 8420, "sib": 2, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5624832, "abuse": "ipadmin@antel.net.uy", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.054381}, {"a": 6079, "h": "RCN-AS", "n": "Astound", "t": "Broadband & mobile", "w": 1172, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.72, "waf": 1.25}, "cs": {"c": {"http_flood": 2, "web_exploit": 10, "bad_crawling": 1, "first_seen_30d": 2, "ssh_bruteforce": 7, "web_bruteforce": 10, "home_connection": 7, "mail_bruteforce": 5, "cve:CVE-2017-3506": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2026-8181": 1, "cve:CVE-2018-12031": 1, "cve:CVE-2018-13379": 3}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.54, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.44, "lo": 0.03, "ips": 1, "mean": 0.18, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 0.42, "lo": 0.17, "ips": 15, "mean": 0.28, "above": false}, "vulncheck": {"n": 7, "p": 0.0000, "hi": 1.24, "lo": 0.38, "ips": 1155, "mean": 0.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.23, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.170, 0.004, 0, false], ["2026-10-12", 0.099, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.648, "ts": null, "map": 0.044, "obs": 0, "own": 0.198, "comp": null, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 13, "vulncheck": 7, "blocklist_de": 1}, "lo": 0.099, "se": 0.437, "ts": 0.565, "map": 0.168, "obs": 23, "own": 0.262, "comp": {"cins": 0.4993, "dshield": -1.3282, "crowdsec": 6.6764, "vulncheck": 1.4658, "blocklist_de": -7.7026}, "mass": 17.2, "listed": false}}, "abq": false, "bot": 0.274, "det": {"vulncheck": {"botnet_node": 1155}, "blocklist_de": {"ssh": 1}}, "oid": "RTSL-6-ARIN", "org": "RCN", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.astound.com"}, "pfx": 2759, "reg": "2001-04-04", "rir": "arin", "s24": 18286, "sib": 10, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4905984, "abuse": "abuse@rcn.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.151636}, {"a": 6124, "h": "MARIST", "n": "Marist University", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0547, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.418, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.681, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.183, "det": {"shodan": {"compromised": 1}}, "oid": "MARIST-1-Z-ARIN", "org": "Marist University", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://marist.edu"}, "pfx": 4, "reg": "1995-11-22", "rir": "arin", "s24": 255, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 68864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6128, "h": "CABLE-NET-1", "n": "Cablevision Systems Corporation", "t": "Broadband & mobile", "w": 42, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.58, "waf": 0.37}, "cs": {"c": {"http_flood": 3, "data_centre": 4, "web_exploit": 7, "bad_crawling": 1, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 20, "web_bruteforce": 18, "home_connection": 19, "mail_bruteforce": 11, "cve:CVE-2017-9841": 4, "cve:CVE-2019-8318": 1, "cve:CVE-2019-9082": 4, "cve:CVE-2018-10562": 1, "cve:CVE-2018-20062": 4}, "n": 24}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.70, "lo": 0.09, "ips": 2, "mean": 0.33, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.56, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}, "urlhaus": {"n": 2, "p": 0.0113, "hi": 2.29, "lo": 0.30, "ips": 2, "mean": 1.09, "above": false}, "crowdsec": {"n": 24, "p": 0.0000, "hi": 0.66, "lo": 0.34, "ips": 24, "mean": 0.49, "above": false}, "threatfox": {"n": 1, "p": 0.0001, "hi": 1.21, "lo": 0.09, "ips": 1, "mean": 0.51, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 0.71, "lo": 0.12, "ips": 3, "mean": 0.37, "above": false}, "blocklist_de": {"n": 18, "p": 0.0000, "hi": 1.25, "lo": 0.58, "ips": 18, "mean": 0.89, "above": false}}, "h2": [["2026-10-05", 0.279, 0.046, 0, false], ["2026-10-12", 0.331, 0.101, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 1, "phishing_db": 0}, "lo": 0.101, "se": 1.091, "ts": 0.667, "map": 0.349, "obs": 3, "own": 1.067, "comp": {"urlhaus": 1.8919, "threatfox": -0.1976, "phishing_db": -1.1196}, "mass": 11.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 24, "vulncheck": 3, "blocklist_de": 18}, "lo": 0.331, "se": 0.392, "ts": 0.490, "map": 0.513, "obs": 49, "own": 0.793, "comp": {"cins": -0.7462, "dshield": -2.2069, "crowdsec": -0.4861, "vulncheck": -0.6514, "blocklist_de": 4.817}, "mass": 54.1, "listed": false}}, "abq": false, "bot": 0.130, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:AsyncRAT": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 11, "mail": 16}}, "oid": "CVNT-Z-ARIN", "org": "Cablevision Systems Corp.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.optimum.net"}, "pfx": 79, "reg": null, "rir": "arin", "s24": 18942, "sib": 0, "tor": 0, "w24": 42, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7221760, "abuse": "abuse@cv.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.205243}, {"a": 6134, "h": "XNNET", "n": "XNNET LLC", "t": "Transit & backbone", "w": 7, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 9, "p": 0.9960, "hi": 13.08, "lo": 4.52, "ips": 9, "mean": 8.33, "above": true}, "threatfox": {"n": 4, "p": 0.8079, "hi": 9.02, "lo": 1.94, "ips": 5, "mean": 4.93, "above": true}, "vulncheck": {"n": 2, "p": 0.3909, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "phishing_db": {"n": 1, "p": 0.1795, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.009, 8.863, 0, false], ["2026-10-12", 0.438, 5.687, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 1}, "lo": 5.687, "se": 0.883, "ts": 0.800, "map": 15.546, "obs": 5, "own": 51.952, "comp": {"urlhaus": -0.7721, "threatfox": 4.5855, "phishing_db": 0.5566}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.438, "se": 0.914, "ts": 1.000, "map": 1.709, "obs": 2, "own": 5.827, "comp": {"cins": -0.212, "dshield": -0.4727, "crowdsec": -1.8684, "vulncheck": 5.582, "blocklist_de": -1.099}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.955, "det": {"shodan": {"c2": 6, "compromised": 3}, "threatfox": {"family:pupy": 3, "family:AdaptixC2": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 2}}, "oid": "XL-94-ARIN", "org": "XNNET LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://xn.net/"}, "pfx": 94, "reg": "2019-06-10", "rir": "arin", "s24": 94, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 24064, "abuse": "noc@xn.net", "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.00068618138656}, {"a": 6142, "h": "SUN-JAVA", "n": "Oracle Cloud Infrastructure US Government", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 3.25}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 0.200, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.781, "ts": null, "map": 0.148, "obs": 0, "own": 0.056, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.970, "det": null, "oid": "ORACLE-4-ARIN", "org": "Oracle Corporation", "pdb": null, "pfx": 34, "reg": null, "rir": "arin", "s24": 119, "sib": 42, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30464, "abuse": "abuse@oracleemaildelivery.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01214031721144}, {"a": 6147, "h": "", "n": "Telefonica Del Perú", "t": "Broadband & mobile", "w": 21, "cc": "PE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.97, "waf": 0.85}, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 4, "proxy_or_vpn": 5, "ssh_bruteforce": 6, "web_bruteforce": 6, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2024-6387": 1}, "n": 10}, "ev": {"cins": {"n": 1, "p": 0.0003, "hi": 1.35, "lo": 0.10, "ips": 1, "mean": 0.57, "above": false}, "dshield": {"n": 3, "p": 0.0014, "hi": 1.85, "lo": 0.33, "ips": 3, "mean": 0.95, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 1.01, "lo": 0.37, "ips": 10, "mean": 0.66, "above": false}, "vulncheck": {"n": 1, "p": 0.0001, "hi": 1.15, "lo": 0.09, "ips": 1, "mean": 0.49, "above": false}, "blocklist_de": {"n": 9, "p": 0.0015, "hi": 2.14, "lo": 0.74, "ips": 9, "mean": 1.36, "above": false}}, "h2": [["2026-10-05", 0.385, 0.006, 0, false], ["2026-10-12", 0.479, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.709, "ts": null, "map": 0.071, "obs": 0, "own": 0.319, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 10, "vulncheck": 1, "blocklist_de": 9}, "lo": 0.479, "se": 0.420, "ts": 0.417, "map": 0.795, "obs": 24, "own": 1.227, "comp": {"cins": -0.5254, "dshield": -0.0486, "crowdsec": -1.9722, "vulncheck": -0.7414, "blocklist_de": 4.4514}, "mass": 26.2, "listed": false}}, "abq": true, "bot": 0.116, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2, "bots": 5, "mail": 2}}, "oid": "@aut-6147-LACNIC", "org": "INTEGRATEL PERÚ S.A.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Tbps", "pol": "Selective", "web": "https://www.telefonica.com.pe/"}, "pfx": 1174, "reg": "1995-12-08", "rir": "lacnic", "s24": 5929, "sib": 1, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2618880, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.075613}, {"a": 6167, "h": "CELLCO-PART", "n": "Verizon Business AS6167", "t": "Broadband & mobile", "w": 51, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.11, "waf": 0.13}, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 20, "web_bruteforce": 10, "home_connection": 28, "mail_bruteforce": 24, "cve:CVE-2017-9841": 1, "cve:CVE-2026-8181": 1}, "n": 28}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.20, "lo": 0.03, "ips": 2, "mean": 0.10, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.03, "lo": 0.00, "ips": 1, "mean": 0.01, "above": false}, "dshield": {"n": 8, "p": 0.0000, "hi": 0.37, "lo": 0.12, "ips": 8, "mean": 0.23, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.63, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "crowdsec": {"n": 26, "p": 0.0000, "hi": 0.19, "lo": 0.10, "ips": 28, "mean": 0.14, "above": false}, "blocklist_de": {"n": 19, "p": 0.0000, "hi": 0.36, "lo": 0.17, "ips": 21, "mean": 0.26, "above": false}}, "h2": [["2026-10-05", 0.080, 0.012, 0, false], ["2026-10-12", 0.103, 0.014, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.014, "se": 1.321, "ts": 1.000, "map": 0.069, "obs": 1, "own": 0.264, "comp": {"urlhaus": 0.5803, "threatfox": -0.5349, "phishing_db": -1.0857}, "mass": 10.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 8, "crowdsec": 26, "vulncheck": 0, "blocklist_de": 19}, "lo": 0.103, "se": 0.392, "ts": 0.473, "map": 0.162, "obs": 55, "own": 0.251, "comp": {"cins": -1.1801, "dshield": 0.2675, "crowdsec": -1.4485, "vulncheck": -0.9977, "blocklist_de": 2.9328}, "mass": 63.8, "listed": false}}, "abq": false, "bot": 0.060, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 2, "imap": 15, "mail": 19}}, "oid": "MCICS-ARIN", "org": "Verizon Business", "pdb": null, "pfx": 2179, "reg": "2001-09-04", "rir": "arin", "s24": 70492, "sib": 229, "tor": 0, "w24": 48, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18045952, "abuse": "abuse-mail@verizonbusiness.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 1.180287}, {"a": 6181, "h": "FUSE-NET", "n": "Cincinnati Bell Telephone", "t": "Broadband & mobile", "w": 9, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.54}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 3, "cve:CVE-2024-4577": 1, "cve:CVE-2022-39290": 2}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.0284, "hi": 2.68, "lo": 0.35, "ips": 2, "mean": 1.28, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.80, "lo": 0.10, "ips": 2, "mean": 0.38, "above": false}, "dshield": {"n": 4, "p": 0.0898, "hi": 3.36, "lo": 0.72, "ips": 4, "mean": 1.83, "above": false}, "urlhaus": {"n": 1, "p": 0.1001, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.82, "lo": 0.14, "ips": 3, "mean": 0.42, "above": false}, "blocklist_de": {"n": 3, "p": 0.0008, "hi": 1.75, "lo": 0.31, "ips": 3, "mean": 0.90, "above": false}}, "h2": [["2026-10-05", 0.160, 0.079, 0, false], ["2026-10-12", 0.423, 0.089, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.089, "se": 1.345, "ts": 1.000, "map": 0.562, "obs": 1, "own": 1.672, "comp": {"urlhaus": 2.4112, "threatfox": -0.456, "phishing_db": -0.9045}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.423, "se": 0.472, "ts": 0.333, "map": 0.753, "obs": 12, "own": 1.167, "comp": {"cins": 4.0806, "dshield": 3.8953, "crowdsec": -4.9919, "vulncheck": -0.9327, "blocklist_de": -0.9407}, "mass": 13.4, "listed": false}}, "abq": false, "bot": 0.194, "det": {"shodan": {"doublepulsar": 2}, "blocklist_de": {"imap": 1, "mail": 3}}, "oid": "CBTL-6-ARIN", "org": "Cincinnati Bell Telephone Company LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.cincinnatibell.com"}, "pfx": 116, "reg": "1995-12-21", "rir": "arin", "s24": 3200, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1550848, "abuse": "abuse@fuse.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03989755881296}, {"a": 6206, "h": "NETROUTING-AS", "n": "Netrouting", "t": "Hosting & VPS", "w": 8, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 5, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 5, "cve:CVE-2020-5902": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2025-29927": 2, "cve:CVE-2025-55182": 3}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 1, "p": 0.1273, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 3, "p": 0.4888, "hi": 6.24, "lo": 1.10, "ips": 5, "mean": 3.22, "above": false}, "threatfox": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1595, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 4.223, 0.011, 0, false], ["2026-10-12", 3.716, 0.303, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.303, "se": 1.465, "ts": 1.000, "map": 2.564, "obs": 1, "own": 1.164, "comp": {"urlhaus": -0.1545, "threatfox": 3.0487, "phishing_db": -0.3264}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.716, "se": 0.611, "ts": 0.600, "map": 8.633, "obs": 5, "own": 1.706, "comp": {"cins": 3.3341, "dshield": -1.5282, "crowdsec": 2.9084, "vulncheck": -0.7966, "blocklist_de": -0.3685}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.731, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Remcos": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-NA302-RIPE", "org": "Netrouting B.V.", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://netrouting.com"}, "pfx": 41, "reg": "1970-01-01", "rir": "ripencc", "s24": 91, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30720, "abuse": "abuse@netrouting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00183595471785}, {"a": 6233, "h": "XTOM", "n": "xTom San Jose", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1616, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 1, "p": 0.1535, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.263, 0.011, 0, false], ["2026-10-12", 0.274, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 1.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.274, "se": 1.276, "ts": 1.000, "map": 2.230, "obs": 1, "own": 3.944, "comp": {"cins": -0.129, "dshield": -0.298, "crowdsec": 3.6067, "vulncheck": -0.3116, "blocklist_de": -0.6723}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.691, "det": {"shodan": {"compromised": 1}}, "oid": "XL-88-ARIN", "org": "xTom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://xtom.com/"}, "pfx": 43, "reg": "2019-02-12", "rir": "arin", "s24": 43, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": "abuse@xtom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6282, "h": "FONL-6282", "n": "Fiber Optical Network LLC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.976, "ts": null, "map": 0.178, "obs": 0, "own": 1.197, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.745, "ts": null, "map": 0.134, "obs": 0, "own": 0.372, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.234, "det": null, "oid": "FONL-ARIN", "org": "Fiber Optical Network LLC", "pdb": null, "pfx": 65, "reg": "2021-03-23", "rir": "arin", "s24": 157, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6315, "h": "XMISSION", "n": "XMission", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-3506": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0181, "hi": 2.39, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}}, "h2": [["2026-10-05", 0.070, 0.010, 0, false], ["2026-10-12", 0.072, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.161, "obs": 0, "own": 0.920, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.072, "se": 1.109, "ts": 1.000, "map": 0.424, "obs": 1, "own": 0.711, "comp": {"cins": -0.2073, "dshield": -0.4632, "crowdsec": 2.7084, "vulncheck": -0.4267, "blocklist_de": -1.075}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.675, "det": null, "oid": "XMIS-ARIN", "org": "XMission, L.C.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://xmission.com/"}, "pfx": 28, "reg": "1996-03-04", "rir": "arin", "s24": 370, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 96000, "abuse": "abuse@xmission.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6327, "h": "SHAW", "n": "Shaw Cablesystems", "t": "Broadband & mobile", "w": 37, "cc": "CA", "cf": {"rb": "", "wb": "hi", "rep": 0.70, "waf": 0.44}, "cs": {"c": {"http_flood": 6, "data_centre": 1, "web_exploit": 7, "bad_crawling": 4, "proxy_or_vpn": 5, "ssh_bruteforce": 4, "web_bruteforce": 7, "home_connection": 7, "mail_bruteforce": 6, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-63030": 1}, "n": 12}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.94, "lo": 0.20, "ips": 4, "mean": 0.51, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.17, "lo": 0.03, "ips": 3, "mean": 0.09, "above": false}, "dshield": {"n": 17, "p": 0.0002, "hi": 2.09, "lo": 0.95, "ips": 17, "mean": 1.48, "above": false}, "urlhaus": {"n": 2, "p": 0.0076, "hi": 2.16, "lo": 0.28, "ips": 2, "mean": 1.03, "above": false}, "crowdsec": {"n": 12, "p": 0.0000, "hi": 0.35, "lo": 0.14, "ips": 12, "mean": 0.23, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.57, "lo": 0.17, "ips": 7, "mean": 0.34, "above": false}}, "h2": [["2026-10-05", 0.129, 0.069, 0, false], ["2026-10-12", 0.231, 0.078, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.078, "se": 1.141, "ts": 1.000, "map": 0.300, "obs": 2, "own": 0.923, "comp": {"urlhaus": 2.0813, "threatfox": -0.5466, "phishing_db": -1.1132}, "mass": 10.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 17, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.231, "se": 0.399, "ts": 0.425, "map": 0.368, "obs": 40, "own": 0.569, "comp": {"cins": 3.0825, "dshield": 7.6918, "crowdsec": -4.718, "vulncheck": -0.9885, "blocklist_de": -4.674}, "mass": 42.5, "listed": false}}, "abq": false, "bot": 0.128, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ftp": 1, "imap": 5, "mail": 5, "apache": 1, "bruteforcelogin": 1}}, "oid": "RCC-291-ARIN", "org": "Shaw Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.shaw.ca"}, "pfx": 3837, "reg": "1996-03-08", "rir": "arin", "s24": 20737, "sib": 7, "tor": 0, "w24": 37, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13439744, "abuse": "abuse@rogers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.144652}, {"a": 6364, "h": "ATLANTIC-NET-1", "n": "Atlantic.net", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.4854, "hi": 5.78, "lo": 1.24, "ips": 4, "mean": 3.16, "above": false}, "crowdsec": {"n": 1, "p": 0.0349, "hi": 2.75, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "phishing_db": {"n": 2, "p": 0.3397, "hi": 5.55, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "blocklist_de": {"n": 1, "p": 0.1010, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.538, 0.651, 0, false], ["2026-10-12", 0.311, 0.671, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.671, "se": 1.137, "ts": 1.000, "map": 2.859, "obs": 2, "own": 1.172, "comp": {"urlhaus": -0.4644, "threatfox": -0.3495, "phishing_db": 3.4906}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.311, "se": 0.869, "ts": 0.500, "map": 1.156, "obs": 2, "own": 0.235, "comp": {"cins": -0.3983, "dshield": -0.824, "crowdsec": 0.7557, "vulncheck": -0.6024, "blocklist_de": 2.608}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.882, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 1}}, "oid": "INCC-ARIN", "org": "Atlantic.net, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.atlantic.net/"}, "pfx": 93, "reg": "1996-03-20", "rir": "arin", "s24": 273, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 74496, "abuse": "abuse@atlantic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023509023681}, {"a": 6400, "h": "", "n": "Claro Dominicana", "t": "Broadband & mobile", "w": 26, "cc": "DO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.0259, "hi": 2.63, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 1.14, "lo": 0.24, "ips": 4, "mean": 0.62, "above": false}, "dshield": {"n": 9, "p": 0.6741, "hi": 5.65, "lo": 1.95, "ips": 9, "mean": 3.60, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.79, "lo": 0.14, "ips": 3, "mean": 0.41, "above": false}, "phishing_db": {"n": 1, "p": 0.0035, "hi": 1.82, "lo": 0.14, "ips": 1, "mean": 0.77, "above": false}, "blocklist_de": {"n": 11, "p": 0.2953, "hi": 4.02, "lo": 1.53, "ips": 11, "mean": 2.65, "above": false}}, "h2": [["2026-10-05", 0.199, 0.046, 0, false], ["2026-10-12", 0.985, 0.049, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.049, "se": 1.331, "ts": 1.000, "map": 0.271, "obs": 1, "own": 0.907, "comp": {"urlhaus": -0.5215, "threatfox": -0.369, "phishing_db": 1.2128}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 9, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 11}, "lo": 0.985, "se": 0.413, "ts": 0.440, "map": 1.622, "obs": 25, "own": 2.499, "comp": {"cins": 1.1528, "dshield": 4.7911, "crowdsec": -9.0487, "vulncheck": -0.977, "blocklist_de": 5.9588}, "mass": 29.6, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"compromised": 3, "doublepulsar": 1}, "blocklist_de": {"ssh": 2, "bots": 8, "imap": 1, "mail": 1}}, "oid": "@aut-6400-LACNIC", "org": "Compañía Dominicana de Teléfonos S. A.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.claro.com.do"}, "pfx": 109, "reg": "1996-03-29", "rir": "lacnic", "s24": 3297, "sib": 0, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1554944, "abuse": "abuse@codetel.net.do", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04702580692356}, {"a": 6405, "h": "AIN", "n": "AiNET", "t": "Transit & backbone", "w": 7, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 7, "bad_crawling": 7, "first_seen_30d": 3, "web_bruteforce": 2, "cve:CVE-2024-0012": 1, "cve:CVE-2021-43798": 1}, "n": 7}, "ev": {"crowdsec": {"n": 2, "p": 0.4073, "hi": 6.15, "lo": 0.80, "ips": 7, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 4.129, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 3.049, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.129, "se": 1.003, "ts": 1.000, "map": 20.050, "obs": 2, "own": 65.862, "comp": {"cins": -0.2367, "dshield": -0.5224, "crowdsec": 6.8377, "vulncheck": -0.4615, "blocklist_de": -1.2252}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.946, "det": {"blocklist_de": {"bots": 1, "apache": 2, "bruteforcelogin": 1}}, "oid": "AI-ARIN", "org": "American Information Network", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.ai.net"}, "pfx": 5, "reg": "1996-04-02", "rir": "arin", "s24": 9, "sib": 10, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6461, "h": "ZAYO-6461", "n": "Zayo", "t": "Transit & backbone", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.0013, "hi": 1.82, "lo": 0.32, "ips": 4, "mean": 0.94, "above": false}}, "h2": [["2026-10-12", 0.020, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.706, "ts": null, "map": 0.070, "obs": 0, "own": 0.446, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.020, "se": 0.727, "ts": 1.000, "map": 0.055, "obs": 3, "own": 0.185, "comp": {"cins": -0.4295, "dshield": -0.8781, "crowdsec": -3.4579, "vulncheck": 5.4609, "blocklist_de": -2.1966}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.632, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ZAYOB-ARIN", "org": "Zayo Bandwidth", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Tbps", "pol": "Restrictive", "web": "http://www.zayo.com/"}, "pfx": 223, "reg": "1996-04-22", "rir": "arin", "s24": 6203, "sib": 46, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1756672, "abuse": "abuse@zayo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02408960299452}, {"a": 6535, "h": "", "n": "Telmex Servicios Empresariales AS6535", "t": "Broadband & mobile", "w": 5, "cc": "CL", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.0026, "hi": 1.87, "lo": 0.24, "ips": 2, "mean": 0.89, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 1.36, "lo": 0.24, "ips": 3, "mean": 0.70, "above": false}}, "h2": [["2026-10-05", 0.013, 0.006, 0, false], ["2026-10-12", 0.110, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.729, "ts": null, "map": 0.080, "obs": 0, "own": 0.363, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.110, "se": 0.591, "ts": 0.600, "map": 0.244, "obs": 5, "own": 0.381, "comp": {"cins": -1.111, "dshield": 3.4111, "crowdsec": -7.0356, "vulncheck": -0.8449, "blocklist_de": 5.5646}, "mass": 6.0, "listed": false}}, "abq": true, "bot": 0.533, "det": {"blocklist_de": {"bots": 3}}, "oid": "@aut-6535-LACNIC", "org": "Telmex Servicios Empresariales S.A.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.clarochile.cl"}, "pfx": 85, "reg": "2000-03-01", "rir": "lacnic", "s24": 4370, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1575424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0203811185925}, {"a": 6536, "h": "CITYNET", "n": "Citynet", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.4499, "hi": 5.94, "lo": 1.05, "ips": 3, "mean": 3.06, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.180, "obs": 0, "own": 1.229, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.757, "ts": null, "map": 0.139, "obs": 0, "own": 0.393, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"compromised": 3}}, "oid": "CITYNE-10-ARIN", "org": "CityNet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.citynet.net"}, "pfx": 7, "reg": "1996-05-20", "rir": "arin", "s24": 143, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39424, "abuse": "ipadmin@citynet.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6559, "h": "NCIH", "n": "State of NC - State Telecommunications Services", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 1.07, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.801, "ts": null, "map": 0.114, "obs": 0, "own": 0.542, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.451, "ts": null, "map": 0.041, "obs": 0, "own": 0.081, "comp": null, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.110, "det": {"shodan": {"malware": 1}}, "oid": "NCIH-Z-ARIN", "org": "State of NC - State Telecommunications Services", "pdb": null, "pfx": 9, "reg": "1996-08-30", "rir": "arin", "s24": 1603, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 410368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6568, "h": "", "n": "Entel S.A. - EntelNet", "t": "Other", "w": 23, "cc": "BO", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 5, "proxy_or_vpn": 1, "ssh_bruteforce": 9, "web_bruteforce": 5, "home_connection": 2, "mail_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2024-6387": 3, "cve:CVE-2021-41773": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 13}, "ev": {"cins": {"n": 2, "p": 0.2196, "hi": 4.57, "lo": 0.59, "ips": 2, "mean": 2.18, "above": false}, "dshield": {"n": 3, "p": 0.3519, "hi": 5.23, "lo": 0.92, "ips": 4, "mean": 2.70, "above": false}, "crowdsec": {"n": 11, "p": 0.6839, "hi": 5.40, "lo": 2.05, "ips": 13, "mean": 3.56, "above": false}, "blocklist_de": {"n": 6, "p": 0.6276, "hi": 6.05, "lo": 1.68, "ips": 7, "mean": 3.58, "above": false}}, "h2": [["2026-10-05", 1.557, 0.008, 0, false], ["2026-10-12", 2.730, 0.009, 0, false]], "sh": false, "uc": 111.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.846, "ts": null, "map": 0.134, "obs": 0, "own": 0.273, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 6}, "lo": 2.730, "se": 0.419, "ts": 0.500, "map": 4.549, "obs": 22, "own": 2.559, "comp": {"cins": 2.1479, "dshield": 0.404, "crowdsec": 0.6061, "vulncheck": -0.965, "blocklist_de": 0.7156}, "mass": 22.4, "listed": false}}, "abq": true, "bot": 0.205, "det": {"blocklist_de": {"ftp": 1, "ssh": 4, "bots": 2}}, "oid": "@aut-6568-LACNIC", "org": "EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA", "pdb": {"t": null, "sc": null, "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.entel.bo/"}, "pfx": 157, "reg": "1996-05-28", "rir": "lacnic", "s24": 892, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 488960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02970046373552}, {"a": 6597, "h": "COLOBLOX", "n": "Coloblox Data Centers", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0969, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 0.189, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.755, "ts": null, "map": 0.138, "obs": 0, "own": 0.050, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.835, "det": {"shodan": {"compromised": 1}}, "oid": "CDC-175-ARIN", "org": "Coloblox Data Centers Inc", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Open", "web": "https://coloblox.com"}, "pfx": 20, "reg": "1996-06-03", "rir": "arin", "s24": 145, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40192, "abuse": "abuse@coloblox.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6677, "h": "ICENET-AS1", "n": "Mila", "t": "Transit & backbone", "w": 3, "cc": "IS", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2022-26134": 1, "cve:CVE-2023-22515": 1, "cve:CVE-2024-34351": 1, "cve:CVE-2025-30208": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0231, "hi": 2.58, "lo": 0.33, "ips": 2, "mean": 1.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.0499, "hi": 3.00, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}}, "h2": [["2026-10-12", 0.329, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.885, "ts": null, "map": 0.150, "obs": 0, "own": 1.149, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.329, "se": 0.722, "ts": 0.667, "map": 0.927, "obs": 3, "own": 2.958, "comp": {"cins": -0.6032, "dshield": -1.1561, "crowdsec": 2.4801, "vulncheck": -0.7104, "blocklist_de": 1.3075}, "mass": 2.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-MH183-RIPE", "org": "Mila hf", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.mila.is"}, "pfx": 13, "reg": "1996-06-24", "rir": "ripencc", "s24": 543, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 141312, "abuse": "abuse@mila.is", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00572925174057}, {"a": 6681, "h": "giveme-cloud", "n": "Giveme Cloud AS6681", "t": "Hosting & VPS", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RSZO27-RIPE", "org": "GIVEME CLOUD SP Z O O", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://giveme.cloud"}, "pfx": 10, "reg": "2010-03-12", "rir": "ripencc", "s24": 10, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@giveme.cloud", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002339004765}, {"a": 6697, "h": "BELPAK-AS", "n": "Beltelecom", "t": "Broadband & mobile", "w": 31, "cc": "BY", "cf": {"rb": "lo", "wb": "lo", "rep": 2.62, "waf": 1.97}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2025-55182": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.48, "lo": 0.04, "ips": 1, "mean": 0.20, "above": false}, "dshield": {"n": 7, "p": 0.2433, "hi": 4.04, "lo": 1.22, "ips": 7, "mean": 2.46, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.64, "lo": 0.11, "ips": 3, "mean": 0.33, "above": false}, "threatfox": {"n": 1, "p": 0.0432, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "vulncheck": {"n": 9, "p": 0.5133, "hi": 4.93, "lo": 1.70, "ips": 14, "mean": 3.14, "above": false}, "blocklist_de": {"n": 7, "p": 0.0078, "hi": 2.40, "lo": 0.73, "ips": 7, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.171, 0.038, 0, false], ["2026-10-12", 0.537, 0.040, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.040, "se": 1.333, "ts": 1.000, "map": 0.219, "obs": 1, "own": 0.755, "comp": {"urlhaus": -0.5297, "threatfox": 1.355, "phishing_db": -0.7196}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 7, "crowdsec": 3, "vulncheck": 9, "blocklist_de": 7}, "lo": 0.537, "se": 0.427, "ts": 0.346, "map": 0.883, "obs": 26, "own": 1.366, "comp": {"cins": -2.3832, "dshield": 5.3899, "crowdsec": -7.3735, "vulncheck": 1.6599, "blocklist_de": 3.9764}, "mass": 20.5, "listed": false}}, "abq": true, "bot": 0.254, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Evilginx": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 13}, "blocklist_de": {"ssh": 2, "bots": 5}}, "oid": "ORG-RAB1-RIPE", "org": "Republican Unitary Telecommunication Enterprise Beltelecom", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.beltelecom.by"}, "pfx": 218, "reg": "1996-07-01", "rir": "ripencc", "s24": 4172, "sib": 0, "tor": 0, "w24": 25, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1689344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0396830612872}, {"a": 6698, "h": "virtualsystems", "n": "Virtual Systems AS6698", "t": "Hosting & VPS", "w": 9, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 6, "web_exploit": 4, "bad_crawling": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2010-2861": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.1632, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 4, "p": 0.7577, "hi": 8.25, "lo": 1.78, "ips": 6, "mean": 4.51, "above": false}, "threatfox": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 4.934, 0.406, 0, false], ["2026-10-12", 8.259, 0.420, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.420, "se": 1.522, "ts": 1.000, "map": 4.058, "obs": 1, "own": 1.852, "comp": {"urlhaus": -0.1117, "threatfox": 3.3904, "phishing_db": -0.2519}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 8.259, "se": 0.585, "ts": 0.667, "map": 18.124, "obs": 6, "own": 3.580, "comp": {"cins": -0.8366, "dshield": -1.4796, "crowdsec": 6.3453, "vulncheck": 0.3963, "blocklist_de": -0.1345}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.929, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Evilginx": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-VSL22-RIPE", "org": "Virtual Systems LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://vsys.host/"}, "pfx": 34, "reg": "2011-09-27", "rir": "ripencc", "s24": 41, "sib": 2, "tor": 1, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": "abuse@v-sys.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00163896001082}, {"a": 6702, "h": "APEXNCC-AS", "n": "APEXNCC", "t": "Broadband & mobile", "w": 1, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1106, "hi": 3.78, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "crowdsec": {"n": 1, "p": 0.0954, "hi": 3.60, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.562, 0.010, 0, false], ["2026-10-12", 0.151, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 1.292, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.151, "se": 1.190, "ts": 1.000, "map": 1.036, "obs": 1, "own": 1.776, "comp": {"cins": -0.1645, "dshield": -0.3743, "crowdsec": 3.1917, "vulncheck": -0.3683, "blocklist_de": -0.8554}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.305, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ANN1-RIPE", "org": "Science Production Company \"Trifle\" Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.trifle.net/"}, "pfx": 3, "reg": "1996-07-05", "rir": "ripencc", "s24": 119, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32768, "abuse": "abuse@trifle.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045654817974}, {"a": 6713, "h": "IAM-AS", "n": "MAROC TELECOM", "t": "Broadband & mobile", "w": 30, "cc": "MA", "cf": null, "cs": {"c": {"data_centre": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 15, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 7}, "n": 21}, "ev": {"cins": {"n": 7, "p": 0.0000, "hi": 1.21, "lo": 0.37, "ips": 7, "mean": 0.73, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.35, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}, "urlhaus": {"n": 1, "p": 0.0008, "hi": 1.50, "lo": 0.11, "ips": 2, "mean": 0.63, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 0.33, "lo": 0.13, "ips": 21, "mean": 0.22, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 1.03, "lo": 0.08, "ips": 1, "mean": 0.44, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.50, "lo": 0.15, "ips": 15, "mean": 0.31, "above": false}}, "h2": [["2026-10-05", 0.166, 0.039, 0, false], ["2026-10-12", 0.170, 0.043, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 0.043, "se": 1.199, "ts": 0.500, "map": 0.175, "obs": 2, "own": 0.588, "comp": {"urlhaus": 0.9273, "threatfox": 0.0175, "phishing_db": -1.0617}, "mass": 7.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 1, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.170, "se": 0.415, "ts": 0.464, "map": 0.278, "obs": 28, "own": 0.431, "comp": {"cins": 9.1383, "dshield": -2.3557, "crowdsec": -2.6749, "vulncheck": -0.9839, "blocklist_de": -3.009}, "mass": 36.4, "listed": false}}, "abq": false, "bot": 0.262, "det": {"threatfox": {"family:AsyncRAT": 1}, "blocklist_de": {"ssh": 9, "imap": 6, "mail": 6}}, "oid": "ORG-ONDP1-AFRINIC", "org": "Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM", "pdb": null, "pfx": 408, "reg": "2007-09-20", "rir": "afrinic", "s24": 23433, "sib": 2, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16054528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00705856824036}, {"a": 6718, "h": "NAV", "n": "NAV Communications", "t": "Transit & backbone", "w": 6, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "bad_crawling": 3, "proxy_or_vpn": 6, "ssh_bruteforce": 5, "web_bruteforce": 6, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 6, "cve:CVE-2019-18935": 1, "cve:CVE-2021-41773": 2, "cve:CVE-2022-26134": 2}, "n": 6}, "ev": {"crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 6, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.266, 0.011, 0, false], ["2026-10-12", 0.281, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 2.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.281, "se": 1.280, "ts": 1.000, "map": 2.310, "obs": 1, "own": 8.312, "comp": {"cins": -0.1274, "dshield": -0.2945, "crowdsec": 3.6255, "vulncheck": -0.3088, "blocklist_de": -0.6641}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.844, "det": null, "oid": "ORG-NCS28-RIPE", "org": "NAV COMMUNICATIONS SRL", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.nav.co"}, "pfx": 40, "reg": "2009-07-24", "rir": "ripencc", "s24": 41, "sib": 1, "tor": 6, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "abuse@nav.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002745499131}, {"a": 6724, "h": "STRATO", "n": "STRATO AG", "t": "Hosting & VPS", "w": 13, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 1, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 6, "home_connection": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"shodan": {"n": 21, "p": 1.0000, "hi": 16.44, "lo": 8.10, "ips": 21, "mean": 11.96, "above": true}, "crowdsec": {"n": 7, "p": 0.7254, "hi": 6.43, "lo": 1.95, "ips": 7, "mean": 3.91, "above": false}, "vulncheck": {"n": 3, "p": 0.5113, "hi": 6.43, "lo": 1.13, "ips": 3, "mean": 3.32, "above": false}, "blocklist_de": {"n": 4, "p": 0.5775, "hi": 6.44, "lo": 1.39, "ips": 4, "mean": 3.52, "above": false}}, "h2": [["2026-10-05", 2.244, 0.009, 0, false], ["2026-10-12", 2.893, 0.010, 0, false]], "sh": false, "uc": 122.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.910, "ts": null, "map": 0.159, "obs": 0, "own": 0.139, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 3, "blocklist_de": 4}, "lo": 2.893, "se": 0.464, "ts": 0.500, "map": 5.169, "obs": 14, "own": 1.016, "comp": {"cins": -1.7269, "dshield": -2.3585, "crowdsec": 3.1261, "vulncheck": 0.5971, "blocklist_de": 3.3985}, "mass": 11.3, "listed": false}}, "abq": false, "bot": 0.973, "det": {"shodan": {"c2": 4, "compromised": 17}, "vulncheck": {"attack_tooling": 3}, "blocklist_de": {"ftp": 2, "ssh": 1, "apache": 1}}, "oid": "ORG-SRA1-RIPE", "org": "Strato GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Restrictive", "web": "https://www.strato.de/"}, "pfx": 9, "reg": "2002-11-20", "rir": "ripencc", "s24": 393, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 166400, "abuse": "abuse@strato.de", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0011743303476}, {"a": 6729, "h": "DEMENIN-AS", "n": "DEMENIN B.V.", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.895, "det": null, "oid": "ORG-DB230-RIPE", "org": "DEMENIN B.V.", "pdb": null, "pfx": 1, "reg": "2015-10-23", "rir": "ripencc", "s24": 1, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@demenin.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6730, "h": "SUNRISE", "n": "Sunrise GmbH", "t": "Broadband & mobile", "w": 32, "cc": "CH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.96, "waf": 0.84}, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 5, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 6}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.36, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 1.21, "lo": 0.16, "ips": 2, "mean": 0.58, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.55, "lo": 0.15, "ips": 6, "mean": 0.32, "above": false}, "blocklist_de": {"n": 24, "p": 0.2616, "hi": 3.62, "lo": 1.86, "ips": 24, "mean": 2.68, "above": false}}, "h2": [["2026-10-05", 0.153, 0.005, 0, false], ["2026-10-12", 0.642, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.693, "ts": null, "map": 0.064, "obs": 0, "own": 0.285, "comp": null, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 24}, "lo": 0.642, "se": 0.401, "ts": 0.750, "map": 1.026, "obs": 32, "own": 1.582, "comp": {"cins": -3.1824, "dshield": -1.94, "crowdsec": -8.6444, "vulncheck": -0.9897, "blocklist_de": 16.1762}, "mass": 44.2, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"bots": 1, "imap": 23, "mail": 23}}, "oid": "ORG-STSA1-RIPE", "org": "Sunrise GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.sunrise.ch"}, "pfx": 157, "reg": "1996-07-30", "rir": "ripencc", "s24": 7768, "sib": 6, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3798528, "abuse": "abuse@sunrise.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.075928}, {"a": 6739, "h": "ONO-AS", "n": "VODAFONE ONO, S.A.", "t": "Broadband & mobile", "w": 6, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0001, "hi": 1.19, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.30, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "dshield": {"n": 4, "p": 0.0013, "hi": 1.90, "lo": 0.41, "ips": 4, "mean": 1.04, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.24, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.008, 0.028, 0, false], ["2026-10-12", 0.077, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.699, "ts": null, "map": 0.066, "obs": 0, "own": 0.297, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.077, "se": 0.559, "ts": 0.667, "map": 0.162, "obs": 6, "own": 0.253, "comp": {"cins": 2.7, "dshield": 8.2174, "crowdsec": -4.7854, "vulncheck": -0.8541, "blocklist_de": -5.7062}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.203, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OA4-RIPE", "org": "VODAFONE ONO, S.A.", "pdb": null, "pfx": 68, "reg": "1999-11-24", "rir": "ripencc", "s24": 7053, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1988608, "abuse": "abuse@corp.vodafone.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04237662132818}, {"a": 6752, "h": "ANDORRA", "n": "ANDORRA TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "AD", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.1693, "hi": 4.16, "lo": 0.54, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.097, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.946, "ts": null, "map": 0.171, "obs": 0, "own": 1.056, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.689, "ts": null, "map": 0.113, "obs": 0, "own": 0.287, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.282, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-SDTD1-RIPE", "org": "ANDORRA TELECOM, S.A.U.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.andorratelecom.ad"}, "pfx": 117, "reg": "1996-09-02", "rir": "ripencc", "s24": 240, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 114688, "abuse": "abuse.andorpac@andorratelecom.ad", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00296744597856}, {"a": 6762, "h": "SEABONE-NET", "n": "Telecom Italia Sparkle", "t": "Transit & backbone", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0005, "hi": 1.42, "lo": 0.11, "ips": 1, "mean": 0.60, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.127, "obs": 0, "own": 0.891, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.496, "ts": null, "map": 0.051, "obs": 0, "own": 0.215, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.704, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TIIO1-RIPE", "org": "TELECOM ITALIA SPARKLE S.p.A.", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Tbps", "pol": "Restrictive", "web": "https://www.tisparkle.com/"}, "pfx": 288, "reg": "1996-09-12", "rir": "ripencc", "s24": 1097, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 283392, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00318075617696}, {"a": 6789, "h": "CRELCOM-NET", "n": "CRELCOM", "t": "Transit & backbone", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.3563, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "vulncheck": {"n": 1, "p": 0.1578, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-12", 0.614, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.961, "ts": null, "map": 0.174, "obs": 0, "own": 1.598, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.614, "se": 0.753, "ts": 0.667, "map": 1.829, "obs": 3, "own": 5.920, "comp": {"cins": -0.4448, "dshield": 6.9258, "crowdsec": -3.5591, "vulncheck": 1.348, "blocklist_de": -2.2725}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-CJ2-RIPE", "org": "CRELCOM LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.crelcom.ru"}, "pfx": 68, "reg": "1996-10-10", "rir": "ripencc", "s24": 195, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 59904, "abuse": "abuse@crelcom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00048170479209}, {"a": 6799, "h": "OTENET-GR", "n": "OTEnet", "t": "Broadband & mobile", "w": 7, "cc": "GR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.80, "waf": 0.70}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 1}, "n": 4}, "ev": {"dshield": {"n": 3, "p": 0.0001, "hi": 1.50, "lo": 0.26, "ips": 3, "mean": 0.78, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.43, "lo": 0.09, "ips": 4, "mean": 0.23, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.68, "lo": 0.09, "ips": 2, "mean": 0.32, "above": false}}, "h2": [["2026-10-05", 0.151, 0.005, 0, false], ["2026-10-12", 0.115, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.693, "ts": null, "map": 0.064, "obs": 0, "own": 0.286, "comp": null, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.115, "se": 0.503, "ts": 0.444, "map": 0.217, "obs": 9, "own": 0.337, "comp": {"cins": -1.5251, "dshield": 3.893, "crowdsec": -0.5861, "vulncheck": -0.8998, "blocklist_de": -1.0174}, "mass": 9.4, "listed": false}}, "abq": false, "bot": 0.122, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-OSTO1-RIPE", "org": "Ote SA (Hellenic Telecommunications Organisation)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.ote.gr/"}, "pfx": 88, "reg": "1996-10-22", "rir": "ripencc", "s24": 7711, "sib": 3, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3923456, "abuse": "abuse@ote.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.092071}, {"a": 6805, "h": "TDDE-ASN1", "n": "Telefónica Germany GmbH & Co. OHG", "t": "Transit & backbone", "w": 29, "cc": "DE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.36, "waf": 0.32}, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.11, "lo": 0.02, "ips": 3, "mean": 0.06, "above": false}, "dshield": {"n": 8, "p": 0.0000, "hi": 0.78, "lo": 0.25, "ips": 8, "mean": 0.48, "above": false}, "blocklist_de": {"n": 21, "p": 0.0000, "hi": 0.84, "lo": 0.41, "ips": 21, "mean": 0.61, "above": false}}, "h2": [["2026-10-05", 0.755, 0.003, 0, false], ["2026-10-12", 0.140, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.625, "ts": null, "map": 0.033, "obs": 0, "own": 0.221, "comp": null, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 21}, "lo": 0.140, "se": 0.411, "ts": 0.724, "map": 0.228, "obs": 29, "own": 0.717, "comp": {"cins": -3.1178, "dshield": 2.0771, "crowdsec": -12.1253, "vulncheck": -0.9878, "blocklist_de": 14.0689}, "mass": 41.5, "listed": false}}, "abq": false, "bot": 0.085, "det": {"shodan": {"c2": 3}, "blocklist_de": {"bots": 1, "imap": 20, "mail": 20}}, "oid": "ORG-TDG4-RIPE", "org": "Telefonica Germany GmbH & Co.OHG", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.telefonica.de"}, "pfx": 33, "reg": "1996-10-29", "rir": "ripencc", "s24": 32623, "sib": 1, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8351488, "abuse": "abuse.de@telefonica.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.201835}, {"a": 6810, "h": "BEZEK", "n": "Bezeq", "t": "Broadband & mobile", "w": 12, "cc": "IL", "cf": {"rb": "hi", "wb": "", "rep": 1.32, "waf": 1.74}, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 1}, "n": 5}, "ev": {"dshield": {"n": 3, "p": 0.4779, "hi": 6.16, "lo": 1.08, "ips": 3, "mean": 3.18, "above": false}, "urlhaus": {"n": 1, "p": 0.1801, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 5, "p": 0.3222, "hi": 4.61, "lo": 1.15, "ips": 5, "mean": 2.63, "above": false}, "blocklist_de": {"n": 4, "p": 0.5233, "hi": 6.04, "lo": 1.30, "ips": 4, "mean": 3.30, "above": false}}, "h2": [["2026-10-05", 1.341, 1.043, 0, false], ["2026-10-12", 2.427, 0.233, 0, false]], "sh": false, "uc": 116, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.233, "se": 1.433, "ts": 1.000, "map": 1.863, "obs": 1, "own": 5.353, "comp": {"urlhaus": 3.332, "threatfox": -0.3691, "phishing_db": -0.7144}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.427, "se": 0.467, "ts": 0.417, "map": 4.318, "obs": 12, "own": 6.651, "comp": {"cins": -1.7503, "dshield": 2.9254, "crowdsec": -0.5825, "vulncheck": -0.9204, "blocklist_de": 3.1842}, "mass": 11.5, "listed": false}}, "abq": false, "bot": 0.221, "det": {"blocklist_de": {"bots": 3, "imap": 1, "mail": 1}}, "oid": "ORG-TICC2-RIPE", "org": "\"Bezeq\"- THE ISRAEL TELECOMMUNICATION CORP. LTD.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "https://www.bezeq.co.il/"}, "pfx": 180, "reg": "1996-11-01", "rir": "ripencc", "s24": 481, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 304128, "abuse": "abuse@bezeq.co.il", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.055556}, {"a": 6821, "h": "MT-AS-OWN", "n": "Makedonski Telekom", "t": "Broadband & mobile", "w": 5, "cc": "MK", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.2647, "hi": 4.65, "lo": 0.82, "ips": 3, "mean": 2.40, "above": false}, "blocklist_de": {"n": 2, "p": 0.0302, "hi": 2.71, "lo": 0.35, "ips": 2, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.157, 0.008, 0, false], ["2026-10-12", 0.334, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.821, "ts": null, "map": 0.123, "obs": 0, "own": 0.599, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.334, "se": 0.596, "ts": 0.600, "map": 0.746, "obs": 5, "own": 1.162, "comp": {"cins": -0.9944, "dshield": 6.7155, "crowdsec": -6.5358, "vulncheck": -0.8231, "blocklist_de": 2.7391}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.174, "det": {"blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MTA1-RIPE", "org": "Makedonski Telekom AD-Skopje", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.telekom.mk"}, "pfx": 89, "reg": "1996-11-07", "rir": "ripencc", "s24": 1237, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 701952, "abuse": "ripe.abuse@telekom.mk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01070186859474}, {"a": 6848, "h": "TELENET-AS", "n": "Telenet", "t": "Broadband & mobile", "w": 11, "cc": "BE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.84, "waf": 0.74}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 3}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.99, "lo": 0.07, "ips": 1, "mean": 0.42, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.31, "lo": 0.04, "ips": 2, "mean": 0.15, "above": false}, "urlhaus": {"n": 1, "p": 0.0266, "hi": 2.59, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.42, "lo": 0.10, "ips": 5, "mean": 0.24, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.83, "lo": 0.06, "ips": 1, "mean": 0.35, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.59, "lo": 0.08, "ips": 2, "mean": 0.28, "above": false}}, "h2": [["2026-10-05", 0.082, 0.167, 0, false], ["2026-10-12", 0.097, 0.087, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.087, "se": 1.172, "ts": 0.500, "map": 0.360, "obs": 2, "own": 1.113, "comp": {"urlhaus": 1.3771, "threatfox": -0.5089, "phishing_db": -0.2623}, "mass": 5.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.097, "se": 0.511, "ts": 0.556, "map": 0.187, "obs": 9, "own": 0.291, "comp": {"cins": 1.9122, "dshield": -2.2006, "crowdsec": 1.3568, "vulncheck": -0.3014, "blocklist_de": -1.0525}, "mass": 9.4, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-TA1-RIPE", "org": "Telenet BV", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Restrictive", "web": "http://www.telenet.be"}, "pfx": 99, "reg": "1996-11-29", "rir": "ripencc", "s24": 9005, "sib": 5, "tor": 0, "w24": 11, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2305792, "abuse": "abuse@telenetgroup.be", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.086809}, {"a": 6849, "h": "UKRTELNET", "n": "Ukrtelecom", "t": "Broadband & mobile", "w": 11, "cc": "UA", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0296, "hi": 2.65, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.95, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}, "dshield": {"n": 5, "p": 0.4406, "hi": 5.23, "lo": 1.30, "ips": 5, "mean": 2.98, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 1.05, "lo": 0.14, "ips": 2, "mean": 0.50, "above": false}, "vulncheck": {"n": 1, "p": 0.0181, "hi": 2.39, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "phishing_db": {"n": 1, "p": 0.0216, "hi": 2.48, "lo": 0.19, "ips": 1, "mean": 1.04, "above": false}, "blocklist_de": {"n": 1, "p": 0.0012, "hi": 1.58, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}}, "h2": [["2026-10-05", 0.276, 0.064, 0, false], ["2026-10-12", 0.463, 0.068, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.068, "se": 1.339, "ts": 1.000, "map": 0.396, "obs": 1, "own": 1.275, "comp": {"urlhaus": -0.444, "threatfox": -0.3419, "phishing_db": 1.4846}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.463, "se": 0.496, "ts": 0.500, "map": 0.875, "obs": 10, "own": 1.358, "comp": {"cins": 1.9652, "dshield": 8.0888, "crowdsec": -4.4574, "vulncheck": -0.2859, "blocklist_de": -4.0502}, "mass": 9.2, "listed": false}}, "abq": true, "bot": 0.231, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-USTC1-RIPE", "org": "JSC \"Ukrtelecom\"", "pdb": {"t": "NSP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.ukrtelecom.ua"}, "pfx": 534, "reg": "1996-11-29", "rir": "ripencc", "s24": 1873, "sib": 3, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 689920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01267096979181}, {"a": 6855, "h": "SK-TELEKOM", "n": "Slovak Telekom/T-Mobile CZ", "t": "Broadband & mobile", "w": 11, "cc": "SK", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.73, "lo": 0.05, "ips": 1, "mean": 0.31, "above": false}, "dshield": {"n": 1, "p": 0.0062, "hi": 1.98, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.80, "lo": 0.10, "ips": 2, "mean": 0.38, "above": false}, "vulncheck": {"n": 1, "p": 0.0068, "hi": 2.01, "lo": 0.15, "ips": 8, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.198, 0.007, 0, false], ["2026-10-12", 0.095, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.765, "ts": null, "map": 0.098, "obs": 0, "own": 0.449, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.095, "se": 0.649, "ts": 0.500, "map": 0.233, "obs": 4, "own": 0.367, "comp": {"cins": -0.7027, "dshield": 2.0362, "crowdsec": 1.4947, "vulncheck": 0.6397, "blocklist_de": -3.5331}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 8}}, "oid": "ORG-ST4-RIPE", "org": "Slovak Telekom, a.s.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.telekom.sk"}, "pfx": 37, "reg": "1996-12-03", "rir": "ripencc", "s24": 2589, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 663552, "abuse": "abuse@telekom.sk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03057184443752}, {"a": 6863, "h": "ROSNET-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0589, "hi": 3.13, "lo": 0.23, "ips": 1, "mean": 1.32, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.946, "ts": null, "map": 0.170, "obs": 0, "own": 1.054, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.688, "ts": null, "map": 0.113, "obs": 0, "own": 0.287, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.501, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 12, "reg": "1996-12-10", "rir": "ripencc", "s24": 241, "sib": 120, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 69888, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 6866, "h": "CYTA-NETWORK", "n": "CYTA", "t": "Broadband & mobile", "w": 4, "cc": "CY", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0228, "hi": 2.51, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.95, "lo": 0.12, "ips": 3, "mean": 0.45, "above": false}}, "h2": [["2026-10-05", 0.240, 0.100, 0, false], ["2026-10-12", 0.100, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.780, "ts": null, "map": 0.105, "obs": 0, "own": 0.486, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.100, "se": 0.705, "ts": 0.667, "map": 0.272, "obs": 3, "own": 0.429, "comp": {"cins": 3.764, "dshield": -1.2643, "crowdsec": 1.7415, "vulncheck": -0.7384, "blocklist_de": -3.4097}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.170, "det": null, "oid": "ORG-CTA2-RIPE", "org": "Cyprus Telecommunications Authority", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.cyta.com.cy"}, "pfx": 142, "reg": "1996-12-11", "rir": "ripencc", "s24": 2115, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1183488, "abuse": "abuse@cytanet.com.cy", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02057501257902}, {"a": 6867, "h": "UCnet", "n": "University of Crete", "t": "Other", "w": 0, "cc": "GR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0541, "hi": 3.06, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.109, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UOC8-RIPE", "org": "University of Crete", "pdb": null, "pfx": 2, "reg": "1996-12-11", "rir": "ripencc", "s24": 257, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65792, "abuse": "abuse@uoc.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000037390491}, {"a": 6871, "h": "Plusnet", "n": "Plusnet plc", "t": "Broadband & mobile", "w": 5, "cc": "GB", "cf": {"rb": "hi", "wb": "hi", "rep": 1.30, "waf": 1.14}, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"cins": {"n": 3, "p": 0.0008, "hi": 1.74, "lo": 0.31, "ips": 3, "mean": 0.90, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}}, "h2": [["2026-10-05", 0.057, 0.005, 0, false], ["2026-10-12", 0.064, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.690, "ts": null, "map": 0.062, "obs": 0, "own": 0.279, "comp": null, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.064, "se": 0.592, "ts": 0.600, "map": 0.142, "obs": 5, "own": 0.223, "comp": {"cins": 10.3545, "dshield": 0.6139, "crowdsec": -4.8825, "vulncheck": -0.8569, "blocklist_de": -5.7868}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.114, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-BPIS1-RIPE", "org": "British Telecommunications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.plus.net"}, "pfx": 61, "reg": "1996-12-13", "rir": "ripencc", "s24": 8194, "sib": 8, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2130944, "abuse": "abuse@bt.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.056156}, {"a": 6876, "h": "TENET-AS", "n": "TENET", "t": "Broadband & mobile", "w": 6, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.6855, "hi": 7.40, "lo": 1.59, "ips": 4, "mean": 4.04, "above": false}, "vulncheck": {"n": 2, "p": 0.2873, "hi": 5.12, "lo": 0.66, "ips": 2, "mean": 2.44, "above": false}}, "h2": [["2026-10-05", 0.053, 0.223, 0, false], ["2026-10-12", 0.755, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.156, "obs": 0, "own": 0.870, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.755, "se": 0.585, "ts": 0.667, "map": 1.663, "obs": 6, "own": 2.602, "comp": {"cins": -0.823, "dshield": 10.9409, "crowdsec": -5.7282, "vulncheck": 1.62, "blocklist_de": -4.1076}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.230, "det": {"vulncheck": {"c2_server": 1, "botnet_node": 1}}, "oid": "ORG-TNC2-RIPE", "org": "TENET Scientific Production Enterprise LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.tenet.ua"}, "pfx": 31, "reg": "1996-12-17", "rir": "ripencc", "s24": 438, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 112128, "abuse": "abuse@te.net.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0058346352378}, {"a": 6878, "h": "AS6878", "n": "T-Systems International GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 9, "p": 0.9912, "hi": 11.63, "lo": 4.02, "ips": 9, "mean": 7.41, "above": true}}, "h2": [["2026-10-05", 0.124, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 0.476, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.739, "ts": null, "map": 0.132, "obs": 0, "own": 0.133, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"c2": 6, "doublepulsar": 3}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TA10-RIPE", "org": "T-Systems International GmbH", "pdb": null, "pfx": 48, "reg": "1996-12-18", "rir": "ripencc", "s24": 164, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 44288, "abuse": "abuse@telekom.de", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0042939755838}, {"a": 6939, "h": "HURRICANE", "n": "Hurricane Electric", "t": "Transit & backbone", "w": 36, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 5.62}, "cs": {"c": {"http_flood": 6, "data_centre": 22, "web_exploit": 12, "bad_crawling": 2, "proxy_or_vpn": 15, "ssh_bruteforce": 5, "web_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2022-22947": 1, "cve:CVE-2023-23752": 3, "cve:CVE-2024-36401": 11, "cve:CVE-2024-55591": 16, "cve:CVE-2025-31324": 1}, "n": 29}, "ev": {"cins": {"n": 8, "p": 0.9352, "hi": 8.75, "lo": 2.85, "ips": 19, "mean": 5.46, "above": true}, "shodan": {"n": 5, "p": 0.0118, "hi": 2.45, "lo": 0.61, "ips": 5, "mean": 1.40, "above": false}, "urlhaus": {"n": 1, "p": 0.1438, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "crowdsec": {"n": 8, "p": 0.0326, "hi": 2.84, "lo": 0.92, "ips": 29, "mean": 1.77, "above": false}, "vulncheck": {"n": 1, "p": 0.0284, "hi": 2.63, "lo": 0.20, "ips": 2, "mean": 1.11, "above": false}}, "h2": [["2026-10-05", 0.914, 0.119, 0, false], ["2026-10-12", 1.331, 0.131, 0, false]], "sh": false, "uc": 99, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.131, "se": 1.372, "ts": 1.000, "map": 0.905, "obs": 1, "own": 3.738, "comp": {"urlhaus": 2.7927, "threatfox": -0.4268, "phishing_db": -0.8396}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 0, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.331, "se": 0.444, "ts": 0.471, "map": 2.303, "obs": 17, "own": 7.216, "comp": {"cins": 17.6263, "dshield": -2.762, "crowdsec": -1.294, "vulncheck": -0.6557, "blocklist_de": -10.6868}, "mass": 19.7, "listed": false}}, "abq": false, "bot": 0.754, "det": {"shodan": {"compromised": 5}, "vulncheck": {"botnet_node": 2}}, "oid": "HURC-ARIN", "org": "Hurricane Electric LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "100+Tbps", "pol": "Open", "web": "http://he.net"}, "pfx": 235, "reg": "1996-06-28", "rir": "arin", "s24": 1538, "sib": 2, "tor": 0, "w24": 14, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 558336, "abuse": "abuse@he.net", "score": 0.0012, "groups": [], "sensors": ["cins"], "traffic": 0.02530874608407}, {"a": 7018, "h": "ATT-INTERNET4", "n": "AT&T US - 7018", "t": "Broadband & mobile", "w": 119, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.30, "waf": 0.22}, "cs": {"c": {"http_flood": 8, "web_exploit": 17, "bad_crawling": 4, "proxy_or_vpn": 6, "first_seen_30d": 3, "ssh_bruteforce": 18, "web_bruteforce": 14, "home_connection": 29, "mail_bruteforce": 11, "router_or_botnet": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2019-8318": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-10562": 3, "cve:CVE-2018-20062": 3}, "n": 34}, "ev": {"cins": {"n": 12, "p": 0.0000, "hi": 0.13, "lo": 0.05, "ips": 12, "mean": 0.09, "above": false}, "shodan": {"n": 22, "p": 0.0000, "hi": 0.04, "lo": 0.02, "ips": 22, "mean": 0.03, "above": false}, "dshield": {"n": 27, "p": 0.0000, "hi": 0.20, "lo": 0.10, "ips": 27, "mean": 0.15, "above": false}, "urlhaus": {"n": 3, "p": 0.0000, "hi": 0.23, "lo": 0.04, "ips": 3, "mean": 0.12, "above": false}, "crowdsec": {"n": 33, "p": 0.0000, "hi": 0.05, "lo": 0.03, "ips": 34, "mean": 0.04, "above": false}, "threatfox": {"n": 4, "p": 0.0000, "hi": 0.17, "lo": 0.04, "ips": 4, "mean": 0.09, "above": false}, "vulncheck": {"n": 10, "p": 0.0000, "hi": 0.09, "lo": 0.03, "ips": 12, "mean": 0.06, "above": false}, "phishing_db": {"n": 10, "p": 0.0000, "hi": 0.10, "lo": 0.04, "ips": 10, "mean": 0.06, "above": false}, "blocklist_de": {"n": 25, "p": 0.0000, "hi": 0.09, "lo": 0.05, "ips": 25, "mean": 0.07, "above": false}}, "h2": [["2026-10-05", 0.035, 0.028, 0, false], ["2026-10-12", 0.040, 0.028, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 4, "phishing_db": 10}, "lo": 0.028, "se": 1.074, "ts": 0.588, "map": 0.075, "obs": 17, "own": 0.294, "comp": {"urlhaus": -0.6662, "threatfox": -0.2063, "phishing_db": -0.0955}, "mass": 58.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 12, "dshield": 27, "crowdsec": 33, "vulncheck": 10, "blocklist_de": 25}, "lo": 0.040, "se": 0.385, "ts": 0.308, "map": 0.062, "obs": 107, "own": 0.096, "comp": {"cins": 4.2183, "dshield": 3.1338, "crowdsec": -5.402, "vulncheck": -0.4899, "blocklist_de": -2.848}, "mass": 121.9, "listed": false}}, "abq": false, "bot": 0.121, "det": {"shodan": {"c2": 2, "malware": 2, "compromised": 18}, "threatfox": {"family:Chaos": 1, "family:DeimosC2": 2, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 3, "botnet_node": 8, "other_infrastructure": 1}, "blocklist_de": {"ftp": 1, "sip": 1, "ssh": 6, "bots": 3, "imap": 10, "mail": 12, "apache": 1, "bruteforcelogin": 1}}, "oid": "AEL-360-ARIN", "org": "AT&T Enterprises, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.att.com"}, "pfx": 625, "reg": "1996-07-30", "rir": "arin", "s24": 351294, "sib": 122, "tor": 0, "w24": 116, "drop": 21, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 117261568, "abuse": "abuse@att.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 2.151044}, {"a": 7029, "h": "WINDSTREAM", "n": "Uniti Kinetic", "t": "Broadband & mobile", "w": 210, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.78, "waf": 0.68}, "cs": {"c": {"http_flood": 180, "web_exploit": 199, "bad_crawling": 46, "proxy_or_vpn": 176, "first_seen_30d": 2, "ssh_bruteforce": 6, "web_bruteforce": 7, "home_connection": 8, "mail_bruteforce": 3, "router_or_botnet": 176, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4396": 3, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 203}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 2, "mean": 0.03, "above": false}, "crowdsec": {"n": 18, "p": 0.0000, "hi": 0.25, "lo": 0.11, "ips": 203, "mean": 0.17, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 2, "mean": 0.09, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.23, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 0.21, "lo": 0.04, "ips": 5, "mean": 0.11, "above": false}}, "h2": [["2026-10-05", 0.064, 0.010, 0, false], ["2026-10-12", 0.059, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.010, "se": 1.351, "ts": 1.000, "map": 0.052, "obs": 1, "own": 0.216, "comp": {"urlhaus": -1.0044, "threatfox": -0.4717, "phishing_db": 0.1409}, "mass": 5.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 18, "vulncheck": 1, "blocklist_de": 4}, "lo": 0.059, "se": 0.429, "ts": 0.783, "map": 0.099, "obs": 23, "own": 0.153, "comp": {"cins": -2.4748, "dshield": -2.8371, "crowdsec": 8.2401, "vulncheck": -0.6951, "blocklist_de": -3.1562}, "mass": 22.4, "listed": false}}, "abq": false, "bot": 0.194, "det": {"shodan": {"malware": 1, "compromised": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 3}}, "oid": "WINDS-6-ARIN", "org": "Windstream Communications LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.uniti.com/"}, "pfx": 2912, "reg": "1996-07-30", "rir": "arin", "s24": 40594, "sib": 47, "tor": 0, "w24": 23, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12536832, "abuse": "abuse@windstream.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.093875}, {"a": 7040, "h": "NETMINDERS", "n": "Netminders Server Hosting", "t": "Hosting & VPS", "w": 15, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.5716, "hi": 6.97, "lo": 1.23, "ips": 3, "mean": 3.59, "above": false}, "crowdsec": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 2, "mean": 1.75, "above": false}, "threatfox": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "vulncheck": {"n": 2, "p": 0.4048, "hi": 6.13, "lo": 0.80, "ips": 10, "mean": 2.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1878, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1751, "hi": 4.49, "lo": 0.34, "ips": 2, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 2.966, 0.378, 0, false], ["2026-10-12", 2.815, 1.983, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 1.983, "se": 1.159, "ts": 0.500, "map": 9.417, "obs": 2, "own": 3.624, "comp": {"urlhaus": -0.3132, "threatfox": 2.124, "phishing_db": 2.0579}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 1}, "lo": 2.815, "se": 0.701, "ts": 0.500, "map": 7.567, "obs": 4, "own": 1.538, "comp": {"cins": -0.4941, "dshield": -0.9856, "crowdsec": -0.1148, "vulncheck": 3.016, "blocklist_de": 1.9959}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.917, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:PureRAT": 1}, "vulncheck": {"botnet_node": 10}, "blocklist_de": {"bots": 2}}, "oid": "OL-372-ARIN", "org": "Netminders Server Hosting", "pdb": null, "pfx": 36, "reg": "2019-08-27", "rir": "arin", "s24": 53, "sib": 2, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": "abuseteam@net-minders.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037051638743}, {"a": 7122, "h": "MTS-ASN", "n": "MTS", "t": "Broadband & mobile", "w": 2, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.0158, "hi": 2.33, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}}, "h2": [["2026-10-05", 0.022, 0.007, 0, false], ["2026-10-12", 0.058, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.787, "ts": null, "map": 0.108, "obs": 0, "own": 0.505, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.058, "se": 0.811, "ts": 0.500, "map": 0.192, "obs": 2, "own": 0.305, "comp": {"cins": -0.4572, "dshield": 2.9596, "crowdsec": 0.212, "vulncheck": -0.6393, "blocklist_de": -2.3341}, "mass": 2.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "LINX-ARIN", "org": "Bell Canada", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.mts.ca"}, "pfx": 18, "reg": "1996-09-11", "rir": "arin", "s24": 1920, "sib": 19, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 511488, "abuse": "abuse@bell.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01208243627745}, {"a": 7155, "h": "VIASAT-SP-BACKBONE", "n": "ViaSat", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.45, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}, "dshield": {"n": 1, "p": 0.0004, "hi": 1.39, "lo": 0.10, "ips": 1, "mean": 0.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.82, "lo": 0.06, "ips": 1, "mean": 0.35, "above": false}}, "h2": [["2026-10-05", 0.013, 0.006, 0, false], ["2026-10-12", 0.030, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.728, "ts": null, "map": 0.080, "obs": 0, "own": 0.359, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.030, "se": 0.794, "ts": 0.500, "map": 0.098, "obs": 2, "own": 0.156, "comp": {"cins": -0.5331, "dshield": 2.6563, "crowdsec": -4.1217, "vulncheck": -0.6793, "blocklist_de": 1.7484}, "mass": 2.5, "listed": false}}, "abq": true, "bot": 0.215, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "VIASA-16-ARIN", "org": "ViaSat,Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.viasat.com/"}, "pfx": 4337, "reg": "2009-10-15", "rir": "arin", "s24": 4461, "sib": 14, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2159360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040210244507}, {"a": 7184, "h": "", "n": "Universidad Veracruzana", "t": "Other", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0831, "hi": 3.45, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.969, "ts": null, "map": 0.176, "obs": 0, "own": 0.468, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.731, "ts": null, "map": 0.128, "obs": 0, "own": 0.128, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.114, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-7184-LACNIC", "org": "Universidad Veracruzana", "pdb": null, "pfx": 174, "reg": "1996-09-30", "rir": "lacnic", "s24": 175, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44800, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002075943296}, {"a": 7195, "h": "", "n": "EdgeUno", "t": "Transit & backbone", "w": 7, "cc": "CO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1084, "hi": 3.76, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "threatfox": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 3, "p": 0.6040, "hi": 7.28, "lo": 1.28, "ips": 6, "mean": 3.76, "above": false}}, "h2": [["2026-10-05", 1.072, 0.256, 0, false], ["2026-10-12", 0.627, 0.265, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.265, "se": 1.446, "ts": 1.000, "map": 2.139, "obs": 1, "own": 8.957, "comp": {"urlhaus": -0.1731, "threatfox": 2.9153, "phishing_db": -0.3559}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.627, "se": 0.774, "ts": 1.000, "map": 1.886, "obs": 3, "own": 6.303, "comp": {"cins": -0.2998, "dshield": -0.6449, "crowdsec": -2.5448, "vulncheck": 7.0633, "blocklist_de": -1.5456}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.841, "det": {"shodan": {"doublepulsar": 1}, "threatfox": {"family:DCRat": 1}, "vulncheck": {"botnet_node": 6}}, "oid": "@aut-273993-LACNIC", "org": "EDGEUNO S.A.S", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Tbps", "pol": "Selective", "web": "http://edgeuno.com/"}, "pfx": 128, "reg": "1996-10-07", "rir": "lacnic", "s24": 123, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 41472, "abuse": "hostmaster@edgeuno.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023275420307}, {"a": 7203, "h": "LEASEWEB-USA-SFO", "n": "LeaseWeb USA / SFO-12", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.2339, "hi": 4.17, "lo": 1.04, "ips": 5, "mean": 2.38, "above": false}, "dshield": {"n": 1, "p": 0.0809, "hi": 3.43, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "crowdsec": {"n": 1, "p": 0.0016, "hi": 1.64, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}}, "h2": [["2026-10-05", 0.468, 0.009, 0, false], ["2026-10-12", 0.131, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.864, "ts": null, "map": 0.142, "obs": 0, "own": 0.113, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.131, "se": 0.836, "ts": 0.500, "map": 0.461, "obs": 2, "own": 0.093, "comp": {"cins": -0.4132, "dshield": 3.1438, "crowdsec": 0.6159, "vulncheck": -0.6123, "blocklist_de": -2.115}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.908, "det": {"shodan": {"compromised": 5}}, "oid": "LU-76-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 149, "reg": "1996-10-08", "rir": "arin", "s24": 713, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 182528, "abuse": "abuse@us.leaseweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00649098503456}, {"a": 7219, "h": "ASNTULIX", "n": "Tulix Systems, Inc.", "t": "Other", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4214, "hi": 6.28, "lo": 0.82, "ips": 6, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 18.423, 0.011, 1, false], ["2026-10-12", 4.149, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.149, "se": 1.031, "ts": 1.000, "map": 20.305, "obs": 2, "own": 12.687, "comp": {"cins": -0.1363, "dshield": -0.3139, "crowdsec": -1.2424, "vulncheck": 6.8074, "blocklist_de": -0.7101}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.983, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "TULIX-ARIN", "org": "Tulix Systems, Inc.", "pdb": null, "pfx": 2, "reg": "1996-10-11", "rir": "arin", "s24": 5, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7303, "h": "", "n": "TELECOM ARGENTINA", "t": "Broadband & mobile", "w": 90, "cc": "AR", "cf": {"rb": "", "wb": "", "rep": 1.02, "waf": 0.80}, "cs": {"c": {"http_flood": 2, "web_exploit": 22, "proxy_or_vpn": 15, "first_seen_30d": 1, "ssh_bruteforce": 20, "web_bruteforce": 30, "home_connection": 38, "mail_bruteforce": 28, "router_or_botnet": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-22457": 1}, "n": 46}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.62, "lo": 0.13, "ips": 4, "mean": 0.34, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.09, "lo": 0.01, "ips": 2, "mean": 0.04, "above": false}, "dshield": {"n": 20, "p": 0.0000, "hi": 1.56, "lo": 0.75, "ips": 20, "mean": 1.13, "above": false}, "crowdsec": {"n": 22, "p": 0.0000, "hi": 0.36, "lo": 0.18, "ips": 46, "mean": 0.26, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.28, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "blocklist_de": {"n": 33, "p": 0.0000, "hi": 1.22, "lo": 0.69, "ips": 33, "mean": 0.94, "above": false}}, "h2": [["2026-10-05", 0.211, 0.032, 0, false], ["2026-10-12", 0.343, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.012, "se": 1.346, "ts": 1.000, "map": 0.060, "obs": 1, "own": 0.243, "comp": {"urlhaus": -0.9528, "threatfox": -0.4642, "phishing_db": 0.222}, "mass": 4.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 20, "crowdsec": 22, "vulncheck": 0, "blocklist_de": 33}, "lo": 0.343, "se": 0.379, "ts": 0.418, "map": 0.526, "obs": 79, "own": 0.812, "comp": {"cins": -0.4554, "dshield": 2.6917, "crowdsec": -6.5378, "vulncheck": -1.004, "blocklist_de": 6.0563}, "mass": 95.6, "listed": false}}, "abq": false, "bot": 0.148, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"ftp": 1, "ssh": 13, "bots": 14, "imap": 2, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-7303-LACNIC", "org": "Telecom Argentina S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.telecom.com.ar"}, "pfx": 222, "reg": "2000-06-09", "rir": "lacnic", "s24": 32700, "sib": 10, "tor": 0, "w24": 66, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18787072, "abuse": "abuse@teco.com.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.207151}, {"a": 7311, "h": "FRONTIER", "n": "Frontier Networks", "t": "Broadband & mobile", "w": 6, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"urlhaus": {"n": 2, "p": 0.3932, "hi": 6.02, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "crowdsec": {"n": 2, "p": 0.0310, "hi": 2.72, "lo": 0.35, "ips": 2, "mean": 1.30, "above": false}, "blocklist_de": {"n": 3, "p": 0.3277, "hi": 5.07, "lo": 0.89, "ips": 3, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 0.715, 1.023, 0, false], ["2026-10-12", 0.823, 1.137, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 1.137, "se": 1.137, "ts": 1.000, "map": 5.226, "obs": 2, "own": 12.748, "comp": {"urlhaus": 4.7535, "threatfox": -0.4907, "phishing_db": -0.983}, "mass": 3.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.823, "se": 0.601, "ts": 0.600, "map": 1.873, "obs": 5, "own": 2.909, "comp": {"cins": -0.9959, "dshield": -1.673, "crowdsec": -1.0383, "vulncheck": -0.8234, "blocklist_de": 6.5518}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.619, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "FRONT-16-ARIN", "org": "Frontier Networks Inc", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "http://frontiernetworks.ca"}, "pfx": 99, "reg": "2009-10-16", "rir": "arin", "s24": 494, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 152320, "abuse": "abuse@frontiernetworks.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00119325854844}, {"a": 7385, "h": "ABUL-14-7385", "n": "Electric Lightwave", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.002, 0.006, 0, false], ["2026-10-12", 0.002, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.706, "ts": null, "map": 0.070, "obs": 0, "own": 0.445, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.002, "se": 1.300, "ts": null, "map": 0.016, "obs": 0, "own": 0.061, "comp": null, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.646, "det": null, "oid": "ABUL-14-ARIN", "org": "Allstream Business US, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "20-50Gbps", "pol": "Restrictive", "web": "http://www.electriclightwave.com/"}, "pfx": 73, "reg": "2022-08-22", "rir": "arin", "s24": 6230, "sib": 8, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1682176, "abuse": "abuse@zayo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029021405098}, {"a": 7393, "h": "CYBERCON", "n": "CYBERCON, INC.", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.5529, "hi": 6.25, "lo": 1.35, "ips": 4, "mean": 3.42, "above": false}, "vulncheck": {"n": 1, "p": 0.1536, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.099, 0.010, 0, false], ["2026-10-12", 0.081, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.954, "ts": null, "map": 0.172, "obs": 0, "own": 0.439, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.081, "se": 1.141, "ts": 1.000, "map": 0.489, "obs": 1, "own": 0.314, "comp": {"cins": -0.1423, "dshield": -0.3268, "crowdsec": -1.2932, "vulncheck": 3.1813, "blocklist_de": -0.7409}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.874, "det": {"shodan": {"compromised": 4}, "vulncheck": {"attack_tooling": 1}}, "oid": "CBCN-ARIN", "org": "CYBERCON, INC.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.cybercon.com"}, "pfx": 141, "reg": "1996-12-02", "rir": "arin", "s24": 217, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58624, "abuse": "abuse@cybercon.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7418, "h": "", "n": "Movistar ISP", "t": "Broadband & mobile", "w": 26, "cc": "CL", "cf": {"rb": "", "wb": "hi", "rep": 1.24, "waf": 0.78}, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.43, "lo": 0.09, "ips": 4, "mean": 0.24, "above": false}, "dshield": {"n": 15, "p": 0.2611, "hi": 3.78, "lo": 1.64, "ips": 15, "mean": 2.62, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.84, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "blocklist_de": {"n": 10, "p": 0.0000, "hi": 1.52, "lo": 0.55, "ips": 10, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 0.077, 0.024, 0, false], ["2026-10-12", 0.328, 0.026, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.026, "se": 1.329, "ts": 1.000, "map": 0.134, "obs": 1, "own": 0.487, "comp": {"urlhaus": -0.6946, "threatfox": -0.4159, "phishing_db": 0.7305}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 15, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.328, "se": 0.417, "ts": 0.600, "map": 0.531, "obs": 25, "own": 0.821, "comp": {"cins": -2.7234, "dshield": 10.6862, "crowdsec": -11.4605, "vulncheck": -0.9746, "blocklist_de": 5.2329}, "mass": 28.0, "listed": false}}, "abq": true, "bot": 0.142, "det": {"shodan": {"c2": 3, "compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 8}}, "oid": "@aut-52489-LACNIC", "org": "TELEFÓNICA CHILE S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.movistar.cl"}, "pfx": 112, "reg": "2000-03-06", "rir": "lacnic", "s24": 9474, "sib": 2, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2656768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.081962}, {"a": 7438, "h": "", "n": "Telefonica Mexico (Movistar)", "t": "Broadband & mobile", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0482, "hi": 2.97, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.935, "ts": null, "map": 0.167, "obs": 0, "own": 1.007, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.669, "ts": null, "map": 0.105, "obs": 0, "own": 0.262, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.057, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-28415-LACNIC", "org": "PEGASO PCS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "No", "web": "https://movistar.com.mx"}, "pfx": 129, "reg": "1996-12-12", "rir": "lacnic", "s24": 279, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 160000, "abuse": "abuse.mx@telefonica.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0187231844992}, {"a": 7468, "h": "CYBEREC-AS-AP", "n": "Superhub Ltd., Cyber Express Communication Ltd.", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1493, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 0.620, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.873, "ts": null, "map": 0.181, "obs": 0, "own": 0.237, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.426, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SL53-AP-APNIC", "org": "Superhub Ltd.", "pdb": null, "pfx": 32, "reg": "1997-01-06", "rir": "apnic", "s24": 59, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44032, "abuse": "support@superhub.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013983973898}, {"a": 7470, "h": "TRUEINTERNET-AS-AP", "n": "TRUE INTERNET", "t": "Broadband & mobile", "w": 9, "cc": "TH", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "ssh_bruteforce": 2, "home_connection": 5, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.73, "lo": 0.05, "ips": 1, "mean": 0.31, "above": false}, "dshield": {"n": 1, "p": 0.0061, "hi": 1.98, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 1.33, "lo": 0.33, "ips": 5, "mean": 0.76, "above": false}, "phishing_db": {"n": 2, "p": 0.0344, "hi": 2.78, "lo": 0.36, "ips": 2, "mean": 1.32, "above": false}, "blocklist_de": {"n": 5, "p": 0.0306, "hi": 2.78, "lo": 0.69, "ips": 5, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.366, 0.128, 0, false], ["2026-10-12", 0.455, 0.133, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.133, "se": 1.149, "ts": 1.000, "map": 0.523, "obs": 2, "own": 1.592, "comp": {"urlhaus": -0.7295, "threatfox": -0.4237, "phishing_db": 2.1319}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.455, "se": 0.479, "ts": 0.455, "map": 0.836, "obs": 11, "own": 1.293, "comp": {"cins": -1.7956, "dshield": -0.692, "crowdsec": -0.9545, "vulncheck": -0.9241, "blocklist_de": 5.5803}, "mass": 12.1, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "imap": 2, "mail": 3}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.trueinternet.co.th"}, "pfx": 716, "reg": "1997-01-07", "rir": "apnic", "s24": 2593, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3673344, "abuse": "abuse@trueinternet.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00642677153946}, {"a": 7474, "h": "OPTUSCOM-AS01-AU", "n": "SingTel Optus", "t": "Broadband & mobile", "w": 5, "cc": "AU", "cf": null, "cs": {"c": {"web_exploit": 4, "proxy_or_vpn": 4, "web_bruteforce": 4, "mail_bruteforce": 2}, "n": 4}, "ev": {"urlhaus": {"n": 1, "p": 0.1297, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.44, "lo": 0.31, "ips": 4, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.178, 0.103, 0, false], ["2026-10-12", 0.139, 0.114, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.114, "se": 1.361, "ts": 1.000, "map": 0.760, "obs": 1, "own": 2.224, "comp": {"urlhaus": 2.6549, "threatfox": -0.4382, "phishing_db": -0.8648}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.139, "se": 0.636, "ts": 1.000, "map": 0.336, "obs": 4, "own": 0.525, "comp": {"cins": -0.7751, "dshield": -1.3994, "crowdsec": 7.1265, "vulncheck": -0.7698, "blocklist_de": -3.8801}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.186, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SOPL2-AP-APNIC", "org": "SingTel Optus Pty Ltd", "pdb": {"t": "NSP", "sc": "Australia", "tr": "1-5Tbps", "pol": "Selective", "web": "http://optus.com.au/business/"}, "pfx": 153, "reg": "1997-02-03", "rir": "apnic", "s24": 2017, "sib": 60, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 559616, "abuse": "abuse@optusnet.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00374092387336}, {"a": 7488, "h": "CNSERVER-AP-AS", "n": "CnServer LLC", "t": "Hosting & VPS", "w": 26, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 2, "web_exploit": 6, "bad_crawling": 2, "first_seen_30d": 5, "ssh_bruteforce": 19, "web_bruteforce": 7, "cve:CVE-2017-9841": 6, "cve:CVE-2019-9082": 6, "cve:CVE-2018-20062": 6}, "n": 20}, "ev": {"cins": {"n": 2, "p": 0.3998, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "shodan": {"n": 8, "p": 0.9895, "hi": 12.24, "lo": 3.98, "ips": 8, "mean": 7.63, "above": true}, "dshield": {"n": 1, "p": 0.1797, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 12, "p": 0.9999, "hi": 15.89, "lo": 6.29, "ips": 20, "mean": 10.63, "above": true}, "threatfox": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 5, "mean": 1.97, "above": false}, "blocklist_de": {"n": 6, "p": 0.9510, "hi": 10.86, "lo": 3.01, "ips": 9, "mean": 6.42, "above": true}}, "h2": [["2026-10-05", 23.454, 0.285, 1, false], ["2026-10-12", 25.864, 0.314, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.314, "se": 1.470, "ts": 1.000, "map": 2.689, "obs": 1, "own": 1.220, "comp": {"urlhaus": -0.1498, "threatfox": 3.0839, "phishing_db": -0.3187}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 6}, "lo": 25.864, "se": 0.416, "ts": 0.571, "map": 43.165, "obs": 21, "own": 8.410, "comp": {"cins": 2.5647, "dshield": -1.594, "crowdsec": 3.0968, "vulncheck": -0.9592, "blocklist_de": 2.0504}, "mass": 19.9, "listed": false}}, "abq": false, "bot": 0.903, "det": {"shodan": {"c2": 3, "compromised": 5}, "threatfox": {"family:AsyncRAT": 5}, "blocklist_de": {"ssh": 8, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TAL4-AP-APNIC", "org": "CNServer LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://cnserver.com"}, "pfx": 65, "reg": "2023-07-28", "rir": "apnic", "s24": 84, "sib": 0, "tor": 0, "w24": 14, "drop": 1, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 21504, "abuse": "abuse@cnserver.com", "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.000000165564}, {"a": 7489, "h": "HOSTUS-GLOBAL-AS", "n": "HostUS", "t": "Hosting & VPS", "w": 11, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 5}, "n": 6}, "ev": {"shodan": {"n": 6, "p": 0.9342, "hi": 10.13, "lo": 2.81, "ips": 6, "mean": 5.99, "above": true}, "crowdsec": {"n": 4, "p": 0.7007, "hi": 7.57, "lo": 1.63, "ips": 6, "mean": 4.13, "above": false}, "threatfox": {"n": 1, "p": 0.1938, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 3, "p": 0.6213, "hi": 7.47, "lo": 1.32, "ips": 4, "mean": 3.85, "above": false}}, "h2": [["2026-10-05", 4.310, 5.158, 0, false], ["2026-10-12", 2.623, 5.174, 0, false]], "sh": false, "uc": 7051.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 5.174, "se": 0.925, "ts": 0.750, "map": 15.317, "obs": 4, "own": 5.575, "comp": {"urlhaus": -0.6669, "threatfox": 1.0244, "phishing_db": 3.9977}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.623, "se": 0.664, "ts": 1.000, "map": 6.747, "obs": 4, "own": 1.336, "comp": {"cins": -0.6336, "dshield": -1.2014, "crowdsec": 9.0595, "vulncheck": -0.7225, "blocklist_de": -3.1993}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.860, "det": {"shodan": {"c2": 4, "compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://hostus.com/"}, "pfx": 75, "reg": "2015-12-23", "rir": "apnic", "s24": 79, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 24576, "abuse": "abuse@hostus.us", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 7497, "h": "CSTNET-AS-AP", "n": "Computer Network Information Center of Chinese Academy of Sciences (CNIC-CAS)", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.58, "lo": 0.04, "ips": 1, "mean": 0.24, "above": false}}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.746, "ts": null, "map": 0.089, "obs": 0, "own": 0.162, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.366, "ts": null, "map": 0.025, "obs": 0, "own": 0.017, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.627, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CA107-AP-APNIC", "org": "CNIC-CAS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://cnic.cn"}, "pfx": 468, "reg": "1997-04-08", "rir": "apnic", "s24": 3390, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1125120, "abuse": "abuse-ip@cstnet.cn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00088609869114}, {"a": 7506, "h": "GMO-I-R1", "n": "GMO Internet, Inc.", "t": "Hosting & VPS", "w": 78, "cc": "JP", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.0973, "hi": 3.38, "lo": 0.84, "ips": 5, "mean": 1.93, "above": false}, "urlhaus": {"n": 1, "p": 0.1618, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 1, "p": 0.0002, "hi": 1.31, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}, "phishing_db": {"n": 33, "p": 1.0000, "hi": 29.77, "lo": 16.87, "ips": 76, "mean": 22.94, "above": true}}, "h2": [["2026-10-05", 1.384, 6.463, 0, false], ["2026-10-12", 0.036, 6.511, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 33}, "lo": 6.511, "se": 0.749, "ts": 0.971, "map": 13.265, "obs": 34, "own": 4.771, "comp": {"urlhaus": -1.1756, "threatfox": -0.5709, "phishing_db": 5.9578}, "mass": 17.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.036, "se": 1.049, "ts": 1.000, "map": 0.191, "obs": 1, "own": 0.040, "comp": {"cins": -0.2468, "dshield": -0.5426, "crowdsec": 2.2778, "vulncheck": -0.4727, "blocklist_de": -1.2769}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.963, "det": {"shodan": {"malware": 1, "compromised": 3, "doublepulsar": 1}}, "oid": "@family-41747", "org": "GMO Internet, Inc.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://internet.gmo"}, "pfx": 98, "reg": "1997-03-03", "rir": "apnic", "s24": 987, "sib": 5, "tor": 0, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 269056, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.0030890467725}, {"a": 7514, "h": "MEX", "n": "MEX", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.860, "ts": null, "map": 0.140, "obs": 0, "own": 0.291, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.542, "ts": null, "map": 0.064, "obs": 0, "own": 0.050, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.710, "det": null, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://msp.cec-ltd.co.jp"}, "pfx": 22, "reg": "1997-03-03", "rir": "apnic", "s24": 750, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 196096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7539, "h": "TWAREN-TW", "n": "TaiWan Advanced Research and Education Network(TWAREN)", "t": "Enterprise, edu & gov", "w": 1, "cc": "TW", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0352, "hi": 2.75, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "crowdsec": {"n": 1, "p": 0.0225, "hi": 2.50, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "blocklist_de": {"n": 1, "p": 0.0854, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}}, "h2": [["2026-10-05", 0.074, 0.010, 0, false], ["2026-10-12", 0.261, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.921, "ts": null, "map": 0.163, "obs": 0, "own": 1.598, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.261, "se": 0.862, "ts": 0.500, "map": 0.959, "obs": 2, "own": 5.555, "comp": {"cins": -0.408, "dshield": -0.841, "crowdsec": 0.6642, "vulncheck": -0.6089, "blocklist_de": 2.5455}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.404, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-18426-APNIC", "org": "National Applied Research Laboratories", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.twaren.net/english/"}, "pfx": 14, "reg": "1997-03-22", "rir": "apnic", "s24": 338, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 90112, "abuse": "abuse@twaren.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013439863755}, {"a": 7545, "h": "TPG-INTERNET-AP", "n": "TPG Telecom", "t": "Broadband & mobile", "w": 55, "cc": "AU", "cf": {"rb": "", "wb": "hi", "rep": 0.67, "waf": 0.55}, "cs": {"c": {"http_flood": 2, "web_exploit": 18, "first_seen_30d": 1, "ssh_bruteforce": 35, "web_bruteforce": 33, "home_connection": 36, "mail_bruteforce": 34, "cve:CVE-2026-63030": 1}, "n": 39}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 1.03, "lo": 0.13, "ips": 2, "mean": 0.49, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.23, "lo": 0.03, "ips": 2, "mean": 0.11, "above": false}, "dshield": {"n": 6, "p": 0.0000, "hi": 1.57, "lo": 0.44, "ips": 6, "mean": 0.93, "above": false}, "urlhaus": {"n": 2, "p": 0.0476, "hi": 2.97, "lo": 0.39, "ips": 2, "mean": 1.41, "above": false}, "crowdsec": {"n": 39, "p": 0.0000, "hi": 1.53, "lo": 0.91, "ips": 39, "mean": 1.20, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.91, "lo": 0.12, "ips": 2, "mean": 0.43, "above": false}, "blocklist_de": {"n": 13, "p": 0.0000, "hi": 1.48, "lo": 0.60, "ips": 13, "mean": 1.00, "above": false}}, "h2": [["2026-10-05", 0.586, 0.183, 0, false], ["2026-10-12", 0.565, 0.173, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 2}, "lo": 0.173, "se": 1.037, "ts": 0.500, "map": 0.548, "obs": 4, "own": 1.603, "comp": {"urlhaus": 1.8801, "threatfox": -0.5495, "phishing_db": -0.3058}, "mass": 11.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 39, "vulncheck": 0, "blocklist_de": 13}, "lo": 0.565, "se": 0.383, "ts": 0.650, "map": 0.875, "obs": 60, "own": 1.351, "comp": {"cins": -0.9866, "dshield": -0.4133, "crowdsec": 5.4135, "vulncheck": -0.9963, "blocklist_de": -1.7569}, "mass": 58.9, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"imap": 7, "mail": 11, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-TIPL2-AP-APNIC", "org": "TPG Internet Pty Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.tpgtelecom.com.au/"}, "pfx": 4647, "reg": "1997-04-25", "rir": "apnic", "s24": 12124, "sib": 18, "tor": 0, "w24": 54, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5550336, "abuse": "hostmaster@tpgtelecom.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.115725}, {"a": 7552, "h": "VIETEL-AS-AP", "n": "Viettel", "t": "Broadband & mobile", "w": 154, "cc": "VN", "cf": {"rb": "", "wb": "", "rep": 0.89, "waf": 0.73}, "cs": {"c": {"http_flood": 18, "web_exploit": 28, "bad_crawling": 8, "proxy_or_vpn": 24, "first_seen_30d": 19, "ssh_bruteforce": 72, "web_bruteforce": 46, "home_connection": 85, "mail_bruteforce": 35, "router_or_botnet": 20, "cve:CVE-2017-9841": 5, "cve:CVE-2024-6387": 6, "cve:CVE-2018-20062": 6, "cve:CVE-2024-12847": 5, "cve:CVE-2024-28000": 7}, "n": 96}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.99, "lo": 0.21, "ips": 4, "mean": 0.54, "above": false}, "shodan": {"n": 57, "p": 0.0000, "hi": 1.67, "lo": 1.08, "ips": 57, "mean": 1.36, "above": false}, "dshield": {"n": 19, "p": 0.0030, "hi": 2.43, "lo": 1.15, "ips": 19, "mean": 1.74, "above": false}, "urlhaus": {"n": 2, "p": 0.0101, "hi": 2.25, "lo": 0.29, "ips": 2, "mean": 1.07, "above": false}, "crowdsec": {"n": 90, "p": 0.0000, "hi": 2.03, "lo": 1.44, "ips": 96, "mean": 1.73, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 0.56, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}, "blocklist_de": {"n": 60, "p": 0.2714, "hi": 3.41, "lo": 2.23, "ips": 61, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.974, 0.045, 0, false], ["2026-10-12", 1.158, 0.082, 0, false]], "sh": false, "uc": 66.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.082, "se": 1.140, "ts": 1.000, "map": 0.315, "obs": 2, "own": 0.963, "comp": {"urlhaus": 2.1278, "threatfox": -0.5459, "phishing_db": -1.1116}, "mass": 10.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 19, "crowdsec": 90, "vulncheck": 2, "blocklist_de": 60}, "lo": 1.158, "se": 0.364, "ts": 0.514, "map": 1.720, "obs": 175, "own": 2.649, "comp": {"cins": -2.2357, "dshield": -0.4277, "crowdsec": 0.6255, "vulncheck": -0.9426, "blocklist_de": 4.9167}, "mass": 185.4, "listed": false}}, "abq": true, "bot": 0.269, "det": {"shodan": {"compromised": 57}, "threatfox": {"family:Mirai": 4}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 28, "bots": 14, "imap": 16, "mail": 19}}, "oid": "@aut-7552-APNIC", "org": "Viettel Group", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.viettel.com.vn"}, "pfx": 4095, "reg": "2002-10-08", "rir": "apnic", "s24": 19451, "sib": 0, "tor": 1, "w24": 145, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19300096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.507213}, {"a": 7562, "h": "HCNSEOCHO-AS-KR", "n": "KTHCN Dongjak", "t": "Hosting & VPS", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0220, "hi": 2.49, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 0.136, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.614, "ts": null, "map": 0.086, "obs": 0, "own": 0.025, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.199, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-7562-APNIC", "org": "HCN Dongjak", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.hcn.co.kr"}, "pfx": 134, "reg": "1997-05-13", "rir": "apnic", "s24": 425, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 182528, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013232758588}, {"a": 7565, "h": "BDCOM-BD", "n": "BDCOM Online Limited", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1708, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 1, "p": 0.0733, "hi": 3.33, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "phishing_db": {"n": 1, "p": 0.1667, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1344, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.954, 1.388, 0, false], ["2026-10-12", 1.037, 0.247, 0, false]], "sh": false, "uc": 495.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.247, "se": 1.433, "ts": 1.000, "map": 1.940, "obs": 1, "own": 5.676, "comp": {"urlhaus": -0.2023, "threatfox": -0.2151, "phishing_db": 2.7066}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.037, "se": 0.746, "ts": 0.333, "map": 3.086, "obs": 3, "own": 4.846, "comp": {"cins": 3.9463, "dshield": -1.141, "crowdsec": -0.9494, "vulncheck": -0.7062, "blocklist_de": 1.3707}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.312, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-BOL2-AP-APNIC", "org": "BDCOM Online Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.bdcom.com"}, "pfx": 109, "reg": "2008-05-01", "rir": "apnic", "s24": 160, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 148224, "abuse": "abuse@bdcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00132073230918}, {"a": 7588, "h": "PUBNET-TH-AS", "n": "Thailand Public backbone Network", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.318, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ITCL3-AP-APNIC", "org": "Internet Thailand Company Ltd.", "pdb": null, "pfx": 2, "reg": "1997-07-01", "rir": "apnic", "s24": 33, "sib": 13, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7590, "h": "COMSATS", "n": "Commission on Science and Technology for", "t": "Other", "w": 4, "cc": "PK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 3}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.3631, "hi": 5.75, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "crowdsec": {"n": 4, "p": 0.7533, "hi": 8.20, "lo": 1.76, "ips": 4, "mean": 4.48, "above": false}, "blocklist_de": {"n": 1, "p": 0.1790, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 5.104, 0.011, 0, false], ["2026-10-12", 6.732, 0.012, 0, false]], "sh": false, "uc": 2610.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.732, "se": 0.613, "ts": 0.800, "map": 15.695, "obs": 5, "own": 8.882, "comp": {"cins": -0.7879, "dshield": -1.4163, "crowdsec": 6.9616, "vulncheck": -0.7735, "blocklist_de": 0.163}, "mass": 3.8, "listed": false}}, "abq": true, "bot": 0.361, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CA20-AP-APNIC", "org": "COMSATS", "pdb": null, "pfx": 44, "reg": "1997-07-01", "rir": "apnic", "s24": 44, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010209305062}, {"a": 7602, "h": "SPT-AS-VN", "n": "Saigon Postel Corp.", "t": "Broadband & mobile", "w": 36, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 9, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 10, "ssh_bruteforce": 17, "web_bruteforce": 9, "home_connection": 2, "mail_bruteforce": 10, "cve:CVE-2017-16894": 4, "cve:CVE-2019-17050": 4, "cve:CVE-2021-41714": 4, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 2}, "n": 27}, "ev": {"cins": {"n": 2, "p": 0.3184, "hi": 5.38, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "shodan": {"n": 19, "p": 1.0000, "hi": 14.95, "lo": 7.11, "ips": 19, "mean": 10.72, "above": true}, "dshield": {"n": 2, "p": 0.2930, "hi": 5.17, "lo": 0.67, "ips": 2, "mean": 2.46, "above": false}, "crowdsec": {"n": 23, "p": 1.0000, "hi": 15.69, "lo": 7.97, "ips": 27, "mean": 11.56, "above": true}, "vulncheck": {"n": 1, "p": 0.1221, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "blocklist_de": {"n": 10, "p": 0.9952, "hi": 11.83, "lo": 4.30, "ips": 11, "mean": 7.67, "above": true}}, "h2": [["2026-10-05", 6.196, 0.810, 0, false], ["2026-10-12", 10.135, 0.010, 1, false]], "sh": false, "uc": 64, "v2": {"band": 1, "host": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.158, "obs": 0, "own": 0.893, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 23, "vulncheck": 1, "blocklist_de": 10}, "lo": 10.135, "se": 0.388, "ts": 0.605, "map": 15.951, "obs": 38, "own": 24.420, "comp": {"cins": 0.5064, "dshield": -1.6086, "crowdsec": 4.5903, "vulncheck": -0.8135, "blocklist_de": 1.4884}, "mass": 35.6, "listed": false}}, "abq": true, "bot": 0.846, "det": {"shodan": {"compromised": 19}, "threatfox": {"family:Remcos": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 5, "imap": 4, "mail": 5, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-7602-APNIC", "org": "Sai gon Postel Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.spt.vn"}, "pfx": 200, "reg": "2003-08-28", "rir": "apnic", "s24": 405, "sib": 0, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 126464, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00157572291786}, {"a": 7633, "h": "SOFTNET-AS-AP", "n": "Software Technology Parks of India - Bangalore", "t": "Other", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 4}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.1194, "hi": 3.73, "lo": 0.48, "ips": 2, "mean": 1.78, "above": false}, "crowdsec": {"n": 4, "p": 0.3471, "hi": 4.93, "lo": 1.06, "ips": 4, "mean": 2.69, "above": false}, "blocklist_de": {"n": 4, "p": 0.6220, "hi": 6.81, "lo": 1.46, "ips": 4, "mean": 3.72, "above": false}}, "h2": [["2026-10-05", 2.711, 0.010, 0, false], ["2026-10-12", 2.286, 0.011, 0, false]], "sh": false, "uc": 622.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 0.388, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.286, "se": 0.519, "ts": 0.500, "map": 4.488, "obs": 8, "own": 2.535, "comp": {"cins": -1.3826, "dshield": -2.0706, "crowdsec": 0.6226, "vulncheck": -0.8839, "blocklist_de": 6.6096}, "mass": 8.0, "listed": false}}, "abq": true, "bot": 0.191, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"imap": 2, "mail": 4}}, "oid": "@aut-7633-APNIC", "org": "Software Technology Parks of India - Bangalore", "pdb": null, "pfx": 243, "reg": "1997-09-26", "rir": "apnic", "s24": 322, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 104704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042548758704}, {"a": 7671, "h": "NTTSMC", "n": "NTT SmartConnect", "t": "Hosting & VPS", "w": 1, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.99, "lo": 0.07, "ips": 1, "mean": 0.42, "above": false}, "urlhaus": {"n": 1, "p": 0.1367, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.004, 0.110, 0, false], ["2026-10-12", 0.003, 0.122, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.122, "se": 1.366, "ts": 1.000, "map": 0.826, "obs": 1, "own": 0.372, "comp": {"urlhaus": 2.7209, "threatfox": -0.4329, "phishing_db": -0.853}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.439, "ts": null, "map": 0.038, "obs": 0, "own": 0.010, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.696, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-7671-APNIC", "org": "NTT SmartConnect Corporation", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.nttsmc.com/"}, "pfx": 61, "reg": "1997-11-13", "rir": "apnic", "s24": 1773, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 457728, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00143036897705}, {"a": 7679, "h": "QTNET", "n": "QTnet", "t": "Broadband & mobile", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.65, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.755, "ts": null, "map": 0.093, "obs": 0, "own": 0.424, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.380, "ts": null, "map": 0.027, "obs": 0, "own": 0.052, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.061, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-7679-JPNIC", "org": "QTnet,Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.qtnet.co.jp"}, "pfx": 36, "reg": "1997-11-13", "rir": "apnic", "s24": 2972, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 760832, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02703747972445}, {"a": 7684, "h": "SAKURA-A", "n": "SAKURA-A", "t": "Hosting & VPS", "w": 7, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 4, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3}, "n": 5}, "ev": {"shodan": {"n": 9, "p": 0.2229, "hi": 3.85, "lo": 1.33, "ips": 9, "mean": 2.45, "above": false}, "crowdsec": {"n": 5, "p": 0.0040, "hi": 2.18, "lo": 0.54, "ips": 5, "mean": 1.24, "above": false}, "phishing_db": {"n": 1, "p": 0.0369, "hi": 2.78, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}, "blocklist_de": {"n": 1, "p": 0.0042, "hi": 1.87, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.443, 0.075, 0, false], ["2026-10-12", 0.336, 0.079, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.079, "se": 1.344, "ts": 1.000, "map": 0.471, "obs": 1, "own": 0.231, "comp": {"urlhaus": -0.4112, "threatfox": -0.329, "phishing_db": 1.6132}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.336, "se": 0.561, "ts": 0.833, "map": 0.707, "obs": 6, "own": 0.140, "comp": {"cins": -1.0719, "dshield": -1.7587, "crowdsec": 6.2628, "vulncheck": -0.838, "blocklist_de": -1.5473}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.933, "det": {"shodan": {"compromised": 9}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-55897-JPNIC", "org": "SAKURA Internet Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.sakura.ad.jp/"}, "pfx": 51, "reg": "1997-11-13", "rir": "apnic", "s24": 1440, "sib": 6, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 368640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00287413765795}, {"a": 7713, "h": "telkomnet-as-ap", "n": "Telekomunikasi Indonesia Int (TELIN)", "t": "Broadband & mobile", "w": 199, "cc": "ID", "cf": {"rb": "", "wb": "", "rep": 1.84, "waf": 0.80}, "cs": {"c": {"http_flood": 16, "web_exploit": 33, "bad_crawling": 4, "proxy_or_vpn": 26, "first_seen_30d": 7, "ssh_bruteforce": 38, "web_bruteforce": 33, "home_connection": 58, "mail_bruteforce": 19, "router_or_botnet": 33, "cve:CVE-2017-9841": 5, "cve:CVE-2019-8318": 3, "cve:CVE-2018-10562": 4, "cve:CVE-2024-12847": 5, "cve:CVE-2024-28000": 4}, "n": 70}, "ev": {"cins": {"n": 8, "p": 0.0001, "hi": 1.80, "lo": 0.58, "ips": 8, "mean": 1.12, "above": false}, "shodan": {"n": 19, "p": 0.0000, "hi": 0.76, "lo": 0.36, "ips": 19, "mean": 0.55, "above": false}, "dshield": {"n": 63, "p": 1.0000, "hi": 7.78, "lo": 5.15, "ips": 65, "mean": 6.41, "above": true}, "urlhaus": {"n": 15, "p": 0.9947, "hi": 9.09, "lo": 3.95, "ips": 15, "mean": 6.30, "above": true}, "crowdsec": {"n": 68, "p": 0.0000, "hi": 1.84, "lo": 1.24, "ips": 70, "mean": 1.52, "above": false}, "threatfox": {"n": 2, "p": 0.0016, "hi": 1.77, "lo": 0.23, "ips": 2, "mean": 0.84, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.69, "lo": 0.09, "ips": 2, "mean": 0.33, "above": false}, "blocklist_de": {"n": 50, "p": 0.2124, "hi": 3.36, "lo": 2.11, "ips": 52, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 0.933, 0.905, 0, false], ["2026-10-12", 1.404, 1.135, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 15, "threatfox": 2, "phishing_db": 2}, "lo": 1.135, "se": 0.827, "ts": 0.789, "map": 2.476, "obs": 19, "own": 6.391, "comp": {"urlhaus": 4.0671, "threatfox": -0.4664, "phishing_db": -1.0681}, "mass": 60.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 63, "crowdsec": 68, "vulncheck": 1, "blocklist_de": 50}, "lo": 1.404, "se": 0.362, "ts": 0.358, "map": 2.087, "obs": 190, "own": 3.211, "comp": {"cins": -0.5341, "dshield": 6.2619, "crowdsec": -3.202, "vulncheck": -0.9779, "blocklist_de": 0.5814}, "mass": 192.5, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"compromised": 16, "doublepulsar": 3}, "threatfox": {"family:Chaos": 1, "family:Deimos": 1}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ssh": 14, "bots": 20, "imap": 6, "mail": 7, "apache": 11, "bruteforcelogin": 11}}, "oid": "ORG-TI10-AP-APNIC", "org": "Telekomunikasi Indonesia (PT)", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Tbps", "pol": "Restrictive", "web": "http://www.telin.net"}, "pfx": 3449, "reg": "1998-01-06", "rir": "apnic", "s24": 16661, "sib": 3, "tor": 0, "w24": 191, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 7872000, "abuse": "abuse@telkom.co.id", "score": 0.1060, "groups": ["abusech"], "sensors": ["dshield"], "traffic": 0.2953}, {"a": 7725, "h": "COMCAST-7725", "n": "Comcast - Atlanta", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1632, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 1.667, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.918, "ts": null, "map": 0.195, "obs": 0, "own": 0.781, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"malware": 1}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": null}, "pfx": 32, "reg": "1996-12-20", "rir": "arin", "s24": 41, "sib": 55, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7727, "h": "", "n": "HONDUTEL (Honduras)", "t": "Hosting & VPS", "w": 1, "cc": "HN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0249, "hi": 2.55, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "blocklist_de": {"n": 1, "p": 0.0888, "hi": 3.52, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.242, 0.010, 0, false], ["2026-10-12", 0.270, 0.011, 0, false]], "sh": false, "uc": 189.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.924, "ts": null, "map": 0.164, "obs": 0, "own": 0.149, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.270, "se": 0.863, "ts": 0.500, "map": 0.998, "obs": 2, "own": 0.203, "comp": {"cins": -0.4059, "dshield": -0.8374, "crowdsec": 0.6837, "vulncheck": -0.6076, "blocklist_de": 2.5588}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.165, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-7727-LACNIC", "org": "Hondutel", "pdb": {"t": "Network Services", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.hondutel.hn/"}, "pfx": 8, "reg": "1996-12-20", "rir": "lacnic", "s24": 323, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 99328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000249504419}, {"a": 7738, "h": "", "n": "Vtal 7738", "t": "Transit & backbone", "w": 42, "cc": "BR", "cf": {"rb": "", "wb": "", "rep": 0.88, "waf": 0.84}, "cs": {"c": {"http_flood": 1, "data_centre": 5, "web_exploit": 3, "ssh_bruteforce": 16, "web_bruteforce": 19, "home_connection": 5, "mail_bruteforce": 20}, "n": 22}, "ev": {"cins": {"n": 3, "p": 0.0139, "hi": 2.42, "lo": 0.43, "ips": 3, "mean": 1.25, "above": false}, "shodan": {"n": 12, "p": 0.0000, "hi": 1.60, "lo": 0.63, "ips": 12, "mean": 1.07, "above": false}, "crowdsec": {"n": 22, "p": 0.0001, "hi": 2.12, "lo": 1.06, "ips": 22, "mean": 1.55, "above": false}, "blocklist_de": {"n": 30, "p": 0.9886, "hi": 6.19, "lo": 3.41, "ips": 30, "mean": 4.71, "above": true}}, "h2": [["2026-10-05", 1.000, 0.006, 0, false], ["2026-10-12", 1.552, 0.007, 0, false]], "sh": false, "uc": 134.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.717, "ts": null, "map": 0.075, "obs": 0, "own": 0.479, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 22, "vulncheck": 0, "blocklist_de": 30}, "lo": 1.552, "se": 0.381, "ts": 0.545, "map": 2.409, "obs": 55, "own": 7.527, "comp": {"cins": -0.3405, "dshield": -3.3083, "crowdsec": -4.0444, "vulncheck": -0.9993, "blocklist_de": 10.9655}, "mass": 69.4, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"c2": 3, "compromised": 2, "doublepulsar": 7}, "blocklist_de": {"ssh": 2, "bots": 14, "imap": 8, "mail": 12, "apache": 2, "bruteforcelogin": 2}}, "oid": "@aut-22745-LACNIC", "org": "V tal", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.vtal.com"}, "pfx": 236, "reg": "1999-11-16", "rir": "lacnic", "s24": 5204, "sib": 2, "tor": 0, "w24": 42, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1856512, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.096581}, {"a": 7775, "h": "IRONTRUST-NETWORKS", "n": "Irontrust Networks", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 3.049, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 3.126, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.830, "det": {"shodan": {"malware": 1}}, "oid": "IPL-121-ARIN", "org": "Irontrust Networks", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://prov.net"}, "pfx": 7, "reg": "2018-01-24", "rir": "arin", "s24": 9, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7794, "h": "EXECULINK", "n": "Execulink Telecom", "t": "Broadband & mobile", "w": 2, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0086, "hi": 2.09, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "dshield": {"n": 1, "p": 0.0944, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "crowdsec": {"n": 1, "p": 0.0038, "hi": 1.84, "lo": 0.14, "ips": 1, "mean": 0.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.0436, "hi": 2.90, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}}, "h2": [["2026-10-05", 0.156, 0.009, 0, false], ["2026-10-12", 0.303, 0.010, 0, false]], "sh": false, "uc": 82.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.878, "ts": null, "map": 0.147, "obs": 0, "own": 0.783, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.303, "se": 0.721, "ts": 0.333, "map": 0.857, "obs": 3, "own": 1.346, "comp": {"cins": -0.6091, "dshield": 2.3692, "crowdsec": -1.0783, "vulncheck": -0.7128, "blocklist_de": 1.2705}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "EXLK-ARIN", "org": "Execulink Telecom Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.execulink.ca"}, "pfx": 54, "reg": "1997-01-15", "rir": "arin", "s24": 594, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 303872, "abuse": "abuse@execulink.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0027745010013}, {"a": 7795, "h": "LUMOS", "n": "LUMOS Networks, Inc.", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1005, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}, "blocklist_de": {"n": 1, "p": 0.0476, "hi": 2.96, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.227, 0.009, 0, false], ["2026-10-12", 0.135, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.882, "ts": null, "map": 0.149, "obs": 0, "own": 0.123, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.135, "se": 0.864, "ts": 0.500, "map": 0.488, "obs": 2, "own": 0.102, "comp": {"cins": -0.3495, "dshield": -0.7371, "crowdsec": -2.9064, "vulncheck": 1.7472, "blocklist_de": 2.9222}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "LN-19-ARIN", "org": "LUMOS Networks, Inc.", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.segra.com"}, "pfx": 57, "reg": "1997-01-15", "rir": "arin", "s24": 561, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 185856, "abuse": "abuse@segra.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7859, "h": "PAIR-NETWORKS", "n": "Pair Networks", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0496, "hi": 2.99, "lo": 0.39, "ips": 2, "mean": 1.43, "above": false}, "phishing_db": {"n": 1, "p": 0.1111, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.056, 0.131, 0, false], ["2026-10-12", 0.006, 0.138, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.138, "se": 1.376, "ts": 1.000, "map": 0.924, "obs": 1, "own": 1.126, "comp": {"urlhaus": -0.3004, "threatfox": -0.2767, "phishing_db": 2.1238}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.589, "ts": null, "map": 0.078, "obs": 0, "own": 0.064, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.982, "det": {"shodan": {"compromised": 2}}, "oid": "PAIR-ARIN", "org": "pair Networks", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.pair.com/"}, "pfx": 7, "reg": "1997-01-30", "rir": "arin", "s24": 516, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 133120, "abuse": "abuse@pair.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 7922, "h": "COMCAST-7922", "n": "Comcast", "t": "Broadband & mobile", "w": 1292, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.51, "waf": 0.34}, "cs": {"c": {"http_flood": 16, "web_exploit": 28, "bad_crawling": 7, "proxy_or_vpn": 14, "first_seen_30d": 4, "ssh_bruteforce": 46, "web_bruteforce": 69, "home_connection": 110, "mail_bruteforce": 91, "router_or_botnet": 4, "cve:CVE-2017-9841": 3, "cve:CVE-2019-8318": 2, "cve:CVE-2019-9082": 3, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 3}, "n": 127}, "ev": {"cins": {"n": 19, "p": 0.0000, "hi": 0.25, "lo": 0.12, "ips": 19, "mean": 0.18, "above": false}, "shodan": {"n": 6, "p": 0.0000, "hi": 0.02, "lo": 0.01, "ips": 6, "mean": 0.01, "above": false}, "dshield": {"n": 35, "p": 0.0000, "hi": 0.32, "lo": 0.19, "ips": 35, "mean": 0.25, "above": false}, "urlhaus": {"n": 7, "p": 0.0000, "hi": 0.52, "lo": 0.16, "ips": 7, "mean": 0.31, "above": false}, "crowdsec": {"n": 124, "p": 0.0000, "hi": 0.20, "lo": 0.15, "ips": 127, "mean": 0.18, "above": false}, "vulncheck": {"n": 27, "p": 0.0000, "hi": 0.27, "lo": 0.14, "ips": 1071, "mean": 0.20, "above": false}, "phishing_db": {"n": 5, "p": 0.0000, "hi": 0.08, "lo": 0.02, "ips": 5, "mean": 0.05, "above": false}, "blocklist_de": {"n": 103, "p": 0.0000, "hi": 0.43, "lo": 0.31, "ips": 104, "mean": 0.37, "above": false}}, "h2": [["2026-10-05", 0.120, 0.046, 0, false], ["2026-10-12", 0.158, 0.050, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 7, "threatfox": 0, "phishing_db": 5}, "lo": 0.050, "se": 1.027, "ts": 0.583, "map": 0.131, "obs": 12, "own": 0.466, "comp": {"urlhaus": 0.9615, "threatfox": -0.5855, "phishing_db": -0.7851}, "mass": 70.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 19, "dshield": 35, "crowdsec": 124, "vulncheck": 27, "blocklist_de": 103}, "lo": 0.158, "se": 0.369, "ts": 0.403, "map": 0.235, "obs": 308, "own": 0.364, "comp": {"cins": 0.6518, "dshield": -0.4643, "crowdsec": -3.0517, "vulncheck": -0.5221, "blocklist_de": 3.3323}, "mass": 347.1, "listed": false}}, "abq": false, "bot": 0.140, "det": {"shodan": {"malware": 2, "compromised": 4}, "vulncheck": {"c2_server": 53, "botnet_node": 1016, "attack_tooling": 2}, "blocklist_de": {"ssh": 15, "bots": 7, "imap": 50, "mail": 80, "apache": 2, "bruteforcelogin": 2}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "https://corporate.comcast.com/"}, "pfx": 428, "reg": "1997-02-14", "rir": "arin", "s24": 264777, "sib": 55, "tor": 0, "w24": 245, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 68337664, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 2.382753}, {"a": 7979, "h": "SERVERS-COM", "n": "SERVERS.COM", "t": "Hosting & VPS", "w": 12, "cc": "US", "cf": {"rb": "hi", "wb": "", "rep": 0.08, "waf": 0.15}, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "web_bruteforce": 1, "cve:CVE-2021-43798": 1}, "n": 3}, "ev": {"shodan": {"n": 3, "p": 0.0001, "hi": 1.49, "lo": 0.26, "ips": 3, "mean": 0.77, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 1.24, "lo": 0.22, "ips": 3, "mean": 0.64, "above": false}, "vulncheck": {"n": 4, "p": 0.2709, "hi": 4.50, "lo": 0.97, "ips": 8, "mean": 2.46, "above": false}, "phishing_db": {"n": 1, "p": 0.0190, "hi": 2.41, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.222, 0.062, 0, false], ["2026-10-12", 0.182, 0.066, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.066, "se": 1.338, "ts": 1.000, "map": 0.382, "obs": 1, "own": 0.191, "comp": {"urlhaus": -0.4509, "threatfox": -0.3445, "phishing_db": 1.4588}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 4, "blocklist_de": 0}, "lo": 0.182, "se": 0.569, "ts": 0.571, "map": 0.384, "obs": 7, "own": 0.077, "comp": {"cins": -0.8509, "dshield": -1.4978, "crowdsec": 3.1597, "vulncheck": 3.8657, "blocklist_de": -4.2397}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "vulncheck": {"botnet_node": 8}}, "oid": "SERVE-105-ARIN", "org": "Servers.com, Inc.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://servers.com"}, "pfx": 1946, "reg": "1997-03-11", "rir": "arin", "s24": 1975, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 507648, "abuse": "abuse@servers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.949956}, {"a": 7992, "h": "COGECOWAVE", "n": "Cogeco Cable Canada", "t": "Broadband & mobile", "w": 6, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0033, "hi": 1.80, "lo": 0.13, "ips": 1, "mean": 0.76, "above": false}, "dshield": {"n": 1, "p": 0.0010, "hi": 1.54, "lo": 0.12, "ips": 1, "mean": 0.65, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.69, "lo": 0.12, "ips": 3, "mean": 0.35, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.22, "lo": 0.16, "ips": 2, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.165, 0.006, 0, false], ["2026-10-12", 0.180, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.737, "ts": null, "map": 0.084, "obs": 0, "own": 0.381, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.180, "se": 0.537, "ts": 0.429, "map": 0.364, "obs": 7, "own": 0.567, "comp": {"cins": 2.2866, "dshield": 0.1988, "crowdsec": -1.3627, "vulncheck": -0.8808, "blocklist_de": 0.1419}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.136, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "CC-4445-ARIN", "org": "Cogeco Connexion Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.cogeco.com"}, "pfx": 39, "reg": "1997-03-17", "rir": "arin", "s24": 3865, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 989440, "abuse": "security@cogeco.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03806376979363}, {"a": 8001, "h": "COLOGIX", "n": "Cologix", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1104, "hi": 3.78, "lo": 0.28, "ips": 6, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.004, 0.065, 0, false], ["2026-10-12", 0.004, 0.069, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.069, "se": 1.344, "ts": 1.000, "map": 0.402, "obs": 1, "own": 0.202, "comp": {"urlhaus": -0.4059, "threatfox": 1.746, "phishing_db": -0.6251}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.446, "ts": null, "map": 0.040, "obs": 0, "own": 0.010, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.861, "det": {"threatfox": {"family:Unknown malware": 6}}, "oid": "COLOG-8-Z-ARIN", "org": "Cologix, Inc", "pdb": {"t": "NSP", "sc": "North America", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.cologix.com"}, "pfx": 53, "reg": "1996-08-22", "rir": "arin", "s24": 1662, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 440320, "abuse": "abuse@cologix.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8046, "h": "NAPANET", "n": "NapaNet", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"compromised": 2}}, "oid": "NIS-115-ARIN", "org": "NapaNet", "pdb": null, "pfx": 1, "reg": "1997-03-20", "rir": "arin", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "noc@napanet.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8048, "h": "", "n": "CANTV", "t": "Broadband & mobile", "w": 22, "cc": "VE", "cf": null, "cs": {"c": {"ssh_bruteforce": 8, "web_bruteforce": 1, "home_connection": 7, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.92, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 1.45, "lo": 0.31, "ips": 4, "mean": 0.79, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 0.58, "lo": 0.20, "ips": 9, "mean": 0.37, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.77, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}, "blocklist_de": {"n": 9, "p": 0.0000, "hi": 1.36, "lo": 0.47, "ips": 10, "mean": 0.86, "above": false}}, "h2": [["2026-10-05", 0.111, 0.005, 0, false], ["2026-10-12", 0.293, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.679, "ts": null, "map": 0.058, "obs": 0, "own": 0.258, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 9}, "lo": 0.293, "se": 0.421, "ts": 0.375, "map": 0.486, "obs": 24, "own": 0.752, "comp": {"cins": -0.5656, "dshield": 0.8487, "crowdsec": -3.0613, "vulncheck": -0.7459, "blocklist_de": 4.1968}, "mass": 26.7, "listed": false}}, "abq": false, "bot": 0.256, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 7, "bots": 3}}, "oid": "@aut-10293-LACNIC", "org": "CANTV Servicios, Venezuela", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.cantv.com.ve"}, "pfx": 461, "reg": "1997-03-20", "rir": "lacnic", "s24": 9857, "sib": 1, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2530048, "abuse": "ipadmin@cantv.com.ve", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01438143738819}, {"a": 8069, "h": "MICROSOFT-CORP-MSN-AS-BLOCK", "n": "Microsoft AS8069", "t": "Hyperscale cloud", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.0301, "hi": 2.76, "lo": 0.59, "ips": 4, "mean": 1.51, "above": false}, "crowdsec": {"n": 1, "p": 0.0001, "hi": 1.22, "lo": 0.09, "ips": 1, "mean": 0.51, "above": false}, "threatfox": {"n": 1, "p": 0.1359, "hi": 4.07, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "blocklist_de": {"n": 1, "p": 0.0114, "hi": 2.19, "lo": 0.16, "ips": 1, "mean": 0.92, "above": false}}, "h2": [["2026-10-05", 0.199, 0.084, 0, false], ["2026-10-12", 0.099, 0.088, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.088, "se": 1.353, "ts": 1.000, "map": 0.533, "obs": 1, "own": 0.484, "comp": {"urlhaus": -0.3572, "threatfox": 1.9338, "phishing_db": -0.5805}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.099, "se": 0.829, "ts": 0.500, "map": 0.343, "obs": 2, "own": 0.146, "comp": {"cins": -0.4624, "dshield": -0.9335, "crowdsec": 0.1653, "vulncheck": -0.6423, "blocklist_de": 2.1972}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"c2": 3, "doublepulsar": 1}, "threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 1}}, "oid": "MSFT-ARIN", "org": "Microsoft Corporation", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Restrictive", "web": "http://www.microsoft.com"}, "pfx": 760, "reg": "1997-03-31", "rir": "arin", "s24": 1085, "sib": 63, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 277760, "abuse": "abuse@microsoft.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00515309568558}, {"a": 8070, "h": "MICROSOFT-CORP-MSN-AS-BLOCK", "n": "Microsoft Corporation", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 0.64, "lo": 0.11, "ips": 3, "mean": 0.33, "above": false}, "threatfox": {"n": 1, "p": 0.0428, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "blocklist_de": {"n": 3, "p": 0.0001, "hi": 1.41, "lo": 0.25, "ips": 3, "mean": 0.73, "above": false}}, "h2": [["2026-10-05", 0.127, 0.038, 0, false], ["2026-10-12", 0.139, 0.040, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.040, "se": 1.333, "ts": 1.000, "map": 0.218, "obs": 1, "own": 0.303, "comp": {"urlhaus": -0.5305, "threatfox": 1.3527, "phishing_db": -0.7202}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.139, "se": 0.560, "ts": 0.500, "map": 0.292, "obs": 6, "own": 0.167, "comp": {"cins": -1.2312, "dshield": -1.9257, "crowdsec": -0.3634, "vulncheck": -0.8638, "blocklist_de": 4.5483}, "mass": 6.9, "listed": false}}, "abq": false, "bot": 0.579, "det": {"threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"ssh": 3}}, "oid": "MSFT-ARIN", "org": "Microsoft Corporation", "pdb": null, "pfx": 30, "reg": "1997-03-31", "rir": "arin", "s24": 4195, "sib": 63, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1073920, "abuse": "abuse@microsoft.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8075, "h": "MICROSOFT-CORP-MSN-AS-BLOCK", "n": "Microsoft", "t": "Hyperscale cloud", "w": 3687, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.76, "waf": 2.12}, "cs": {"c": {"http_flood": 765, "data_centre": 1259, "web_exploit": 1130, "bad_crawling": 698, "proxy_or_vpn": 57, "first_seen_30d": 302, "ssh_bruteforce": 570, "web_bruteforce": 706, "mail_bruteforce": 39, "router_or_botnet": 1, "cve:CVE-2017-9841": 81, "cve:CVE-2022-41082": 304, "cve:CVE-2022-46604": 68, "cve:CVE-2025-31324": 318, "cve:CVE-2025-55182": 70}, "n": 1415}, "ev": {"cins": {"n": 557, "p": 1.0000, "hi": 4.45, "lo": 3.87, "ips": 1602, "mean": 4.16, "above": true}, "shodan": {"n": 398, "p": 0.0000, "hi": 0.64, "lo": 0.54, "ips": 398, "mean": 0.59, "above": false}, "dshield": {"n": 34, "p": 0.0000, "hi": 0.26, "lo": 0.15, "ips": 35, "mean": 0.20, "above": false}, "urlhaus": {"n": 3, "p": 0.0000, "hi": 0.26, "lo": 0.05, "ips": 3, "mean": 0.13, "above": false}, "crowdsec": {"n": 1236, "p": 0.0000, "hi": 1.54, "lo": 1.41, "ips": 1415, "mean": 1.47, "above": false}, "threatfox": {"n": 36, "p": 0.0000, "hi": 0.96, "lo": 0.56, "ips": 40, "mean": 0.75, "above": false}, "vulncheck": {"n": 92, "p": 0.0000, "hi": 0.66, "lo": 0.47, "ips": 93, "mean": 0.56, "above": false}, "phishing_db": {"n": 560, "p": 1.0000, "hi": 3.87, "lo": 3.37, "ips": 602, "mean": 3.62, "above": true}, "blocklist_de": {"n": 218, "p": 0.0000, "hi": 0.72, "lo": 0.58, "ips": 229, "mean": 0.65, "above": false}}, "h2": [["2026-10-05", 1.058, 0.430, 0, false], ["2026-10-12", 0.952, 0.422, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 36, "phishing_db": 560}, "lo": 0.422, "se": 0.850, "ts": 0.935, "map": 0.885, "obs": 599, "own": 0.720, "comp": {"urlhaus": -2.9392, "threatfox": -0.2693, "phishing_db": 4.7127}, "mass": 451.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 557, "dshield": 34, "crowdsec": 1236, "vulncheck": 92, "blocklist_de": 218}, "lo": 0.952, "se": 0.356, "ts": 0.578, "map": 1.418, "obs": 2137, "own": 0.584, "comp": {"cins": 16.4442, "dshield": -3.1591, "crowdsec": 1.0339, "vulncheck": -0.7827, "blocklist_de": -11.7932}, "mass": 2480.6, "listed": false}}, "abq": false, "bot": 0.968, "det": {"shodan": {"c2": 89, "malware": 24, "compromised": 214, "doublepulsar": 71}, "threatfox": {"family:Havoc": 6, "family:AdaptixC2": 4, "family:Unknown RAT": 2, "family:Cobalt Strike": 3, "family:Unknown malware": 19}, "vulncheck": {"c2_server": 51, "botnet_node": 1, "attack_tooling": 28, "other_infrastructure": 13}, "blocklist_de": {"ftp": 2, "sip": 1, "ssh": 136, "bots": 33, "imap": 9, "mail": 12, "apache": 45, "bruteforcelogin": 17}}, "oid": "MSFT-ARIN", "org": "Microsoft Corporation", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.microsoft.com"}, "pfx": 1205, "reg": "1997-03-31", "rir": "arin", "s24": 315437, "sib": 63, "tor": 0, "w24": 2347, "drop": 1, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 81649664, "abuse": "abuse@microsoft.com", "score": 0.0810, "groups": ["phishing"], "sensors": ["cins"], "traffic": 2.881972}, {"a": 8151, "h": "", "n": "Uninet S.A. de C.V.", "t": "Broadband & mobile", "w": 163, "cc": "MX", "cf": {"rb": "", "wb": "", "rep": 0.65, "waf": 0.46}, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 3, "first_seen_30d": 12, "ssh_bruteforce": 31, "web_bruteforce": 3, "home_connection": 34, "mail_bruteforce": 5, "router_or_botnet": 5, "cve:CVE-2024-6387": 1}, "n": 39}, "ev": {"cins": {"n": 20, "p": 0.0000, "hi": 1.25, "lo": 0.60, "ips": 20, "mean": 0.90, "above": false}, "shodan": {"n": 853, "p": 1.0000, "hi": 7.93, "lo": 7.09, "ips": 853, "mean": 7.51, "above": true}, "dshield": {"n": 51, "p": 0.0000, "hi": 2.18, "lo": 1.38, "ips": 51, "mean": 1.76, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.81, "lo": 0.06, "ips": 1, "mean": 0.34, "above": false}, "crowdsec": {"n": 39, "p": 0.0000, "hi": 0.36, "lo": 0.21, "ips": 39, "mean": 0.28, "above": false}, "threatfox": {"n": 6, "p": 0.0000, "hi": 1.30, "lo": 0.36, "ips": 6, "mean": 0.77, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.17, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.29, "lo": 0.05, "ips": 3, "mean": 0.15, "above": false}, "blocklist_de": {"n": 55, "p": 0.0000, "hi": 1.20, "lo": 0.77, "ips": 55, "mean": 0.97, "above": false}}, "h2": [["2026-10-05", 0.327, 0.048, 0, false], ["2026-10-12", 0.456, 0.068, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 6, "phishing_db": 3}, "lo": 0.068, "se": 1.026, "ts": 0.600, "map": 0.184, "obs": 10, "own": 0.623, "comp": {"urlhaus": -0.6912, "threatfox": 0.9137, "phishing_db": -0.2909}, "mass": 18.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 20, "dshield": 51, "crowdsec": 39, "vulncheck": 1, "blocklist_de": 55}, "lo": 0.456, "se": 0.368, "ts": 0.331, "map": 0.692, "obs": 166, "own": 1.068, "comp": {"cins": 4.3938, "dshield": 4.0342, "crowdsec": -7.8429, "vulncheck": -0.9797, "blocklist_de": 1.42}, "mass": 202.9, "listed": false}}, "abq": true, "bot": 0.122, "det": {"shodan": {"c2": 7, "malware": 1, "compromised": 845}, "threatfox": {"family:DarkComet": 1, "family:Unknown malware": 5}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 4, "ssh": 27, "bots": 18, "mail": 3, "apache": 3, "bruteforcelogin": 3}}, "oid": "@aut-28513-LACNIC", "org": "Uninet S.A. de C.V.", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://telmex.com"}, "pfx": 13315, "reg": "1997-04-29", "rir": "lacnic", "s24": 52778, "sib": 7, "tor": 0, "w24": 163, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23565312, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.466001}, {"a": 8167, "h": "", "n": "Vtal 8167", "t": "Transit & backbone", "w": 19, "cc": "BR", "cf": {"rb": "", "wb": "hi", "rep": 0.89, "waf": 0.74}, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 6, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 5}, "n": 6}, "ev": {"shodan": {"n": 5, "p": 0.0000, "hi": 0.53, "lo": 0.13, "ips": 5, "mean": 0.30, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 1.34, "lo": 0.24, "ips": 3, "mean": 0.69, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.48, "lo": 0.13, "ips": 6, "mean": 0.28, "above": false}, "blocklist_de": {"n": 14, "p": 0.0004, "hi": 2.08, "lo": 0.88, "ips": 14, "mean": 1.43, "above": false}}, "h2": [["2026-10-05", 0.351, 0.005, 0, false], ["2026-10-12", 0.356, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.685, "ts": null, "map": 0.060, "obs": 0, "own": 0.383, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 14}, "lo": 0.356, "se": 0.420, "ts": 0.609, "map": 0.591, "obs": 23, "own": 1.854, "comp": {"cins": -2.7674, "dshield": -0.3475, "crowdsec": -6.4016, "vulncheck": -0.9762, "blocklist_de": 11.3601}, "mass": 29.2, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"doublepulsar": 5}, "blocklist_de": {"ssh": 2, "bots": 8, "imap": 3, "mail": 4}}, "oid": "@aut-22745-LACNIC", "org": "V tal", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Selective", "web": "http://www.vtal.com"}, "pfx": 864, "reg": "1999-11-17", "rir": "lacnic", "s24": 8876, "sib": 2, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2273280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.086096}, {"a": 8175, "h": "HIGHSPEEDWEB", "n": "High Speed Web, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 0.183, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.741, "ts": null, "map": 0.132, "obs": 0, "own": 0.047, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.938, "det": null, "oid": "WILDW-5-ARIN", "org": "High Speed Web/Genesis 2 Networks", "pdb": {"t": "Content", "sc": "North America", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.highspeedweb.net"}, "pfx": 6, "reg": "1997-05-12", "rir": "arin", "s24": 162, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 63744, "abuse": "noc@highspeedweb.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8193, "h": "BRM-AS", "n": "\"Uzbektelekom\" Joint Stock Company", "t": "Broadband & mobile", "w": 108, "cc": "UZ", "cf": {"rb": "lo", "wb": "lo", "rep": 3.30, "waf": 1.48}, "cs": {"c": {"http_flood": 35, "web_exploit": 61, "bad_crawling": 30, "proxy_or_vpn": 10, "ssh_bruteforce": 37, "web_bruteforce": 75, "home_connection": 38, "mail_bruteforce": 35, "router_or_botnet": 5, "cve:CVE-2025-4396": 3, "cve:CVE-2024-28000": 5, "cve:CVE-2024-34351": 3, "cve:CVE-2026-60137": 7, "cve:CVE-2026-63030": 10}, "n": 92}, "ev": {"cins": {"n": 2, "p": 0.3548, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "shodan": {"n": 1, "p": 0.0547, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "dshield": {"n": 1, "p": 0.1454, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 52, "p": 1.0000, "hi": 39.05, "lo": 24.81, "ips": 92, "mean": 31.59, "above": true}, "vulncheck": {"n": 7, "p": 0.9769, "hi": 11.60, "lo": 3.51, "ips": 7, "mean": 7.06, "above": true}, "blocklist_de": {"n": 22, "p": 1.0000, "hi": 24.67, "lo": 12.35, "ips": 22, "mean": 18.06, "above": true}}, "h2": [["2026-10-05", 28.988, 0.010, 1, false], ["2026-10-12", 33.653, 0.011, 2, false]], "sh": false, "uc": 3696.9, "v2": {"band": 2, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.036, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 52, "vulncheck": 7, "blocklist_de": 22}, "lo": 33.653, "se": 0.362, "ts": 0.619, "map": 51.338, "obs": 84, "own": 78.320, "comp": {"cins": -1.5161, "dshield": -2.9276, "crowdsec": 6.9836, "vulncheck": -0.4026, "blocklist_de": 3.1948}, "mass": 71.9, "listed": true}}, "abq": false, "bot": 0.279, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 7}, "blocklist_de": {"ssh": 8, "bots": 2, "imap": 5, "mail": 12}}, "oid": "ORG-UNCN1-RIPE", "org": "\"Uzbektelekom\" Joint Stock Company", "pdb": null, "pfx": 91, "reg": "1997-02-03", "rir": "ripencc", "s24": 255, "sib": 2, "tor": 0, "w24": 57, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.8493]], "ipv4": 88576, "abuse": "ripe@bkm.uz", "score": 0.8493, "groups": ["sensors", "vulncheck"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0386764995344}, {"a": 8200, "h": "UPLINK-AS", "n": "Uplink LLC", "t": "Other", "w": 2, "cc": "KZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.522, 0.011, 0, false], ["2026-10-12", 5.298, 0.012, 0, false]], "sh": false, "uc": 3331.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 5.298, "se": 0.804, "ts": 0.333, "map": 17.304, "obs": 3, "own": 10.142, "comp": {"cins": -0.3734, "dshield": -0.7801, "crowdsec": 0.9929, "vulncheck": 1.637, "blocklist_de": 2.7682}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.237, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-UL110-RIPE", "org": "Uplink LLC", "pdb": null, "pfx": 16, "reg": "2015-11-12", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057619953237}, {"a": 8218, "h": "NEO-ASN", "n": "Zayo Europe", "t": "Transit & backbone", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0628, "hi": 3.19, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.398, 0.010, 0, false], ["2026-10-12", 0.114, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 1.626, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.114, "se": 1.157, "ts": 1.000, "map": 0.738, "obs": 1, "own": 2.545, "comp": {"cins": -0.1806, "dshield": -0.408, "crowdsec": 3.0082, "vulncheck": -0.3914, "blocklist_de": -0.9379}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.580, "det": null, "oid": "ORG-NTG3-RIPE", "org": "Zayo Infrastructure France SA", "pdb": {"t": "NSP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.zayoeurope.com"}, "pfx": 19, "reg": "2004-07-09", "rir": "ripencc", "s24": 184, "sib": 2, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47104, "abuse": "abuse@zayo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00078339428532}, {"a": 8220, "h": "COLT", "n": "Colt", "t": "Broadband & mobile", "w": 7, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1}, "n": 6}, "ev": {"dshield": {"n": 1, "p": 0.0001, "hi": 1.15, "lo": 0.09, "ips": 1, "mean": 0.48, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.72, "lo": 0.20, "ips": 6, "mean": 0.43, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.87, "lo": 0.11, "ips": 2, "mean": 0.41, "above": false}}, "h2": [["2026-10-05", 0.102, 0.006, 0, false], ["2026-10-12", 0.151, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.710, "ts": null, "map": 0.072, "obs": 0, "own": 0.322, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.151, "se": 0.503, "ts": 0.667, "map": 0.283, "obs": 9, "own": 0.439, "comp": {"cins": -1.5085, "dshield": -0.1318, "crowdsec": 3.5721, "vulncheck": -0.8981, "blocklist_de": -0.9036}, "mass": 9.2, "listed": false}}, "abq": false, "bot": 0.230, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-CI9-RIPE", "org": "COLT Technology Services Group Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.colt.net"}, "pfx": 152, "reg": "1997-02-24", "rir": "ripencc", "s24": 5816, "sib": 8, "tor": 0, "w24": 7, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1517824, "abuse": "abuse@colt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02724431807578}, {"a": 8251, "h": "NFX_ZSPO", "n": "NFX, z.s.p.o. (FreeTel, s.r.o.)", "t": "Enterprise, edu & gov", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1428, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.209, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 2.512, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 2.176, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.154, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-SK14-RIPE", "org": "FreeTel, s.r.o.", "pdb": {"t": "Non-Profit", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.nfx.cz"}, "pfx": 6, "reg": "2006-07-17", "rir": "ripencc", "s24": 68, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "abuse@nfx.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00206451700535}, {"a": 8256, "h": "LODMAN-AS", "n": "Lodz University of Technology", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0921, "hi": 3.56, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 0.484, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.747, "ts": null, "map": 0.135, "obs": 0, "own": 0.137, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MANL1-RIPE", "org": "Lodz University of Technology", "pdb": null, "pfx": 6, "reg": "1997-04-04", "rir": "ripencc", "s24": 155, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39680, "abuse": "abuse@man.lodz.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025636036842}, {"a": 8278, "h": "TUC-AS", "n": "Technical University of Crete", "t": "Other", "w": 0, "cc": "GR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.190, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TUOC3-RIPE", "org": "Technical University of Crete", "pdb": null, "pfx": 1, "reg": "1997-04-16", "rir": "ripencc", "s24": 256, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "noc@noc.tuc.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000265771287}, {"a": 8283, "h": "COLOCLUE-AS", "n": "Netwerkvereniging ColoClue", "t": "Hosting & VPS", "w": 2, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2019-17233": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 7.589, 0.011, 0, false], ["2026-10-12", 3.150, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.150, "se": 0.985, "ts": 1.000, "map": 14.721, "obs": 2, "own": 3.025, "comp": {"cins": -0.2502, "dshield": -0.5492, "crowdsec": 6.6527, "vulncheck": -0.4764, "blocklist_de": -1.294}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.910, "det": null, "oid": "ORG-NC22-RIPE", "org": "Netwerkvereniging Coloclue", "pdb": {"t": "Non-Profit", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://coloclue.net"}, "pfx": 3, "reg": "2003-06-23", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 2, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@coloclue.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8285, "h": "", "n": "Versija SIA", "t": "Transit & backbone", "w": 0, "cc": "LV", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1435, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 2.125, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.856, "ts": null, "map": 0.175, "obs": 0, "own": 1.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.734, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VL1-RIPE", "org": "Versija SIA", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.vernet.lv/eng/"}, "pfx": 20, "reg": "1997-04-23", "rir": "ripencc", "s24": 67, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47616, "abuse": "abuse@vernet.lv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014795712084}, {"a": 8308, "h": "NASK-COMMERCIAL", "n": "NASK", "t": "Transit & backbone", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.0011, "hi": 1.70, "lo": 0.22, "ips": 3, "mean": 0.81, "above": false}}, "h2": [["2026-10-12", 0.098, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.836, "ts": null, "map": 0.130, "obs": 0, "own": 0.917, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.098, "se": 0.827, "ts": 1.000, "map": 0.336, "obs": 2, "own": 1.084, "comp": {"cins": -0.4274, "dshield": -0.8745, "crowdsec": 4.411, "vulncheck": -0.6214, "blocklist_de": -2.1861}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.539, "det": {"blocklist_de": {"ftp": 1}}, "oid": "ORG-NRAA1-RIPE", "org": "NAUKOWA I AKADEMICKA SIEC KOMPUTEROWA - PANSTWOWY INSTYTUT BADAWCZY", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.nask.pl"}, "pfx": 11, "reg": "1997-05-12", "rir": "ripencc", "s24": 1017, "sib": 8, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 280064, "abuse": "abuse@nask.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00116558555412}, {"a": 8334, "h": "CO-TPTEL-AS", "n": "JOINT-STOCK COMPANY \"TELEPORT TELECOM\"", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1653, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "dshield": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 2, "p": 0.1684, "hi": 4.15, "lo": 0.54, "ips": 2, "mean": 1.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1580, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "blocklist_de": {"n": 2, "p": 0.2986, "hi": 5.21, "lo": 0.68, "ips": 2, "mean": 2.48, "above": false}}, "h2": [["2026-10-05", 0.753, 0.010, 0, false], ["2026-10-12", 2.706, 0.011, 0, false]], "sh": false, "uc": 300, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 1.126, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 2.706, "se": 0.553, "ts": 0.286, "map": 5.675, "obs": 7, "own": 8.796, "comp": {"cins": 2.7658, "dshield": 0.737, "crowdsec": -2.0925, "vulncheck": 0.0127, "blocklist_de": 1.7066}, "mass": 6.1, "listed": false}}, "abq": false, "bot": 0.419, "det": {"vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-JCT9-RIPE", "org": "JOINT-STOCK COMPANY \"TELEPORT TELECOM\"", "pdb": null, "pfx": 42, "reg": "1997-06-04", "rir": "ripencc", "s24": 194, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59648, "abuse": "info@tptel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075391015315}, {"a": 8339, "h": "KABSI-AS", "n": "Kabelplus GmbH", "t": "Broadband & mobile", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0059, "hi": 2.08, "lo": 0.27, "ips": 2, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 0.005, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.841, "ts": null, "map": 0.132, "obs": 0, "own": 0.662, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.513, "ts": null, "map": 0.056, "obs": 0, "own": 0.117, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.164, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-KA1-RIPE", "org": "kabelplus GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.kabelplus.at"}, "pfx": 27, "reg": "1997-06-10", "rir": "ripencc", "s24": 948, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 244224, "abuse": "abuse@kabsi.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00584293524464}, {"a": 8342, "h": "RTCOMM-AS", "n": "RTCOMM", "t": "Transit & backbone", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0596, "hi": 3.14, "lo": 0.24, "ips": 1, "mean": 1.32, "above": false}, "crowdsec": {"n": 3, "p": 0.0014, "hi": 1.84, "lo": 0.32, "ips": 3, "mean": 0.95, "above": false}, "vulncheck": {"n": 2, "p": 0.1332, "hi": 3.85, "lo": 0.50, "ips": 2, "mean": 1.84, "above": false}, "phishing_db": {"n": 1, "p": 0.0489, "hi": 2.98, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}}, "h2": [["2026-10-05", 0.222, 0.082, 0, false], ["2026-10-12", 0.316, 0.087, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.087, "se": 1.349, "ts": 1.000, "map": 0.529, "obs": 1, "own": 2.365, "comp": {"urlhaus": -0.3904, "threatfox": -0.3202, "phishing_db": 1.6999}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.316, "se": 0.586, "ts": 0.500, "map": 0.687, "obs": 6, "own": 2.191, "comp": {"cins": 3.25, "dshield": -1.5759, "crowdsec": 2.5144, "vulncheck": 1.3653, "blocklist_de": -4.5362}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.932, "det": {"vulncheck": {"c2_server": 1, "botnet_node": 1}}, "oid": "ORG-RA25-RIPE", "org": "JSC RTComm.RU", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.rtcomm.ru/en/geo/net/"}, "pfx": 92, "reg": "1997-06-11", "rir": "ripencc", "s24": 1208, "sib": 3, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 321024, "abuse": "abuse@rtcomm.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004420612735}, {"a": 8345, "h": "DSI-IAS", "n": "JSC \"ER-Telecom Holding\"", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1205, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 1.515, 0.011, 0, false], ["2026-10-12", 0.189, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.423, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.189, "se": 1.220, "ts": 1.000, "map": 1.378, "obs": 1, "own": 2.385, "comp": {"cins": -0.1512, "dshield": -0.3459, "crowdsec": 3.3459, "vulncheck": -0.348, "blocklist_de": -0.7867}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 21, "reg": "1997-06-11", "rir": "ripencc", "s24": 82, "sib": 121, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25856, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8346, "h": "SONATEL", "n": "SONATEL DAKAR", "t": "Broadband & mobile", "w": 11, "cc": "SN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 6, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 6}, "ev": {"shodan": {"n": 3, "p": 0.0035, "hi": 2.03, "lo": 0.36, "ips": 3, "mean": 1.05, "above": false}, "dshield": {"n": 1, "p": 0.0362, "hi": 2.77, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}, "crowdsec": {"n": 6, "p": 0.0192, "hi": 2.63, "lo": 0.73, "ips": 6, "mean": 1.56, "above": false}, "phishing_db": {"n": 1, "p": 0.0428, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "blocklist_de": {"n": 8, "p": 0.6981, "hi": 5.99, "lo": 1.95, "ips": 8, "mean": 3.73, "above": false}}, "h2": [["2026-10-05", 0.818, 0.078, 0, false], ["2026-10-12", 1.318, 0.083, 0, false]], "sh": false, "uc": 86.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.083, "se": 1.346, "ts": 1.000, "map": 0.500, "obs": 1, "own": 1.579, "comp": {"urlhaus": -0.4005, "threatfox": -0.3245, "phishing_db": 1.6572}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 8}, "lo": 1.318, "se": 0.447, "ts": 0.533, "map": 2.298, "obs": 15, "own": 3.541, "comp": {"cins": -2.1634, "dshield": -1.3014, "crowdsec": -2.3544, "vulncheck": -0.9486, "blocklist_de": 8.9935}, "mass": 16.8, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3, "bots": 3, "imap": 1, "mail": 2}}, "oid": "@aut-8346-RIPE", "org": "SONATEL-AS Autonomous System", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.sonatel.com"}, "pfx": 220, "reg": "1997-06-12", "rir": "ripencc", "s24": 1317, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1194240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0260882034816}, {"a": 8359, "h": "MTS", "n": "Mobile TeleSystems PJSC", "t": "Broadband & mobile", "w": 45, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 8, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 4, "cve:CVE-2024-6387": 2}, "n": 10}, "ev": {"cins": {"n": 2, "p": 0.0017, "hi": 1.78, "lo": 0.23, "ips": 2, "mean": 0.85, "above": false}, "dshield": {"n": 25, "p": 0.9993, "hi": 8.23, "lo": 4.30, "ips": 28, "mean": 6.13, "above": true}, "urlhaus": {"n": 1, "p": 0.0533, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 1.00, "lo": 0.36, "ips": 10, "mean": 0.65, "above": false}, "blocklist_de": {"n": 9, "p": 0.0012, "hi": 2.11, "lo": 0.73, "ips": 9, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.457, 0.056, 0, false], ["2026-10-12", 0.872, 0.062, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.062, "se": 1.328, "ts": 1.000, "map": 0.370, "obs": 1, "own": 1.135, "comp": {"urlhaus": 2.0624, "threatfox": -0.4772, "phishing_db": -0.9524}, "mass": 3.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 25, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 9}, "lo": 0.872, "se": 0.389, "ts": 0.543, "map": 1.344, "obs": 46, "own": 2.072, "comp": {"cins": -0.205, "dshield": 11.9936, "crowdsec": -6.3431, "vulncheck": -0.99, "blocklist_de": -2.7659}, "mass": 44.8, "listed": false}}, "abq": false, "bot": 0.364, "det": {"blocklist_de": {"ssh": 3, "bots": 3, "imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "https://ir.mts.ru/"}, "pfx": 434, "reg": "1997-06-26", "rir": "ripencc", "s24": 6007, "sib": 95, "tor": 0, "w24": 40, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1923584, "abuse": "abuse@mtu.ru", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.0408899881852}, {"a": 8368, "h": "DSTNY-BACKBONE", "n": "DSTNY", "t": "Transit & backbone", "w": 1, "cc": "BE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0059, "hi": 1.97, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "urlhaus": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.134, 0.183, 0, false], ["2026-10-12", 0.005, 0.201, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.201, "se": 1.414, "ts": 1.000, "map": 1.536, "obs": 1, "own": 6.275, "comp": {"urlhaus": 3.1934, "threatfox": -0.3864, "phishing_db": -0.7514}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.558, "ts": null, "map": 0.068, "obs": 0, "own": 0.303, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.640, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DN490-RIPE", "org": "Dstny BE N.V.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.dstny.com"}, "pfx": 91, "reg": "2006-08-22", "rir": "ripencc", "s24": 661, "sib": 9, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 170240, "abuse": "abuse@dstny.be", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00397794804772}, {"a": 8369, "h": "INTERSVYAZ-AS", "n": "Intersvyaz", "t": "Broadband & mobile", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0556, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "dshield": {"n": 2, "p": 0.1194, "hi": 3.73, "lo": 0.48, "ips": 2, "mean": 1.78, "above": false}, "urlhaus": {"n": 1, "p": 0.1522, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "crowdsec": {"n": 2, "p": 0.0002, "hi": 1.43, "lo": 0.19, "ips": 2, "mean": 0.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.0067, "hi": 2.00, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.359, 0.008, 0, false], ["2026-10-12", 0.409, 0.145, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.145, "se": 1.381, "ts": 1.000, "map": 1.018, "obs": 1, "own": 2.946, "comp": {"urlhaus": 2.8844, "threatfox": -0.4186, "phishing_db": -0.8215}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.409, "se": 0.563, "ts": 0.333, "map": 0.859, "obs": 6, "own": 1.336, "comp": {"cins": 2.7708, "dshield": 3.3125, "crowdsec": -2.0758, "vulncheck": -0.8488, "blocklist_de": -1.917}, "mass": 6.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-IJ7-RIPE", "org": "Intersvyaz-2 JSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://is74.ru"}, "pfx": 52, "reg": "1997-07-03", "rir": "ripencc", "s24": 1275, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 333568, "abuse": "abuse@is74.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00600254216485}, {"a": 8374, "h": "PLUSNET", "n": "Polkomtel", "t": "Broadband & mobile", "w": 6, "cc": "PL", "cf": {"rb": "hi", "wb": "hi", "rep": 1.34, "waf": 1.17}, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0374, "hi": 2.79, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 1.05, "lo": 0.08, "ips": 1, "mean": 0.44, "above": false}, "dshield": {"n": 1, "p": 0.0230, "hi": 2.51, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "urlhaus": {"n": 2, "p": 0.3287, "hi": 5.46, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 1.17, "lo": 0.15, "ips": 2, "mean": 0.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.0023, "hi": 1.71, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}}, "h2": [["2026-10-05", 0.212, 0.438, 0, false], ["2026-10-12", 0.258, 0.486, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.486, "se": 1.123, "ts": 1.000, "map": 2.082, "obs": 2, "own": 5.357, "comp": {"urlhaus": 3.9072, "threatfox": -0.513, "phishing_db": -1.0345}, "mass": 5.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.258, "se": 0.596, "ts": 0.400, "map": 0.576, "obs": 5, "own": 0.898, "comp": {"cins": 3.0268, "dshield": 1.0614, "crowdsec": -1.1999, "vulncheck": -0.8276, "blocklist_de": -1.2195}, "mass": 5.3, "listed": false}}, "abq": false, "bot": 0.085, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PN5-RIPE", "org": "Polkomtel Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.plus.pl"}, "pfx": 16, "reg": "1997-07-07", "rir": "ripencc", "s24": 1651, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 423680, "abuse": "abuse@plus.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.05455}, {"a": 8376, "h": "", "n": "Jordan Data Communications Company LLC", "t": "Other", "w": 8, "cc": "JO", "cf": {"rb": "lo", "wb": null, "rep": 1.64, "waf": null}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0843, "hi": 3.47, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}, "crowdsec": {"n": 2, "p": 0.0029, "hi": 1.90, "lo": 0.25, "ips": 2, "mean": 0.90, "above": false}, "blocklist_de": {"n": 5, "p": 0.4783, "hi": 5.44, "lo": 1.35, "ips": 5, "mean": 3.10, "above": false}}, "h2": [["2026-10-05", 0.612, 0.009, 0, false], ["2026-10-12", 1.002, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.848, "ts": null, "map": 0.135, "obs": 0, "own": 0.275, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.002, "se": 0.518, "ts": 0.625, "map": 1.978, "obs": 8, "own": 1.118, "comp": {"cins": 1.8571, "dshield": -2.2219, "crowdsec": -4.7398, "vulncheck": -0.9029, "blocklist_de": 8.0829}, "mass": 9.6, "listed": false}}, "abq": false, "bot": 0.213, "det": {"blocklist_de": {"bots": 5}}, "oid": "ORG-JDCC1-RIPE", "org": "Jordan Data Communications Company LLC", "pdb": null, "pfx": 783, "reg": "1997-07-10", "rir": "ripencc", "s24": 871, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 454656, "abuse": "abuse@go.com.jo", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02271611186502}, {"a": 8386, "h": "KOCNET", "n": "VODAFONE NET ILETISIM HIZMETLERI AS8386", "t": "Broadband & mobile", "w": 5, "cc": "TR", "cf": {"rb": "lo", "wb": null, "rep": 5.95, "waf": null}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.0703, "hi": 3.24, "lo": 0.42, "ips": 2, "mean": 1.55, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.84, "lo": 0.06, "ips": 1, "mean": 0.35, "above": false}, "blocklist_de": {"n": 2, "p": 0.0085, "hi": 2.19, "lo": 0.28, "ips": 2, "mean": 1.05, "above": false}}, "h2": [["2026-10-05", 0.177, 0.008, 0, false], ["2026-10-12", 0.242, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.794, "ts": null, "map": 0.111, "obs": 0, "own": 0.525, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.242, "se": 0.594, "ts": 0.400, "map": 0.539, "obs": 5, "own": 0.841, "comp": {"cins": -1.0093, "dshield": 3.853, "crowdsec": -3.872, "vulncheck": -0.8261, "blocklist_de": 2.6307}, "mass": 5.3, "listed": false}}, "abq": false, "bot": 0.148, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-BIHA1-RIPE", "org": "Vodafone Net Iletisim Hizmetler AS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.vodafone.com.tr"}, "pfx": 750, "reg": "1997-07-18", "rir": "ripencc", "s24": 1745, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 471552, "abuse": "abuse@vodafone.net.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04241432776445}, {"a": 8400, "h": "TELEKOM-AS", "n": "TSSRB - Telekom Srbija", "t": "Broadband & mobile", "w": 12, "cc": "RS", "cf": {"rb": "", "wb": "hi", "rep": 1.22, "waf": 1.06}, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.60, "lo": 0.05, "ips": 1, "mean": 0.25, "above": false}, "urlhaus": {"n": 1, "p": 0.0998, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.81, "lo": 0.14, "ips": 3, "mean": 0.42, "above": false}, "vulncheck": {"n": 5, "p": 0.1856, "hi": 3.91, "lo": 0.97, "ips": 5, "mean": 2.23, "above": false}, "phishing_db": {"n": 1, "p": 0.0039, "hi": 1.84, "lo": 0.14, "ips": 1, "mean": 0.78, "above": false}, "blocklist_de": {"n": 2, "p": 0.0002, "hi": 1.42, "lo": 0.18, "ips": 2, "mean": 0.67, "above": false}}, "h2": [["2026-10-05", 0.300, 0.373, 0, false], ["2026-10-12", 0.199, 0.182, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.182, "se": 1.159, "ts": 0.500, "map": 0.770, "obs": 2, "own": 2.222, "comp": {"urlhaus": 1.8753, "threatfox": -0.487, "phishing_db": -0.0239}, "mass": 4.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 5, "blocklist_de": 2}, "lo": 0.199, "se": 0.522, "ts": 0.500, "map": 0.384, "obs": 10, "own": 0.602, "comp": {"cins": -1.2381, "dshield": -1.9326, "crowdsec": -0.4197, "vulncheck": 3.0431, "blocklist_de": 0.9847}, "mass": 7.0, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"botnet_node": 5}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-TS21-RIPE", "org": "TELEKOM SRBIJA a.d.", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://www.mts.rs"}, "pfx": 88, "reg": "1997-07-29", "rir": "ripencc", "s24": 3217, "sib": 3, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1058048, "abuse": "abuse@telekom.rs", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.060574}, {"a": 8402, "h": "CORBINA-AS", "n": "Corbina Telecom", "t": "Broadband & mobile", "w": 21, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1}, "n": 7}, "ev": {"cins": {"n": 2, "p": 0.0006, "hi": 1.61, "lo": 0.21, "ips": 2, "mean": 0.77, "above": false}, "dshield": {"n": 10, "p": 0.1632, "hi": 3.59, "lo": 1.30, "ips": 10, "mean": 2.33, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.68, "lo": 0.21, "ips": 7, "mean": 0.41, "above": false}, "vulncheck": {"n": 2, "p": 0.0001, "hi": 1.36, "lo": 0.18, "ips": 2, "mean": 0.65, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.75, "lo": 0.10, "ips": 2, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.155, 0.028, 0, false], ["2026-10-12", 0.332, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.700, "ts": null, "map": 0.067, "obs": 0, "own": 0.299, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 10, "crowdsec": 7, "vulncheck": 2, "blocklist_de": 2}, "lo": 0.332, "se": 0.425, "ts": 0.435, "map": 0.547, "obs": 23, "own": 0.847, "comp": {"cins": 2.4043, "dshield": 8.6343, "crowdsec": -3.0445, "vulncheck": -0.394, "blocklist_de": -6.8089}, "mass": 21.1, "listed": false}}, "abq": false, "bot": 0.416, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-CTAM1-RIPE", "org": "PJSC \"Vimpelcom\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Restrictive", "web": "http://www.corbina.net"}, "pfx": 387, "reg": "1997-07-30", "rir": "ripencc", "s24": 6915, "sib": 0, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2981120, "abuse": "abuse-b2b@beeline.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02802684878455}, {"a": 8412, "h": "TMA", "n": "Magenta Telekom", "t": "Broadband & mobile", "w": 8, "cc": "AT", "cf": {"rb": "hi", "wb": "hi", "rep": 1.28, "waf": 1.12}, "cs": {"c": {"data_centre": 2, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.45, "lo": 0.06, "ips": 2, "mean": 0.21, "above": false}, "urlhaus": {"n": 2, "p": 0.1539, "hi": 4.03, "lo": 0.52, "ips": 2, "mean": 1.92, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.37, "lo": 0.05, "ips": 2, "mean": 0.18, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 1.13, "lo": 0.08, "ips": 1, "mean": 0.48, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 1.03, "lo": 0.18, "ips": 3, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.092, 0.055, 0, false], ["2026-10-12", 0.088, 0.192, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.192, "se": 1.124, "ts": 1.000, "map": 0.767, "obs": 2, "own": 2.136, "comp": {"urlhaus": 2.9722, "threatfox": -0.5322, "phishing_db": -1.0792}, "mass": 7.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.088, "se": 0.571, "ts": 0.500, "map": 0.188, "obs": 6, "own": 0.294, "comp": {"cins": -1.168, "dshield": -1.8613, "crowdsec": -2.3118, "vulncheck": -0.0181, "blocklist_de": 5.0815}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"c2": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-MTSG1-RIPE", "org": "T-Mobile Austria GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.magenta.at"}, "pfx": 124, "reg": "1997-08-05", "rir": "ripencc", "s24": 6071, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2944512, "abuse": "abuse@magenta.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.05716}, {"a": 8422, "h": "NETCOLOGNE", "n": "NetCologne", "t": "Hosting & VPS", "w": 3, "cc": "DE", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.0394, "hi": 2.85, "lo": 0.37, "ips": 2, "mean": 1.36, "above": false}, "blocklist_de": {"n": 1, "p": 0.0004, "hi": 1.40, "lo": 0.10, "ips": 1, "mean": 0.59, "above": false}}, "h2": [["2026-10-05", 1.421, 0.007, 0, false], ["2026-10-12", 0.095, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.776, "ts": null, "map": 0.103, "obs": 0, "own": 0.074, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.095, "se": 0.703, "ts": 0.667, "map": 0.256, "obs": 3, "own": 0.051, "comp": {"cins": -0.6744, "dshield": 5.5292, "crowdsec": -4.9471, "vulncheck": -0.7375, "blocklist_de": 0.8628}, "mass": 3.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NG11-RIPE", "org": "NetCologne Gesellschaft fur Telekommunikation mbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.netcologne.de"}, "pfx": 39, "reg": "1997-08-14", "rir": "ripencc", "s24": 2236, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 577024, "abuse": "abuse@netcologne.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0232101573549}, {"a": 8434, "h": "TELENOR-SE", "n": "Telenor Sweden", "t": "Broadband & mobile", "w": 17, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 7, "web_bruteforce": 8, "home_connection": 8, "mail_bruteforce": 5}, "n": 10}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.96, "lo": 0.12, "ips": 2, "mean": 0.46, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.60, "lo": 0.22, "ips": 10, "mean": 0.39, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 0.98, "lo": 0.13, "ips": 2, "mean": 0.47, "above": false}, "blocklist_de": {"n": 6, "p": 0.0000, "hi": 0.98, "lo": 0.27, "ips": 6, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.169, 0.005, 0, false], ["2026-10-12", 0.220, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.677, "ts": null, "map": 0.056, "obs": 0, "own": 0.253, "comp": null, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 10, "vulncheck": 2, "blocklist_de": 6}, "lo": 0.220, "se": 0.433, "ts": 0.476, "map": 0.373, "obs": 21, "own": 0.578, "comp": {"cins": -0.0484, "dshield": -0.5595, "crowdsec": 0.1022, "vulncheck": -0.4046, "blocklist_de": 1.3178}, "mass": 21.5, "listed": false}}, "abq": false, "bot": 0.111, "det": {"vulncheck": {"attack_tooling": 2}, "blocklist_de": {"ftp": 1, "ssh": 1, "imap": 3, "mail": 4}}, "oid": "ORG-TBSA1-RIPE", "org": "Telenor Sverige AB", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.telenor.se/"}, "pfx": 76, "reg": "1997-08-20", "rir": "ripencc", "s24": 10336, "sib": 4, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2646016, "abuse": "abuse@telenor.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04549533813724}, {"a": 8439, "h": "AIST", "n": "AIST JSC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0834, "hi": 3.38, "lo": 0.44, "ips": 2, "mean": 1.61, "above": false}, "blocklist_de": {"n": 1, "p": 0.0886, "hi": 3.52, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 0.766, 0.010, 0, false], ["2026-10-12", 0.516, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.924, "ts": null, "map": 0.164, "obs": 0, "own": 0.387, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.516, "se": 0.730, "ts": 0.667, "map": 1.483, "obs": 3, "own": 0.852, "comp": {"cins": -0.5792, "dshield": -1.1198, "crowdsec": 2.7287, "vulncheck": -0.7003, "blocklist_de": 1.4581}, "mass": 2.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 19, "reg": "1997-08-25", "rir": "ripencc", "s24": 324, "sib": 120, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 82944, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00032619106905}, {"a": 8445, "h": "SALZBURG-AG-AS", "n": "Salzburg AG", "t": "Broadband & mobile", "w": 1, "cc": "AT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.0178, "hi": 2.51, "lo": 0.44, "ips": 3, "mean": 1.30, "above": false}, "crowdsec": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.175, 0.008, 0, false], ["2026-10-12", 0.037, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.839, "ts": null, "map": 0.131, "obs": 0, "own": 0.655, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.037, "se": 1.049, "ts": 1.000, "map": 0.193, "obs": 1, "own": 0.319, "comp": {"cins": -0.2463, "dshield": -0.5416, "crowdsec": 2.2833, "vulncheck": -0.4722, "blocklist_de": -1.2743}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.155, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-SA1-RIPE", "org": "SALZBURG AG fur Energie, Verkehr und Telekommunikation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.salzburg-ag.at"}, "pfx": 36, "reg": "1997-08-26", "rir": "ripencc", "s24": 975, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 250368, "abuse": "abuse@sol.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00501470914776}, {"a": 8447, "h": "A1TELEKOM-AT", "n": "A1 Telekom Austria AG", "t": "Broadband & mobile", "w": 12, "cc": "AT", "cf": {"rb": "hi", "wb": "hi", "rep": 1.25, "waf": 1.09}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.26, "lo": 0.03, "ips": 2, "mean": 0.13, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 1.14, "lo": 0.20, "ips": 3, "mean": 0.59, "above": false}, "urlhaus": {"n": 1, "p": 0.0178, "hi": 2.38, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.26, "lo": 0.05, "ips": 3, "mean": 0.14, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 0.84, "lo": 0.21, "ips": 5, "mean": 0.48, "above": false}}, "h2": [["2026-10-05", 0.068, 0.197, 0, false], ["2026-10-12", 0.120, 0.044, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.044, "se": 1.318, "ts": 1.000, "map": 0.251, "obs": 1, "own": 0.797, "comp": {"urlhaus": 1.7281, "threatfox": -0.4941, "phishing_db": -0.9908}, "mass": 4.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.120, "se": 0.481, "ts": 0.455, "map": 0.215, "obs": 11, "own": 0.335, "comp": {"cins": -1.8634, "dshield": 2.4804, "crowdsec": -4.7167, "vulncheck": -0.9292, "blocklist_de": 4.8868}, "mass": 12.9, "listed": false}}, "abq": false, "bot": 0.125, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "threatfox": {"family:Eye Pyramid": 1}, "blocklist_de": {"ssh": 4, "bots": 1}}, "oid": "ORG-TAA1-RIPE", "org": "A1 Telekom Austria AG", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.a1.net/"}, "pfx": 125, "reg": "1997-08-27", "rir": "ripencc", "s24": 10715, "sib": 12, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2786048, "abuse": "abuse@a1.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.058774}, {"a": 8449, "h": "AS8449-ELCAT", "n": "ElCat AS8449", "t": "Broadband & mobile", "w": 3, "cc": "KG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4061, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.732, 0.409, 0, false]], "sh": false, "uc": 579.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.409, "se": 1.515, "ts": 1.000, "map": 3.900, "obs": 1, "own": 11.412, "comp": {"urlhaus": -0.1276, "threatfox": -0.1538, "phishing_db": 3.2685}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.732, "se": 0.936, "ts": 1.000, "map": 2.985, "obs": 2, "own": 5.022, "comp": {"cins": -0.1938, "dshield": -0.4355, "crowdsec": -1.7216, "vulncheck": 5.8439, "blocklist_de": -1.0058}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.379, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-JVF1-RIPE", "org": "\"ElCat\" Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.elcat.kg"}, "pfx": 50, "reg": "1997-08-28", "rir": "ripencc", "s24": 49, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040620070221}, {"a": 8452, "h": "TE-AS", "n": "Telecom Egypt", "t": "Broadband & mobile", "w": 102, "cc": "EG", "cf": {"rb": "", "wb": "", "rep": 0.87, "waf": 1.45}, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 17, "web_bruteforce": 5, "home_connection": 14, "mail_bruteforce": 4, "router_or_botnet": 3, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 4}, "n": 34}, "ev": {"cins": {"n": 10, "p": 0.0000, "hi": 1.25, "lo": 0.46, "ips": 10, "mean": 0.81, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.14, "lo": 0.03, "ips": 4, "mean": 0.08, "above": false}, "dshield": {"n": 16, "p": 0.0000, "hi": 1.43, "lo": 0.64, "ips": 16, "mean": 1.00, "above": false}, "urlhaus": {"n": 1, "p": 0.0002, "hi": 1.27, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}, "crowdsec": {"n": 31, "p": 0.0000, "hi": 0.52, "lo": 0.29, "ips": 34, "mean": 0.40, "above": false}, "threatfox": {"n": 4, "p": 0.0002, "hi": 1.65, "lo": 0.36, "ips": 4, "mean": 0.90, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.31, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "blocklist_de": {"n": 40, "p": 0.0000, "hi": 1.59, "lo": 0.95, "ips": 40, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.363, 0.063, 0, false], ["2026-10-12", 0.488, 0.076, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 4, "phishing_db": 1}, "lo": 0.076, "se": 1.052, "ts": 0.667, "map": 0.224, "obs": 6, "own": 0.738, "comp": {"urlhaus": -0.0081, "threatfox": 0.8522, "phishing_db": -0.7129}, "mass": 12.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 10, "dshield": 16, "crowdsec": 31, "vulncheck": 1, "blocklist_de": 40}, "lo": 0.488, "se": 0.374, "ts": 0.408, "map": 0.747, "obs": 98, "own": 1.153, "comp": {"cins": 2.7573, "dshield": 0.3975, "crowdsec": -6.0021, "vulncheck": -0.956, "blocklist_de": 4.9055}, "mass": 123.0, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"malware": 3, "compromised": 1}, "threatfox": {"family:AsyncRAT": 4}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 7, "bots": 28, "mail": 1, "apache": 4, "bruteforcelogin": 4}}, "oid": "@aut-8452-RIPE", "org": "TE-AS", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.te.eg"}, "pfx": 1988, "reg": "1997-09-01", "rir": "ripencc", "s24": 29633, "sib": 0, "tor": 0, "w24": 98, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15224064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.263342}, {"a": 8468, "h": "ENTANET", "n": "CityFibre", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0001, "hi": 1.19, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.811, "ts": null, "map": 0.119, "obs": 0, "own": 0.571, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.466, "ts": null, "map": 0.044, "obs": 0, "own": 0.089, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CHL10-RIPE", "org": "Cityfibre Limited", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://www.cityfibre.com"}, "pfx": 46, "reg": "1997-09-10", "rir": "ripencc", "s24": 1400, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 364544, "abuse": "abuse@cityfibre.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00416499495937}, {"a": 8469, "h": "PIRONETNDH-AS", "n": "CANCOM Managed Services GmbH", "t": "Broadband & mobile", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0185, "hi": 2.40, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 0.858, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.605, "ts": null, "map": 0.083, "obs": 0, "own": 0.191, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.868, "det": {"shodan": {"c2": 1}}, "oid": "ORG-PNA1-RIPE", "org": "CANCOM Managed Services GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.cancom.de"}, "pfx": 12, "reg": "1997-09-10", "rir": "ripencc", "s24": 456, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 117248, "abuse": "abuse@cancom-pironet.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8473, "h": "BAHNHOF", "n": "Bahnhof", "t": "Broadband & mobile", "w": 40, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 1, "web_exploit": 17, "bad_crawling": 5, "proxy_or_vpn": 3, "ssh_bruteforce": 34, "web_bruteforce": 34, "home_connection": 31, "mail_bruteforce": 27, "router_or_botnet": 1, "cve:CVE-2016-1555": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2025-22457": 2}, "n": 37}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.05, "lo": 0.14, "ips": 2, "mean": 0.50, "above": false}, "dshield": {"n": 1, "p": 0.0089, "hi": 2.10, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "crowdsec": {"n": 28, "p": 0.9272, "hi": 5.34, "lo": 2.89, "ips": 37, "mean": 4.03, "above": true}, "vulncheck": {"n": 3, "p": 0.1010, "hi": 3.49, "lo": 0.61, "ips": 3, "mean": 1.80, "above": false}, "blocklist_de": {"n": 10, "p": 0.5223, "hi": 4.85, "lo": 1.76, "ips": 10, "mean": 3.15, "above": false}}, "h2": [["2026-10-05", 2.087, 0.007, 0, false], ["2026-10-12", 1.868, 0.008, 0, false]], "sh": false, "uc": 214.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.773, "ts": null, "map": 0.101, "obs": 0, "own": 0.468, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 28, "vulncheck": 3, "blocklist_de": 10}, "lo": 1.868, "se": 0.391, "ts": 0.667, "map": 2.887, "obs": 42, "own": 4.440, "comp": {"cins": -3.0207, "dshield": -2.3875, "crowdsec": 7.4304, "vulncheck": -0.4938, "blocklist_de": 0.9255}, "mass": 37.2, "listed": false}}, "abq": false, "bot": 0.178, "det": {"shodan": {"compromised": 2}, "vulncheck": {"attack_tooling": 3}, "blocklist_de": {"ssh": 2, "imap": 6, "mail": 8}}, "oid": "ORG-BIA1-RIPE", "org": "Bahnhof AB", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.bahnhof.net/"}, "pfx": 121, "reg": "1997-09-18", "rir": "ripencc", "s24": 2329, "sib": 3, "tor": 2, "w24": 31, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 598784, "abuse": "abuse@bahnhof.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.03677605442056}, {"a": 8492, "h": "OBIT-AS", "n": "OBIT", "t": "Transit & backbone", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1363, "hi": 4.07, "lo": 0.30, "ips": 6, "mean": 1.72, "above": false}}, "h2": [["2026-10-12", 0.063, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.165, "obs": 0, "own": 1.378, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.063, "se": 1.117, "ts": 1.000, "map": 0.364, "obs": 1, "own": 1.291, "comp": {"cins": -0.1534, "dshield": -0.3506, "crowdsec": -1.3873, "vulncheck": 3.0728, "blocklist_de": -0.7982}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.519, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-OL12-RIPE", "org": "\"OBIT\" Ltd.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://obit.ru"}, "pfx": 145, "reg": "2005-02-17", "rir": "ripencc", "s24": 315, "sib": 5, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 90624, "abuse": "abuse@obit.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004175639391}, {"a": 8522, "h": "FORTH-AS", "n": "FORTH", "t": "Other", "w": 0, "cc": "GR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.3181, "hi": 5.01, "lo": 0.88, "ips": 3, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.109, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.424, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-FORA4-RIPE", "org": "Foundation of Research and Technology Hellas", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.forth.gr"}, "pfx": 4, "reg": "1997-10-24", "rir": "ripencc", "s24": 257, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 66304, "abuse": "abuse@ics.forth.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000694671714}, {"a": 8542, "h": "Eviny-AS8542", "n": "Eviny AS8542", "t": "Other", "w": 1, "cc": "NO", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0067, "hi": 2.01, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.0541, "hi": 3.06, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.177, 0.009, 0, false], ["2026-10-12", 0.185, 0.010, 0, false]], "sh": false, "uc": 95.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.152, "obs": 0, "own": 0.332, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.185, "se": 0.849, "ts": 0.500, "map": 0.665, "obs": 2, "own": 0.388, "comp": {"cins": -0.4272, "dshield": -0.8741, "crowdsec": 0.4856, "vulncheck": -0.6213, "blocklist_de": 2.4223}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.240, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-BBA1-RIPE", "org": "Eviny Fiber AS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://eviny.no/"}, "pfx": 11, "reg": "1997-11-12", "rir": "ripencc", "s24": 513, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 131584, "abuse": "abuse@eviny.no", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00110674674592}, {"a": 8551, "h": "BEZEQ-INTERNATIONAL-AS", "n": "Bezeq International", "t": "Broadband & mobile", "w": 36, "cc": "IL", "cf": null, "cs": {"c": {"http_flood": 31, "web_exploit": 10, "bad_crawling": 20, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 25, "cve:CVE-2024-34351": 2}, "n": 32}, "ev": {"crowdsec": {"n": 4, "p": 0.0000, "hi": 0.82, "lo": 0.18, "ips": 32, "mean": 0.45, "above": false}, "vulncheck": {"n": 1, "p": 0.0012, "hi": 1.58, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}, "blocklist_de": {"n": 3, "p": 0.0002, "hi": 1.52, "lo": 0.27, "ips": 4, "mean": 0.78, "above": false}}, "h2": [["2026-10-05", 0.170, 0.006, 0, false], ["2026-10-12", 0.191, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.738, "ts": null, "map": 0.085, "obs": 0, "own": 0.383, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.191, "se": 0.526, "ts": 0.500, "map": 0.375, "obs": 8, "own": 0.584, "comp": {"cins": -1.3748, "dshield": -2.0634, "crowdsec": 0.6919, "vulncheck": -0.1947, "blocklist_de": 3.3536}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.309, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-IL9-RIPE", "org": "Bezeq International Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.bezeqint.net/english/#banner"}, "pfx": 737, "reg": "1997-11-17", "rir": "ripencc", "s24": 3823, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1814528, "abuse": "abuse@bezeqint.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00984924855642}, {"a": 8560, "h": "IONOS-AS", "n": "IONOS SE", "t": "Hosting & VPS", "w": 295, "cc": "DE", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 4.75}, "cs": {"c": {"http_flood": 95, "data_centre": 107, "web_exploit": 121, "bad_crawling": 28, "proxy_or_vpn": 62, "first_seen_30d": 34, "ssh_bruteforce": 58, "web_bruteforce": 113, "home_connection": 20, "mail_bruteforce": 29, "router_or_botnet": 2, "cve:CVE-2017-9841": 14, "cve:CVE-2019-9082": 8, "cve:CVE-2018-20062": 9, "cve:CVE-2024-28000": 16, "cve:CVE-2025-55182": 6}, "n": 204}, "ev": {"cins": {"n": 4, "p": 0.1885, "hi": 4.02, "lo": 0.86, "ips": 4, "mean": 2.19, "above": false}, "shodan": {"n": 116, "p": 1.0000, "hi": 18.13, "lo": 13.36, "ips": 116, "mean": 15.67, "above": true}, "dshield": {"n": 11, "p": 0.8952, "hi": 6.91, "lo": 2.63, "ips": 11, "mean": 4.56, "above": true}, "urlhaus": {"n": 1, "p": 0.1040, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "crowdsec": {"n": 185, "p": 1.0000, "hi": 23.10, "lo": 18.15, "ips": 204, "mean": 20.56, "above": true}, "threatfox": {"n": 8, "p": 0.9645, "hi": 9.86, "lo": 3.21, "ips": 8, "mean": 6.15, "above": true}, "vulncheck": {"n": 24, "p": 1.0000, "hi": 13.04, "lo": 6.72, "ips": 27, "mean": 9.66, "above": true}, "phishing_db": {"n": 17, "p": 0.9993, "hi": 10.29, "lo": 4.69, "ips": 17, "mean": 7.26, "above": true}, "blocklist_de": {"n": 52, "p": 1.0000, "hi": 15.44, "lo": 9.81, "ips": 52, "mean": 12.49, "above": true}}, "h2": [["2026-10-05", 8.465, 1.939, 0, false], ["2026-10-12", 9.012, 1.790, 0, false]], "sh": false, "uc": 187.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 8, "phishing_db": 17}, "lo": 1.790, "se": 0.807, "ts": 0.654, "map": 3.875, "obs": 26, "own": 1.502, "comp": {"urlhaus": -1.0056, "threatfox": 1.0741, "phishing_db": 2.9122}, "mass": 16.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 11, "crowdsec": 185, "vulncheck": 24, "blocklist_de": 52}, "lo": 9.012, "se": 0.352, "ts": 0.670, "map": 13.438, "obs": 276, "own": 2.622, "comp": {"cins": -2.603, "dshield": -2.0362, "crowdsec": 10.3624, "vulncheck": -0.3446, "blocklist_de": -1.3869}, "mass": 224.1, "listed": false}}, "abq": false, "bot": 0.871, "det": {"shodan": {"c2": 25, "malware": 10, "compromised": 76, "doublepulsar": 5}, "threatfox": {"family:Havoc": 1, "family:Mirai": 1, "family:Remus": 1, "family:AsyncRAT": 3, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 11, "botnet_node": 7, "attack_tooling": 9}, "blocklist_de": {"ftp": 13, "sip": 8, "ssh": 19, "bots": 4, "imap": 2, "mail": 3, "apache": 5, "bruteforcelogin": 5}}, "oid": "ORG-SA12-RIPE", "org": "IONOS SE", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.ionos.com"}, "pfx": 524, "reg": "1997-11-26", "rir": "ripencc", "s24": 3027, "sib": 2, "tor": 1, "w24": 267, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 901376, "abuse": "abuse@ionos.com", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.04458421685848}, {"a": 8562, "h": "LICPLUS-AS", "n": "A1 Telekom Austria AG", "t": "Broadband & mobile", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.4587, "hi": 5.61, "lo": 1.21, "ips": 4, "mean": 3.06, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.931, "ts": null, "map": 0.166, "obs": 0, "own": 0.989, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.661, "ts": null, "map": 0.103, "obs": 0, "own": 0.252, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.319, "det": {"shodan": {"malware": 4}}, "oid": "ORG-TAA1-RIPE", "org": "A1 Telekom Austria AG", "pdb": null, "pfx": 9, "reg": "1997-11-26", "rir": "ripencc", "s24": 296, "sib": 12, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 75776, "abuse": "abuse@a1.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003103669192}, {"a": 8580, "h": "SANDY", "n": "MTS PJSC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "cve:CVE-2021-26294": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1994, "hi": 4.41, "lo": 0.57, "ips": 2, "mean": 2.10, "above": false}}, "h2": [["2026-10-12", 0.442, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 0.479, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.442, "se": 0.882, "ts": 1.000, "map": 1.696, "obs": 2, "own": 0.990, "comp": {"cins": -0.3488, "dshield": -0.7357, "crowdsec": 5.3657, "vulncheck": -0.5665, "blocklist_de": -1.7925}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": null, "pfx": 20, "reg": "1997-12-15", "rir": "ripencc", "s24": 161, "sib": 95, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 47872, "abuse": "abuse@mtu.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0015209907482}, {"a": 8595, "h": "WESTCALL-AS", "n": "WestCall", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 2, "p": 0.4046, "hi": 6.12, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1417, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.0933, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 0.268, 2.369, 0, false], ["2026-10-12", 0.088, 2.531, 0, false]], "sh": false, "uc": 178.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 1}, "lo": 2.531, "se": 1.024, "ts": 0.667, "map": 9.283, "obs": 3, "own": 8.942, "comp": {"urlhaus": 4.4965, "threatfox": -0.4981, "phishing_db": -0.1441}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.088, "se": 1.130, "ts": 1.000, "map": 0.537, "obs": 1, "own": 0.332, "comp": {"cins": -0.2153, "dshield": -0.4794, "crowdsec": -1.8946, "vulncheck": -0.4365, "blocklist_de": 3.798}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.759, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-WL4-RIPE", "org": "OOO WestCall Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://westcall.ru"}, "pfx": 51, "reg": "1997-12-22", "rir": "ripencc", "s24": 304, "sib": 13, "tor": 0, "w24": 4, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 81920, "abuse": "abuse@westcall.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003811147802}, {"a": 8622, "h": "ISIONUK", "n": "TEAM BLUE INTERNET SERVICES UK LIMITED", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0893, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.742, "ts": null, "map": 0.133, "obs": 0, "own": 0.367, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.993, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NL12-RIPE", "org": "TEAM BLUE INTERNET SERVICES UK LIMITED", "pdb": null, "pfx": 5, "reg": "1998-01-15", "rir": "ripencc", "s24": 161, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41216, "abuse": "abuse@names.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8636, "h": "MAXNET", "n": "MAXnet Systems", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 2, "p": 0.2879, "hi": 5.12, "lo": 0.67, "ips": 2, "mean": 2.44, "above": false}, "blocklist_de": {"n": 1, "p": 0.1615, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 2.586, 0.011, 0, false], ["2026-10-12", 2.817, 0.012, 0, false]], "sh": false, "uc": 417.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 1.406, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.817, "se": 0.668, "ts": 0.500, "map": 7.282, "obs": 4, "own": 11.338, "comp": {"cins": 3.6568, "dshield": -1.3334, "crowdsec": 1.2698, "vulncheck": -0.755, "blocklist_de": 0.5409}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.490, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-MSL3-RIPE", "org": "MAXnet Systems Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "https://maxnet.ru"}, "pfx": 21, "reg": "1998-01-27", "rir": "ripencc", "s24": 86, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28416, "abuse": "abuse@maxnet.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007699943405}, {"a": 8646, "h": "cloudinfrastack", "n": "cloudinfrastack", "t": "Hosting & VPS", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.941, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-CS363-RIPE", "org": "cloudinfrastack, s.r.o.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://cloudinfrastack.com"}, "pfx": 1, "reg": "2015-10-13", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8648, "h": "ONE-NETWORK", "n": "one.com Group AB and its subsidiaries", "t": "Hosting & VPS", "w": 7, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 3, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 4}, "ev": {"shodan": {"n": 14, "p": 0.9982, "hi": 10.66, "lo": 4.50, "ips": 14, "mean": 7.31, "above": true}, "crowdsec": {"n": 4, "p": 0.1794, "hi": 3.96, "lo": 0.85, "ips": 4, "mean": 2.16, "above": false}, "vulncheck": {"n": 3, "p": 0.4784, "hi": 6.16, "lo": 1.09, "ips": 3, "mean": 3.18, "above": false}}, "h2": [["2026-10-05", 0.655, 0.009, 0, false], ["2026-10-12", 0.748, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.892, "ts": null, "map": 0.153, "obs": 0, "own": 0.129, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.748, "se": 0.564, "ts": 0.571, "map": 1.580, "obs": 7, "own": 0.315, "comp": {"cins": -0.8693, "dshield": -1.5209, "crowdsec": 5.9427, "vulncheck": 2.6256, "blocklist_de": -4.3266}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.943, "det": {"shodan": {"c2": 5, "compromised": 9}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-DIG4-RIPE", "org": "dogado GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.group.one/"}, "pfx": 88, "reg": "1998-02-06", "rir": "ripencc", "s24": 493, "sib": 7, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 131072, "abuse": "abuse@dogado.de", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00122713037925}, {"a": 8649, "h": "Webtraffic", "n": "ZeXoTeK IT-Services GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.679, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 0.293, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.267, "det": null, "oid": "ORG-ZIG1-RIPE", "org": "ZeXoTeK IT-Services GmbH", "pdb": null, "pfx": 4, "reg": "2010-03-01", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@zexotek.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8708, "h": "DIGI-RO", "n": "DIGI RO", "t": "Broadband & mobile", "w": 19, "cc": "RO", "cf": {"rb": "", "wb": "", "rep": 0.77, "waf": 0.49}, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 2}, "n": 4}, "ev": {"shodan": {"n": 18, "p": 0.0000, "hi": 1.68, "lo": 0.78, "ips": 18, "mean": 1.20, "above": false}, "dshield": {"n": 4, "p": 0.0015, "hi": 1.92, "lo": 0.41, "ips": 4, "mean": 1.05, "above": false}, "urlhaus": {"n": 1, "p": 0.0428, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.47, "lo": 0.10, "ips": 4, "mean": 0.26, "above": false}, "vulncheck": {"n": 6, "p": 0.0146, "hi": 2.55, "lo": 0.71, "ips": 6, "mean": 1.50, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 1.08, "lo": 0.23, "ips": 4, "mean": 0.59, "above": false}}, "h2": [["2026-10-05", 0.210, 0.051, 0, false], ["2026-10-12", 0.211, 0.057, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.057, "se": 1.325, "ts": 1.000, "map": 0.335, "obs": 1, "own": 1.037, "comp": {"urlhaus": 1.9784, "threatfox": -0.4817, "phishing_db": -0.9627}, "mass": 4.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 4, "vulncheck": 6, "blocklist_de": 4}, "lo": 0.211, "se": 0.454, "ts": 0.333, "map": 0.368, "obs": 18, "own": 0.571, "comp": {"cins": -1.978, "dshield": 3.5845, "crowdsec": -3.8641, "vulncheck": 1.5159, "blocklist_de": 1.1355}, "mass": 14.3, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"c2": 5, "malware": 1, "compromised": 7, "doublepulsar": 5}, "threatfox": {"family:Nanocore RAT": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 3, "attack_tooling": 2}, "blocklist_de": {"bots": 2, "apache": 2, "bruteforcelogin": 1}}, "oid": "ORG-RA18-RIPE", "org": "DIGI ROMANIA S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.digi.ro"}, "pfx": 137, "reg": "1998-03-11", "rir": "ripencc", "s24": 6961, "sib": 9, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1810176, "abuse": "abuse@rcs-rds.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.184997}, {"a": 8717, "h": "A1BG", "n": "A1 BG EAD", "t": "Transit & backbone", "w": 4, "cc": "BG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 3}, "ev": {"urlhaus": {"n": 1, "p": 0.1667, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 3, "p": 0.0123, "hi": 2.38, "lo": 0.42, "ips": 3, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.325, 0.162, 0, false], ["2026-10-12", 0.206, 0.178, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.178, "se": 1.401, "ts": 1.000, "map": 1.318, "obs": 1, "own": 5.389, "comp": {"urlhaus": 3.08, "threatfox": -0.3991, "phishing_db": -0.7789}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.206, "se": 0.713, "ts": 1.000, "map": 0.573, "obs": 3, "own": 1.829, "comp": {"cins": -0.5851, "dshield": -1.1289, "crowdsec": 6.2176, "vulncheck": -0.7028, "blocklist_de": -2.9635}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.346, "det": null, "oid": "ORG-MN1-RIPE", "org": "A1 Bulgaria EAD", "pdb": {"t": "NSP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.a1.bg"}, "pfx": 103, "reg": "1998-03-19", "rir": "ripencc", "s24": 848, "sib": 7, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 992512, "abuse": "RIPE.Abuse@a1.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00362692243381}, {"a": 8745, "h": "AS-BG-BAS", "n": "Bulgarian Academy of Sciences", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3378, "hi": 5.54, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.247, "det": {"shodan": {"doublepulsar": 2}}, "oid": "ORG-BAOS1-RIPE", "org": "Bulgarian Academy of Sciences", "pdb": null, "pfx": 2, "reg": "1998-04-07", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "abuse@bas.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003663374975}, {"a": 8749, "h": "REDCOM-AS", "n": "Redcom-lnternet", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"dshield": {"n": 3, "p": 0.6193, "hi": 7.44, "lo": 1.31, "ips": 3, "mean": 3.84, "above": false}, "crowdsec": {"n": 2, "p": 0.3003, "hi": 5.23, "lo": 0.68, "ips": 2, "mean": 2.49, "above": false}}, "h2": [["2026-10-05", 0.756, 0.011, 0, false], ["2026-10-12", 3.818, 0.012, 0, false]], "sh": false, "uc": 390.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.021, "ts": null, "map": 0.187, "obs": 0, "own": 1.445, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.818, "se": 0.608, "ts": 0.600, "map": 8.796, "obs": 5, "own": 13.608, "comp": {"cins": -0.7754, "dshield": 8.1759, "crowdsec": 0.8185, "vulncheck": -0.7699, "blocklist_de": -3.8812}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.498, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RA23-RIPE", "org": "JSC \"Redcom-lnternet\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://redcom.ru"}, "pfx": 23, "reg": "1998-04-09", "rir": "ripencc", "s24": 77, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": "abuse@redcom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008951838434}, {"a": 8764, "h": "Telia-Lietuva", "n": "Telia Lietuva, AB", "t": "Broadband & mobile", "w": 19, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 4, "cve:CVE-2026-8181": 2}, "n": 5}, "ev": {"dshield": {"n": 4, "p": 0.0765, "hi": 3.25, "lo": 0.70, "ips": 4, "mean": 1.77, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 1.06, "lo": 0.26, "ips": 5, "mean": 0.60, "above": false}, "vulncheck": {"n": 8, "p": 0.5505, "hi": 5.22, "lo": 1.70, "ips": 8, "mean": 3.25, "above": false}, "blocklist_de": {"n": 3, "p": 0.0005, "hi": 1.68, "lo": 0.30, "ips": 3, "mean": 0.87, "above": false}}, "h2": [["2026-10-05", 0.333, 0.007, 0, false], ["2026-10-12", 0.428, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.747, "ts": null, "map": 0.089, "obs": 0, "own": 0.403, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 5, "vulncheck": 8, "blocklist_de": 3}, "lo": 0.428, "se": 0.447, "ts": 0.400, "map": 0.733, "obs": 20, "own": 1.136, "comp": {"cins": -1.9373, "dshield": 3.7736, "crowdsec": -2.0631, "vulncheck": 2.4496, "blocklist_de": -1.1403}, "mass": 13.8, "listed": false}}, "abq": false, "bot": 0.166, "det": {"vulncheck": {"botnet_node": 8}, "blocklist_de": {"ssh": 2, "bots": 1}}, "oid": "ORG-LT1-RIPE", "org": "Telia Lietuva, AB", "pdb": {"t": "NSP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.telia.lt/eng"}, "pfx": 920, "reg": "1998-04-24", "rir": "ripencc", "s24": 3369, "sib": 4, "tor": 0, "w24": 19, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1460736, "abuse": "abuse@telia.lt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.041549599344}, {"a": 8767, "h": "MNET-AS", "n": "M-net", "t": "Broadband & mobile", "w": 2, "cc": "DE", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0137, "hi": 2.27, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}, "phishing_db": {"n": 1, "p": 0.0178, "hi": 2.39, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}}, "h2": [["2026-10-05", 0.625, 0.061, 0, false], ["2026-10-12", 0.022, 0.065, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.065, "se": 1.338, "ts": 1.000, "map": 0.376, "obs": 1, "own": 1.217, "comp": {"urlhaus": -0.4541, "threatfox": -0.3457, "phishing_db": 1.4469}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.022, "se": 1.010, "ts": 1.000, "map": 0.106, "obs": 1, "own": 0.174, "comp": {"cins": -0.2782, "dshield": 3.7495, "crowdsec": -2.3828, "vulncheck": -0.5049, "blocklist_de": -1.436}, "mass": 1.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MTG1-RIPE", "org": "M-net Telekommunikations GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.m-net.de"}, "pfx": 65, "reg": "1998-04-28", "rir": "ripencc", "s24": 2024, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 519424, "abuse": "abuse@m-online.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0238763424396}, {"a": 8771, "h": "YUNET-AS", "n": "YUnet International d.o.o.", "t": "Other", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0556, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.169, "obs": 0, "own": 0.419, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.682, "ts": null, "map": 0.110, "obs": 0, "own": 0.102, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.192, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-YI2-RIPE", "org": "YUnet International d.o.o.", "pdb": null, "pfx": 9, "reg": "1998-05-01", "rir": "ripencc", "s24": 252, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65024, "abuse": "abuse@yu.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038611446525}, {"a": 8781, "h": "QA-ISP", "n": "Ooredoo Qatar", "t": "Broadband & mobile", "w": 11, "cc": "QA", "cf": {"rb": "lo", "wb": null, "rep": 1.51, "waf": null}, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 3, "web_bruteforce": 3}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.0508, "hi": 3.01, "lo": 0.39, "ips": 2, "mean": 1.43, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.99, "lo": 0.17, "ips": 3, "mean": 0.51, "above": false}, "vulncheck": {"n": 3, "p": 0.0784, "hi": 3.29, "lo": 0.58, "ips": 3, "mean": 1.70, "above": false}, "blocklist_de": {"n": 3, "p": 0.0039, "hi": 2.06, "lo": 0.36, "ips": 3, "mean": 1.06, "above": false}}, "h2": [["2026-10-05", 0.321, 0.007, 0, false], ["2026-10-12", 0.387, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.765, "ts": null, "map": 0.098, "obs": 0, "own": 0.449, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 3}, "lo": 0.387, "se": 0.499, "ts": 0.273, "map": 0.731, "obs": 11, "own": 1.135, "comp": {"cins": 4.9563, "dshield": -2.2982, "crowdsec": -3.4086, "vulncheck": 0.7077, "blocklist_de": 1.1226}, "mass": 10.6, "listed": false}}, "abq": false, "bot": 0.156, "det": {"vulncheck": {"botnet_node": 3}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-QT1-RIPE", "org": "Ooredoo Q.S.C.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.ooredoo.qa"}, "pfx": 151, "reg": "1998-05-08", "rir": "ripencc", "s24": 2583, "sib": 5, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 883712, "abuse": "abuse@qatar.net.qa", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04491952602726}, {"a": 8796, "h": "FD-298-8796", "n": "Fast Data", "t": "Hosting & VPS", "w": 17, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 7, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2023-23752": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-75650": 2}, "n": 10}, "ev": {"shodan": {"n": 3, "p": 0.0985, "hi": 3.47, "lo": 0.61, "ips": 3, "mean": 1.79, "above": false}, "dshield": {"n": 1, "p": 0.0964, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "crowdsec": {"n": 7, "p": 0.5088, "hi": 5.18, "lo": 1.57, "ips": 10, "mean": 3.15, "above": false}, "threatfox": {"n": 1, "p": 0.1628, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "vulncheck": {"n": 1, "p": 0.0984, "hi": 3.64, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "phishing_db": {"n": 2, "p": 0.2613, "hi": 4.91, "lo": 0.64, "ips": 2, "mean": 2.34, "above": false}, "blocklist_de": {"n": 2, "p": 0.1371, "hi": 3.89, "lo": 0.50, "ips": 2, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.601, 0.686, 0, false], ["2026-10-12", 1.560, 0.684, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 0.684, "se": 1.026, "ts": 0.667, "map": 2.264, "obs": 3, "own": 0.932, "comp": {"urlhaus": -0.7094, "threatfox": 0.9382, "phishing_db": 2.2146}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 2}, "lo": 1.560, "se": 0.482, "ts": 0.636, "map": 2.882, "obs": 11, "own": 0.567, "comp": {"cins": -1.5218, "dshield": -0.1597, "crowdsec": 5.4249, "vulncheck": -0.2961, "blocklist_de": -0.9951}, "mass": 9.3, "listed": false}}, "abq": false, "bot": 0.523, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "FD-298-ARIN", "org": "FASTNET DATA INC", "pdb": {"t": "Network Services", "sc": "North America", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.fastnetdata.com"}, "pfx": 326, "reg": "2022-04-04", "rir": "arin", "s24": 578, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 161280, "abuse": "abuse@fastnetdata.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00595316260018}, {"a": 8814, "h": "AS-AZTELEKOM", "n": "Aztelekom LLC", "t": "Broadband & mobile", "w": 8, "cc": "AZ", "cf": null, "cs": null, "ev": {"cins": {"n": 2, "p": 0.4044, "hi": 6.12, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}, "dshield": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 4, "p": 0.7779, "hi": 8.54, "lo": 1.84, "ips": 4, "mean": 4.67, "above": false}}, "h2": [["2026-10-05", 2.017, 0.011, 0, false], ["2026-10-12", 9.974, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 1.494, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 9.974, "se": 0.543, "ts": 0.571, "map": 20.652, "obs": 7, "own": 31.755, "comp": {"cins": 5.9853, "dshield": 0.2362, "crowdsec": -7.9232, "vulncheck": -0.8788, "blocklist_de": 7.002}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-AA137-RIPE", "org": "Aztelekom LLC", "pdb": null, "pfx": 43, "reg": "1998-06-04", "rir": "ripencc", "s24": 67, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": "abuse@aztelekom.az", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01135102699808}, {"a": 8849, "h": "MELBICOM-EU-AS", "n": "Melbicom", "t": "Hosting & VPS", "w": 9, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2015-4455": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-11776": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1434, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "vulncheck": {"n": 2, "p": 0.4044, "hi": 6.12, "lo": 0.80, "ips": 8, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 3.818, 0.011, 0, false], ["2026-10-12", 1.531, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.531, "se": 0.785, "ts": 0.667, "map": 4.750, "obs": 3, "own": 0.983, "comp": {"cins": -0.3291, "dshield": -0.6997, "crowdsec": 1.4273, "vulncheck": 4.2468, "blocklist_de": -1.6935}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.823, "det": {"vulncheck": {"botnet_node": 8}}, "oid": "ORG-MU30-RIPE", "org": "Melbikomas UAB", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.melbicom.net"}, "pfx": 44, "reg": "2009-07-29", "rir": "ripencc", "s24": 54, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@melbicom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00260266426318}, {"a": 8860, "h": "DELTA-BG-AS", "n": "Delta Cloud", "t": "Hosting & VPS", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3696, "hi": 5.81, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.260, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 0.102, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.949, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-DHL29-RIPE", "org": "Delta HighTech Ltd.", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://delta.bg"}, "pfx": 42, "reg": "1998-06-30", "rir": "ripencc", "s24": 39, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "abuse@delta.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025574277703}, {"a": 8866, "h": "VIVACOM-AS", "n": "Vivacom Bulgaria EAD", "t": "Broadband & mobile", "w": 23, "cc": "BG", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 7, "web_bruteforce": 5, "home_connection": 9, "mail_bruteforce": 7, "router_or_botnet": 5, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 10}, "ev": {"shodan": {"n": 17, "p": 0.0144, "hi": 2.68, "lo": 1.22, "ips": 17, "mean": 1.89, "above": false}, "dshield": {"n": 6, "p": 0.1697, "hi": 3.76, "lo": 1.04, "ips": 6, "mean": 2.22, "above": false}, "urlhaus": {"n": 5, "p": 0.7687, "hi": 7.69, "lo": 1.91, "ips": 5, "mean": 4.39, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 1.36, "lo": 0.47, "ips": 10, "mean": 0.86, "above": false}, "vulncheck": {"n": 1, "p": 0.0010, "hi": 1.54, "lo": 0.12, "ips": 1, "mean": 0.65, "above": false}, "blocklist_de": {"n": 4, "p": 0.0005, "hi": 1.74, "lo": 0.37, "ips": 4, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.454, 1.215, 0, false], ["2026-10-12", 0.495, 1.059, 0, false]], "sh": false, "uc": 98.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 0, "phishing_db": 0}, "lo": 1.059, "se": 0.906, "ts": 1.000, "map": 2.841, "obs": 5, "own": 7.166, "comp": {"urlhaus": 4.3998, "threatfox": -0.5673, "phishing_db": -1.1623}, "mass": 16.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 4}, "lo": 0.495, "se": 0.430, "ts": 0.450, "map": 0.833, "obs": 20, "own": 1.288, "comp": {"cins": -2.265, "dshield": 4.8835, "crowdsec": 0.5978, "vulncheck": -0.6325, "blocklist_de": -1.3727}, "mass": 18.4, "listed": false}}, "abq": false, "bot": 0.138, "det": {"shodan": {"malware": 2, "compromised": 15}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 3, "mail": 4}}, "oid": "ORG-BTCP1-RIPE", "org": "Vivacom Bulgaria EAD", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.vivacom.bg"}, "pfx": 1014, "reg": "1998-07-02", "rir": "ripencc", "s24": 3978, "sib": 10, "tor": 1, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 1485312, "abuse": "abuse-ip@vivacom.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04653113827128}, {"a": 8881, "h": "VERSATEL", "n": "1&1 Versatel Deutschland", "t": "Broadband & mobile", "w": 34, "cc": "DE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.47, "waf": 0.41}, "cs": {"c": {"http_flood": 6, "web_exploit": 10, "bad_crawling": 3, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 6, "web_bruteforce": 12, "home_connection": 10, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 4, "cve:CVE-2018-20062": 5, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.0005, "hi": 1.58, "lo": 0.20, "ips": 2, "mean": 0.75, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "dshield": {"n": 15, "p": 0.6239, "hi": 4.79, "lo": 2.08, "ips": 15, "mean": 3.32, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 0.79, "lo": 0.27, "ips": 14, "mean": 0.50, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 1.01, "lo": 0.08, "ips": 1, "mean": 0.42, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.90, "lo": 0.16, "ips": 3, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 2.402, 0.005, 0, false], ["2026-10-12", 0.438, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.698, "ts": null, "map": 0.066, "obs": 0, "own": 0.297, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 15, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.438, "se": 0.408, "ts": 0.500, "map": 0.707, "obs": 30, "own": 1.092, "comp": {"cins": 1.3893, "dshield": 10.7564, "crowdsec": -3.4301, "vulncheck": -0.7566, "blocklist_de": -6.9125}, "mass": 27.8, "listed": false}}, "abq": false, "bot": 0.127, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-KG4-RIPE", "org": "1&1 Versatel GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Tbps", "pol": "Selective", "web": "https://www.1und1.net/"}, "pfx": 567, "reg": "1998-07-08", "rir": "ripencc", "s24": 7076, "sib": 3, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2461696, "abuse": "abuse@1und1.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.154943}, {"a": 8888, "h": "XTOM", "n": "xTom APAC", "t": "Broadband & mobile", "w": 7, "cc": "AU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 7, "p": 0.9745, "hi": 11.37, "lo": 3.44, "ips": 7, "mean": 6.92, "above": true}, "crowdsec": {"n": 2, "p": 0.3059, "hi": 5.27, "lo": 0.68, "ips": 3, "mean": 2.51, "above": false}, "threatfox": {"n": 1, "p": 0.1942, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "vulncheck": {"n": 2, "p": 0.3980, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1667, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 1.740, 1.523, 0, false], ["2026-10-12", 3.138, 0.334, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.334, "se": 1.480, "ts": 1.000, "map": 2.921, "obs": 1, "own": 8.575, "comp": {"urlhaus": -0.1417, "threatfox": 3.1451, "phishing_db": -0.3052}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 1}, "lo": 3.138, "se": 0.637, "ts": 0.400, "map": 7.507, "obs": 5, "own": 11.817, "comp": {"cins": -0.6489, "dshield": -1.2236, "crowdsec": 2.0188, "vulncheck": 2.2412, "blocklist_de": 1.022}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.833, "det": {"shodan": {"c2": 1, "compromised": 6}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-XPL3-RIPE", "org": "xTom Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://xtom.com/"}, "pfx": 73, "reg": "1998-07-15", "rir": "ripencc", "s24": 73, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 18688, "abuse": "abuse@xtom.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00125655368874}, {"a": 8895, "h": "ISU", "n": "King Abdul Aziz City for Science and Technology", "t": "Other", "w": 0, "cc": "SA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.910, "ts": null, "map": 0.159, "obs": 0, "own": 0.364, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.625, "ts": null, "map": 0.090, "obs": 0, "own": 0.077, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.204, "det": null, "oid": "ORG-KA17-RIPE", "org": "King Abdul Aziz City for Science and Technology", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.isu.net.sa"}, "pfx": 98, "reg": "1998-07-21", "rir": "ripencc", "s24": 390, "sib": 4, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 126720, "abuse": "abuse@isu.net.sa", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036038928022}, {"a": 8899, "h": "DEUTSCHE-GLASFASER", "n": "Deutsche Glasfaser Group", "t": "Broadband & mobile", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2025-55182": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 2, "p": 0.3985, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 48.652, 0.011, 1, false], ["2026-10-12", 3.819, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 1.721, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.819, "se": 0.774, "ts": 0.667, "map": 11.965, "obs": 3, "own": 18.757, "comp": {"cins": -0.5134, "dshield": -1.0168, "crowdsec": -0.2828, "vulncheck": -0.6696, "blocklist_de": 6.3582}, "mass": 2.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-IG45-RIPE", "org": "inexio Informationstechnologie und Telekommunikation Gmbh", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://deutsche-glasfaser.de/"}, "pfx": 14, "reg": "1998-07-23", "rir": "ripencc", "s24": 35, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@inexio.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0140446482975}, {"a": 8916, "h": "PORTFAST", "n": "Portfast Ltd", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1689, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 0.267, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.202, "obs": 0, "own": 0.109, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.891, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PL120-RIPE", "org": "Portfast Ltd", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.portfast.co.uk"}, "pfx": 6, "reg": "2009-08-12", "rir": "ripencc", "s24": 34, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@portfast.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8926, "h": "MOLDTELECOM-AS", "n": "Moldtelecom", "t": "Broadband & mobile", "w": 10, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 6, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2026-8181": 2}, "n": 6}, "ev": {"urlhaus": {"n": 2, "p": 0.3198, "hi": 5.39, "lo": 0.70, "ips": 2, "mean": 2.57, "above": false}, "crowdsec": {"n": 6, "p": 0.0014, "hi": 2.03, "lo": 0.56, "ips": 6, "mean": 1.20, "above": false}, "phishing_db": {"n": 1, "p": 0.0230, "hi": 2.51, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.0014, "hi": 1.61, "lo": 0.12, "ips": 1, "mean": 0.68, "above": false}}, "h2": [["2026-10-05", 0.326, 0.582, 0, false], ["2026-10-12", 0.326, 0.633, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 1}, "lo": 0.633, "se": 1.037, "ts": 0.667, "map": 2.235, "obs": 3, "own": 5.779, "comp": {"urlhaus": 3.3864, "threatfox": -0.5243, "phishing_db": -0.4318}, "mass": 6.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.326, "se": 0.536, "ts": 0.857, "map": 0.649, "obs": 7, "own": 1.008, "comp": {"cins": -1.1985, "dshield": -1.8927, "crowdsec": 7.2019, "vulncheck": -0.859, "blocklist_de": -2.2911}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.186, "det": {"blocklist_de": {"apache": 1}}, "oid": "ORG-MS14-RIPE", "org": "Moldtelecom SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "http://moldtelecom.md"}, "pfx": 101, "reg": "1998-08-13", "rir": "ripencc", "s24": 1823, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 870144, "abuse": "cert.mtc@moldtelecom.md", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0075561904194}, {"a": 8953, "h": "ASN-ORANGE-ROMANIA", "n": "Orange Romania S.A (AS8953)", "t": "Broadband & mobile", "w": 4, "cc": "RO", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0027, "hi": 1.88, "lo": 0.24, "ips": 2, "mean": 0.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.0694, "hi": 3.23, "lo": 0.42, "ips": 2, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 0.038, 0.159, 0, false], ["2026-10-12", 0.339, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.847, "ts": null, "map": 0.135, "obs": 0, "own": 0.679, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.339, "se": 0.645, "ts": 0.500, "map": 0.832, "obs": 4, "own": 1.299, "comp": {"cins": -0.8294, "dshield": -1.4704, "crowdsec": 0.3374, "vulncheck": -0.7849, "blocklist_de": 3.9567}, "mass": 4.1, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"ftp": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ORS1-RIPE", "org": "Orange Romania S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.orange.ro"}, "pfx": 30, "reg": "1998-08-27", "rir": "ripencc", "s24": 884, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 226560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03998531161764}, {"a": 8966, "h": "Etisalat-AS", "n": "Etisalat", "t": "Broadband & mobile", "w": 0, "cc": "AE", "cf": {"rb": "hi", "wb": "hi", "rep": 1.29, "waf": 1.13}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 1.505, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.860, "ts": null, "map": 0.176, "obs": 0, "own": 0.614, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.086, "det": null, "oid": "ORG-ETC1-RIPE", "org": "EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.etisalat.ae"}, "pfx": 34, "reg": "1998-09-04", "rir": "ripencc", "s24": 65, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 216320, "abuse": "abuse@emirates.net.ae", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.056738}, {"a": 8972, "h": "GD-EMEA-DC-SXB1", "n": "Host Europe GmbH", "t": "Hosting & VPS", "w": 4, "cc": "DE", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0834, "hi": 3.38, "lo": 0.44, "ips": 2, "mean": 1.61, "above": false}, "crowdsec": {"n": 1, "p": 0.0144, "hi": 2.29, "lo": 0.17, "ips": 1, "mean": 0.97, "above": false}, "vulncheck": {"n": 2, "p": 0.2967, "hi": 5.20, "lo": 0.67, "ips": 2, "mean": 2.48, "above": false}, "phishing_db": {"n": 1, "p": 0.1266, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.066, 0.150, 0, false], ["2026-10-12", 0.268, 0.157, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.157, "se": 1.386, "ts": 1.000, "map": 1.083, "obs": 1, "own": 0.502, "comp": {"urlhaus": -0.2774, "threatfox": -0.2638, "phishing_db": 2.2476}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.268, "se": 0.752, "ts": 0.667, "map": 0.784, "obs": 3, "own": 0.162, "comp": {"cins": -0.3985, "dshield": -0.8244, "crowdsec": 0.7538, "vulncheck": 3.6606, "blocklist_de": -2.0416}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 2}}, "oid": "ORG-OG1-RIPE", "org": "Host Europe GmbH", "pdb": null, "pfx": 116, "reg": "2001-10-12", "rir": "ripencc", "s24": 403, "sib": 19, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 107264, "abuse": "abuse@hosteurope.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 8987, "h": "GOVCLOUD", "n": "Amazon Gov Cloud", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 13, "p": 0.0000, "hi": 1.76, "lo": 0.72, "ips": 13, "mean": 1.19, "above": false}, "vulncheck": {"n": 6, "p": 0.0823, "hi": 3.26, "lo": 0.90, "ips": 6, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.047, 0.006, 0, false], ["2026-10-12", 0.046, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.720, "ts": null, "map": 0.076, "obs": 0, "own": 0.053, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 6, "blocklist_de": 0}, "lo": 0.046, "se": 0.606, "ts": 1.000, "map": 0.102, "obs": 6, "own": 0.021, "comp": {"cins": -0.6141, "dshield": -1.1724, "crowdsec": -4.605, "vulncheck": 8.6088, "blocklist_de": -3.1043}, "mass": 3.0, "listed": false}}, "abq": true, "bot": 0.969, "det": {"shodan": {"c2": 9, "malware": 2, "compromised": 2}, "vulncheck": {"c2_server": 3, "attack_tooling": 3}}, "oid": "AT-9068-ARIN", "org": "Amazon Technologies Inc.", "pdb": null, "pfx": 134, "reg": "2026-06-30", "rir": "arin", "s24": 5028, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1425408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9008, "h": "ASN-VO", "n": "Visual Online S.A.", "t": "Broadband & mobile", "w": 1, "cc": "LU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1213, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.181, 0.011, 0, false], ["2026-10-12", 0.190, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 1.427, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.190, "se": 1.221, "ts": 1.000, "map": 1.391, "obs": 1, "own": 2.408, "comp": {"cins": -0.1507, "dshield": -0.345, "crowdsec": 3.3509, "vulncheck": -0.3473, "blocklist_de": -0.7845}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.307, "det": null, "oid": "ORG-VOS1-RIPE", "org": "Visual Online S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://vo.lu"}, "pfx": 8, "reg": "1998-10-08", "rir": "ripencc", "s24": 81, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": "abuse@visual-online.lu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037720514304}, {"a": 9009, "h": "M247", "n": "M247 Global", "t": "Hosting & VPS", "w": 556, "cc": "RO", "cf": {"rb": "", "wb": "", "rep": 1.92, "waf": 2.04}, "cs": {"c": {"http_flood": 311, "data_centre": 362, "web_exploit": 355, "bad_crawling": 255, "proxy_or_vpn": 418, "first_seen_30d": 1, "ssh_bruteforce": 76, "web_bruteforce": 333, "mail_bruteforce": 50, "router_or_botnet": 17, "cve:CVE-2017-9841": 108, "cve:CVE-2022-26134": 37, "cve:CVE-2022-35914": 34, "cve:CVE-2022-46604": 57, "cve:CVE-2024-28000": 62}, "n": 418}, "ev": {"cins": {"n": 3, "p": 0.0053, "hi": 2.13, "lo": 0.38, "ips": 12, "mean": 1.10, "above": false}, "shodan": {"n": 11, "p": 0.0000, "hi": 1.27, "lo": 0.48, "ips": 11, "mean": 0.84, "above": false}, "dshield": {"n": 22, "p": 0.9918, "hi": 7.20, "lo": 3.60, "ips": 23, "mean": 5.27, "above": true}, "crowdsec": {"n": 154, "p": 1.0000, "hi": 10.03, "lo": 7.69, "ips": 418, "mean": 8.83, "above": true}, "threatfox": {"n": 30, "p": 1.0000, "hi": 20.80, "lo": 11.47, "ips": 40, "mean": 15.85, "above": true}, "vulncheck": {"n": 6, "p": 0.0290, "hi": 2.77, "lo": 0.77, "ips": 6, "mean": 1.64, "above": false}, "phishing_db": {"n": 20, "p": 0.9871, "hi": 7.19, "lo": 3.48, "ips": 25, "mean": 5.19, "above": true}, "blocklist_de": {"n": 30, "p": 0.9352, "hi": 5.30, "lo": 2.92, "ips": 60, "mean": 4.04, "above": true}}, "h2": [["2026-10-05", 4.360, 1.395, 0, false], ["2026-10-12", 3.407, 1.437, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 30, "phishing_db": 20}, "lo": 1.437, "se": 0.799, "ts": 0.600, "map": 2.976, "obs": 50, "own": 1.176, "comp": {"urlhaus": -2.5742, "threatfox": 3.3841, "phishing_db": 1.9067}, "mass": 27.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 22, "crowdsec": 154, "vulncheck": 6, "blocklist_de": 30}, "lo": 3.407, "se": 0.357, "ts": 0.716, "map": 5.127, "obs": 215, "own": 1.003, "comp": {"cins": -2.6194, "dshield": 0.2219, "crowdsec": 11.7165, "vulncheck": -0.7978, "blocklist_de": -5.4931}, "mass": 176.4, "listed": false}}, "abq": false, "bot": 0.574, "det": {"shodan": {"c2": 5, "compromised": 5, "doublepulsar": 1}, "threatfox": {"family:DCRat": 3, "family:Remcos": 10, "family:AsyncRAT": 5, "family:AdaptixC2": 11, "family:Cobalt Strike": 3}, "vulncheck": {"c2_server": 2, "botnet_node": 1, "attack_tooling": 2, "other_infrastructure": 1}, "blocklist_de": {"ftp": 2, "ssh": 4, "bots": 27, "imap": 4, "mail": 6, "apache": 21, "bruteforcelogin": 19}}, "oid": "ORG-MES6-RIPE", "org": "M247 Europe SRL", "pdb": {"t": "NSP", "sc": "Global", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.m247global.com"}, "pfx": 4398, "reg": "2005-06-06", "rir": "ripencc", "s24": 6230, "sib": 1, "tor": 6, "w24": 233, "drop": 10, "hist": [["2026-10-05", 0.9982], ["2026-10-12", 0.9981]], "ipv4": 1657344, "abuse": "abuse@m247.ro", "score": 0.9981, "groups": ["sensors", "abusech", "phishing"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.248004}, {"a": 9029, "h": "HOMETVPRO-AS", "n": "SIA HomeTV Pro", "t": "Hosting & VPS", "w": 3, "cc": "LV", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 3.631, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.375, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-SP228-RIPE", "org": "SIA \"HomeTV Pro\"", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.hometv.pro"}, "pfx": 2, "reg": "2015-10-07", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9031, "h": "EDPNETapp", "n": "EDPNET Belgium", "t": "Transit & backbone", "w": 1, "cc": "BE", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.3748, "hi": 5.09, "lo": 1.10, "ips": 4, "mean": 2.78, "above": false}, "vulncheck": {"n": 1, "p": 0.1270, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.185, 0.010, 0, false], ["2026-10-12", 0.057, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.160, "obs": 0, "own": 1.305, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.057, "se": 1.107, "ts": 1.000, "map": 0.318, "obs": 1, "own": 1.126, "comp": {"cins": -0.1585, "dshield": -0.3616, "crowdsec": -1.4306, "vulncheck": 3.0241, "blocklist_de": -0.8247}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.219, "det": {"shodan": {"c2": 4}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-EBB4-RIPE", "org": "EDPNET Belgium BV", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.edpnet.be"}, "pfx": 11, "reg": "1998-10-28", "rir": "ripencc", "s24": 373, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 95488, "abuse": "abuse+ripe@citymesh.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00342616795812}, {"a": 9038, "h": "BAT-AS9038", "n": "Umniah Mobile Company", "t": "Broadband & mobile", "w": 7, "cc": "JO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0299, "hi": 2.66, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "dshield": {"n": 1, "p": 0.1261, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 1, "p": 0.0184, "hi": 2.40, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "blocklist_de": {"n": 5, "p": 0.7559, "hi": 7.54, "lo": 1.87, "ips": 5, "mean": 4.30, "above": false}}, "h2": [["2026-10-05", 1.824, 0.010, 0, false], ["2026-10-12", 1.864, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.161, "obs": 0, "own": 0.922, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.864, "se": 0.539, "ts": 0.714, "map": 3.756, "obs": 7, "own": 5.799, "comp": {"cins": -1.3404, "dshield": 0.2387, "crowdsec": -5.6895, "vulncheck": -0.8787, "blocklist_de": 10.3868}, "mass": 7.7, "listed": false}}, "abq": true, "bot": 0.245, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NETS1-RIPE", "org": "Al Bahrainia al Urdunia Liltaknia Wa Alitisalat Plc. Co", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.umniah.com"}, "pfx": 226, "reg": "1998-11-03", "rir": "ripencc", "s24": 368, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 171264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01886177816398}, {"a": 9050, "h": "RTD", "n": "Orange Romania S.A.", "t": "Broadband & mobile", "w": 6, "cc": "RO", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 3}, "n": 3}, "ev": {"urlhaus": {"n": 2, "p": 0.1638, "hi": 4.12, "lo": 0.53, "ips": 2, "mean": 1.96, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.48, "lo": 0.08, "ips": 3, "mean": 0.25, "above": false}, "vulncheck": {"n": 1, "p": 0.0001, "hi": 1.18, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.66, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}}, "h2": [["2026-10-05", 0.132, 0.340, 0, false], ["2026-10-12", 0.065, 0.200, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.200, "se": 1.123, "ts": 1.000, "map": 0.802, "obs": 2, "own": 2.224, "comp": {"urlhaus": 3.0143, "threatfox": -0.5314, "phishing_db": -1.0774}, "mass": 7.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.065, "se": 0.602, "ts": 0.600, "map": 0.147, "obs": 5, "own": 0.231, "comp": {"cins": -0.9253, "dshield": -1.5898, "crowdsec": 2.4001, "vulncheck": 0.2637, "blocklist_de": -0.6719}, "mass": 4.8, "listed": false}}, "abq": true, "bot": 0.194, "det": {"vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ORS1-RIPE", "org": "Orange Romania S.A.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.orange.ro/wholesale/en/"}, "pfx": 79, "reg": "1998-11-06", "rir": "ripencc", "s24": 5728, "sib": 2, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1766400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00668476843416}, {"a": 9063, "h": "SAARGATE-AS", "n": "VSE NET GmbH", "t": "Transit & backbone", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0263, "hi": 2.58, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "blocklist_de": {"n": 1, "p": 0.0907, "hi": 3.55, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}}, "h2": [["2026-10-05", 2.375, 0.010, 0, false], ["2026-10-12", 0.275, 0.011, 0, false]], "sh": false, "uc": 173.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.165, "obs": 0, "own": 1.378, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.275, "se": 0.864, "ts": 0.500, "map": 1.020, "obs": 2, "own": 3.305, "comp": {"cins": -0.4048, "dshield": -0.8354, "crowdsec": 0.6944, "vulncheck": -0.6068, "blocklist_de": 2.5662}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.157, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-SGFM1-RIPE", "org": "VSE NET GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.vsenet.de"}, "pfx": 67, "reg": "1998-11-18", "rir": "ripencc", "s24": 315, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80640, "abuse": "abuse@vsenet.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0072992140797}, {"a": 9081, "h": "AS9081", "n": "\"B92\" DOO BEOGRAD", "t": "Other", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.335, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BO2-RIPE", "org": "\"B92\" DOO BEOGRAD", "pdb": null, "pfx": 3, "reg": "1998-12-01", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "abuse@b92.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000173635245}, {"a": 9112, "h": "POZMAN", "n": "POZMAN", "t": "Enterprise, edu & gov", "w": 1, "cc": "PL", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.3413, "hi": 5.16, "lo": 0.91, "ips": 3, "mean": 2.66, "above": false}, "crowdsec": {"n": 1, "p": 0.0449, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.094, 0.010, 0, false], ["2026-10-12", 0.097, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.792, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.097, "se": 1.139, "ts": 1.000, "map": 0.609, "obs": 1, "own": 3.735, "comp": {"cins": -0.1898, "dshield": -0.4272, "crowdsec": 2.9039, "vulncheck": -0.404, "blocklist_de": -0.9853}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.602, "det": {"shodan": {"compromised": 1, "doublepulsar": 2}}, "oid": "ORG-PSAN1-RIPE", "org": "Institute of Bioorganic Chemistry Polish Academy of Science, Poznan Supercomputing and Networking Center", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.pcss.pl"}, "pfx": 2, "reg": "1998-12-23", "rir": "ripencc", "s24": 235, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 73728, "abuse": "cert@man.poznan.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033614373156}, {"a": 9121, "h": "TTNet", "n": "Turk Telekom", "t": "Broadband & mobile", "w": 107, "cc": "TR", "cf": {"rb": "", "wb": "", "rep": 5.41, "waf": 1.17}, "cs": {"c": {"http_flood": 10, "data_centre": 1, "web_exploit": 19, "bad_crawling": 5, "proxy_or_vpn": 11, "first_seen_30d": 1, "ssh_bruteforce": 17, "web_bruteforce": 30, "home_connection": 33, "mail_bruteforce": 24, "router_or_botnet": 7, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 2, "cve:CVE-2024-28000": 3, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 5}, "n": 42}, "ev": {"cins": {"n": 12, "p": 0.0000, "hi": 1.59, "lo": 0.63, "ips": 12, "mean": 1.06, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.13, "lo": 0.02, "ips": 3, "mean": 0.07, "above": false}, "dshield": {"n": 19, "p": 0.0000, "hi": 1.81, "lo": 0.86, "ips": 19, "mean": 1.30, "above": false}, "urlhaus": {"n": 3, "p": 0.0078, "hi": 2.24, "lo": 0.39, "ips": 3, "mean": 1.16, "above": false}, "crowdsec": {"n": 39, "p": 0.0000, "hi": 0.71, "lo": 0.42, "ips": 42, "mean": 0.56, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.32, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.45, "lo": 0.06, "ips": 2, "mean": 0.21, "above": false}, "blocklist_de": {"n": 30, "p": 0.0000, "hi": 1.38, "lo": 0.76, "ips": 40, "mean": 1.05, "above": false}}, "h2": [["2026-10-05", 0.343, 0.084, 0, false], ["2026-10-12", 0.535, 0.137, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 2}, "lo": 0.137, "se": 1.016, "ts": 0.600, "map": 0.402, "obs": 5, "own": 1.215, "comp": {"urlhaus": 1.9173, "threatfox": -0.5658, "phishing_db": -0.6361}, "mass": 18.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 12, "dshield": 19, "crowdsec": 39, "vulncheck": 1, "blocklist_de": 30}, "lo": 0.535, "se": 0.374, "ts": 0.386, "map": 0.799, "obs": 101, "own": 1.234, "comp": {"cins": 4.3877, "dshield": 1.2938, "crowdsec": -3.7783, "vulncheck": -0.9535, "blocklist_de": 0.2201}, "mass": 118.2, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"c2": 1, "compromised": 2}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 2, "ssh": 3, "bots": 14, "imap": 15, "mail": 18, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-TT3-RIPE", "org": "Turk Telekomunikasyon Anonim Sirketi", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.turktelekom.com.tr"}, "pfx": 339, "reg": "1998-12-29", "rir": "ripencc", "s24": 26627, "sib": 0, "tor": 0, "w24": 95, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13930752, "abuse": "abuse@turktelekom.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.382516}, {"a": 9123, "h": "TimeWeb-AS", "n": "JSC TimeWeb", "t": "Hosting & VPS", "w": 31, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 2, "first_seen_30d": 4, "ssh_bruteforce": 5, "web_bruteforce": 2, "home_connection": 3, "cve:CVE-2025-55182": 1}, "n": 8}, "ev": {"shodan": {"n": 24, "p": 1.0000, "hi": 11.35, "lo": 5.84, "ips": 24, "mean": 8.41, "above": true}, "crowdsec": {"n": 8, "p": 0.2930, "hi": 4.18, "lo": 1.36, "ips": 8, "mean": 2.60, "above": false}, "threatfox": {"n": 1, "p": 0.1440, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "vulncheck": {"n": 14, "p": 0.9999, "hi": 14.74, "lo": 6.23, "ips": 14, "mean": 10.10, "above": true}, "phishing_db": {"n": 5, "p": 0.7276, "hi": 7.24, "lo": 1.80, "ips": 6, "mean": 4.13, "above": false}, "blocklist_de": {"n": 2, "p": 0.0633, "hi": 3.16, "lo": 0.41, "ips": 2, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 2.035, 0.895, 0, false], ["2026-10-12", 1.417, 1.089, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 5}, "lo": 1.089, "se": 0.905, "ts": 0.833, "map": 2.849, "obs": 6, "own": 1.137, "comp": {"urlhaus": -1.1667, "threatfox": 0.3001, "phishing_db": 3.5399}, "mass": 3.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 14, "blocklist_de": 2}, "lo": 1.417, "se": 0.439, "ts": 0.583, "map": 2.390, "obs": 24, "own": 0.471, "comp": {"cins": -1.8164, "dshield": -2.4252, "crowdsec": 3.8584, "vulncheck": 5.63, "blocklist_de": -2.9818}, "mass": 12.3, "listed": false}}, "abq": false, "bot": 0.821, "det": {"shodan": {"c2": 5, "compromised": 19}, "threatfox": {"family:BianLian": 1}, "vulncheck": {"c2_server": 4, "botnet_node": 6, "attack_tooling": 4}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-TL188-RIPE", "org": "JSC \"TIMEWEB\"", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.timeweb.ru"}, "pfx": 924, "reg": "2008-04-01", "rir": "ripencc", "s24": 924, "sib": 1, "tor": 0, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 236544, "abuse": "abuse@timeweb.ru", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.01053092891961}, {"a": 9125, "h": "ORIONTELEKOM-AS", "n": "Orion Telekom", "t": "Broadband & mobile", "w": 14, "cc": "RS", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2022-39290": 1, "cve:CVE-2023-27372": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0540, "hi": 3.05, "lo": 0.40, "ips": 2, "mean": 1.45, "above": false}, "vulncheck": {"n": 3, "p": 0.5090, "hi": 6.41, "lo": 1.13, "ips": 12, "mean": 3.31, "above": false}, "blocklist_de": {"n": 1, "p": 0.0727, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 0.547, 0.009, 0, false], ["2026-10-12", 0.756, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.908, "ts": null, "map": 0.159, "obs": 0, "own": 0.897, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 1}, "lo": 0.756, "se": 0.598, "ts": 0.500, "map": 1.694, "obs": 6, "own": 2.671, "comp": {"cins": -0.7755, "dshield": -1.3998, "crowdsec": 0.8172, "vulncheck": 3.0398, "blocklist_de": 0.2389}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.222, "det": {"vulncheck": {"botnet_node": 12}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MW1-RIPE", "org": "Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://oriontelekom.rs"}, "pfx": 287, "reg": "1998-12-30", "rir": "ripencc", "s24": 400, "sib": 4, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110336, "abuse": "abuse@oriontelekom.rs", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001942615629}, {"a": 9129, "h": "KE-NET2000", "n": "MTN Business Kenya", "t": "Transit & backbone", "w": 8, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 8, "bad_crawling": 4, "proxy_or_vpn": 7, "ssh_bruteforce": 6, "web_bruteforce": 8, "mail_bruteforce": 4, "router_or_botnet": 5, "cve:CVE-2025-4396": 2, "cve:CVE-2018-10562": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 2}, "n": 8}, "ev": {"crowdsec": {"n": 6, "p": 0.9048, "hi": 9.24, "lo": 2.56, "ips": 8, "mean": 5.46, "above": true}}, "h2": [["2026-10-05", 3.442, 0.011, 0, false], ["2026-10-12", 3.608, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.002, "ts": null, "map": 0.183, "obs": 0, "own": 1.895, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.608, "se": 0.568, "ts": 1.000, "map": 7.786, "obs": 6, "own": 24.430, "comp": {"cins": -0.9103, "dshield": -1.5715, "crowdsec": 11.252, "vulncheck": -0.8049, "blocklist_de": -4.5193}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.216, "det": null, "oid": "ORG-VSA1-AFRINIC", "org": "MTN SA", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://bayobab.africa/"}, "pfx": 61, "reg": "2007-09-20", "rir": "afrinic", "s24": 106, "sib": 8, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52736, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00339925696112}, {"a": 9141, "h": "AS9141", "n": "P4 PLAY Network", "t": "Broadband & mobile", "w": 15, "cc": "PL", "cf": {"rb": "hi", "wb": "hi", "rep": 1.08, "waf": 0.95}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 5, "web_bruteforce": 6, "home_connection": 6, "mail_bruteforce": 6, "router_or_botnet": 3}, "n": 8}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.33, "lo": 0.02, "ips": 1, "mean": 0.14, "above": false}, "dshield": {"n": 5, "p": 0.0095, "hi": 2.39, "lo": 0.59, "ips": 5, "mean": 1.36, "above": false}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 0.81, "lo": 0.26, "ips": 8, "mean": 0.51, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.36, "lo": 0.34, "ips": 5, "mean": 0.77, "above": false}}, "h2": [["2026-10-05", 0.259, 0.006, 0, false], ["2026-10-12", 0.311, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.705, "ts": null, "map": 0.070, "obs": 0, "own": 0.311, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.311, "se": 0.437, "ts": 0.444, "map": 0.524, "obs": 18, "own": 0.811, "comp": {"cins": -2.2606, "dshield": 3.6378, "crowdsec": -0.6, "vulncheck": -0.9539, "blocklist_de": 0.9246}, "mass": 18.4, "listed": false}}, "abq": false, "bot": 0.122, "det": {"shodan": {"c2": 1}, "blocklist_de": {"ssh": 2, "imap": 3, "mail": 3}}, "oid": "ORG-UTKS1-RIPE", "org": "P4 Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Restrictive", "web": "https://www.play.pl/"}, "pfx": 76, "reg": "1999-01-08", "rir": "ripencc", "s24": 6298, "sib": 5, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1612288, "abuse": "abuse@play.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.067668}, {"a": 9145, "h": "EWETEL", "n": "EWE TEL", "t": "Broadband & mobile", "w": 6, "cc": "DE", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0045, "hi": 1.88, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}, "dshield": {"n": 4, "p": 0.0612, "hi": 3.11, "lo": 0.67, "ips": 4, "mean": 1.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.98, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}}, "h2": [["2026-10-05", 0.882, 0.006, 0, false], ["2026-10-12", 0.156, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.742, "ts": null, "map": 0.087, "obs": 0, "own": 0.393, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.156, "se": 0.561, "ts": 0.667, "map": 0.325, "obs": 6, "own": 0.507, "comp": {"cins": 2.6524, "dshield": 8.0627, "crowdsec": -7.3508, "vulncheck": -0.8575, "blocklist_de": -2.2366}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.142, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ETG2-RIPE", "org": "EWE TEL GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.ewe.de/"}, "pfx": 54, "reg": "1999-01-11", "rir": "ripencc", "s24": 3598, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 921344, "abuse": "abuse@ewetel.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02553572053815}, {"a": 9146, "h": "BIHNET", "n": "BHTelecom", "t": "Broadband & mobile", "w": 10, "cc": "BA", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 4}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1030, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "dshield": {"n": 2, "p": 0.2253, "hi": 4.62, "lo": 0.60, "ips": 2, "mean": 2.20, "above": false}, "urlhaus": {"n": 1, "p": 0.1729, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 3, "p": 0.0330, "hi": 2.78, "lo": 0.49, "ips": 4, "mean": 1.43, "above": false}, "vulncheck": {"n": 1, "p": 0.0873, "hi": 3.51, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "blocklist_de": {"n": 5, "p": 0.5873, "hi": 6.11, "lo": 1.52, "ips": 6, "mean": 3.49, "above": false}}, "h2": [["2026-10-05", 1.432, 0.181, 0, false], ["2026-10-12", 1.838, 0.200, 0, false]], "sh": false, "uc": 324.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.200, "se": 1.413, "ts": 1.000, "map": 1.520, "obs": 1, "own": 4.365, "comp": {"urlhaus": 3.1854, "threatfox": -0.3873, "phishing_db": -0.7534}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 5}, "lo": 1.838, "se": 0.474, "ts": 0.417, "map": 3.301, "obs": 12, "own": 5.091, "comp": {"cins": 1.2773, "dshield": 0.9483, "crowdsec": -4.4793, "vulncheck": -0.4604, "blocklist_de": 5.3022}, "mass": 12.3, "listed": false}}, "abq": false, "bot": 0.182, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 2, "imap": 1, "mail": 4}}, "oid": "ORG-PEOP1-RIPE", "org": "BH Telecom d.d. Sarajevo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.bhtelecom.ba"}, "pfx": 111, "reg": "1999-01-12", "rir": "ripencc", "s24": 673, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 436992, "abuse": "abuse@bhtelecom.ba", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01154897291352}, {"a": 9198, "h": "KAZTELECOM-AS", "n": "Kazakhtelecom", "t": "Broadband & mobile", "w": 57, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 5, "bad_crawling": 1, "first_seen_30d": 2, "ssh_bruteforce": 20, "web_bruteforce": 9, "home_connection": 10, "mail_bruteforce": 10, "router_or_botnet": 1, "cve:CVE-2018-1207": 1, "cve:CVE-2018-10562": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2021-44228": 1, "cve:CVE-2024-12847": 2}, "n": 30}, "ev": {"cins": {"n": 5, "p": 0.0568, "hi": 3.06, "lo": 0.76, "ips": 5, "mean": 1.75, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.79, "lo": 0.20, "ips": 5, "mean": 0.45, "above": false}, "dshield": {"n": 9, "p": 0.2161, "hi": 3.83, "lo": 1.32, "ips": 9, "mean": 2.44, "above": false}, "urlhaus": {"n": 1, "p": 0.0565, "hi": 3.10, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "crowdsec": {"n": 30, "p": 0.0025, "hi": 2.50, "lo": 1.38, "ips": 30, "mean": 1.90, "above": false}, "vulncheck": {"n": 4, "p": 0.0073, "hi": 2.28, "lo": 0.49, "ips": 4, "mean": 1.24, "above": false}, "blocklist_de": {"n": 19, "p": 0.3442, "hi": 3.89, "lo": 1.85, "ips": 19, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.887, 0.057, 0, false], ["2026-10-12", 1.428, 0.064, 0, false]], "sh": false, "uc": 170, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.064, "se": 1.329, "ts": 1.000, "map": 0.381, "obs": 1, "own": 1.165, "comp": {"urlhaus": 2.0868, "threatfox": -0.4759, "phishing_db": -0.9494}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 9, "crowdsec": 30, "vulncheck": 4, "blocklist_de": 19}, "lo": 1.428, "se": 0.378, "ts": 0.448, "map": 2.170, "obs": 67, "own": 3.338, "comp": {"cins": 1.8241, "dshield": 0.3753, "crowdsec": -0.8263, "vulncheck": -0.6415, "blocklist_de": 1.4366}, "mass": 69.1, "listed": false}}, "abq": false, "bot": 0.207, "det": {"shodan": {"compromised": 5}, "vulncheck": {"botnet_node": 4}, "blocklist_de": {"ssh": 6, "bots": 6, "imap": 5, "mail": 7}}, "oid": "ORG-KDNA1-RIPE", "org": "JSC Kazakhtelecom", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.telecom.kz"}, "pfx": 1014, "reg": "1999-02-23", "rir": "ripencc", "s24": 5754, "sib": 2, "tor": 0, "w24": 57, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3261184, "abuse": "abuse@telecom.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03397797288347}, {"a": 9228, "h": "CENTRALONLINE-ID-AS-AP", "n": "Total Info Kharisma", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1756, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.339, 0.011, 0, false], ["2026-10-12", 0.360, 0.012, 0, false]], "sh": false, "uc": 1412.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 1.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.360, "se": 1.323, "ts": 1.000, "map": 3.207, "obs": 1, "own": 5.794, "comp": {"cins": -0.1126, "dshield": -0.2619, "crowdsec": 3.8031, "vulncheck": -0.2822, "blocklist_de": -0.5873}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.236, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-9228-APNIC", "org": "PT. Total Info Kharisma", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://central.net.id"}, "pfx": 26, "reg": "2000-05-15", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@central.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9230, "h": "BOL-BD-AP", "n": "Bangladesh Online", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1421, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "urlhaus": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3117, "hi": 5.32, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}, "blocklist_de": {"n": 2, "p": 0.3754, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 1.859, 0.473, 0, false], ["2026-10-12", 3.384, 0.510, 0, false]], "sh": false, "uc": 1007.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.510, "se": 1.577, "ts": 1.000, "map": 5.441, "obs": 1, "own": 16.652, "comp": {"urlhaus": 4.0139, "threatfox": -0.2418, "phishing_db": -0.452}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.384, "se": 0.670, "ts": 0.500, "map": 8.788, "obs": 4, "own": 13.663, "comp": {"cins": -0.707, "dshield": -1.3065, "crowdsec": 1.4535, "vulncheck": -0.7487, "blocklist_de": 4.8757}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.535, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1, "mail": 1}}, "oid": "ORG-BOL1-AP-APNIC", "org": "Bangladesh Online Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.bol-online.com/"}, "pfx": 94, "reg": "2000-05-17", "rir": "apnic", "s24": 69, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 46336, "abuse": "adminx@bol-online.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058126206088}, {"a": 9231, "h": "IPEOPLESNET-AS-AP", "n": "China Mobile Hong Kong", "t": "Broadband & mobile", "w": 7, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"dshield": {"n": 4, "p": 0.7959, "hi": 8.82, "lo": 1.90, "ips": 4, "mean": 4.82, "above": true}, "crowdsec": {"n": 3, "p": 0.5241, "hi": 6.54, "lo": 1.15, "ips": 3, "mean": 3.37, "above": false}, "blocklist_de": {"n": 1, "p": 0.1680, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 2.931, 0.011, 0, false], ["2026-10-12", 8.389, 0.012, 0, false]], "sh": false, "uc": 998.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.188, "obs": 0, "own": 1.479, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 8.389, "se": 0.519, "ts": 0.500, "map": 16.353, "obs": 8, "own": 25.159, "comp": {"cins": -1.1704, "dshield": 8.1952, "crowdsec": 0.1447, "vulncheck": -0.8546, "blocklist_de": -2.1267}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.097, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CMHK1-AP-APNIC", "org": "China Mobile Hong Kong Company Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.hk.chinamobile.com"}, "pfx": 70, "reg": "2000-05-18", "rir": "apnic", "s24": 70, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": "abusehandler@hk.chinamobile.com", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.0139688454403}, {"a": 9232, "h": "NTTE-AS", "n": "Ntte Global Network (Brand Name)", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.318, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.913, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 33, "reg": "2022-06-14", "rir": "apnic", "s24": 33, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": "abuse@ntte.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9260, "h": "MULTINET-AS-AP", "n": "Multinet Pakistan Pvt. Ltd.", "t": "Broadband & mobile", "w": 9, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 3, "web_bruteforce": 5, "home_connection": 7, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2024-28000": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "shodan": {"n": 1, "p": 0.1123, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "crowdsec": {"n": 8, "p": 0.9808, "hi": 11.03, "lo": 3.59, "ips": 8, "mean": 6.88, "above": true}}, "h2": [["2026-10-05", 8.719, 0.011, 0, false], ["2026-10-12", 5.916, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 1.301, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.916, "se": 0.502, "ts": 0.889, "map": 11.369, "obs": 9, "own": 17.508, "comp": {"cins": 2.4189, "dshield": -1.99, "crowdsec": 10.5594, "vulncheck": -0.873, "blocklist_de": -6.2907}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.257, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-MB4-AP-APNIC", "org": "Multinet Broadband", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.multinet.com.pk"}, "pfx": 118, "reg": "2007-02-01", "rir": "apnic", "s24": 116, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49664, "abuse": "abuse@multinet.com.pk", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00209596601599}, {"a": 9269, "h": "HKBN-AS-AP", "n": "Hong Kong Broadband Network LTD", "t": "Broadband & mobile", "w": 32, "cc": "HK", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.85}, "cs": {"c": {"http_flood": 1, "web_exploit": 8, "bad_crawling": 1, "first_seen_30d": 2, "ssh_bruteforce": 9, "web_bruteforce": 8, "home_connection": 12, "mail_bruteforce": 5, "router_or_botnet": 3, "cve:CVE-2024-6387": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-12847": 1}, "n": 14}, "ev": {"cins": {"n": 3, "p": 0.0078, "hi": 2.24, "lo": 0.39, "ips": 3, "mean": 1.16, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.78, "lo": 0.19, "ips": 5, "mean": 0.45, "above": false}, "dshield": {"n": 6, "p": 0.0359, "hi": 2.86, "lo": 0.79, "ips": 6, "mean": 1.69, "above": false}, "urlhaus": {"n": 1, "p": 0.0555, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 1.33, "lo": 0.56, "ips": 14, "mean": 0.91, "above": false}, "vulncheck": {"n": 3, "p": 0.0020, "hi": 1.91, "lo": 0.34, "ips": 3, "mean": 0.99, "above": false}, "phishing_db": {"n": 1, "p": 0.0001, "hi": 1.23, "lo": 0.09, "ips": 1, "mean": 0.52, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.45, "lo": 0.36, "ips": 5, "mean": 0.83, "above": false}}, "h2": [["2026-10-05", 0.536, 0.282, 0, false], ["2026-10-12", 0.564, 0.120, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.120, "se": 1.165, "ts": 0.500, "map": 0.497, "obs": 2, "own": 1.487, "comp": {"urlhaus": 1.5924, "threatfox": -0.5001, "phishing_db": -0.1661}, "mass": 4.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 6, "crowdsec": 14, "vulncheck": 3, "blocklist_de": 5}, "lo": 0.564, "se": 0.409, "ts": 0.452, "map": 0.912, "obs": 31, "own": 1.408, "comp": {"cins": 3.1525, "dshield": 2.2258, "crowdsec": 0.293, "vulncheck": -0.3606, "blocklist_de": -4.0095}, "mass": 29.5, "listed": false}}, "abq": false, "bot": 0.245, "det": {"shodan": {"malware": 1, "compromised": 4}, "vulncheck": {"attack_tooling": 3}, "blocklist_de": {"ssh": 5}}, "oid": "ORG-HKBN1-AP-APNIC", "org": "Hong Kong Broadband Network Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.hkbn.net"}, "pfx": 189, "reg": "1998-02-13", "rir": "apnic", "s24": 5828, "sib": 2, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3870976, "abuse": "abuse@hkbn.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0419843873142}, {"a": 9286, "h": "KINXIDC-AS-KR", "n": "KINX Transit", "t": "Transit & backbone", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.1362, "hi": 3.63, "lo": 0.90, "ips": 5, "mean": 2.07, "above": false}}, "h2": [["2026-10-05", 0.038, 0.008, 0, false], ["2026-10-12", 0.005, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.846, "ts": null, "map": 0.135, "obs": 0, "own": 0.964, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.522, "ts": null, "map": 0.058, "obs": 0, "own": 0.248, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.673, "det": {"shodan": {"compromised": 5}}, "oid": "@aut-9286-APNIC", "org": "KINX", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.kinx.net/?lang=en"}, "pfx": 138, "reg": "2002-09-06", "rir": "apnic", "s24": 887, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 319232, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003110657858}, {"a": 9287, "h": "AIDC-AS-AP", "n": "Arise IDC Company Limited, Thailand", "t": "Transit & backbone", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3280, "hi": 5.46, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 2.088, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.847, "ts": null, "map": 0.172, "obs": 0, "own": 1.180, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.844, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-TIDC1-AP-APNIC", "org": "Arise IDC Company Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.ariseidc.com"}, "pfx": 82, "reg": "1998-03-10", "rir": "apnic", "s24": 72, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31488, "abuse": "network@ariseidc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007186292826}, {"a": 9294, "h": "GNETINC-AS-AP", "n": "GNET INC.", "t": "Other", "w": 9, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "first_seen_30d": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0098, "hi": 2.24, "lo": 0.29, "ips": 2, "mean": 1.07, "above": false}, "crowdsec": {"n": 1, "p": 0.0006, "hi": 1.46, "lo": 0.11, "ips": 1, "mean": 0.61, "above": false}, "threatfox": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 4, "mean": 1.77, "above": false}, "phishing_db": {"n": 2, "p": 0.2046, "hi": 4.45, "lo": 0.58, "ips": 4, "mean": 2.12, "above": false}}, "h2": [["2026-10-05", 0.039, 0.928, 0, false], ["2026-10-12", 0.041, 0.502, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 0.502, "se": 1.034, "ts": 0.667, "map": 1.669, "obs": 3, "own": 1.835, "comp": {"urlhaus": -0.7535, "threatfox": 0.8551, "phishing_db": 2.0368}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.041, "se": 1.057, "ts": 1.000, "map": 0.216, "obs": 1, "own": 0.131, "comp": {"cins": -0.2406, "dshield": -0.5302, "crowdsec": 2.345, "vulncheck": -0.4659, "blocklist_de": -1.245}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"c2": 2}, "threatfox": {"family:AdaptixC2": 4}}, "oid": "ORG-GI16-AP-APNIC", "org": "GNET INC.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://gnet.cc"}, "pfx": 264, "reg": "2022-02-11", "rir": "apnic", "s24": 848, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 432640, "abuse": "abuse@gnet.cc", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003331830562}, {"a": 9299, "h": "IPG-AS-AP", "n": "Philippine Long Distance Company", "t": "Broadband & mobile", "w": 93, "cc": "PH", "cf": {"rb": "", "wb": "", "rep": 1.48, "waf": 0.60}, "cs": {"c": {"http_flood": 20, "data_centre": 1, "web_exploit": 18, "bad_crawling": 8, "proxy_or_vpn": 16, "first_seen_30d": 1, "ssh_bruteforce": 16, "web_bruteforce": 25, "home_connection": 20, "mail_bruteforce": 5, "router_or_botnet": 5, "cve:CVE-2024-28000": 8}, "n": 39}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.18, "lo": 0.01, "ips": 1, "mean": 0.08, "above": false}, "dshield": {"n": 30, "p": 0.9637, "hi": 5.60, "lo": 3.09, "ips": 30, "mean": 4.27, "above": true}, "crowdsec": {"n": 39, "p": 0.0000, "hi": 1.60, "lo": 0.95, "ips": 39, "mean": 1.26, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.71, "lo": 0.05, "ips": 1, "mean": 0.30, "above": false}, "blocklist_de": {"n": 29, "p": 0.0393, "hi": 2.94, "lo": 1.61, "ips": 30, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 0.767, 0.021, 0, false], ["2026-10-12", 0.992, 0.023, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.023, "se": 1.330, "ts": 1.000, "map": 0.118, "obs": 1, "own": 0.433, "comp": {"urlhaus": -0.7326, "threatfox": -0.4244, "phishing_db": 0.6427}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 30, "crowdsec": 39, "vulncheck": 0, "blocklist_de": 29}, "lo": 0.992, "se": 0.371, "ts": 0.398, "map": 1.520, "obs": 98, "own": 2.342, "comp": {"cins": -3.7794, "dshield": 5.5053, "crowdsec": -1.821, "vulncheck": -1.0043, "blocklist_de": 2.9122}, "mass": 97.8, "listed": false}}, "abq": false, "bot": 0.119, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 5, "bots": 14, "imap": 3, "mail": 4, "apache": 7, "bruteforcelogin": 7}}, "oid": "@family-31372", "org": "Philippine Long Distance Telephone Co.", "pdb": {"t": "NSP", "sc": null, "tr": null, "pol": "Selective", "web": "http://www.pldt.com"}, "pfx": 519, "reg": "1998-04-16", "rir": "apnic", "s24": 11602, "sib": 28, "tor": 0, "w24": 88, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4375552, "abuse": "abuse@pldt.com.ph", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.442488}, {"a": 9304, "h": "HUTCHISON-AS-AP", "n": "HGC", "t": "Broadband & mobile", "w": 20, "cc": "HK", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.72}, "cs": {"c": {"data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 3, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"cins": {"n": 2, "p": 0.0006, "hi": 1.60, "lo": 0.21, "ips": 2, "mean": 0.76, "above": false}, "shodan": {"n": 8, "p": 0.0000, "hi": 0.91, "lo": 0.30, "ips": 8, "mean": 0.57, "above": false}, "dshield": {"n": 4, "p": 0.0015, "hi": 1.92, "lo": 0.41, "ips": 4, "mean": 1.05, "above": false}, "urlhaus": {"n": 2, "p": 0.1304, "hi": 3.83, "lo": 0.50, "ips": 2, "mean": 1.82, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.67, "lo": 0.20, "ips": 7, "mean": 0.41, "above": false}, "vulncheck": {"n": 5, "p": 0.0057, "hi": 2.26, "lo": 0.56, "ips": 6, "mean": 1.29, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.56, "lo": 0.04, "ips": 1, "mean": 0.24, "above": false}}, "h2": [["2026-10-05", 0.316, 0.089, 0, false], ["2026-10-12", 0.230, 0.172, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.172, "se": 1.125, "ts": 1.000, "map": 0.690, "obs": 2, "own": 1.941, "comp": {"urlhaus": 2.8724, "threatfox": -0.5339, "phishing_db": -1.0833}, "mass": 7.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 7, "vulncheck": 5, "blocklist_de": 1}, "lo": 0.230, "se": 0.447, "ts": 0.368, "map": 0.397, "obs": 19, "own": 0.617, "comp": {"cins": 3.57, "dshield": 3.1953, "crowdsec": -0.1631, "vulncheck": 0.9593, "blocklist_de": -7.0909}, "mass": 15.5, "listed": false}}, "abq": false, "bot": 0.314, "det": {"shodan": {"compromised": 8}, "vulncheck": {"c2_server": 1, "attack_tooling": 5}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HGCL2-AP-APNIC", "org": "HGC Global Communications Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.hgc-intl.com/"}, "pfx": 1287, "reg": "1998-05-12", "rir": "apnic", "s24": 6969, "sib": 4, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4571136, "abuse": "abuse@hgcbroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0240233853649}, {"a": 9312, "h": "XTOM", "n": "xTom Hong Kong", "t": "Broadband & mobile", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5843, "hi": 7.09, "lo": 1.25, "ips": 3, "mean": 3.66, "above": false}}, "h2": [["2026-10-05", 0.257, 0.394, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.753, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.864, "det": {"shodan": {"c2": 1, "compromised": 2}}, "oid": "ORG-XHKL1-AP-APNIC", "org": "xTom Hong Kong Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://xtom.com/"}, "pfx": 44, "reg": "2017-07-05", "rir": "apnic", "s24": 44, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": "abuse@xtom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056593870018}, {"a": 9313, "h": "ONTHENET-AS", "n": "OntheNet", "t": "Broadband & mobile", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.184, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.740, "ts": null, "map": 0.132, "obs": 0, "own": 0.364, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.208, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.onthenet.com.au"}, "pfx": 62, "reg": "1998-05-22", "rir": "apnic", "s24": 163, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43264, "abuse": "abuse@onthenet.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001312669107}, {"a": 9318, "h": "SKB-AS", "n": "SK Broadband", "t": "Broadband & mobile", "w": 104, "cc": "KR", "cf": {"rb": "", "wb": "", "rep": 1.11, "waf": 0.96}, "cs": {"c": {"http_flood": 12, "web_exploit": 19, "bad_crawling": 4, "proxy_or_vpn": 8, "first_seen_30d": 12, "ssh_bruteforce": 66, "web_bruteforce": 32, "mail_bruteforce": 27, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 5, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 5, "cve:CVE-2024-28000": 3}, "n": 73}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.24, "lo": 0.03, "ips": 2, "mean": 0.12, "above": false}, "shodan": {"n": 27, "p": 0.0000, "hi": 0.30, "lo": 0.16, "ips": 27, "mean": 0.22, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 0.28, "lo": 0.06, "ips": 4, "mean": 0.15, "above": false}, "urlhaus": {"n": 5, "p": 0.0001, "hi": 1.64, "lo": 0.41, "ips": 5, "mean": 0.93, "above": false}, "crowdsec": {"n": 70, "p": 0.0000, "hi": 0.55, "lo": 0.37, "ips": 73, "mean": 0.45, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.47, "lo": 0.04, "ips": 1, "mean": 0.20, "above": false}, "vulncheck": {"n": 10, "p": 0.0000, "hi": 0.53, "lo": 0.19, "ips": 10, "mean": 0.35, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 0.21, "lo": 0.03, "ips": 2, "mean": 0.10, "above": false}, "blocklist_de": {"n": 46, "p": 0.0000, "hi": 0.92, "lo": 0.57, "ips": 48, "mean": 0.74, "above": false}}, "h2": [["2026-10-05", 0.259, 0.113, 0, false], ["2026-10-12", 0.280, 0.125, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 1, "phishing_db": 2}, "lo": 0.125, "se": 0.984, "ts": 0.625, "map": 0.329, "obs": 8, "own": 1.025, "comp": {"urlhaus": 1.8571, "threatfox": -0.4512, "phishing_db": -0.891}, "mass": 34.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 70, "vulncheck": 10, "blocklist_de": 46}, "lo": 0.280, "se": 0.373, "ts": 0.530, "map": 0.428, "obs": 132, "own": 0.661, "comp": {"cins": -2.7664, "dshield": -2.5937, "crowdsec": 1.153, "vulncheck": -0.5585, "blocklist_de": 5.3102}, "mass": 139.4, "listed": false}}, "abq": false, "bot": 0.169, "det": {"shodan": {"c2": 1, "compromised": 26}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 5, "attack_tooling": 5}, "blocklist_de": {"ftp": 5, "ssh": 22, "bots": 1, "imap": 14, "mail": 20}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.skbroadband.com/"}, "pfx": 807, "reg": "1998-06-03", "rir": "apnic", "s24": 58579, "sib": 23, "tor": 0, "w24": 98, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25757952, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.278222}, {"a": 9326, "h": "CENTRIN-AS-AP", "n": "CENTRIN", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2017-8046": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-0027": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0870, "hi": 3.50, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "crowdsec": {"n": 2, "p": 0.1944, "hi": 4.37, "lo": 0.57, "ips": 3, "mean": 2.08, "above": false}, "vulncheck": {"n": 1, "p": 0.1634, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.822, 0.010, 0, false], ["2026-10-12", 0.707, 0.011, 0, false]], "sh": false, "uc": 124.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 1.178, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.707, "se": 0.755, "ts": 0.667, "map": 2.102, "obs": 3, "own": 3.349, "comp": {"cins": -0.4361, "dshield": -0.8892, "crowdsec": 4.31, "vulncheck": 1.3805, "blocklist_de": -2.2289}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"malware": 1}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-9326-APNIC", "org": "PT Centrin Utama", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.centrin.net.id"}, "pfx": 35, "reg": "1998-06-09", "rir": "apnic", "s24": 166, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50688, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0010943853316}, {"a": 9329, "h": "SLTINT-AS-AP", "n": "Sri Lanka Telecom", "t": "Broadband & mobile", "w": 30, "cc": "LK", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 2, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 4, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 3}, "n": 9}, "ev": {"cins": {"n": 9, "p": 0.9871, "hi": 10.96, "lo": 3.79, "ips": 10, "mean": 6.98, "above": true}, "shodan": {"n": 5, "p": 0.0855, "hi": 3.30, "lo": 0.82, "ips": 5, "mean": 1.88, "above": false}, "dshield": {"n": 5, "p": 0.6758, "hi": 6.77, "lo": 1.68, "ips": 5, "mean": 3.86, "above": false}, "crowdsec": {"n": 9, "p": 0.3229, "hi": 4.22, "lo": 1.46, "ips": 9, "mean": 2.69, "above": false}, "phishing_db": {"n": 1, "p": 0.0610, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "blocklist_de": {"n": 9, "p": 0.8945, "hi": 7.49, "lo": 2.59, "ips": 9, "mean": 4.77, "above": true}}, "h2": [["2026-10-05", 1.673, 0.091, 0, false], ["2026-10-12", 4.348, 0.096, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.096, "se": 1.353, "ts": 1.000, "map": 0.590, "obs": 1, "own": 1.840, "comp": {"urlhaus": -0.3715, "threatfox": -0.3119, "phishing_db": 1.7817}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 9, "dshield": 5, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 9}, "lo": 4.348, "se": 0.397, "ts": 0.281, "map": 6.995, "obs": 32, "own": 10.730, "comp": {"cins": 11.5518, "dshield": 0.2444, "crowdsec": -6.1674, "vulncheck": -0.9867, "blocklist_de": -1.3032}, "mass": 39.5, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 3, "doublepulsar": 2}, "blocklist_de": {"ssh": 4, "bots": 4, "imap": 1, "mail": 1}}, "oid": "ORG-SLTL1-AP-APNIC", "org": "Sri Lanka Telecom Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.slt.lk"}, "pfx": 170, "reg": "2003-05-02", "rir": "apnic", "s24": 1024, "sib": 4, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 371456, "abuse": "abuse@slt.lk", "score": 0.0719, "groups": ["sensors"], "sensors": ["blocklist_de", "cins"], "traffic": 0.01912138915451}, {"a": 9335, "h": "NTPCL-AS-AP", "n": "NT(CAT) Data Center", "t": "Hosting & VPS", "w": 7, "cc": "TH", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2010-2861": 1, "cve:CVE-2016-1555": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2021-26086": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "shodan": {"n": 8, "p": 0.9758, "hi": 10.59, "lo": 3.44, "ips": 8, "mean": 6.60, "above": true}, "crowdsec": {"n": 3, "p": 0.3673, "hi": 5.34, "lo": 0.94, "ips": 3, "mean": 2.76, "above": false}, "phishing_db": {"n": 2, "p": 0.3697, "hi": 5.81, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}, "blocklist_de": {"n": 2, "p": 0.3123, "hi": 5.33, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}}, "h2": [["2026-10-05", 1.389, 0.901, 0, false], ["2026-10-12", 2.819, 0.932, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.932, "se": 1.140, "ts": 1.000, "map": 4.093, "obs": 2, "own": 1.641, "comp": {"urlhaus": -0.4206, "threatfox": -0.3328, "phishing_db": 3.7888}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.819, "se": 0.570, "ts": 0.500, "map": 6.098, "obs": 6, "own": 1.203, "comp": {"cins": 2.8746, "dshield": -1.775, "crowdsec": 0.8748, "vulncheck": -0.8406, "blocklist_de": 2.0679}, "mass": 5.8, "listed": false}}, "abq": true, "bot": 0.247, "det": {"shodan": {"c2": 1, "compromised": 7}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://ntdatacenter.net/"}, "pfx": 134, "reg": "2016-05-11", "rir": "apnic", "s24": 170, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 62464, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00246245936616}, {"a": 9336, "h": "XYZTELECOM-AS-AP", "n": "Spirit Telecom Limited Backbone", "t": "Broadband & mobile", "w": 1, "cc": "AU", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1056, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}}, "h2": [["2026-10-12", 0.164, 0.012, 0, false]], "sh": false, "uc": 337.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 1.343, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.164, "se": 1.201, "ts": 1.000, "map": 1.158, "obs": 1, "own": 1.991, "comp": {"cins": -0.1593, "dshield": -0.3632, "crowdsec": 3.2518, "vulncheck": -0.3605, "blocklist_de": -0.8285}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.549, "det": null, "oid": "ORG-XT6-AP-APNIC", "org": "XYZ Telecom Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Australia", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.spirit.com.au"}, "pfx": 16, "reg": "2004-10-21", "rir": "apnic", "s24": 103, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "abuse@xyztelecom.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004294434254}, {"a": 9340, "h": "INDONET-AS-AP", "n": "Indonet", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.1802, "hi": 4.08, "lo": 0.72, "ips": 3, "mean": 2.11, "above": false}, "crowdsec": {"n": 1, "p": 0.0128, "hi": 2.24, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}}, "h2": [["2026-10-05", 0.064, 0.009, 0, false], ["2026-10-12", 0.066, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 0.881, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.066, "se": 1.100, "ts": 1.000, "map": 0.382, "obs": 1, "own": 0.639, "comp": {"cins": -0.2124, "dshield": -0.4735, "crowdsec": 2.6523, "vulncheck": -0.433, "blocklist_de": -1.101}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.317, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-9340-APNIC", "org": "INDO Internet, PT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://indonet.id"}, "pfx": 356, "reg": "1998-07-30", "rir": "apnic", "s24": 421, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 254720, "abuse": "abuse@indo.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000635037161}, {"a": 9341, "h": "ICONPLN-ID-AP-ISP", "n": "Indonesia Comnets Plus AS9341", "t": "Transit & backbone", "w": 14, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 5, "ssh_bruteforce": 3, "web_bruteforce": 8, "home_connection": 1, "mail_bruteforce": 4, "router_or_botnet": 8, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 1}, "n": 11}, "ev": {"dshield": {"n": 1, "p": 0.1030, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "crowdsec": {"n": 10, "p": 0.8865, "hi": 7.07, "lo": 2.57, "ips": 11, "mean": 4.58, "above": true}, "vulncheck": {"n": 1, "p": 0.1049, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "phishing_db": {"n": 1, "p": 0.1097, "hi": 3.77, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.0521, "hi": 3.03, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}}, "h2": [["2026-10-05", 3.445, 0.130, 0, false], ["2026-10-12", 1.974, 0.136, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.136, "se": 1.375, "ts": 1.000, "map": 0.911, "obs": 1, "own": 3.920, "comp": {"urlhaus": -0.3024, "threatfox": -0.2778, "phishing_db": 2.1133}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 10, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.974, "se": 0.462, "ts": 0.769, "map": 3.516, "obs": 13, "own": 11.014, "comp": {"cins": -1.6306, "dshield": -0.3802, "crowdsec": 9.7695, "vulncheck": -0.3613, "blocklist_de": -4.7464}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.135, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-46065-APNIC", "org": "PT Indonesia Comnets Plus", "pdb": {"t": "NSP", "sc": null, "tr": "1-5Tbps", "pol": "Open", "web": "https://plniconplus.co.id/"}, "pfx": 585, "reg": "2002-09-11", "rir": "apnic", "s24": 527, "sib": 2, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 228608, "abuse": "abuse@iconpln.net.id", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0262318900998}, {"a": 9355, "h": "NICT", "n": "National Institute of Information and Communications Technology", "t": "Enterprise, edu & gov", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0136, "hi": 2.27, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.152, "obs": 0, "own": 1.391, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.590, "ts": null, "map": 0.078, "obs": 0, "own": 0.643, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.243, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-9355-JPNIC", "org": "National Institute of Information and Communications Technology", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": null, "pol": "Restrictive", "web": "http://www.nict.go.jp/en/"}, "pfx": 2, "reg": "1998-08-17", "rir": "apnic", "s24": 512, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 131072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9370, "h": "SAKURA-B", "n": "SAKURA internet AS9370", "t": "Hosting & VPS", "w": 6, "cc": "JP", "cf": null, "cs": {"c": {"data_centre": 4, "web_exploit": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 4}, "ev": {"shodan": {"n": 7, "p": 0.1118, "hi": 3.42, "lo": 1.04, "ips": 7, "mean": 2.08, "above": false}, "dshield": {"n": 1, "p": 0.0355, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "crowdsec": {"n": 4, "p": 0.0024, "hi": 2.02, "lo": 0.43, "ips": 4, "mean": 1.10, "above": false}, "phishing_db": {"n": 1, "p": 0.0421, "hi": 2.87, "lo": 0.22, "ips": 1, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.198, 0.078, 0, false], ["2026-10-12", 0.271, 0.082, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.082, "se": 1.346, "ts": 1.000, "map": 0.496, "obs": 1, "own": 0.242, "comp": {"urlhaus": -0.4018, "threatfox": -0.3251, "phishing_db": 1.6516}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.271, "se": 0.593, "ts": 0.800, "map": 0.607, "obs": 5, "own": 0.121, "comp": {"cins": -0.8955, "dshield": 1.4141, "crowdsec": 5.6271, "vulncheck": -0.8015, "blocklist_de": -4.4498}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.794, "det": {"shodan": {"compromised": 7}}, "oid": "@aut-55897-JPNIC", "org": "SAKURA Internet Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.sakura.ad.jp/"}, "pfx": 39, "reg": "1998-08-17", "rir": "apnic", "s24": 1332, "sib": 6, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 341248, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0044240367366}, {"a": 9371, "h": "SAKURA-C", "n": "SAKURA internet AS9371", "t": "Hosting & VPS", "w": 7, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 6, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.0626, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "shodan": {"n": 8, "p": 0.2854, "hi": 4.15, "lo": 1.35, "ips": 8, "mean": 2.59, "above": false}, "crowdsec": {"n": 6, "p": 0.0397, "hi": 2.90, "lo": 0.80, "ips": 6, "mean": 1.71, "above": false}, "blocklist_de": {"n": 1, "p": 0.0092, "hi": 2.11, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}}, "h2": [["2026-10-05", 0.342, 0.008, 0, false], ["2026-10-12", 0.610, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.826, "ts": null, "map": 0.125, "obs": 0, "own": 0.095, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.610, "se": 0.519, "ts": 0.750, "map": 1.202, "obs": 8, "own": 0.238, "comp": {"cins": 2.3049, "dshield": -2.0399, "crowdsec": 5.3545, "vulncheck": -0.8798, "blocklist_de": -3.1622}, "mass": 7.8, "listed": false}}, "abq": false, "bot": 0.840, "det": {"shodan": {"c2": 1, "compromised": 7}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-55897-JPNIC", "org": "SAKURA Internet Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.sakura.ad.jp/"}, "pfx": 22, "reg": "1998-08-17", "rir": "apnic", "s24": 1161, "sib": 6, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 306688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014866161115}, {"a": 9381, "h": "HKBNES-AS-AP", "n": "HKBNES", "t": "Broadband & mobile", "w": 9, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.1092, "hi": 3.64, "lo": 0.47, "ips": 2, "mean": 1.73, "above": false}, "shodan": {"n": 9, "p": 0.1047, "hi": 3.34, "lo": 1.15, "ips": 9, "mean": 2.13, "above": false}, "urlhaus": {"n": 1, "p": 0.1380, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 1.38, "lo": 0.24, "ips": 3, "mean": 0.71, "above": false}, "threatfox": {"n": 1, "p": 0.1076, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "vulncheck": {"n": 2, "p": 0.0754, "hi": 3.30, "lo": 0.43, "ips": 2, "mean": 1.57, "above": false}, "blocklist_de": {"n": 1, "p": 0.0018, "hi": 1.66, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}}, "h2": [["2026-10-05", 0.475, 0.255, 0, false], ["2026-10-12", 0.373, 0.270, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 0.270, "se": 1.163, "ts": 0.500, "map": 1.175, "obs": 2, "own": 3.307, "comp": {"urlhaus": 2.2127, "threatfox": 0.5074, "phishing_db": -0.9329}, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.373, "se": 0.538, "ts": 0.375, "map": 0.757, "obs": 8, "own": 1.180, "comp": {"cins": 6.1543, "dshield": -1.9844, "crowdsec": -0.8439, "vulncheck": 0.6152, "blocklist_de": -2.8264}, "mass": 7.4, "listed": false}}, "abq": false, "bot": 0.754, "det": {"shodan": {"malware": 1, "compromised": 4, "doublepulsar": 4}, "threatfox": {"family:BianLian": 1}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-WHL1-AP-APNIC", "org": "HKBN Enterprise Solutions HK Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "https://www.hkbnes.net"}, "pfx": 555, "reg": "1998-08-17", "rir": "apnic", "s24": 1732, "sib": 4, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 747264, "abuse": "abuse-wtt@hkbn.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0043289434264}, {"a": 9416, "h": "KBT", "n": "KBT", "t": "Broadband & mobile", "w": 17, "cc": "TW", "cf": null, "cs": {"c": {"web_exploit": 14, "home_connection": 13, "router_or_botnet": 9, "cve:CVE-2019-8318": 10, "cve:CVE-2018-10562": 13, "cve:CVE-2024-12847": 14}, "n": 14}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.56, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}, "urlhaus": {"n": 3, "p": 0.3730, "hi": 5.38, "lo": 0.95, "ips": 3, "mean": 2.78, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 1.60, "lo": 0.68, "ips": 14, "mean": 1.10, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.03, "lo": 0.13, "ips": 2, "mean": 0.49, "above": false}}, "h2": [["2026-10-05", 0.254, 0.204, 0, false], ["2026-10-12", 0.327, 0.438, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.438, "se": 1.014, "ts": 1.000, "map": 1.431, "obs": 3, "own": 3.781, "comp": {"urlhaus": 3.658, "threatfox": -0.5506, "phishing_db": -1.1226}, "mass": 10.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.327, "se": 0.445, "ts": 0.875, "map": 0.553, "obs": 16, "own": 0.857, "comp": {"cins": -2.0112, "dshield": -2.5606, "crowdsec": 10.5731, "vulncheck": -0.9394, "blocklist_de": -4.2598}, "mass": 14.7, "listed": false}}, "abq": true, "bot": 0.185, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.homeplus.net.tw/"}, "pfx": 59, "reg": "1998-09-28", "rir": "apnic", "s24": 4769, "sib": 0, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2172416, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0224901416975}, {"a": 9441, "h": "NEXT-BD", "n": "Next Online", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3734, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 4.165, 0.012, 0, false]], "sh": false, "uc": 9415.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.165, "se": 0.776, "ts": 0.667, "map": 13.131, "obs": 3, "own": 20.579, "comp": {"cins": -0.4717, "dshield": -0.949, "crowdsec": 3.8991, "vulncheck": -0.6475, "blocklist_de": 2.1379}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.251, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-NOL2-AP-APNIC", "org": "Next Online Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.nextonline.com.bd"}, "pfx": 31, "reg": "2011-07-08", "rir": "apnic", "s24": 29, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "admin@nextonline.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046830018387}, {"a": 9443, "h": "VOCUS-RETAIL-AU", "n": "Vocus Retail Australia", "t": "Broadband & mobile", "w": 8, "cc": "AU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2026-21859": 1}, "n": 3}, "ev": {"dshield": {"n": 3, "p": 0.0087, "hi": 2.27, "lo": 0.40, "ips": 3, "mean": 1.17, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.60, "lo": 0.11, "ips": 3, "mean": 0.31, "above": false}, "phishing_db": {"n": 2, "p": 0.0040, "hi": 1.98, "lo": 0.26, "ips": 2, "mean": 0.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.82, "lo": 0.06, "ips": 1, "mean": 0.35, "above": false}}, "h2": [["2026-10-05", 0.183, 0.086, 0, false], ["2026-10-12", 0.138, 0.090, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.090, "se": 1.160, "ts": 1.000, "map": 0.349, "obs": 2, "own": 1.107, "comp": {"urlhaus": -0.8107, "threatfox": -0.4401, "phishing_db": 1.824}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.138, "se": 0.535, "ts": 0.429, "map": 0.279, "obs": 7, "own": 0.434, "comp": {"cins": -1.2454, "dshield": 5.2714, "crowdsec": -0.4794, "vulncheck": -0.8659, "blocklist_de": -2.5637}, "mass": 7.0, "listed": false}}, "abq": false, "bot": 0.099, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-VPL1-AP-APNIC", "org": "VOCUS PTY LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.iprimus.com.au/"}, "pfx": 47, "reg": "1998-11-12", "rir": "apnic", "s24": 4468, "sib": 52, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1153024, "abuse": "abuse@vocus.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0347082191355}, {"a": 9465, "h": "AGOTOZPTELTD-AS-AP", "n": "AGOTOZ PTE. LTD.", "t": "Other", "w": 63, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 45, "web_exploit": 56, "bad_crawling": 12, "ssh_bruteforce": 52, "web_bruteforce": 8, "mail_bruteforce": 27, "cve:CVE-2024-6387": 1}, "n": 56}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 5, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 5, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 56, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 18.137, 0.012, 1, false], ["2026-10-12", 147.518, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 147.518, "se": 0.730, "ts": 0.250, "map": 432.159, "obs": 4, "own": 245.069, "comp": {"cins": 4.0878, "dshield": 2.6767, "crowdsec": -0.4069, "vulncheck": -0.6768, "blocklist_de": 1.7816}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.999, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "ORG-AA280-AP-APNIC", "org": "AGOTOZ PTE. LTD.", "pdb": null, "pfx": 1, "reg": "2023-08-15", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse_team@agotoz.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020699726412}, {"a": 9484, "h": "MOBINET-AS-MN", "n": "Mobinet", "t": "Transit & backbone", "w": 4, "cc": "MN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3161, "hi": 5.36, "lo": 0.70, "ips": 2, "mean": 2.55, "above": false}, "urlhaus": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2933, "hi": 5.17, "lo": 0.67, "ips": 2, "mean": 2.46, "above": false}, "blocklist_de": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.722, 0.446, 0, false], ["2026-10-12", 1.698, 0.479, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.479, "se": 1.562, "ts": 1.000, "map": 4.992, "obs": 1, "own": 21.495, "comp": {"urlhaus": 3.9652, "threatfox": -0.2543, "phishing_db": -0.477}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.698, "se": 0.755, "ts": 0.667, "map": 5.148, "obs": 3, "own": 16.397, "comp": {"cins": -0.5171, "dshield": -1.0227, "crowdsec": 3.3935, "vulncheck": -0.6714, "blocklist_de": 1.85}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.193, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-ML21-AP-APNIC", "org": "Mobinet LLC", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.mobinet.mn"}, "pfx": 9, "reg": "2002-09-30", "rir": "apnic", "s24": 82, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": "abuse@mobinet.mn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00253610506936}, {"a": 9488, "h": "SNU-AS-KR", "n": "Seoul National University", "t": "Hosting & VPS", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0142, "hi": 2.28, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}}, "h2": [["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.890, "ts": null, "map": 0.152, "obs": 0, "own": 0.128, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.592, "ts": null, "map": 0.079, "obs": 0, "own": 0.023, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.221, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-9488-APNIC", "org": "Seoul National University", "pdb": null, "pfx": 20, "reg": "1999-02-22", "rir": "apnic", "s24": 504, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 262656, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014698939976}, {"a": 9498, "h": "BBIL-AP", "n": "Bharti Airtel Limited", "t": "Broadband & mobile", "w": 273, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 18, "web_exploit": 103, "bad_crawling": 7, "proxy_or_vpn": 72, "first_seen_30d": 2, "ssh_bruteforce": 183, "web_bruteforce": 197, "home_connection": 136, "mail_bruteforce": 204, "router_or_botnet": 1, "cve:CVE-2026-8181": 4, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 7, "cve:CVE-2025-22457": 15, "cve:CVE-2026-63030": 7}, "n": 256}, "ev": {"cins": {"n": 5, "p": 0.0081, "hi": 2.35, "lo": 0.58, "ips": 5, "mean": 1.34, "above": false}, "shodan": {"n": 20, "p": 0.0000, "hi": 1.57, "lo": 0.76, "ips": 20, "mean": 1.13, "above": false}, "dshield": {"n": 3, "p": 0.0001, "hi": 1.43, "lo": 0.25, "ips": 3, "mean": 0.74, "above": false}, "urlhaus": {"n": 2, "p": 0.1028, "hi": 3.58, "lo": 0.46, "ips": 2, "mean": 1.70, "above": false}, "crowdsec": {"n": 162, "p": 1.0000, "hi": 8.07, "lo": 6.24, "ips": 256, "mean": 7.13, "above": true}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 1.18, "lo": 0.15, "ips": 2, "mean": 0.56, "above": false}, "blocklist_de": {"n": 72, "p": 1.0000, "hi": 8.93, "lo": 6.07, "ips": 122, "mean": 7.44, "above": true}}, "h2": [["2026-10-05", 3.298, 0.137, 0, false], ["2026-10-12", 3.507, 0.154, 0, false]], "sh": false, "uc": 704.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.154, "se": 1.127, "ts": 1.000, "map": 0.608, "obs": 2, "own": 1.731, "comp": {"urlhaus": 2.7524, "threatfox": -0.536, "phishing_db": -1.0882}, "mass": 8.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 3, "crowdsec": 162, "vulncheck": 2, "blocklist_de": 72}, "lo": 3.507, "se": 0.356, "ts": 0.664, "map": 5.270, "obs": 244, "own": 8.088, "comp": {"cins": -2.347, "dshield": -3.1277, "crowdsec": 6.1289, "vulncheck": -0.9594, "blocklist_de": 3.3609}, "mass": 239.4, "listed": false}}, "abq": true, "bot": 0.313, "det": {"shodan": {"malware": 1, "compromised": 18, "doublepulsar": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 10, "bots": 1, "imap": 69, "mail": 110, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-BAL1-AP-APNIC", "org": "Bharti Airtel Limited", "pdb": {"t": "NSP", "sc": null, "tr": null, "pol": "Open", "web": "http://www.Airtel.in"}, "pfx": 5108, "reg": "1999-03-09", "rir": "apnic", "s24": 8224, "sib": 5, "tor": 0, "w24": 177, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 4218368, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.03009290041291}, {"a": 9500, "h": "ONENZ-TRANSIT-AS", "n": "One New Zealand Ltd.", "t": "Broadband & mobile", "w": 5, "cc": "NZ", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.0000, "hi": 0.92, "lo": 0.20, "ips": 4, "mean": 0.50, "above": false}, "vulncheck": {"n": 1, "p": 0.0024, "hi": 1.72, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 1.03, "lo": 0.08, "ips": 1, "mean": 0.44, "above": false}}, "h2": [["2026-10-05", 0.118, 0.007, 0, false], ["2026-10-12", 0.135, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.747, "ts": null, "map": 0.089, "obs": 0, "own": 0.404, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.135, "se": 0.571, "ts": 0.667, "map": 0.289, "obs": 6, "own": 0.452, "comp": {"cins": -1.0313, "dshield": -1.7134, "crowdsec": 4.0747, "vulncheck": 0.1283, "blocklist_de": -1.3061}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.101, "det": {"vulncheck": {"attack_tooling": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-VNZL1-AP-APNIC", "org": "One New Zealand Group Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://one.nz"}, "pfx": 19, "reg": "1999-03-15", "rir": "apnic", "s24": 3349, "sib": 21, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 857344, "abuse": "abuse@one.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02835179026875}, {"a": 9506, "h": "SINGTEL-FIBRE", "n": "Singtel Fibre Broadband", "t": "Broadband & mobile", "w": 8, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 4, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 5}, "ev": {"cins": {"n": 3, "p": 0.0486, "hi": 2.98, "lo": 0.53, "ips": 3, "mean": 1.54, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.69, "lo": 0.09, "ips": 2, "mean": 0.33, "above": false}, "urlhaus": {"n": 1, "p": 0.0880, "hi": 3.51, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.95, "lo": 0.24, "ips": 5, "mean": 0.54, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.94, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}}, "h2": [["2026-10-05", 0.390, 0.073, 0, false], ["2026-10-12", 0.260, 0.081, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.081, "se": 1.340, "ts": 1.000, "map": 0.503, "obs": 1, "own": 1.508, "comp": {"urlhaus": 2.3199, "threatfox": -0.462, "phishing_db": -0.9179}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.260, "se": 0.505, "ts": 0.556, "map": 0.493, "obs": 9, "own": 0.767, "comp": {"cins": 8.3075, "dshield": -2.2897, "crowdsec": 0.3721, "vulncheck": -0.9108, "blocklist_de": -4.7917}, "mass": 10.4, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Mirai": 1}, "blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 73, "reg": "1999-03-28", "rir": "apnic", "s24": 3785, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1446144, "abuse": "hostmaster@singnet.com.sg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03916082560195}, {"a": 9526, "h": "KOSCOM-AS-KR", "n": "KOSCOM", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1280, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 0.560, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.818, "ts": null, "map": 0.161, "obs": 0, "own": 0.188, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.703, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-9526-APNIC", "org": "KOSCOM", "pdb": null, "pfx": 44, "reg": "1999-05-13", "rir": "apnic", "s24": 90, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000506292164}, {"a": 9534, "h": "MAXIS-AS1-AP", "n": "Maxis Communications Bhd", "t": "Broadband & mobile", "w": 23, "cc": "MY", "cf": {"rb": "hi", "wb": "", "rep": 0.80, "waf": 1.02}, "cs": {"c": {"http_flood": 6, "web_exploit": 9, "bad_crawling": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 9, "mail_bruteforce": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 2}, "n": 11}, "ev": {"cins": {"n": 3, "p": 0.2044, "hi": 4.25, "lo": 0.75, "ips": 4, "mean": 2.19, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.92, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "dshield": {"n": 2, "p": 0.0551, "hi": 3.06, "lo": 0.40, "ips": 3, "mean": 1.46, "above": false}, "crowdsec": {"n": 8, "p": 0.0050, "hi": 2.33, "lo": 0.76, "ips": 11, "mean": 1.45, "above": false}, "blocklist_de": {"n": 5, "p": 0.0996, "hi": 3.40, "lo": 0.84, "ips": 5, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.660, 0.007, 0, false], ["2026-10-12", 1.106, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.786, "ts": null, "map": 0.107, "obs": 0, "own": 0.502, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 2, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.106, "se": 0.435, "ts": 0.444, "map": 1.858, "obs": 18, "own": 2.865, "comp": {"cins": 5.0232, "dshield": -0.4143, "crowdsec": -1.5328, "vulncheck": -0.9593, "blocklist_de": -0.1037}, "mass": 20.1, "listed": false}}, "abq": false, "bot": 0.115, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MBSB1-AP-APNIC", "org": "Maxis Broadband Sdn Bhd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.maxis.com.my"}, "pfx": 73, "reg": "1999-05-17", "rir": "apnic", "s24": 1954, "sib": 2, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1150976, "abuse": "abuse@maxis.com.my", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.091209}, {"a": 9541, "h": "CYBERNET-AP", "n": "Cyber Internet Services", "t": "Broadband & mobile", "w": 822, "cc": "PK", "cf": {"rb": "", "wb": "", "rep": 2.35, "waf": 1.01}, "cs": {"c": {"http_flood": 80, "web_exploit": 755, "bad_crawling": 16, "proxy_or_vpn": 28, "first_seen_30d": 1, "ssh_bruteforce": 49, "web_bruteforce": 120, "mail_bruteforce": 6, "router_or_botnet": 474, "cve:CVE-2019-8318": 366, "cve:CVE-2025-4396": 4, "cve:CVE-2018-10562": 474, "cve:CVE-2024-12847": 733, "cve:CVE-2024-28000": 7}, "n": 764}, "ev": {"cins": {"n": 2, "p": 0.2549, "hi": 4.86, "lo": 0.63, "ips": 2, "mean": 2.31, "above": false}, "shodan": {"n": 1, "p": 0.0047, "hi": 1.90, "lo": 0.14, "ips": 1, "mean": 0.80, "above": false}, "dshield": {"n": 25, "p": 1.0000, "hi": 25.33, "lo": 13.22, "ips": 27, "mean": 18.86, "above": true}, "crowdsec": {"n": 119, "p": 1.0000, "hi": 48.40, "lo": 35.82, "ips": 764, "mean": 41.91, "above": true}, "vulncheck": {"n": 2, "p": 0.2234, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}, "blocklist_de": {"n": 36, "p": 1.0000, "hi": 27.15, "lo": 15.76, "ips": 39, "mean": 21.13, "above": true}}, "h2": [["2026-10-05", 20.204, 0.178, 2, false], ["2026-10-12", 26.623, 0.010, 2, false]], "sh": false, "uc": 169.5, "v2": {"band": 2, "host": {"n": null, "lo": 0.010, "se": 1.865, "ts": null, "map": 0.142, "obs": 0, "own": 0.739, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 25, "crowdsec": 119, "vulncheck": 2, "blocklist_de": 36}, "lo": 26.623, "se": 0.351, "ts": 0.647, "map": 39.777, "obs": 184, "own": 60.718, "comp": {"cins": -2.9211, "dshield": 1.3299, "crowdsec": 8.7943, "vulncheck": -0.9279, "blocklist_de": -1.1983}, "mass": 153.2, "listed": true}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1, "other_infrastructure": 1}, "blocklist_de": {"bots": 21, "imap": 1, "mail": 2, "apache": 16, "bruteforcelogin": 16}}, "oid": "ORG-CISP3-AP-APNIC", "org": "Cyber Internet Services (Private) Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.cyber.net.pk"}, "pfx": 693, "reg": "1999-06-01", "rir": "apnic", "s24": 701, "sib": 4, "tor": 0, "w24": 140, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 226816, "abuse": "noc-abuse@cyber.net.pk", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.099563}, {"a": 9551, "h": "KMUTT-AP", "n": "King Mongkut's University of Technology", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KMUO2-AP-APNIC", "org": "King Mongkut's University of Technology Thonburi", "pdb": null, "pfx": 13, "reg": "1999-06-22", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "noc@kmutt.ac.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014403059958}, {"a": 9557, "h": "PKTELECOM-AS-PK", "n": "Paknet Limited Merged into PTCL", "t": "Broadband & mobile", "w": 1, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1622, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 0.313, 0.012, 0, false]], "sh": false, "uc": 371.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.313, "se": 1.297, "ts": 1.000, "map": 2.646, "obs": 1, "own": 4.724, "comp": {"cins": -0.1212, "dshield": -0.281, "crowdsec": 3.6992, "vulncheck": -0.2979, "blocklist_de": -0.6321}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.191, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 28, "reg": "1999-07-01", "rir": "apnic", "s24": 34, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": "abuse.irt@ptcl.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044139461861}, {"a": 9572, "h": "HUFSNET-AS", "n": "Hankuk University of Foreign Studies Computer Center", "t": "Other", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1464, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 2, "p": 0.3204, "hi": 5.39, "lo": 0.70, "ips": 2, "mean": 2.57, "above": false}}, "h2": [["2026-10-05", 1.990, 0.011, 0, false], ["2026-10-12", 0.934, 0.012, 0, false]], "sh": false, "uc": 855.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 0.611, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.934, "se": 0.916, "ts": 1.000, "map": 3.828, "obs": 2, "own": 2.240, "comp": {"cins": -0.3108, "dshield": -0.6656, "crowdsec": 5.8489, "vulncheck": -0.5351, "blocklist_de": -1.6013}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-9572-APNIC", "org": "Hankuk University of Foreign Studies Computer Center", "pdb": null, "pfx": 7, "reg": "1999-07-21", "rir": "apnic", "s24": 63, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001173364276}, {"a": 9583, "h": "SIFY-AS-IN", "n": "Sify Technologies Limited", "t": "Transit & backbone", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.0001, "hi": 1.64, "lo": 0.45, "ips": 6, "mean": 0.97, "above": false}}, "h2": [["2026-10-05", 0.061, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.757, "ts": null, "map": 0.094, "obs": 0, "own": 0.608, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.382, "ts": null, "map": 0.027, "obs": 0, "own": 0.107, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.335, "det": {"shodan": {"c2": 1, "compromised": 2, "doublepulsar": 3}}, "oid": "@aut-9583-APNIC", "org": "Sify Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.sifycorp.com/"}, "pfx": 2065, "reg": "1999-07-23", "rir": "apnic", "s24": 2919, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 996096, "abuse": "abuse@sifycorp.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00303120880437}, {"a": 9595, "h": "XEPHION", "n": "NTT-ME (XePhion,WAKWAK)", "t": "Transit & backbone", "w": 5, "cc": "JP", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "home_connection": 3, "router_or_botnet": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 1.13, "lo": 0.08, "ips": 1, "mean": 0.48, "above": false}, "urlhaus": {"n": 2, "p": 0.1584, "hi": 4.07, "lo": 0.53, "ips": 2, "mean": 1.94, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.46, "lo": 0.08, "ips": 3, "mean": 0.24, "above": false}}, "h2": [["2026-10-05", 0.037, 0.174, 0, false], ["2026-10-12", 0.052, 0.196, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.196, "se": 1.124, "ts": 1.000, "map": 0.783, "obs": 2, "own": 3.094, "comp": {"urlhaus": 2.9914, "threatfox": -0.5318, "phishing_db": -1.0783}, "mass": 7.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.052, "se": 0.628, "ts": 0.750, "map": 0.124, "obs": 4, "own": 0.395, "comp": {"cins": -0.8267, "dshield": 1.6268, "crowdsec": 3.4147, "vulncheck": -0.7842, "blocklist_de": -4.1254}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.090, "det": null, "oid": "@aut-9595-JPNIC", "org": "NTT-ME Corporation", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.ntt-me.co.jp/"}, "pfx": 45, "reg": "1999-08-05", "rir": "apnic", "s24": 5912, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1628160, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00643743117615}, {"a": 9605, "h": "docomo", "n": "NTT DOCOMO", "t": "Broadband & mobile", "w": 2, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.28, "waf": 0.25}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 0.75, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.41, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}}, "h2": [["2026-10-05", 0.007, 0.005, 0, false], ["2026-10-12", 0.015, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.679, "ts": null, "map": 0.057, "obs": 0, "own": 0.257, "comp": null, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.015, "se": 0.778, "ts": 0.500, "map": 0.048, "obs": 2, "own": 0.076, "comp": {"cins": -0.5736, "dshield": 2.5013, "crowdsec": -4.3671, "vulncheck": -0.6978, "blocklist_de": 1.4932}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.030, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-9605-JPNIC", "org": "NTT DOCOMO, INC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.nttdocomo.co.jp/"}, "pfx": 853, "reg": "1999-08-05", "rir": "apnic", "s24": 9908, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2595840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.258696}, {"a": 9607, "h": "BBTower", "n": "BroadBand Tower", "t": "Broadband & mobile", "w": 1, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1078, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.156, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.181, "obs": 0, "own": 1.278, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.156, "se": 1.196, "ts": 1.000, "map": 1.083, "obs": 1, "own": 1.863, "comp": {"cins": -0.1785, "dshield": -0.4037, "crowdsec": -1.5965, "vulncheck": -0.3885, "blocklist_de": 4.0404}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.679, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-7530-JPNIC", "org": "BroadBand Tower, Inc.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.bbtower.co.jp/en/corporate/"}, "pfx": 20, "reg": "1999-08-05", "rir": "apnic", "s24": 124, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31744, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 9644, "h": "SKTELECOM-NET-AS", "n": "SK Telecom", "t": "Broadband & mobile", "w": 2, "cc": "KR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.79, "waf": 0.69}, "cs": null, "ev": {"shodan": {"n": 19, "p": 0.0000, "hi": 0.46, "lo": 0.22, "ips": 19, "mean": 0.33, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.30, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.32, "lo": 0.02, "ips": 1, "mean": 0.14, "above": false}}, "h2": [["2026-10-05", 0.001, 0.012, 0, false], ["2026-10-12", 0.003, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.013, "se": 1.343, "ts": 1.000, "map": 0.066, "obs": 1, "own": 0.265, "comp": {"urlhaus": -0.9157, "threatfox": -0.4584, "phishing_db": 0.2839}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.003, "se": 0.900, "ts": 1.000, "map": 0.011, "obs": 1, "own": 0.018, "comp": {"cins": -0.3986, "dshield": 3.2064, "crowdsec": -3.2485, "vulncheck": -0.6026, "blocklist_de": -2.042}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.052, "det": {"shodan": {"compromised": 19}}, "oid": "@aut-18302-APNIC", "org": "SK Telecom", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.sktelecom.com/"}, "pfx": 38, "reg": "1999-08-18", "rir": "apnic", "s24": 27847, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7271680, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.093325}, {"a": 9657, "h": "MELSANET-ID-AP", "n": "MELSA", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 3.374, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.196, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-9657-APNIC", "org": "Melsa-i-net AS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.melsa.id"}, "pfx": 32, "reg": "1999-09-03", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@melsa.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011011294668}, {"a": 9658, "h": "ETPI-IDS-AS-AP", "n": "Eastern Telecommunications Philippines Inc.", "t": "Broadband & mobile", "w": 10, "cc": "PH", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 3}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.0666, "hi": 3.24, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "shodan": {"n": 7, "p": 0.2152, "hi": 3.92, "lo": 1.19, "ips": 7, "mean": 2.39, "above": false}, "dshield": {"n": 1, "p": 0.0484, "hi": 2.98, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}, "crowdsec": {"n": 6, "p": 0.0518, "hi": 3.02, "lo": 0.84, "ips": 6, "mean": 1.78, "above": false}, "blocklist_de": {"n": 4, "p": 0.2193, "hi": 4.20, "lo": 0.90, "ips": 4, "mean": 2.29, "above": false}}, "h2": [["2026-10-05", 0.794, 0.008, 0, false], ["2026-10-12", 1.155, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.127, "obs": 0, "own": 0.626, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.155, "se": 0.469, "ts": 0.500, "map": 2.061, "obs": 12, "own": 3.181, "comp": {"cins": 1.228, "dshield": -0.7811, "crowdsec": 0.2762, "vulncheck": -0.9279, "blocklist_de": 2.3216}, "mass": 12.6, "listed": false}}, "abq": true, "bot": 0.152, "det": {"shodan": {"compromised": 7}, "blocklist_de": {"ssh": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.eastern.com.ph/"}, "pfx": 539, "reg": "1999-09-03", "rir": "apnic", "s24": 1101, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 550144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00887472839444}, {"a": 9674, "h": "FET-TW", "n": "Far EastTone Telecommunication Co., Ltd.", "t": "Broadband & mobile", "w": 29, "cc": "TW", "cf": {"rb": "hi", "wb": "hi", "rep": 1.34, "waf": 1.17}, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 14, "web_bruteforce": 15, "home_connection": 24, "mail_bruteforce": 26}, "n": 27}, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 0.98, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}, "crowdsec": {"n": 12, "p": 0.0000, "hi": 0.97, "lo": 0.38, "ips": 27, "mean": 0.65, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 1.66, "lo": 0.54, "ips": 17, "mean": 1.04, "above": false}}, "h2": [["2026-10-05", 0.327, 0.005, 0, false], ["2026-10-12", 0.344, 0.006, 0, false]], "sh": false, "uc": 133.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.698, "ts": null, "map": 0.066, "obs": 0, "own": 0.295, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.344, "se": 0.427, "ts": 0.571, "map": 0.573, "obs": 21, "own": 0.886, "comp": {"cins": -2.5022, "dshield": -1.7782, "crowdsec": 1.5257, "vulncheck": -0.9656, "blocklist_de": 4.5571}, "mass": 22.8, "listed": false}}, "abq": true, "bot": 0.103, "det": {"blocklist_de": {"imap": 14, "mail": 17}}, "oid": "@aut-18412-APNIC", "org": "Far EastTone Telecommunication Co., Ltd.", "pdb": null, "pfx": 85, "reg": "1999-10-04", "rir": "apnic", "s24": 7160, "sib": 1, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2298624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.054631}, {"a": 9676, "h": "SAVECOM-TW", "n": "SaveCom", "t": "Broadband & mobile", "w": 1, "cc": "TW", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0751, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.037, 0.008, 0, false], ["2026-10-12", 0.040, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.838, "ts": null, "map": 0.131, "obs": 0, "own": 0.653, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.040, "se": 1.058, "ts": 1.000, "map": 0.211, "obs": 1, "own": 0.351, "comp": {"cins": 4.6465, "dshield": -0.5888, "crowdsec": -2.3245, "vulncheck": -0.4973, "blocklist_de": -1.397}, "mass": 1.2, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "@aut-9676-APNIC", "org": "SaveCom Internation Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.savecom.net.tw"}, "pfx": 116, "reg": "1999-10-04", "rir": "apnic", "s24": 984, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 664064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00062537252215}, {"a": 9694, "h": "SEOKYUNG-CATV-AS-KR", "n": "Seokyung Cable Television Company", "t": "Hosting & VPS", "w": 33, "cc": "KR", "cf": null, "cs": {"c": {"web_exploit": 8, "ssh_bruteforce": 4, "web_bruteforce": 27, "mail_bruteforce": 29}, "n": 29}, "ev": {"cins": {"n": 1, "p": 0.0932, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "dshield": {"n": 1, "p": 0.0749, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "crowdsec": {"n": 25, "p": 1.0000, "hi": 11.44, "lo": 5.97, "ips": 29, "mean": 8.52, "above": true}, "blocklist_de": {"n": 16, "p": 0.9999, "hi": 13.30, "lo": 5.93, "ips": 17, "mean": 9.30, "above": true}}, "h2": [["2026-10-05", 6.061, 0.009, 0, false], ["2026-10-12", 6.659, 0.010, 0, false]], "sh": false, "uc": 833.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.857, "ts": null, "map": 0.139, "obs": 0, "own": 0.110, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 25, "vulncheck": 0, "blocklist_de": 16}, "lo": 6.659, "se": 0.384, "ts": 0.581, "map": 10.300, "obs": 43, "own": 2.012, "comp": {"cins": -1.6688, "dshield": -2.5511, "crowdsec": 2.7316, "vulncheck": -0.9896, "blocklist_de": 6.2038}, "mass": 43.8, "listed": false}}, "abq": false, "bot": 0.182, "det": {"blocklist_de": {"ssh": 2, "imap": 14, "mail": 15}}, "oid": "@aut-9694-APNIC", "org": "Seokyung Cable Television Co.. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.scs.co.kr/"}, "pfx": 103, "reg": "1999-10-05", "rir": "apnic", "s24": 772, "sib": 0, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 394240, "abuse": "hostmaster@nic.or.kr", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0017827861478}, {"a": 9697, "h": "CJHAEUNDAEGIJANG-AS-KR", "n": "CJHAEUNDAEGIJANG", "t": "Other", "w": 7, "cc": "KR", "cf": null, "cs": null, "ev": {"cins": {"n": 6, "p": 0.9161, "hi": 9.54, "lo": 2.65, "ips": 7, "mean": 5.64, "above": true}}, "h2": [["2026-10-12", 1.199, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.149, "obs": 0, "own": 0.320, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 6, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.199, "se": 0.567, "ts": 1.000, "map": 2.574, "obs": 6, "own": 1.458, "comp": {"cins": 20.1797, "dshield": -2.0853, "crowdsec": -8.1253, "vulncheck": -0.8858, "blocklist_de": -6.7442}, "mass": 8.2, "listed": false}}, "abq": false, "bot": 0.143, "det": null, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.lghellovision.net"}, "pfx": 105, "reg": "1999-10-05", "rir": "apnic", "s24": 571, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 148480, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": ["cins"], "traffic": 0.0006497665608}, {"a": 9756, "h": "SKB-CHEONANVITSSEN-AS-KR", "n": "SK Broadband Co Ltd", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0125, "hi": 2.23, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.0683, "hi": 3.26, "lo": 0.24, "ips": 1, "mean": 1.38, "above": false}}, "h2": [["2026-10-05", 0.205, 0.009, 0, false], ["2026-10-12", 0.216, 0.010, 0, false]], "sh": false, "uc": 129, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 0.879, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.216, "se": 0.855, "ts": 0.500, "map": 0.786, "obs": 2, "own": 1.253, "comp": {"cins": -0.4184, "dshield": -0.859, "crowdsec": 0.5672, "vulncheck": -0.6157, "blocklist_de": 2.4788}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.219, "det": {"blocklist_de": {"mail": 1}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": null, "pfx": 20, "reg": "1999-12-10", "rir": "apnic", "s24": 424, "sib": 23, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 112128, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008880023236}, {"a": 9762, "h": "HCN-AS", "n": "kt HCN Co.,Ltd.", "t": "Other", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0958, "hi": 3.51, "lo": 0.46, "ips": 2, "mean": 1.67, "above": false}, "blocklist_de": {"n": 1, "p": 0.0945, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 0.522, 0.010, 0, false], ["2026-10-12", 0.554, 0.011, 0, false]], "sh": false, "uc": 184.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.930, "ts": null, "map": 0.166, "obs": 0, "own": 0.397, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.554, "se": 0.732, "ts": 0.667, "map": 1.595, "obs": 3, "own": 0.916, "comp": {"cins": -0.5755, "dshield": -1.1141, "crowdsec": 2.7674, "vulncheck": -0.6987, "blocklist_de": 1.4814}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.163, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-9762-APNIC", "org": "kt HCN Co.,Ltd.", "pdb": null, "pfx": 111, "reg": "1999-12-10", "rir": "apnic", "s24": 299, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 76800, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001914838282}, {"a": 9790, "h": "TWO-DEGREES-AS-AP", "n": "2degrees Next Gen", "t": "Transit & backbone", "w": 5, "cc": "NZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "dshield": {"n": 2, "p": 0.0330, "hi": 2.75, "lo": 0.36, "ips": 2, "mean": 1.31, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.65, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "vulncheck": {"n": 1, "p": 0.0091, "hi": 2.11, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.0003, "hi": 1.33, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.049, 0.007, 0, false], ["2026-10-12", 0.148, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.771, "ts": null, "map": 0.100, "obs": 0, "own": 0.660, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.148, "se": 0.606, "ts": 0.400, "map": 0.335, "obs": 5, "own": 1.069, "comp": {"cins": -0.8877, "dshield": 4.4193, "crowdsec": -3.1029, "vulncheck": 0.3175, "blocklist_de": -0.4448}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.116, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@family-38474", "org": "Two Degrees Mobile Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.2degrees.nz"}, "pfx": 62, "reg": "1999-12-16", "rir": "apnic", "s24": 2384, "sib": 32, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 723456, "abuse": "abuse@2degrees.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0350695683}, {"a": 9794, "h": "DNET-ID-AP", "n": "Core Mediatech (D-NET)", "t": "Broadband & mobile", "w": 8, "cc": "ID", "cf": null, "cs": {"c": {"data_centre": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"shodan": {"n": 10, "p": 0.9995, "hi": 15.94, "lo": 5.80, "ips": 10, "mean": 10.34, "above": true}, "urlhaus": {"n": 3, "p": 0.6454, "hi": 7.73, "lo": 1.36, "ips": 5, "mean": 3.99, "above": false}, "crowdsec": {"n": 3, "p": 0.5938, "hi": 7.18, "lo": 1.27, "ips": 3, "mean": 3.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.566, 20.740, 1, false], ["2026-10-12", 6.726, 22.827, 1, false]], "sh": false, "uc": 794.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 22.827, "se": 1.007, "ts": 1.000, "map": 88.595, "obs": 3, "own": 188.528, "comp": {"urlhaus": 7.5921, "threatfox": -0.4931, "phishing_db": -0.9887}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.726, "se": 0.677, "ts": 0.750, "map": 17.632, "obs": 4, "own": 27.377, "comp": {"cins": -0.6295, "dshield": -1.1953, "crowdsec": 5.6659, "vulncheck": -0.7209, "blocklist_de": 1.143}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.304, "det": {"shodan": {"malware": 9, "compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-9794-APNIC", "org": "PT. Core Mediatech (D-NET)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.dnet.net.id"}, "pfx": 30, "reg": "1999-12-29", "rir": "apnic", "s24": 30, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 7680, "abuse": "abuse@dnet.net.id", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 9808, "h": "CHINAMOBILE-CN", "n": "China Mobile Communications Group Co., Ltd.", "t": "Broadband & mobile", "w": 380, "cc": "CN", "cf": {"rb": "", "wb": "", "rep": 1.29, "waf": 1.86}, "cs": {"c": {"http_flood": 35, "web_exploit": 63, "bad_crawling": 23, "proxy_or_vpn": 20, "first_seen_30d": 18, "ssh_bruteforce": 169, "web_bruteforce": 66, "home_connection": 5, "mail_bruteforce": 73, "router_or_botnet": 4, "cve:CVE-2017-9841": 12, "cve:CVE-2019-9082": 6, "cve:CVE-2024-6387": 51, "cve:CVE-2018-20062": 7, "cve:CVE-2024-12847": 21}, "n": 225}, "ev": {"cins": {"n": 53, "p": 0.0000, "hi": 2.26, "lo": 1.44, "ips": 55, "mean": 1.83, "above": false}, "shodan": {"n": 83, "p": 0.0000, "hi": 0.69, "lo": 0.48, "ips": 83, "mean": 0.58, "above": false}, "dshield": {"n": 75, "p": 0.0001, "hi": 2.43, "lo": 1.66, "ips": 77, "mean": 2.03, "above": false}, "urlhaus": {"n": 5, "p": 0.0000, "hi": 1.45, "lo": 0.36, "ips": 5, "mean": 0.83, "above": false}, "crowdsec": {"n": 184, "p": 0.0000, "hi": 1.15, "lo": 0.91, "ips": 225, "mean": 1.03, "above": false}, "threatfox": {"n": 2, "p": 0.0000, "hi": 0.55, "lo": 0.07, "ips": 2, "mean": 0.26, "above": false}, "vulncheck": {"n": 4, "p": 0.0000, "hi": 0.25, "lo": 0.05, "ips": 4, "mean": 0.14, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.23, "lo": 0.04, "ips": 3, "mean": 0.12, "above": false}, "blocklist_de": {"n": 118, "p": 0.0000, "hi": 1.88, "lo": 1.39, "ips": 121, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.687, 0.127, 0, false], ["2026-10-12", 0.903, 0.119, 0, false]], "sh": false, "uc": 63.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 2, "phishing_db": 3}, "lo": 0.119, "se": 0.980, "ts": 0.500, "map": 0.307, "obs": 10, "own": 0.968, "comp": {"urlhaus": 1.5649, "threatfox": -0.3427, "phishing_db": -0.7753}, "mass": 37.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 53, "dshield": 75, "crowdsec": 184, "vulncheck": 4, "blocklist_de": 118}, "lo": 0.903, "se": 0.359, "ts": 0.424, "map": 1.330, "obs": 434, "own": 2.049, "comp": {"cins": 5.32, "dshield": 1.0332, "crowdsec": -2.752, "vulncheck": -0.9636, "blocklist_de": -0.9588}, "mass": 497.4, "listed": false}}, "abq": false, "bot": 0.480, "det": {"shodan": {"c2": 3, "malware": 2, "compromised": 77, "doublepulsar": 1}, "threatfox": {"family:DeimosC2": 1, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 3, "attack_tooling": 1}, "blocklist_de": {"sip": 1, "ssh": 59, "imap": 40, "mail": 61}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "100+Tbps", "pol": "Restrictive", "web": "http://www.chinamobileltd.com/en/global/home.php"}, "pfx": 14040, "reg": "2000-01-10", "rir": "apnic", "s24": 67456, "sib": 28, "tor": 0, "w24": 333, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 56411648, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.259296}, {"a": 9812, "h": "CNNIC-CN-COLNET", "n": "Oriental Cable Network Co., Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0004, "hi": 1.37, "lo": 0.10, "ips": 1, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.826, "ts": null, "map": 0.126, "obs": 0, "own": 0.615, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.490, "ts": null, "map": 0.050, "obs": 0, "own": 0.102, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.415, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-9812-APNIC", "org": "Oriental Cable Network Co., Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ocn.net.cn/"}, "pfx": 12, "reg": "2000-01-10", "rir": "apnic", "s24": 1152, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 327936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007005862214}, {"a": 9824, "h": "JTCL-JP-AS", "n": "JCOM", "t": "Broadband & mobile", "w": 2, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.65, "waf": 0.57}, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.12, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.57, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}}, "h2": [["2026-10-05", 0.004, 0.004, 0, false], ["2026-10-12", 0.008, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.648, "ts": null, "map": 0.043, "obs": 0, "own": 0.197, "comp": null, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.008, "se": 0.763, "ts": 1.000, "map": 0.025, "obs": 2, "own": 0.040, "comp": {"cins": -0.5657, "dshield": 6.1617, "crowdsec": -4.3196, "vulncheck": -0.6943, "blocklist_de": -2.8683}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.051, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-JTCL1-AP-APNIC", "org": "JCOM Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.jcom.co.jp/english/"}, "pfx": 233, "reg": "2000-01-12", "rir": "apnic", "s24": 18536, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10315776, "abuse": "abuse@home.ne.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.113097}, {"a": 9829, "h": "BSNL-NIB", "n": "National Internet Backbone India", "t": "Broadband & mobile", "w": 164, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 2.45, "waf": 1.08}, "cs": {"c": {"http_flood": 18, "web_exploit": 26, "bad_crawling": 5, "proxy_or_vpn": 16, "first_seen_30d": 3, "ssh_bruteforce": 51, "web_bruteforce": 49, "home_connection": 68, "mail_bruteforce": 46, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2021-41773": 2, "cve:CVE-2024-28000": 6}, "n": 77}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 0.70, "lo": 0.12, "ips": 3, "mean": 0.36, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.18, "lo": 0.04, "ips": 4, "mean": 0.10, "above": false}, "dshield": {"n": 19, "p": 0.0001, "hi": 2.00, "lo": 0.95, "ips": 19, "mean": 1.43, "above": false}, "urlhaus": {"n": 5, "p": 0.0810, "hi": 3.26, "lo": 0.81, "ips": 5, "mean": 1.86, "above": false}, "crowdsec": {"n": 74, "p": 0.0000, "hi": 1.39, "lo": 0.95, "ips": 77, "mean": 1.16, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 0.57, "lo": 0.10, "ips": 3, "mean": 0.29, "above": false}, "blocklist_de": {"n": 83, "p": 0.6501, "hi": 3.73, "lo": 2.60, "ips": 85, "mean": 3.14, "above": false}}, "h2": [["2026-10-05", 0.859, 0.309, 0, false], ["2026-10-12", 1.054, 0.231, 0, false]], "sh": false, "uc": 73.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 0, "phishing_db": 0}, "lo": 0.231, "se": 0.966, "ts": 1.000, "map": 0.631, "obs": 5, "own": 1.815, "comp": {"urlhaus": 2.9179, "threatfox": -0.574, "phishing_db": -1.1785}, "mass": 24.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 19, "crowdsec": 74, "vulncheck": 3, "blocklist_de": 83}, "lo": 1.054, "se": 0.363, "ts": 0.456, "map": 1.585, "obs": 182, "own": 2.441, "comp": {"cins": -2.8937, "dshield": -0.7988, "crowdsec": -3.2683, "vulncheck": -0.9218, "blocklist_de": 9.7367}, "mass": 210.9, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 2, "botnet_node": 1}, "blocklist_de": {"ftp": 2, "ssh": 13, "bots": 24, "imap": 28, "mail": 35, "apache": 11, "bruteforcelogin": 11}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.bsnl.co.in/"}, "pfx": 1904, "reg": "2000-01-19", "rir": "apnic", "s24": 24012, "sib": 0, "tor": 0, "w24": 157, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7205888, "abuse": "abuse1@bsnl.co.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.105189}, {"a": 9832, "h": "ISN-AS-AP", "n": "ISNNET", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"urlhaus": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.5814, "hi": 7.06, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}}, "h2": [["2026-10-05", 8.746, 0.579, 0, false], ["2026-10-12", 3.171, 0.618, 0, false]], "sh": false, "uc": 696.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.618, "se": 1.634, "ts": 1.000, "map": 7.285, "obs": 1, "own": 23.399, "comp": {"urlhaus": 4.1702, "threatfox": -0.1961, "phishing_db": -0.3621}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.171, "se": 0.767, "ts": 1.000, "map": 9.813, "obs": 3, "own": 15.363, "comp": {"cins": -0.452, "dshield": -0.9162, "crowdsec": 7.9902, "vulncheck": -0.6363, "blocklist_de": -2.3083}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.184, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.bangla.net"}, "pfx": 43, "reg": "2000-01-24", "rir": "apnic", "s24": 37, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27392, "abuse": "info@bangla.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045730075993}, {"a": 9835, "h": "GITS-TH-AS-AP", "n": "Government Information Technology Services", "t": "Other", "w": 1, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3477, "hi": 5.62, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "phishing_db": {"n": 1, "p": 0.1872, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.010, 0.370, 0, false], ["2026-10-12", 0.010, 0.387, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.387, "se": 1.504, "ts": 1.000, "map": 3.618, "obs": 1, "own": 4.258, "comp": {"urlhaus": -0.1349, "threatfox": -0.1606, "phishing_db": 3.2075}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.879, "ts": null, "map": 0.183, "obs": 0, "own": 0.243, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.713, "det": {"shodan": {"compromised": 2}}, "oid": null, "org": null, "pdb": null, "pfx": 56, "reg": "2000-01-31", "rir": "apnic", "s24": 56, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "noc@thaisarn.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001700917746}, {"a": 9845, "h": "CJCKN-AS-KR", "n": "CJCKN", "t": "Other", "w": 2, "cc": "KR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0611, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "dshield": {"n": 1, "p": 0.0434, "hi": 2.90, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}}, "h2": [["2026-10-12", 0.095, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.246, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.095, "se": 0.828, "ts": 0.500, "map": 0.324, "obs": 2, "own": 0.189, "comp": {"cins": 4.2032, "dshield": 2.8881, "crowdsec": -3.7541, "vulncheck": -0.6492, "blocklist_de": -2.4208}, "mass": 2.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.lghellovision.net"}, "pfx": 316, "reg": "2000-02-04", "rir": "apnic", "s24": 1183, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 310016, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0018156906474}, {"a": 9848, "h": "SejongTelecom-AS-KR", "n": "Sejong Networks", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0076, "hi": 2.05, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.62, "lo": 0.05, "ips": 1, "mean": 0.26, "above": false}}, "h2": [["2026-10-05", 0.017, 0.007, 0, false], ["2026-10-12", 0.017, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.752, "ts": null, "map": 0.091, "obs": 0, "own": 0.416, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.017, "se": 0.997, "ts": 1.000, "map": 0.081, "obs": 1, "own": 0.134, "comp": {"cins": 4.5278, "dshield": -0.6924, "crowdsec": -2.7312, "vulncheck": -0.5474, "blocklist_de": -1.6738}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.465, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38425-APNIC", "org": "SEJONG NETWORKS", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Selective", "web": "https://en.sejongnetworks.com/"}, "pfx": 162, "reg": "2000-02-04", "rir": "apnic", "s24": 3118, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1105920, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011079295318}, {"a": 9873, "h": "TELECOM-LA-AS-AP", "n": "LAOTELECOM", "t": "Broadband & mobile", "w": 7, "cc": "LA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.3825, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}, "crowdsec": {"n": 1, "p": 0.0972, "hi": 3.63, "lo": 0.27, "ips": 2, "mean": 1.53, "above": false}, "blocklist_de": {"n": 3, "p": 0.5643, "hi": 6.90, "lo": 1.22, "ips": 3, "mean": 3.56, "above": false}}, "h2": [["2026-10-05", 2.573, 0.011, 0, false], ["2026-10-12", 4.031, 0.012, 0, false]], "sh": false, "uc": 303.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 1.301, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 4.031, "se": 0.570, "ts": 0.500, "map": 8.652, "obs": 6, "own": 13.365, "comp": {"cins": -1.0604, "dshield": 3.6277, "crowdsec": -4.1774, "vulncheck": -0.8359, "blocklist_de": 5.9974}, "mass": 5.6, "listed": false}}, "abq": true, "bot": 0.093, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-LTCL2-AP-APNIC", "org": "Lao Telecommunication Public Company", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.laotel.com/"}, "pfx": 110, "reg": "2000-02-07", "rir": "apnic", "s24": 116, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01094827674856}, {"a": 9891, "h": "CSLOX-IDC-AS-AP", "n": "CSL IDC", "t": "Hosting & VPS", "w": 8, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 5, "web_bruteforce": 1, "home_connection": 2}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1663, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "shodan": {"n": 12, "p": 0.9996, "hi": 13.87, "lo": 5.49, "ips": 12, "mean": 9.27, "above": true}, "crowdsec": {"n": 6, "p": 0.8312, "hi": 7.90, "lo": 2.19, "ips": 6, "mean": 4.67, "above": true}, "vulncheck": {"n": 1, "p": 0.1591, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "blocklist_de": {"n": 4, "p": 0.7056, "hi": 7.62, "lo": 1.64, "ips": 4, "mean": 4.16, "above": false}}, "h2": [["2026-10-05", 5.194, 0.010, 0, false], ["2026-10-12", 5.839, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.175, "obs": 0, "own": 0.176, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 4}, "lo": 5.839, "se": 0.473, "ts": 0.500, "map": 10.677, "obs": 12, "own": 2.093, "comp": {"cins": 1.5128, "dshield": -2.3488, "crowdsec": 1.4904, "vulncheck": -0.4068, "blocklist_de": 3.5141}, "mass": 11.1, "listed": false}}, "abq": true, "bot": 0.749, "det": {"shodan": {"compromised": 12}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"sip": 1, "ssh": 3}}, "oid": "@family-29895", "org": "CS Loxinfo Public Company Limited", "pdb": {"t": "Content", "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.csloxinfo.com/idc-solutions/"}, "pfx": 100, "reg": "2003-08-07", "rir": "apnic", "s24": 188, "sib": 44, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 57600, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00054400022244}, {"a": 9905, "h": "LINKNET-ID-AP", "n": "PT Link Net Tbk", "t": "Other", "w": 8, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 1, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"shodan": {"n": 4, "p": 0.4272, "hi": 5.41, "lo": 1.16, "ips": 4, "mean": 2.95, "above": false}, "urlhaus": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 6, "p": 0.6729, "hi": 6.36, "lo": 1.77, "ips": 6, "mean": 3.76, "above": false}, "vulncheck": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "blocklist_de": {"n": 1, "p": 0.0886, "hi": 3.52, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 3.700, 0.010, 0, false], ["2026-10-12", 1.754, 0.279, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.279, "se": 1.458, "ts": 1.000, "map": 2.354, "obs": 1, "own": 2.737, "comp": {"urlhaus": 3.4942, "threatfox": -0.3461, "phishing_db": -0.6657}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.754, "se": 0.526, "ts": 0.750, "map": 3.485, "obs": 8, "own": 1.975, "comp": {"cins": -1.1587, "dshield": -1.8516, "crowdsec": 7.7194, "vulncheck": -0.009, "blocklist_de": -2.058}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.253, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-9905-APNIC", "org": "Linknet ASN", "pdb": null, "pfx": 88, "reg": "2000-03-16", "rir": "apnic", "s24": 324, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 148480, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0019350759318}, {"a": 9908, "h": "HKCABLE2-HK-AP", "n": "Hong Kong Cable Television Limited", "t": "Broadband & mobile", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1477, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 2, "p": 0.0001, "hi": 1.32, "lo": 0.17, "ips": 2, "mean": 0.63, "above": false}, "vulncheck": {"n": 1, "p": 0.0334, "hi": 2.72, "lo": 0.20, "ips": 1, "mean": 1.15, "above": false}, "blocklist_de": {"n": 1, "p": 0.0045, "hi": 1.89, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.245, 0.008, 0, false], ["2026-10-12", 0.174, 0.137, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.137, "se": 1.376, "ts": 1.000, "map": 0.954, "obs": 1, "own": 2.767, "comp": {"urlhaus": 2.8342, "threatfox": -0.4231, "phishing_db": -0.8315}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.174, "se": 0.657, "ts": 0.500, "map": 0.435, "obs": 4, "own": 0.686, "comp": {"cins": -0.7155, "dshield": -1.3183, "crowdsec": 1.3726, "vulncheck": 0.6136, "blocklist_de": 0.6082}, "mass": 3.5, "listed": false}}, "abq": false, "bot": null, "det": {"shodan": {"compromised": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-HKCT1-AP-APNIC", "org": "Hong Kong Cable Television Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://service.i-cable.com/"}, "pfx": 200, "reg": "2000-03-17", "rir": "apnic", "s24": 1415, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1639936, "abuse": "abuse@hkcable.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00548320529444}, {"a": 9919, "h": "NCIC-TW", "n": "New Century InfoComm Tech Co., Ltd.", "t": "Other", "w": 5, "cc": "TW", "cf": null, "cs": null, "ev": {"cins": {"n": 2, "p": 0.0900, "hi": 3.45, "lo": 0.45, "ips": 2, "mean": 1.64, "above": false}, "shodan": {"n": 4, "p": 0.0006, "hi": 1.77, "lo": 0.38, "ips": 4, "mean": 0.97, "above": false}, "vulncheck": {"n": 1, "p": 0.0163, "hi": 2.34, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "phishing_db": {"n": 2, "p": 0.0684, "hi": 3.22, "lo": 0.42, "ips": 2, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 0.003, 0.156, 0, false], ["2026-10-12", 0.096, 0.163, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.163, "se": 1.145, "ts": 1.000, "map": 0.647, "obs": 2, "own": 0.778, "comp": {"urlhaus": -0.6901, "threatfox": -0.4149, "phishing_db": 2.2963}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.096, "se": 0.731, "ts": 0.667, "map": 0.271, "obs": 3, "own": 0.159, "comp": {"cins": 8.3625, "dshield": -1.196, "crowdsec": -4.6966, "vulncheck": 0.8006, "blocklist_de": -3.1816}, "mass": 3.1, "listed": false}}, "abq": true, "bot": 0.413, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-131586-APNIC", "org": "New Century InfoComm Tech Co., Ltd.", "pdb": null, "pfx": 820, "reg": "2000-03-28", "rir": "apnic", "s24": 1952, "sib": 2, "tor": 0, "w24": 5, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3129600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0046892940183}, {"a": 9924, "h": "TFN-TW", "n": "Taiwan Fixed Network", "t": "Transit & backbone", "w": 18, "cc": "TW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 2}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.35, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 1.13, "lo": 0.08, "ips": 2, "mean": 0.48, "above": false}, "urlhaus": {"n": 5, "p": 0.6789, "hi": 6.80, "lo": 1.69, "ips": 14, "mean": 3.88, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.46, "lo": 0.08, "ips": 4, "mean": 0.24, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 1.06, "lo": 0.19, "ips": 4, "mean": 0.55, "above": false}}, "h2": [["2026-10-05", 0.089, 0.504, 0, false], ["2026-10-12", 0.121, 0.755, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 0, "phishing_db": 0}, "lo": 0.755, "se": 0.917, "ts": 1.000, "map": 2.034, "obs": 5, "own": 7.483, "comp": {"urlhaus": 4.071, "threatfox": -0.5688, "phishing_db": -1.1661}, "mass": 17.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.121, "se": 0.536, "ts": 0.429, "map": 0.240, "obs": 7, "own": 0.759, "comp": {"cins": -1.3643, "dshield": 0.1839, "crowdsec": -1.4122, "vulncheck": -0.8816, "blocklist_de": 3.4403}, "mass": 7.9, "listed": false}}, "abq": true, "bot": 0.318, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 2}}, "oid": "@aut-9924-APNIC", "org": "Taiwan Fixed Network, Telco and Network Service Provider.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.taiwanmobile.com"}, "pfx": 548, "reg": "2000-03-28", "rir": "apnic", "s24": 5909, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4313600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00178686208225}, {"a": 9927, "h": "PHILCOMNET-PH", "n": "PhilCom", "t": "Broadband & mobile", "w": 6, "cc": "PH", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1868, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "dshield": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "urlhaus": {"n": 2, "p": 0.4190, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1323, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "vulncheck": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 2.762, 4.230, 0, false]], "sh": false, "uc": 297.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 4.230, "se": 1.194, "ts": 1.000, "map": 23.199, "obs": 2, "own": 53.821, "comp": {"urlhaus": 6.0783, "threatfox": -0.4398, "phishing_db": -0.8683}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.762, "se": 0.687, "ts": 0.250, "map": 7.323, "obs": 4, "own": 11.531, "comp": {"cins": 3.9533, "dshield": 2.4404, "crowdsec": -0.923, "vulncheck": 0.9004, "blocklist_de": -2.9864}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.156, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "@family-41658", "org": "PhilCom Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.philcom.com/"}, "pfx": 67, "reg": "2000-03-31", "rir": "apnic", "s24": 67, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": "abuse@philcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00102495490484}, {"a": 9930, "h": "TTNET-MY", "n": "TIME DotCom Berhad", "t": "Broadband & mobile", "w": 7, "cc": "MY", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.50}, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0098, "hi": 2.13, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "shodan": {"n": 481, "p": 1.0000, "hi": 72.23, "lo": 62.18, "ips": 481, "mean": 67.12, "above": true}, "dshield": {"n": 3, "p": 0.0524, "hi": 3.03, "lo": 0.53, "ips": 3, "mean": 1.56, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.55, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}, "vulncheck": {"n": 2, "p": 0.0195, "hi": 2.50, "lo": 0.32, "ips": 2, "mean": 1.19, "above": false}, "blocklist_de": {"n": 1, "p": 0.0001, "hi": 1.16, "lo": 0.09, "ips": 1, "mean": 0.49, "above": false}}, "h2": [["2026-10-05", 0.179, 0.007, 0, false], ["2026-10-12", 0.216, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.757, "ts": null, "map": 0.094, "obs": 0, "own": 0.429, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.216, "se": 0.536, "ts": 0.375, "map": 0.435, "obs": 8, "own": 0.679, "comp": {"cins": 2.5132, "dshield": 5.2295, "crowdsec": -5.2466, "vulncheck": 0.6738, "blocklist_de": -2.6094}, "mass": 7.1, "listed": false}}, "abq": false, "bot": 0.193, "det": {"shodan": {"malware": 1, "compromised": 480}, "threatfox": {"family:Mirai": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TDSB1-AP-APNIC", "org": "TT DOTCOM SDN BHD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "https://www.time.com.my/"}, "pfx": 74, "reg": "2000-04-05", "rir": "apnic", "s24": 2893, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 837376, "abuse": "abuse@time.com.my", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.04022376580485}, {"a": 9931, "h": "NTPCL-AS-AP", "n": "NT(CAT) Corporate Internet", "t": "Broadband & mobile", "w": 13, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 6, "bad_crawling": 2, "ssh_bruteforce": 7, "web_bruteforce": 8, "home_connection": 1, "mail_bruteforce": 6, "router_or_botnet": 5, "cve:CVE-2017-9841": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2023-22515": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1}, "n": 10}, "ev": {"shodan": {"n": 3, "p": 0.0105, "hi": 2.33, "lo": 0.41, "ips": 3, "mean": 1.20, "above": false}, "urlhaus": {"n": 1, "p": 0.1583, "hi": 4.31, "lo": 0.32, "ips": 2, "mean": 1.82, "above": false}, "crowdsec": {"n": 9, "p": 0.2712, "hi": 4.03, "lo": 1.39, "ips": 10, "mean": 2.57, "above": false}, "phishing_db": {"n": 1, "p": 0.0565, "hi": 3.10, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "blocklist_de": {"n": 2, "p": 0.0430, "hi": 2.91, "lo": 0.38, "ips": 2, "mean": 1.38, "above": false}}, "h2": [["2026-10-05", 0.646, 0.366, 0, false], ["2026-10-12", 0.914, 0.391, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.391, "se": 1.156, "ts": 0.500, "map": 1.713, "obs": 2, "own": 4.685, "comp": {"urlhaus": 2.3546, "threatfox": -0.4597, "phishing_db": 0.2694}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.914, "se": 0.478, "ts": 0.818, "map": 1.661, "obs": 11, "own": 2.567, "comp": {"cins": -1.6055, "dshield": -2.263, "crowdsec": 8.2439, "vulncheck": -0.9077, "blocklist_de": -1.5666}, "mass": 10.1, "listed": false}}, "abq": true, "bot": 0.251, "det": {"shodan": {"compromised": 1, "doublepulsar": 2}, "blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.cat.net.th/cat-corporate/"}, "pfx": 629, "reg": "2000-04-05", "rir": "apnic", "s24": 1089, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 662272, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0069875326302}, {"a": 9937, "h": "DELTANET-AS-AP", "n": "Delta Networks", "t": "Broadband & mobile", "w": 1, "cc": "PK", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.509, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.509, "se": 1.406, "ts": 1.000, "map": 5.081, "obs": 1, "own": 9.965, "comp": {"cins": -0.0625, "dshield": -0.1485, "crowdsec": -0.5888, "vulncheck": 4.1459, "blocklist_de": -0.3269}, "mass": 0.3, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-DN1-AP-APNIC", "org": "Delta Networks", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": null, "pol": "Open", "web": "http://dot99.net"}, "pfx": 8, "reg": "2009-10-01", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022177888656}, {"a": 9946, "h": "CABLENET-AS-KR", "n": "KCTV JEJU BROADCASTING", "t": "Broadband & mobile", "w": 9, "cc": "KR", "cf": null, "cs": {"c": {"bad_crawling": 1, "ssh_bruteforce": 5, "web_bruteforce": 8, "mail_bruteforce": 8}, "n": 8}, "ev": {"dshield": {"n": 1, "p": 0.1128, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "crowdsec": {"n": 6, "p": 0.5052, "hi": 5.35, "lo": 1.49, "ips": 8, "mean": 3.16, "above": false}, "blocklist_de": {"n": 2, "p": 0.1774, "hi": 4.23, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}}, "h2": [["2026-10-05", 2.157, 0.009, 0, false], ["2026-10-12", 1.674, 0.010, 0, false]], "sh": false, "uc": 211.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 0.858, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.674, "se": 0.501, "ts": 0.667, "map": 3.208, "obs": 9, "own": 4.954, "comp": {"cins": -1.3942, "dshield": 0.1163, "crowdsec": 4.8353, "vulncheck": -0.8853, "blocklist_de": -0.1128}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.129, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "@aut-9946-APNIC", "org": "KCTV JEJU BROADCASTING", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.kctvjeju.com"}, "pfx": 131, "reg": "2000-04-14", "rir": "apnic", "s24": 456, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 116736, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00149178043}, {"a": 9952, "h": "HOSTWAY-AS-KR", "n": "Hostway IDC", "t": "Hosting & VPS", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1755, "hi": 4.21, "lo": 0.55, "ips": 2, "mean": 2.01, "above": false}, "blocklist_de": {"n": 1, "p": 0.1259, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.398, 0.010, 0, false], ["2026-10-12", 0.837, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.175, "obs": 0, "own": 0.176, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.837, "se": 0.740, "ts": 0.667, "map": 2.454, "obs": 3, "own": 0.491, "comp": {"cins": -0.5538, "dshield": -1.0806, "crowdsec": 2.9967, "vulncheck": -0.689, "blocklist_de": 1.6179}, "mass": 2.6, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-9952-APNIC", "org": "Hostway IDC", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://hostway.co.kr/"}, "pfx": 174, "reg": "2000-04-14", "rir": "apnic", "s24": 186, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 74752, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001656302928}, {"a": 9976, "h": "ICNDP-AS-KR", "n": "Namincheon Brodcasting Co.", "t": "Broadband & mobile", "w": 4, "cc": "KR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1406, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "vulncheck": {"n": 1, "p": 0.1290, "hi": 3.99, "lo": 0.30, "ips": 3, "mean": 1.68, "above": false}}, "h2": [["2026-10-12", 0.198, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.916, "ts": null, "map": 0.161, "obs": 0, "own": 0.928, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.198, "se": 0.879, "ts": 0.500, "map": 0.728, "obs": 2, "own": 1.197, "comp": {"cins": 4.5052, "dshield": -0.7116, "crowdsec": -2.8066, "vulncheck": 1.8153, "blocklist_de": -1.7263}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.284, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "@aut-9976-APNIC", "org": "Namincheon Brodcasting Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.nibtv.co.kr"}, "pfx": 11, "reg": "2000-04-14", "rir": "apnic", "s24": 360, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 92160, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001439833836}, {"a": 9988, "h": "MPT-AP", "n": "Myanma Posts and Telecommunications (MPT)", "t": "Broadband & mobile", "w": 5, "cc": "MM", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1822, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 1, "p": 0.1125, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "phishing_db": {"n": 1, "p": 0.1797, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 3, "p": 0.5806, "hi": 7.05, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}}, "h2": [["2026-10-05", 4.374, 0.300, 0, false], ["2026-10-12", 4.169, 0.315, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.315, "se": 1.468, "ts": 1.000, "map": 2.695, "obs": 1, "own": 7.844, "comp": {"urlhaus": -0.1653, "threatfox": -0.1867, "phishing_db": 2.9695}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 4.169, "se": 0.612, "ts": 0.600, "map": 9.717, "obs": 5, "own": 15.039, "comp": {"cins": 3.1111, "dshield": -1.6521, "crowdsec": -3.6792, "vulncheck": -0.8198, "blocklist_de": 6.7076}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.309, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MPT1-AP-APNIC", "org": "Myanma Post & Telecommunication", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.mpt.com.mm"}, "pfx": 62, "reg": "2000-04-26", "rir": "apnic", "s24": 93, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53504, "abuse": "abuse@mptmmf.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01334557318752}, {"a": 10013, "h": "FBDC", "n": "FreeBit Co,Ltd.", "t": "Transit & backbone", "w": 1, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.37, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.01, "lo": 0.08, "ips": 1, "mean": 0.42, "above": false}}, "h2": [["2026-10-05", 0.002, 0.028, 0, false], ["2026-10-12", 0.002, 0.030, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.030, "se": 1.328, "ts": 1.000, "map": 0.156, "obs": 1, "own": 0.788, "comp": {"urlhaus": -0.655, "threatfox": -0.4065, "phishing_db": 0.8284}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.002, "se": 1.280, "ts": null, "map": 0.014, "obs": 0, "own": 0.052, "comp": null, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.107, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-10013-JPNIC", "org": "FreeBit Co.,Ltd.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.freebit.com/"}, "pfx": 407, "reg": "2000-04-27", "rir": "apnic", "s24": 7594, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1953536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00486504114915}, {"a": 10021, "h": "KVH", "n": "Colt Technology Asia", "t": "Transit & backbone", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0210, "hi": 2.46, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.902, "ts": null, "map": 0.156, "obs": 0, "own": 1.241, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.612, "ts": null, "map": 0.085, "obs": 0, "own": 0.401, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.612, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-10021-JPNIC", "org": "KVH Co.,Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "No", "web": "http://asia.colt.net/"}, "pfx": 45, "reg": "2000-04-27", "rir": "apnic", "s24": 433, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046685516865}, {"a": 10029, "h": "SHYAMSPECTRA-AS", "n": "Shyam Spectra Pvt. Ltd.", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 4, "cve:CVE-2024-28000": 2}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1232, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "shodan": {"n": 1, "p": 0.0150, "hi": 2.31, "lo": 0.17, "ips": 1, "mean": 0.97, "above": false}, "crowdsec": {"n": 4, "p": 0.1786, "hi": 3.96, "lo": 0.85, "ips": 5, "mean": 2.16, "above": false}, "blocklist_de": {"n": 3, "p": 0.3277, "hi": 5.07, "lo": 0.89, "ips": 3, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 0.480, 0.009, 0, false], ["2026-10-12", 1.539, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.892, "ts": null, "map": 0.153, "obs": 0, "own": 0.835, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.539, "se": 0.519, "ts": 0.500, "map": 3.031, "obs": 8, "own": 4.685, "comp": {"cins": 2.1587, "dshield": -2.1016, "crowdsec": 0.3247, "vulncheck": -0.8879, "blocklist_de": 3.0086}, "mass": 8.3, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-10029-APNIC", "org": "SHYAM SPECTRA PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.spectra.co"}, "pfx": 288, "reg": "2000-06-14", "rir": "apnic", "s24": 494, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 223488, "abuse": "abuseinfo@spectra.co", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00349867649532}, {"a": 10030, "h": "CELCOMNET-AP", "n": "Celcom (M)", "t": "Broadband & mobile", "w": 42, "cc": "MY", "cf": null, "cs": {"c": {"ssh_bruteforce": 19, "web_bruteforce": 7, "mail_bruteforce": 30}, "n": 31}, "ev": {"dshield": {"n": 2, "p": 0.3259, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "crowdsec": {"n": 15, "p": 0.9999, "hi": 13.00, "lo": 5.65, "ips": 31, "mean": 9.01, "above": true}, "blocklist_de": {"n": 10, "p": 0.9975, "hi": 12.92, "lo": 4.70, "ips": 17, "mean": 8.38, "above": true}}, "h2": [["2026-10-05", 7.014, 0.010, 0, false], ["2026-10-12", 10.030, 0.011, 1, false]], "sh": false, "uc": 8723.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.993, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 15, "vulncheck": 0, "blocklist_de": 10}, "lo": 10.030, "se": 0.402, "ts": 0.556, "map": 16.217, "obs": 27, "own": 24.831, "comp": {"cins": -2.6586, "dshield": -1.0194, "crowdsec": 2.6396, "vulncheck": -0.9721, "blocklist_de": 6.1901}, "mass": 26.1, "listed": false}}, "abq": false, "bot": 0.133, "det": {"blocklist_de": {"ssh": 1, "imap": 15, "mail": 16}}, "oid": "ORG-CSB2-AP-APNIC", "org": "Celcom Axiata Berhad", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.celcom.com.my/"}, "pfx": 3, "reg": "2000-06-15", "rir": "apnic", "s24": 292, "sib": 3, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 74752, "abuse": "abuse@celcomdigi.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.01044573259207}, {"a": 10054, "h": "CMBKJ-AS-KR", "n": "CMB Kwangju Broadcasting", "t": "Other", "w": 6, "cc": "KR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 5, "web_bruteforce": 5, "mail_bruteforce": 5}, "n": 6}, "ev": {"crowdsec": {"n": 5, "p": 0.5475, "hi": 5.85, "lo": 1.45, "ips": 6, "mean": 3.34, "above": false}, "blocklist_de": {"n": 3, "p": 0.4405, "hi": 5.87, "lo": 1.03, "ips": 3, "mean": 3.03, "above": false}}, "h2": [["2026-10-05", 1.730, 0.010, 0, false], ["2026-10-12", 2.320, 0.011, 0, false]], "sh": false, "uc": 609.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.930, "ts": null, "map": 0.166, "obs": 0, "own": 0.397, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.320, "se": 0.519, "ts": 0.625, "map": 4.539, "obs": 8, "own": 2.564, "comp": {"cins": -1.3265, "dshield": -2.0184, "crowdsec": 3.375, "vulncheck": -0.8769, "blocklist_de": 3.7531}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.166, "det": {"blocklist_de": {"imap": 1, "mail": 3}}, "oid": "@aut-10054-APNIC", "org": "CMB Kwangju Broadcasting", "pdb": null, "pfx": 89, "reg": "2000-06-16", "rir": "apnic", "s24": 300, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 79616, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006425808648}, {"a": 10075, "h": "FGL-AS-BD", "n": "Fiber@Home Global Limited", "t": "Broadband & mobile", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "proxy_or_vpn": 2, "web_bruteforce": 5, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.6116, "hi": 7.36, "lo": 1.30, "ips": 5, "mean": 3.80, "above": false}}, "h2": [["2026-10-05", 5.084, 0.011, 0, false], ["2026-10-12", 5.352, 0.012, 0, false]], "sh": false, "uc": 1640.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.352, "se": 0.781, "ts": 1.000, "map": 17.059, "obs": 3, "own": 26.704, "comp": {"cins": -0.4274, "dshield": -0.8744, "crowdsec": 8.3392, "vulncheck": -0.6214, "blocklist_de": -2.1858}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.237, "det": null, "oid": "ORG-FGL3-AP-APNIC", "org": "Fiber@Home Global Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.fiberathomeglobal.net"}, "pfx": 25, "reg": "2018-10-22", "rir": "apnic", "s24": 20, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082788378054}, {"a": 10083, "h": "CYNERGIC-AS-AP", "n": "Multiline AS10083", "t": "Broadband & mobile", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.357, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CPL45-AP-APNIC", "org": "Cynergic Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Australia", "tr": null, "pol": "Open", "web": "http://www.multiline.au"}, "pfx": 6, "reg": "2000-09-26", "rir": "apnic", "s24": 6, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@cynergic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10088, "h": "KWANGWOON-AS-KR", "n": "KWANGWOON UNIVERSITY", "t": "Other", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1168, "hi": 3.85, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.724, 0.011, 0, false], ["2026-10-12", 0.182, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 0.565, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.182, "se": 1.215, "ts": 1.000, "map": 1.317, "obs": 1, "own": 0.833, "comp": {"cins": -0.1533, "dshield": -0.3504, "crowdsec": 3.3216, "vulncheck": -0.3513, "blocklist_de": -0.7975}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-10088-APNIC", "org": "KWANGWOON UNIVERSITY", "pdb": null, "pfx": 85, "reg": "2002-11-15", "rir": "apnic", "s24": 87, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29696, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000952553826}, {"a": 10094, "h": "UNN-BN", "n": "Unified National Networks", "t": "Broadband & mobile", "w": 6, "cc": "BN", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1548, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 3, "p": 0.3201, "hi": 5.02, "lo": 0.88, "ips": 3, "mean": 2.59, "above": false}, "blocklist_de": {"n": 5, "p": 0.8359, "hi": 8.62, "lo": 2.14, "ips": 5, "mean": 4.92, "above": true}}, "h2": [["2026-10-05", 1.594, 0.010, 0, false], ["2026-10-12", 4.202, 0.011, 0, false]], "sh": false, "uc": 661.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.958, "ts": null, "map": 0.174, "obs": 0, "own": 1.107, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 5}, "lo": 4.202, "se": 0.502, "ts": 0.556, "map": 8.058, "obs": 9, "own": 12.404, "comp": {"cins": -1.5134, "dshield": -0.142, "crowdsec": -2.4957, "vulncheck": -0.8986, "blocklist_de": 8.53}, "mass": 9.2, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"bots": 2, "mail": 3}}, "oid": "ORG-UNN2-AP-APNIC", "org": "Unified National Networks", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.unn.com.bn"}, "pfx": 192, "reg": "2000-06-30", "rir": "apnic", "s24": 205, "sib": 5, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 132608, "abuse": "abuse-mailbox@unn.com.bn", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00755148159085}, {"a": 10099, "h": "UNICOM-Global", "n": "China Unicom Global", "t": "Broadband & mobile", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1051, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "crowdsec": {"n": 1, "p": 0.0895, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.137, 0.010, 0, false], ["2026-10-12", 0.143, 0.011, 0, false]], "sh": false, "uc": 166.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 1.264, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.143, "se": 1.184, "ts": 1.000, "map": 0.974, "obs": 1, "own": 1.665, "comp": {"cins": -0.1674, "dshield": -0.3805, "crowdsec": 3.1579, "vulncheck": -0.3727, "blocklist_de": -0.8705}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.180, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CUKO1-AP-APNIC", "org": "China Unicom (Hong Kong) Operations Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.chinaunicomglobal.com"}, "pfx": 86, "reg": "2000-07-06", "rir": "apnic", "s24": 129, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00432410321434}, {"a": 10103, "h": "HKBN-AS-AP", "n": "HK Broadband Network", "t": "Broadband & mobile", "w": 16, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 3}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1003, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "shodan": {"n": 5, "p": 0.2436, "hi": 4.22, "lo": 1.05, "ips": 5, "mean": 2.41, "above": false}, "crowdsec": {"n": 3, "p": 0.0286, "hi": 2.71, "lo": 0.48, "ips": 3, "mean": 1.40, "above": false}, "vulncheck": {"n": 1, "p": 0.0845, "hi": 3.47, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}, "phishing_db": {"n": 4, "p": 0.6240, "hi": 6.82, "lo": 1.47, "ips": 10, "mean": 3.73, "above": false}, "blocklist_de": {"n": 1, "p": 0.0329, "hi": 2.71, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 0.696, 0.863, 0, false], ["2026-10-12", 0.627, 0.881, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 0.881, "se": 0.965, "ts": 1.000, "map": 2.585, "obs": 4, "own": 6.763, "comp": {"urlhaus": -0.9035, "threatfox": -0.4564, "phishing_db": 3.9358}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.627, "se": 0.578, "ts": 0.500, "map": 1.365, "obs": 6, "own": 2.130, "comp": {"cins": 3.0193, "dshield": -1.7008, "crowdsec": 1.4851, "vulncheck": 0.1415, "blocklist_de": -1.24}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.348, "det": {"shodan": {"c2": 3, "compromised": 2}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HKBN1-AP-APNIC", "org": "Hong Kong Broadband Network Limited", "pdb": null, "pfx": 272, "reg": "2000-07-10", "rir": "apnic", "s24": 699, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 226816, "abuse": "abuse@hkbn.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.003778070973}, {"a": 10139, "h": "SMARTBRO-PH-AP", "n": "Smart Broadband", "t": "Broadband & mobile", "w": 3, "cc": "PH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.50, "waf": 0.43}, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.2361, "hi": 4.46, "lo": 0.79, "ips": 3, "mean": 2.30, "above": false}}, "h2": [["2026-10-05", 0.048, 0.009, 0, false], ["2026-10-12", 0.309, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.866, "ts": null, "map": 0.143, "obs": 0, "own": 0.743, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.309, "se": 0.722, "ts": 1.000, "map": 0.875, "obs": 3, "own": 1.373, "comp": {"cins": -0.7037, "dshield": -1.3018, "crowdsec": -5.1073, "vulncheck": -0.7475, "blocklist_de": 9.1206}, "mass": 3.4, "listed": false}}, "abq": true, "bot": 0.077, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-SBI2-AP-APNIC", "org": "Smart Broadband, Inc.", "pdb": null, "pfx": 212, "reg": "2006-11-21", "rir": "apnic", "s24": 689, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 387328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.147593}, {"a": 10197, "h": "CNU-AS-KR", "n": "Chonnam National University", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-10197-APNIC", "org": "Chonnam National University", "pdb": null, "pfx": 11, "reg": "2000-09-01", "rir": "apnic", "s24": 256, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 68096, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002782810478}, {"a": 10225, "h": "NETTLINX-IN-AP", "n": "Nettlinx", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.532, 0.011, 0, false], ["2026-10-12", 1.648, 0.012, 0, false]], "sh": false, "uc": 1550.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.269, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.648, "se": 0.947, "ts": 0.500, "map": 7.193, "obs": 2, "own": 1.473, "comp": {"cins": -0.3062, "dshield": -0.657, "crowdsec": 1.6579, "vulncheck": -0.531, "blocklist_de": 3.2031}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.121, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "@aut-10225-APNIC", "org": "Nettlinx Limited", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.nettlinx.com"}, "pfx": 32, "reg": "2000-09-29", "rir": "apnic", "s24": 33, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": "networks@nettlinx.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10269, "h": "", "n": "Belize Telemedia", "t": "Broadband & mobile", "w": 9, "cc": "BZ", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0380, "hi": 2.81, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "vulncheck": {"n": 1, "p": 0.1458, "hi": 4.17, "lo": 0.31, "ips": 8, "mean": 1.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.1044, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.430, 0.010, 0, false], ["2026-10-12", 0.509, 0.011, 0, false]], "sh": false, "uc": 154.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 1.030, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.509, "se": 0.753, "ts": 0.333, "map": 1.505, "obs": 3, "own": 2.404, "comp": {"cins": -0.4835, "dshield": -0.9683, "crowdsec": -0.0218, "vulncheck": 1.213, "blocklist_de": 2.0633}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.143, "det": {"vulncheck": {"botnet_node": 8}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-10269-LACNIC", "org": "Belize Telemedia Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.livedigi.com"}, "pfx": 34, "reg": "1997-06-03", "rir": "lacnic", "s24": 260, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 136448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0025108614828}, {"a": 10396, "h": "COQUI-NET", "n": "Claro Puerto Rico", "t": "Broadband & mobile", "w": 4, "cc": "PR", "cf": null, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.4896, "hi": 5.81, "lo": 1.25, "ips": 4, "mean": 3.17, "above": false}}, "h2": [["2026-10-12", 0.254, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.832, "ts": null, "map": 0.128, "obs": 0, "own": 0.633, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.254, "se": 0.640, "ts": 1.000, "map": 0.613, "obs": 4, "own": 0.957, "comp": {"cins": -0.7534, "dshield": 11.5695, "crowdsec": -5.3723, "vulncheck": -0.7634, "blocklist_de": -3.7761}, "mass": 3.7, "listed": false}}, "abq": true, "bot": 0.124, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "DCI-ARIN", "org": "DATACOM CARIBE, INC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.claropr.com"}, "pfx": 135, "reg": "1997-07-11", "rir": "arin", "s24": 1067, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 484096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01564598188818}, {"a": 10429, "h": "", "n": "TELEFÔNICA BRASIL AS10429", "t": "Broadband & mobile", "w": 56, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 15, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 50, "web_bruteforce": 47, "home_connection": 29, "mail_bruteforce": 45, "router_or_botnet": 3, "cve:CVE-2026-8181": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-63030": 2}, "n": 54}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.53, "lo": 0.09, "ips": 3, "mean": 0.27, "above": false}, "crowdsec": {"n": 50, "p": 0.3171, "hi": 3.51, "lo": 2.21, "ips": 54, "mean": 2.83, "above": false}, "phishing_db": {"n": 1, "p": 0.0001, "hi": 1.15, "lo": 0.09, "ips": 1, "mean": 0.48, "above": false}, "blocklist_de": {"n": 32, "p": 0.9609, "hi": 5.46, "lo": 3.07, "ips": 34, "mean": 4.19, "above": true}}, "h2": [["2026-10-05", 1.584, 0.031, 0, false], ["2026-10-12", 1.596, 0.033, 0, false]], "sh": false, "uc": 325.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.033, "se": 1.328, "ts": 1.000, "map": 0.174, "obs": 1, "own": 0.612, "comp": {"urlhaus": -0.6259, "threatfox": -0.3991, "phishing_db": 0.9044}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 50, "vulncheck": 0, "blocklist_de": 32}, "lo": 1.596, "se": 0.372, "ts": 0.610, "map": 2.453, "obs": 82, "own": 3.773, "comp": {"cins": -3.7096, "dshield": -3.3614, "crowdsec": 3.0721, "vulncheck": -1.0028, "blocklist_de": 7.2927}, "mass": 87.1, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3, "imap": 22, "mail": 31}}, "oid": "@family-59211", "org": "TELEFÔNICA BRASIL S.A", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.telefonica.com.br"}, "pfx": 83, "reg": "1999-11-16", "rir": "lacnic", "s24": 6412, "sib": 11, "tor": 1, "w24": 51, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2403584, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.02598055260297}, {"a": 10430, "h": "WA-K20", "n": "Washington State K-20 Telecommunications Network", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0230, "hi": 2.51, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "dshield": {"n": 3, "p": 0.1183, "hi": 3.63, "lo": 0.64, "ips": 3, "mean": 1.87, "above": false}}, "h2": [["2026-10-12", 0.147, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.780, "ts": null, "map": 0.105, "obs": 0, "own": 0.487, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.147, "se": 0.638, "ts": 0.750, "map": 0.354, "obs": 4, "own": 0.555, "comp": {"cins": 3.4116, "dshield": 7.727, "crowdsec": -5.8096, "vulncheck": -0.7876, "blocklist_de": -4.1854}, "mass": 4.2, "listed": false}}, "abq": true, "bot": 0.277, "det": null, "oid": "WSKT-ARIN", "org": "Washington State K-20 Telecommunications Network", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.wa-k20.net/"}, "pfx": 92, "reg": "1997-08-01", "rir": "arin", "s24": 2106, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 549632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10439, "h": "CARINET", "n": "CARI.net - Fiber Alley Data Centers", "t": "Hosting & VPS", "w": 176, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 29, "data_centre": 116, "web_exploit": 143, "bad_crawling": 23, "proxy_or_vpn": 7, "ssh_bruteforce": 141, "web_bruteforce": 67, "home_connection": 4, "mail_bruteforce": 1, "cve:CVE-2017-3506": 37, "cve:CVE-2017-12149": 81, "cve:CVE-2017-18362": 59, "cve:CVE-2018-13379": 78, "cve:CVE-2019-18935": 37}, "n": 152}, "ev": {"cins": {"n": 8, "p": 0.9896, "hi": 12.27, "lo": 3.99, "ips": 24, "mean": 7.65, "above": true}, "shodan": {"n": 4, "p": 0.3313, "hi": 4.84, "lo": 1.04, "ips": 4, "mean": 2.64, "above": false}, "dshield": {"n": 6, "p": 0.9204, "hi": 9.67, "lo": 2.68, "ips": 8, "mean": 5.71, "above": true}, "crowdsec": {"n": 14, "p": 0.9977, "hi": 10.38, "lo": 4.39, "ips": 152, "mean": 7.11, "above": true}, "blocklist_de": {"n": 13, "p": 0.9998, "hi": 14.29, "lo": 5.85, "ips": 22, "mean": 9.68, "above": true}}, "h2": [["2026-10-05", 11.535, 0.009, 1, false], ["2026-10-12", 13.120, 0.010, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.010, "se": 1.905, "ts": null, "map": 0.157, "obs": 0, "own": 0.137, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 6, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 13}, "lo": 13.120, "se": 0.384, "ts": 0.341, "map": 20.471, "obs": 41, "own": 3.991, "comp": {"cins": 8.2445, "dshield": 0.2732, "crowdsec": -4.4561, "vulncheck": -0.9914, "blocklist_de": 1.3426}, "mass": 47.0, "listed": false}}, "abq": true, "bot": 0.964, "det": {"shodan": {"c2": 4}, "blocklist_de": {"ssh": 16, "bots": 2, "mail": 4}}, "oid": "CARIN-6-ARIN", "org": "CariNet, Inc.", "pdb": {"t": null, "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.fiberalley.com"}, "pfx": 6, "reg": "1997-08-05", "rir": "arin", "s24": 417, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 106752, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": null}, {"a": 10489, "h": "ARMOUR-AS", "n": "Convergent Internet Solutions", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.840, 0, false], ["2026-10-12", 0.012, 0.887, 0, false]], "sh": false, "uc": 8203.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.887, "se": 1.784, "ts": 1.000, "map": 12.743, "obs": 1, "own": 20.214, "comp": {"urlhaus": 4.4321, "threatfox": -0.0933, "phishing_db": -0.1677}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.814, "det": {"blocklist_de": {"mail": 1}}, "oid": "ACL-1319-ARIN", "org": "Armour Cloud, LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.smstv.com"}, "pfx": 8, "reg": "1997-08-26", "rir": "arin", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "admin@armourcloud.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10620, "h": "", "n": "Telmex Colombia S.A.", "t": "Broadband & mobile", "w": 23, "cc": "CO", "cf": {"rb": "", "wb": "", "rep": 1.19, "waf": 0.69}, "cs": {"c": {"web_exploit": 6, "ssh_bruteforce": 9, "web_bruteforce": 8, "home_connection": 9, "mail_bruteforce": 7, "cve:CVE-2026-8181": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-75650": 1}, "n": 10}, "ev": {"cins": {"n": 2, "p": 0.0005, "hi": 1.58, "lo": 0.21, "ips": 2, "mean": 0.75, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "dshield": {"n": 3, "p": 0.0003, "hi": 1.61, "lo": 0.28, "ips": 3, "mean": 0.83, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.86, "lo": 0.31, "ips": 10, "mean": 0.56, "above": false}, "blocklist_de": {"n": 11, "p": 0.0009, "hi": 2.12, "lo": 0.81, "ips": 13, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 0.375, 0.005, 0, false], ["2026-10-12", 0.482, 0.006, 0, false]], "sh": false, "uc": 54, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.698, "ts": null, "map": 0.066, "obs": 0, "own": 0.297, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 11}, "lo": 0.482, "se": 0.414, "ts": 0.423, "map": 0.791, "obs": 26, "own": 1.222, "comp": {"cins": 0.994, "dshield": -0.5188, "crowdsec": -3.5511, "vulncheck": -0.9787, "blocklist_de": 5.2142}, "mass": 31.1, "listed": false}}, "abq": true, "bot": 0.144, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 8, "imap": 5, "mail": 5}}, "oid": "@aut-27864-LACNIC", "org": "Telmex Colombia S.A.", "pdb": null, "pfx": 3399, "reg": "1997-10-06", "rir": "lacnic", "s24": 7071, "sib": 3, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1821696, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.093308}, {"a": 10680, "h": "IU-RESEARCH", "n": "Indiana University", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3683, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 1.256, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.928, "det": {"shodan": {"compromised": 2}}, "oid": "INDIAN-Z-ARIN", "org": "Indiana University", "pdb": null, "pfx": 5, "reg": "1997-10-22", "rir": "arin", "s24": 40, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": "abuse@iu.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10753, "h": "LUMEN-LEGACY-L3-CUSTOMER-SHARED-USE", "n": "Level 3 Parent, LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0219, "hi": 2.49, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}}, "h2": [["2026-10-05", 0.026, 0.008, 0, false], ["2026-10-12", 0.025, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.797, "ts": null, "map": 0.113, "obs": 0, "own": 0.214, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.025, "se": 1.020, "ts": 1.000, "map": 0.123, "obs": 1, "own": 0.074, "comp": {"cins": -0.2703, "dshield": 3.787, "crowdsec": -2.3229, "vulncheck": -0.4971, "blocklist_de": -1.3959}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.451, "det": null, "oid": "LPL-141-ARIN", "org": "Level 3 Parent, LLC", "pdb": null, "pfx": 839, "reg": "1997-11-18", "rir": "arin", "s24": 1684, "sib": 39, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 445184, "abuse": "abuse@level3.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00543380663005}, {"a": 10778, "h": "", "n": "MCL Internet", "t": "Broadband & mobile", "w": 0, "cc": "CL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1134, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.008, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.997, "ts": null, "map": 0.183, "obs": 0, "own": 1.307, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.787, "ts": null, "map": 0.150, "obs": 0, "own": 0.449, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.896, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-10778-LACNIC", "org": "MCL Internet", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.netglobalis.net"}, "pfx": 13, "reg": "1997-11-21", "rir": "lacnic", "s24": 114, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046982483586}, {"a": 10796, "h": "TWC-10796-MIDWEST", "n": "Charter Communications (10796)", "t": "Broadband & mobile", "w": 35, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.46, "waf": 0.30}, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 8, "web_bruteforce": 4, "home_connection": 8, "mail_bruteforce": 6, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.36, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.12, "lo": 0.02, "ips": 3, "mean": 0.06, "above": false}, "dshield": {"n": 9, "p": 0.0000, "hi": 0.95, "lo": 0.33, "ips": 9, "mean": 0.60, "above": false}, "urlhaus": {"n": 3, "p": 0.0048, "hi": 2.11, "lo": 0.37, "ips": 3, "mean": 1.09, "above": false}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 0.19, "lo": 0.06, "ips": 8, "mean": 0.12, "above": false}, "vulncheck": {"n": 5, "p": 0.0000, "hi": 0.65, "lo": 0.16, "ips": 5, "mean": 0.37, "above": false}, "blocklist_de": {"n": 13, "p": 0.0000, "hi": 0.65, "lo": 0.26, "ips": 13, "mean": 0.44, "above": false}}, "h2": [["2026-10-05", 0.142, 0.094, 0, false], ["2026-10-12", 0.149, 0.105, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.105, "se": 1.062, "ts": 1.000, "map": 0.337, "obs": 3, "own": 1.031, "comp": {"urlhaus": 2.2551, "threatfox": -0.5632, "phishing_db": -1.1525}, "mass": 17.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 9, "crowdsec": 8, "vulncheck": 5, "blocklist_de": 13}, "lo": 0.149, "se": 0.408, "ts": 0.361, "map": 0.237, "obs": 36, "own": 0.367, "comp": {"cins": -1.3644, "dshield": 3.1931, "crowdsec": -6.5521, "vulncheck": -0.1825, "blocklist_de": 4.8593}, "mass": 38.2, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"malware": 1, "compromised": 1, "doublepulsar": 1}, "vulncheck": {"c2_server": 5}, "blocklist_de": {"ssh": 2, "bots": 2, "imap": 8, "mail": 9}}, "oid": "CC-3517-ARIN", "org": "Charter Communications Inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.spectrum.com/"}, "pfx": 642, "reg": "2000-06-09", "rir": "arin", "s24": 28944, "sib": 31, "tor": 0, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9848832, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.30885}, {"a": 10834, "h": "", "n": "Telefonica Empresas", "t": "Broadband & mobile", "w": 4, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.0305, "hi": 2.67, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "crowdsec": {"n": 3, "p": 0.0003, "hi": 1.60, "lo": 0.28, "ips": 3, "mean": 0.83, "above": false}, "blocklist_de": {"n": 2, "p": 0.0182, "hi": 2.47, "lo": 0.32, "ips": 2, "mean": 1.18, "above": false}}, "h2": [["2026-10-05", 0.273, 0.008, 0, false], ["2026-10-12", 0.355, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.809, "ts": null, "map": 0.118, "obs": 0, "own": 0.565, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.355, "se": 0.562, "ts": 0.500, "map": 0.753, "obs": 6, "own": 1.171, "comp": {"cins": -1.1258, "dshield": 0.7662, "crowdsec": 0.5297, "vulncheck": -0.8473, "blocklist_de": 1.787}, "mass": 6.1, "listed": false}}, "abq": true, "bot": 0.188, "det": {"blocklist_de": {"ssh": 2}}, "oid": "@family-70025", "org": "Telefonica de Argentina", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.movistar.com.ar/"}, "pfx": 91, "reg": "1997-12-08", "rir": "lacnic", "s24": 1443, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 396800, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00237291052572}, {"a": 10879, "h": "UHC", "n": "Unitedhealthcare", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.52}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.848, "ts": null, "map": 0.135, "obs": 0, "own": 1.150, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.523, "ts": null, "map": 0.058, "obs": 0, "own": 0.449, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.808, "det": null, "oid": "UNITED-215-ARIN", "org": "Unitedhealthcare", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.uhc.com"}, "pfx": 92, "reg": "1997-12-17", "rir": "arin", "s24": 874, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 263168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00716986208488}, {"a": 10913, "h": "INTERNAP-BLK", "n": "Unitas Global", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0940, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 0.488, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.750, "ts": null, "map": 0.136, "obs": 0, "own": 0.139, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.864, "det": {"shodan": {"malware": 1}}, "oid": "UG-210-ARIN", "org": "Unitas Global", "pdb": null, "pfx": 34, "reg": "1998-01-20", "rir": "arin", "s24": 151, "sib": 30, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 48640, "abuse": "abuse@unitasglobal.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10961, "h": "BGP-AS", "n": "Boston GigaPoP", "t": "Enterprise, edu & gov", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 3.617, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 46.156, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.099, "det": null, "oid": "BOSTON-68-ARIN", "org": "Boston GigaPoP", "pdb": {"t": "Educational/Research", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.bu.edu"}, "pfx": 2, "reg": "1998-02-27", "rir": "arin", "s24": 9, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "noc@bu.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10964, "h": "", "n": "Banco Credicoop Cooperativo Limitado", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.326, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-10964-LACNIC", "org": "Banco Credicoop Cooperativo Limitado", "pdb": null, "pfx": 7, "reg": "1998-02-17", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10990, "h": "ATLDC", "n": "Tulix Systems, Inc.", "t": "Other", "w": 8, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 8, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.708, 0.011, 0, false], ["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 6.496, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.888, "det": {"vulncheck": {"botnet_node": 8}}, "oid": "TULIX-ARIN", "org": "Tulix Systems, Inc.", "pdb": null, "pfx": 1, "reg": "2007-05-24", "rir": "arin", "s24": 4, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 10996, "h": "CONCORDE", "n": "VIF Internet", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-43798": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.304, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.727, "det": null, "oid": "CONCOR-51-ARIN", "org": "Concorde inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.vif.com"}, "pfx": 1, "reg": "1998-03-03", "rir": "arin", "s24": 32, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11014, "h": "", "n": "CPS", "t": "Broadband & mobile", "w": 8, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 5}, "ev": {"shodan": {"n": 2, "p": 0.2191, "hi": 4.57, "lo": 0.59, "ips": 2, "mean": 2.18, "above": false}, "dshield": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "urlhaus": {"n": 2, "p": 0.4123, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "crowdsec": {"n": 5, "p": 0.7180, "hi": 7.15, "lo": 1.78, "ips": 5, "mean": 4.08, "above": false}}, "h2": [["2026-10-05", 2.274, 5.307, 0, false], ["2026-10-12", 2.248, 2.260, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 2.260, "se": 1.161, "ts": 1.000, "map": 11.318, "obs": 2, "own": 26.750, "comp": {"urlhaus": 5.449, "threatfox": -0.467, "phishing_db": -0.9294}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.248, "se": 0.566, "ts": 0.833, "map": 4.813, "obs": 6, "own": 7.443, "comp": {"cins": -0.9336, "dshield": 1.3004, "crowdsec": 8.0369, "vulncheck": -0.8102, "blocklist_de": -4.6284}, "mass": 4.7, "listed": false}}, "abq": true, "bot": 0.589, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-11014-LACNIC", "org": "CPS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.metrotel.com.ar/"}, "pfx": 185, "reg": "1998-03-09", "rir": "lacnic", "s24": 177, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 76544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00328124325942}, {"a": 11042, "h": "NTHL", "n": "NETWORK TRANSIT HOLDINGS", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1550, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 1, "p": 0.0380, "hi": 2.81, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "phishing_db": {"n": 2, "p": 0.3434, "hi": 5.59, "lo": 0.73, "ips": 2, "mean": 2.66, "above": false}}, "h2": [["2026-10-05", 0.558, 0.677, 0, false], ["2026-10-12", 0.329, 0.695, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.695, "se": 1.137, "ts": 1.000, "map": 2.967, "obs": 2, "own": 1.213, "comp": {"urlhaus": -0.4597, "threatfox": -0.3478, "phishing_db": 3.5212}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.329, "se": 0.872, "ts": 0.500, "map": 1.225, "obs": 2, "own": 0.249, "comp": {"cins": 4.3622, "dshield": -0.8296, "crowdsec": 0.7253, "vulncheck": -0.6046, "blocklist_de": -2.0567}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "NTHL-ARIN", "org": "NETWORK TRANSIT HOLDINGS LLC", "pdb": {"t": "Network Services", "sc": "North America", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.networktransit.net/"}, "pfx": 96, "reg": "2010-12-03", "rir": "arin", "s24": 260, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 66560, "abuse": "abuse@networktransit.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11139, "h": "CWC-ROC-11139", "n": "CWDOM", "t": "Broadband & mobile", "w": 1, "cc": "DM", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 49, "p": 1.0000, "hi": 37.50, "lo": 23.50, "ips": 49, "mean": 30.16, "above": true}, "crowdsec": {"n": 1, "p": 0.0276, "hi": 2.61, "lo": 0.20, "ips": 1, "mean": 1.10, "above": false}, "blocklist_de": {"n": 1, "p": 0.0923, "hi": 3.57, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}}, "h2": [["2026-10-05", 0.506, 0.010, 0, false], ["2026-10-12", 0.280, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.928, "ts": null, "map": 0.165, "obs": 0, "own": 0.976, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.280, "se": 0.865, "ts": 0.500, "map": 1.040, "obs": 2, "own": 1.659, "comp": {"cins": -0.4038, "dshield": -0.8336, "crowdsec": 0.704, "vulncheck": -0.6061, "blocklist_de": 2.5728}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.204, "det": {"shodan": {"compromised": 49}, "blocklist_de": {"ssh": 1}}, "oid": "CWD-18-ARIN", "org": "Cable & Wireless Dominica", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.discoverflow.co"}, "pfx": 310, "reg": "1998-04-21", "rir": "arin", "s24": 308, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 142336, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00166728547262}, {"a": 11172, "h": "", "n": "Alestra", "t": "Broadband & mobile", "w": 13, "cc": "MX", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 5}, "n": 6}, "ev": {"cins": {"n": 2, "p": 0.0638, "hi": 3.17, "lo": 0.41, "ips": 2, "mean": 1.51, "above": false}, "dshield": {"n": 1, "p": 0.0088, "hi": 2.10, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "crowdsec": {"n": 6, "p": 0.0001, "hi": 1.64, "lo": 0.46, "ips": 6, "mean": 0.97, "above": false}, "phishing_db": {"n": 2, "p": 0.0456, "hi": 2.94, "lo": 0.38, "ips": 2, "mean": 1.40, "above": false}, "blocklist_de": {"n": 3, "p": 0.0071, "hi": 2.21, "lo": 0.39, "ips": 3, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 0.514, 0.138, 0, false], ["2026-10-12", 0.563, 0.143, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.143, "se": 1.148, "ts": 1.000, "map": 0.566, "obs": 2, "own": 1.709, "comp": {"urlhaus": -0.7148, "threatfox": -0.4205, "phishing_db": 2.1923}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.563, "se": 0.471, "ts": 0.500, "map": 1.015, "obs": 12, "own": 1.571, "comp": {"cins": 4.1429, "dshield": -0.8639, "crowdsec": -0.143, "vulncheck": -0.9313, "blocklist_de": -0.7961}, "mass": 13.2, "listed": false}}, "abq": true, "bot": 0.160, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-11172-LACNIC", "org": "Alestra, S. de R.L. de C.V.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://alestra.com.mx"}, "pfx": 951, "reg": "1998-05-05", "rir": "lacnic", "s24": 2335, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1247744, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0189558117504}, {"a": 11191, "h": "CALNET", "n": "Cal.net", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1169, "hi": 3.85, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "dshield": {"n": 1, "p": 0.1745, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.160, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.001, "ts": null, "map": 0.183, "obs": 0, "own": 1.326, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.160, "se": 1.198, "ts": 1.000, "map": 1.120, "obs": 1, "own": 1.925, "comp": {"cins": -0.1615, "dshield": 4.3288, "crowdsec": -1.4557, "vulncheck": -0.3639, "blocklist_de": -0.8402}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 1}}, "oid": "CALNE-88-ARIN", "org": "Cal.net, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.cal.net/"}, "pfx": 78, "reg": "1998-05-12", "rir": "arin", "s24": 108, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45056, "abuse": "abuse@corp.cal.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11232, "h": "MIDCO-NET", "n": "Midcontinent Communications", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.63, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.52, "lo": 0.04, "ips": 1, "mean": 0.22, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 1.11, "lo": 0.08, "ips": 1, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 0.091, 0.007, 0, false], ["2026-10-12", 0.042, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.754, "ts": null, "map": 0.092, "obs": 0, "own": 0.420, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.042, "se": 0.803, "ts": 0.500, "map": 0.137, "obs": 2, "own": 0.218, "comp": {"cins": -0.5125, "dshield": -1.0153, "crowdsec": -0.2748, "vulncheck": -0.6691, "blocklist_de": 1.8791}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "MIDCO-1-ARIN", "org": "Midcontinent Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.midco.com/"}, "pfx": 79, "reg": "1998-05-22", "rir": "arin", "s24": 3046, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 937472, "abuse": "abuse@midco.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03071353181528}, {"a": 11260, "h": "EASTLINK-HSI", "n": "Eastlink", "t": "Broadband & mobile", "w": 5, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 3, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0174, "hi": 2.37, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 1.06, "lo": 0.19, "ips": 3, "mean": 0.55, "above": false}, "blocklist_de": {"n": 1, "p": 0.0003, "hi": 1.34, "lo": 0.10, "ips": 1, "mean": 0.57, "above": false}}, "h2": [["2026-10-05", 0.201, 0.007, 0, false], ["2026-10-12", 0.183, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.772, "ts": null, "map": 0.101, "obs": 0, "own": 0.465, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.183, "se": 0.594, "ts": 0.600, "map": 0.410, "obs": 5, "own": 0.640, "comp": {"cins": 2.9923, "dshield": -1.7148, "crowdsec": 1.3694, "vulncheck": -0.8307, "blocklist_de": -1.3139}, "mass": 5.4, "listed": false}}, "abq": true, "bot": 0.124, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "BRAGG-ARIN", "org": "EastLink", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "https://www.eastlink.ca"}, "pfx": 112, "reg": "1998-06-04", "rir": "arin", "s24": 2364, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 623104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02319256101078}, {"a": 11290, "h": "CC-3272", "n": "Cogeco Connexion", "t": "Broadband & mobile", "w": 3, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0383, "hi": 2.81, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 1.06, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}, "dshield": {"n": 1, "p": 0.0236, "hi": 2.52, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.89, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "blocklist_de": {"n": 1, "p": 0.0024, "hi": 1.73, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}}, "h2": [["2026-10-05", 0.124, 0.008, 0, false], ["2026-10-12", 0.199, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.800, "ts": null, "map": 0.114, "obs": 0, "own": 0.539, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.199, "se": 0.641, "ts": 0.250, "map": 0.481, "obs": 4, "own": 0.752, "comp": {"cins": 3.3384, "dshield": 1.4821, "crowdsec": -3.0067, "vulncheck": -0.7961, "blocklist_de": -0.3567}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.143, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "CC-3272-ARIN", "org": "Cogeco Connexion inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Restrictive", "web": "http://www.cogeco.com"}, "pfx": 63, "reg": "1998-06-16", "rir": "arin", "s24": 1630, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 417280, "abuse": "abuse@cgocable.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01232790614797}, {"a": 11320, "h": "LIGHTEDGE-AS-02", "n": "LightEdge Solutions", "t": "Transit & backbone", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "home_connection": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0604, "hi": 3.15, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "crowdsec": {"n": 2, "p": 0.0003, "hi": 1.51, "lo": 0.20, "ips": 2, "mean": 0.72, "above": false}, "vulncheck": {"n": 1, "p": 0.0447, "hi": 2.92, "lo": 0.22, "ips": 3, "mean": 1.23, "above": false}, "phishing_db": {"n": 1, "p": 0.0497, "hi": 3.00, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "blocklist_de": {"n": 1, "p": 0.0084, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.241, 0.083, 0, false], ["2026-10-12", 0.300, 0.088, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.088, "se": 1.349, "ts": 1.000, "map": 0.533, "obs": 1, "own": 2.382, "comp": {"urlhaus": -0.389, "threatfox": -0.3196, "phishing_db": 1.7056}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.300, "se": 0.612, "ts": 0.400, "map": 0.692, "obs": 5, "own": 2.205, "comp": {"cins": 3.2561, "dshield": -1.5725, "crowdsec": -0.3563, "vulncheck": 0.2838, "blocklist_de": -0.5858}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.949, "det": {"vulncheck": {"c2_server": 3}, "blocklist_de": {"bots": 1}}, "oid": "LIGHT-41-ARIN", "org": "LightEdge Solutions", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Open", "web": "http://www.lightedge.com"}, "pfx": 114, "reg": "1998-06-29", "rir": "arin", "s24": 1194, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 578816, "abuse": "abuse@lightedge.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11342, "h": "PATHWAY", "n": "Pathway Communications", "t": "Broadband & mobile", "w": 5, "cc": "CA", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 5, "home_connection": 4, "router_or_botnet": 5, "cve:CVE-2019-8318": 4, "cve:CVE-2018-10562": 4, "cve:CVE-2018-20062": 1, "cve:CVE-2024-12847": 4}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.5293, "hi": 6.08, "lo": 1.31, "ips": 5, "mean": 3.32, "above": false}}, "h2": [["2026-10-05", 1.148, 0.010, 0, false], ["2026-10-12", 1.192, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.963, "ts": null, "map": 0.175, "obs": 0, "own": 1.133, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.192, "se": 0.656, "ts": 1.000, "map": 2.999, "obs": 4, "own": 4.667, "comp": {"cins": -0.6707, "dshield": -1.2552, "crowdsec": 8.5331, "vulncheck": -0.7362, "blocklist_de": -3.3791}, "mass": 3.2, "listed": false}}, "abq": true, "bot": 0.689, "det": null, "oid": "PATH-ARIN", "org": "Pathway Communications", "pdb": {"t": "NSP", "sc": "North America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.pathcom.com"}, "pfx": 37, "reg": "1998-07-13", "rir": "arin", "s24": 190, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 55296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014880555613}, {"a": 11351, "h": "TWC-11351-NORTHEAST", "n": "Charter Communications Inc", "t": "Hosting & VPS", "w": 17, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.52, "waf": 0.45}, "cs": {"c": {"data_centre": 4, "web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 5, "router_or_botnet": 2}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.58, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.28, "lo": 0.07, "ips": 5, "mean": 0.16, "above": false}, "dshield": {"n": 6, "p": 0.0000, "hi": 1.17, "lo": 0.33, "ips": 6, "mean": 0.69, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.23, "lo": 0.06, "ips": 5, "mean": 0.13, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 0.79, "lo": 0.14, "ips": 3, "mean": 0.41, "above": false}, "blocklist_de": {"n": 6, "p": 0.0000, "hi": 0.62, "lo": 0.17, "ips": 6, "mean": 0.37, "above": false}}, "h2": [["2026-10-05", 0.106, 0.004, 0, false], ["2026-10-12", 0.134, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.652, "ts": null, "map": 0.045, "obs": 0, "own": 0.032, "comp": null, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 6}, "lo": 0.134, "se": 0.436, "ts": 0.286, "map": 0.227, "obs": 21, "own": 0.045, "comp": {"cins": -0.0298, "dshield": 3.9965, "crowdsec": -5.3466, "vulncheck": -0.1192, "blocklist_de": 1.4093}, "mass": 21.4, "listed": false}}, "abq": false, "bot": 0.134, "det": {"shodan": {"malware": 1, "compromised": 4}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"imap": 5, "mail": 6}}, "oid": "CC-3517-ARIN", "org": "Charter Communications Inc", "pdb": null, "pfx": 129, "reg": "1998-07-14", "rir": "arin", "s24": 16865, "sib": 31, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4324608, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.140983}, {"a": 11377, "h": "SENDGRID", "n": "SendGrid", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.0492, "hi": 2.99, "lo": 0.39, "ips": 2, "mean": 1.42, "above": false}}, "h2": [["2026-10-05", 0.104, 0.008, 0, false], ["2026-10-12", 0.112, 0.009, 0, false]], "sh": false, "uc": 78.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.835, "ts": null, "map": 0.130, "obs": 0, "own": 0.099, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.112, "se": 0.833, "ts": 1.000, "map": 0.391, "obs": 2, "own": 0.079, "comp": {"cins": -0.4963, "dshield": -0.9892, "crowdsec": -3.8915, "vulncheck": -0.6608, "blocklist_de": 6.4912}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.989, "det": {"blocklist_de": {"mail": 2}}, "oid": "SENDG-12-ARIN", "org": "SendGrid, Inc.", "pdb": {"t": "Content", "sc": "North America", "tr": "50-100Gbps", "pol": "Selective", "web": "https://sendgrid.com/"}, "pfx": 141, "reg": "2012-06-28", "rir": "arin", "s24": 1032, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 264192, "abuse": "abuse@sendgrid.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11404, "h": "AS-WAVE-1", "n": "Wave Division Holdings", "t": "Transit & backbone", "w": 12, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.24, "waf": 1.08}, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 1.00, "lo": 0.07, "ips": 1, "mean": 0.42, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.31, "lo": 0.04, "ips": 2, "mean": 0.15, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 1.34, "lo": 0.24, "ips": 3, "mean": 0.69, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.31, "lo": 0.06, "ips": 3, "mean": 0.16, "above": false}, "threatfox": {"n": 1, "p": 0.0067, "hi": 2.01, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}, "vulncheck": {"n": 3, "p": 0.0000, "hi": 1.37, "lo": 0.24, "ips": 3, "mean": 0.71, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.89, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}}, "h2": [["2026-10-05", 0.080, 0.075, 0, false], ["2026-10-12", 0.086, 0.052, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.052, "se": 1.181, "ts": 0.500, "map": 0.202, "obs": 2, "own": 0.977, "comp": {"urlhaus": -0.9004, "threatfox": 0.6184, "phishing_db": 0.3102}, "mass": 3.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.086, "se": 0.509, "ts": 0.300, "map": 0.164, "obs": 10, "own": 0.521, "comp": {"cins": 2.2162, "dshield": 4.5311, "crowdsec": -1.6071, "vulncheck": 1.1513, "blocklist_de": -6.7066}, "mass": 8.2, "listed": false}}, "abq": false, "bot": 0.230, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 1}}, "oid": "WAVEB-ARIN", "org": "Wave Broadband", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://business.wavebroadband.com/"}, "pfx": 1836, "reg": "2007-03-28", "rir": "arin", "s24": 8890, "sib": 16, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2979072, "abuse": "noc@astound.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.059172}, {"a": 11426, "h": "TWC-11426-CAROLINAS", "n": "Charter Communications Inc", "t": "Broadband & mobile", "w": 20, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.59, "waf": 0.34}, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 5, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 4, "router_or_botnet": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2019-9082": 2, "cve:CVE-2018-10562": 1, "cve:CVE-2018-20062": 2}, "n": 7}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.21, "lo": 0.04, "ips": 3, "mean": 0.11, "above": false}, "dshield": {"n": 6, "p": 0.0000, "hi": 1.16, "lo": 0.32, "ips": 6, "mean": 0.68, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.28, "lo": 0.09, "ips": 7, "mean": 0.17, "above": false}, "vulncheck": {"n": 6, "p": 0.0000, "hi": 1.19, "lo": 0.33, "ips": 6, "mean": 0.70, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 0.47, "lo": 0.10, "ips": 4, "mean": 0.26, "above": false}}, "h2": [["2026-10-05", 0.117, 0.004, 0, false], ["2026-10-12", 0.119, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.651, "ts": null, "map": 0.045, "obs": 0, "own": 0.204, "comp": null, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 7, "vulncheck": 6, "blocklist_de": 4}, "lo": 0.119, "se": 0.435, "ts": 0.304, "map": 0.197, "obs": 23, "own": 0.307, "comp": {"cins": -2.2879, "dshield": 4.7526, "crowdsec": -2.0621, "vulncheck": 0.9378, "blocklist_de": -1.5695}, "mass": 18.9, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"malware": 2, "doublepulsar": 1}, "vulncheck": {"c2_server": 5, "attack_tooling": 1}, "blocklist_de": {"imap": 4, "mail": 4}}, "oid": "CC-3517-ARIN", "org": "Charter Communications Inc", "pdb": null, "pfx": 206, "reg": "2000-06-09", "rir": "arin", "s24": 17142, "sib": 31, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4478720, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.201507}, {"a": 11427, "h": "TWC-11427-TEXAS", "n": "Charter Communications (11427)", "t": "Broadband & mobile", "w": 36, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.55, "waf": 0.28}, "cs": {"c": {"http_flood": 2, "data_centre": 7, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 10, "web_bruteforce": 7, "home_connection": 7, "mail_bruteforce": 8, "router_or_botnet": 1}, "n": 14}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.87, "lo": 0.19, "ips": 4, "mean": 0.47, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.16, "lo": 0.03, "ips": 3, "mean": 0.08, "above": false}, "dshield": {"n": 11, "p": 0.0000, "hi": 1.38, "lo": 0.52, "ips": 11, "mean": 0.91, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 0.36, "lo": 0.15, "ips": 14, "mean": 0.25, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.37, "lo": 0.03, "ips": 1, "mean": 0.16, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.64, "lo": 0.11, "ips": 3, "mean": 0.33, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 0.57, "lo": 0.19, "ips": 8, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.202, 0.038, 0, false], ["2026-10-12", 0.206, 0.040, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.040, "se": 1.137, "ts": 1.000, "map": 0.135, "obs": 3, "own": 0.479, "comp": {"urlhaus": -1.2763, "threatfox": -0.504, "phishing_db": 1.4003}, "mass": 6.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 11, "crowdsec": 14, "vulncheck": 1, "blocklist_de": 8}, "lo": 0.206, "se": 0.402, "ts": 0.368, "map": 0.327, "obs": 38, "own": 0.506, "comp": {"cins": 3.2507, "dshield": 4.0737, "crowdsec": -3.1873, "vulncheck": -0.8384, "blocklist_de": -3.0236}, "mass": 41.2, "listed": false}}, "abq": false, "bot": 0.143, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "imap": 4, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "CC-3517-ARIN", "org": "Charter Communications Inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.spectrum.com/"}, "pfx": 399, "reg": "2000-06-09", "rir": "arin", "s24": 22624, "sib": 31, "tor": 0, "w24": 36, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5886976, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.254391}, {"a": 11432, "h": "", "n": "Telium Telecomunicações Ltda", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1624, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-12", 0.095, 0.011, 0, false]], "sh": false, "uc": 196.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.970, "ts": null, "map": 0.177, "obs": 0, "own": 1.168, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.095, "se": 1.156, "ts": 1.000, "map": 0.589, "obs": 1, "own": 1.040, "comp": {"cins": -0.1354, "dshield": -0.3118, "crowdsec": -1.2342, "vulncheck": 3.2516, "blocklist_de": -0.7052}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.594, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "@aut-11432-LACNIC", "org": "Telium Telecomunicações Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.telium.com.br"}, "pfx": 47, "reg": "1999-11-17", "rir": "lacnic", "s24": 171, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 82944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00387074087589}, {"a": 11442, "h": "NCSU", "n": "North Carolina State University", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0143, "hi": 2.38, "lo": 0.31, "ips": 2, "mean": 1.13, "above": false}}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.857, "ts": null, "map": 0.139, "obs": 0, "own": 0.288, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.539, "ts": null, "map": 0.063, "obs": 0, "own": 0.049, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.103, "det": {"shodan": {"compromised": 2}}, "oid": "NCSU-ARIN", "org": "North Carolina State University", "pdb": null, "pfx": 4, "reg": "2006-02-09", "rir": "arin", "s24": 772, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 197632, "abuse": "abuse@ncsu.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11492, "h": "CABLEONE", "n": "CABLE ONE", "t": "Broadband & mobile", "w": 13, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.38, "waf": 1.20}, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 8, "home_connection": 7, "mail_bruteforce": 7, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 11}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.41, "lo": 0.03, "ips": 1, "mean": 0.17, "above": false}, "dshield": {"n": 1, "p": 0.0002, "hi": 1.30, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 1.29, "lo": 0.49, "ips": 11, "mean": 0.85, "above": false}, "blocklist_de": {"n": 5, "p": 0.0002, "hi": 1.68, "lo": 0.42, "ips": 5, "mean": 0.96, "above": false}}, "h2": [["2026-10-05", 0.377, 0.006, 0, false], ["2026-10-12", 0.368, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.721, "ts": null, "map": 0.077, "obs": 0, "own": 0.345, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.368, "se": 0.441, "ts": 0.647, "map": 0.633, "obs": 17, "own": 0.980, "comp": {"cins": -2.1961, "dshield": -1.3507, "crowdsec": 3.8785, "vulncheck": -0.9504, "blocklist_de": 1.5556}, "mass": 17.4, "listed": false}}, "abq": false, "bot": 0.154, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 4}}, "oid": "CBL1-ARIN", "org": "CABLE ONE, INC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.sparklight.com/"}, "pfx": 4632, "reg": "1998-09-10", "rir": "arin", "s24": 4921, "sib": 1, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1301504, "abuse": "abuse@cableone.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.053256}, {"a": 11527, "h": "NOVABROADBAND", "n": "NovaBroadband LLC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.249, "det": null, "oid": "XPROX-ARIN", "org": "NovaBroadband LLC", "pdb": null, "pfx": 1, "reg": "2025-01-21", "rir": "arin", "s24": 1, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "info@novabroadband.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11556, "h": "", "n": "Cable & Wireless Panama", "t": "Broadband & mobile", "w": 4, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.68, "lo": 0.09, "ips": 2, "mean": 0.33, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.42, "lo": 0.03, "ips": 1, "mean": 0.18, "above": false}, "phishing_db": {"n": 1, "p": 0.0017, "hi": 1.65, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.23, "lo": 0.16, "ips": 2, "mean": 0.59, "above": false}}, "h2": [["2026-10-05", 0.055, 0.093, 0, false], ["2026-10-12", 0.062, 0.045, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.045, "se": 1.330, "ts": 1.000, "map": 0.245, "obs": 1, "own": 0.827, "comp": {"urlhaus": -0.5445, "threatfox": -0.3762, "phishing_db": 1.1397}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.062, "se": 0.698, "ts": 0.667, "map": 0.168, "obs": 3, "own": 0.264, "comp": {"cins": -0.745, "dshield": -1.3589, "crowdsec": -2.1161, "vulncheck": -0.7608, "blocklist_de": 4.5887}, "mass": 3.7, "listed": false}}, "abq": true, "bot": 0.186, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Mirai": 4}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "@aut-11556-LACNIC", "org": "Cable & Wireless Panama", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.cwpanama.com"}, "pfx": 247, "reg": "1998-10-02", "rir": "lacnic", "s24": 3850, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2795008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02335338514647}, {"a": 11562, "h": "", "n": "NETUNO", "t": "Broadband & mobile", "w": 6, "cc": "VE", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.3547, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "crowdsec": {"n": 2, "p": 0.1632, "hi": 4.11, "lo": 0.53, "ips": 2, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.2952, "hi": 5.18, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}}, "h2": [["2026-10-12", 2.267, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.959, "ts": null, "map": 0.174, "obs": 0, "own": 1.115, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.267, "se": 0.568, "ts": 0.333, "map": 4.862, "obs": 6, "own": 7.523, "comp": {"cins": -1.035, "dshield": 3.7385, "crowdsec": -1.3403, "vulncheck": -0.8311, "blocklist_de": 2.4431}, "mass": 5.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "@aut-11562-LACNIC", "org": "Net Uno, C.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Selective", "web": "https://www.netuno.net/"}, "pfx": 193, "reg": "1998-10-06", "rir": "lacnic", "s24": 200, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 51200, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01244703615489}, {"a": 11572, "h": "SS-ATL", "n": "PhoenixNAP LLC", "t": "Other", "w": 87, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 19, "web_exploit": 82, "bad_crawling": 11, "proxy_or_vpn": 79, "web_bruteforce": 1, "cve:CVE-2021-3129": 3, "cve:CVE-2024-4577": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-22947": 6, "cve:CVE-2025-55182": 3}, "n": 87}, "ev": {"crowdsec": {"n": 8, "p": 0.9929, "hi": 13.08, "lo": 4.25, "ips": 87, "mean": 8.15, "above": true}}, "h2": [["2026-10-05", 15.514, 0.011, 1, false], ["2026-10-12", 13.747, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.679, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 0}, "lo": 13.747, "se": 0.518, "ts": 1.000, "map": 26.810, "obs": 8, "own": 15.071, "comp": {"cins": -1.0939, "dshield": -1.7826, "crowdsec": 13.7717, "vulncheck": -0.8419, "blocklist_de": -5.3709}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.890, "det": null, "oid": "PHOEN-56-ARIN", "org": "PhoenixNAP LLC", "pdb": null, "pfx": 14, "reg": "2010-01-11", "rir": "arin", "s24": 39, "sib": 7, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@phoenixnap.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 11664, "h": "", "n": "CLARO ARGENTINA", "t": "Broadband & mobile", "w": 33, "cc": "AR", "cf": {"rb": "", "wb": "", "rep": 1.10, "waf": 0.69}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 10, "web_bruteforce": 4, "home_connection": 9, "mail_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 14}, "ev": {"cins": {"n": 1, "p": 0.0018, "hi": 1.66, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.60, "lo": 0.08, "ips": 2, "mean": 0.29, "above": false}, "dshield": {"n": 4, "p": 0.0267, "hi": 2.71, "lo": 0.58, "ips": 4, "mean": 1.48, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 1.72, "lo": 0.73, "ips": 14, "mean": 1.18, "above": false}, "blocklist_de": {"n": 18, "p": 0.6388, "hi": 4.66, "lo": 2.17, "ips": 19, "mean": 3.32, "above": false}}, "h2": [["2026-10-05", 0.909, 0.006, 0, false], ["2026-10-12", 1.141, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.728, "ts": null, "map": 0.080, "obs": 0, "own": 0.361, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 18}, "lo": 1.141, "se": 0.395, "ts": 0.486, "map": 1.778, "obs": 37, "own": 2.738, "comp": {"cins": -1.6414, "dshield": -0.6711, "crowdsec": -3.7258, "vulncheck": -0.9893, "blocklist_de": 8.9969}, "mass": 43.5, "listed": false}}, "abq": false, "bot": 0.136, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 6, "bots": 12, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-11664-LACNIC", "org": "Techtel LMDS Comunicaciones Interactivas S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.claro.com.ar"}, "pfx": 1512, "reg": "1998-11-09", "rir": "lacnic", "s24": 4410, "sib": 1, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1669120, "abuse": "abuse@claro.com.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.110756}, {"a": 11721, "h": "STYLENTECH", "n": "StylenTech", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2022-26134": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.765, "det": null, "oid": "SL-2142-ARIN", "org": "StylenTech LLC", "pdb": null, "pfx": 3, "reg": "2023-04-10", "rir": "arin", "s24": 3, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@stylenhost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11776, "h": "ATLANTICBB-JOHNSTOWN", "n": "Breezeline", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0025, "hi": 1.73, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.48, "lo": 0.04, "ips": 1, "mean": 0.20, "above": false}, "dshield": {"n": 2, "p": 0.0036, "hi": 1.95, "lo": 0.25, "ips": 2, "mean": 0.93, "above": false}, "urlhaus": {"n": 1, "p": 0.0817, "hi": 3.44, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "vulncheck": {"n": 1, "p": 0.0008, "hi": 1.50, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.053, 0.069, 0, false], ["2026-10-12", 0.067, 0.077, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.077, "se": 1.338, "ts": 1.000, "map": 0.476, "obs": 1, "own": 1.432, "comp": {"urlhaus": 2.2739, "threatfox": -0.4649, "phishing_db": -0.9245}, "mass": 3.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.067, "se": 0.650, "ts": 0.500, "map": 0.166, "obs": 4, "own": 0.262, "comp": {"cins": 3.5424, "dshield": 4.9643, "crowdsec": -5.5061, "vulncheck": 0.4935, "blocklist_de": -3.8992}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"malware": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"bots": 1}}, "oid": "ATLAN-19-ARIN", "org": "Breezeline", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.breezeline.com"}, "pfx": 1922, "reg": "2005-03-14", "rir": "arin", "s24": 4116, "sib": 17, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1734656, "abuse": "Abuse@atlanticbb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03861345114904}, {"a": 11798, "h": "ACEDATACENTERS-DCH", "n": "Ace Data Centers, Inc.", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.7433, "hi": 8.07, "lo": 1.74, "ips": 5, "mean": 4.41, "above": false}, "phishing_db": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-12", 0.939, 0.200, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.200, "se": 1.409, "ts": 1.000, "map": 1.469, "obs": 1, "own": 0.670, "comp": {"urlhaus": -0.2366, "threatfox": -0.2387, "phishing_db": 2.486}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.939, "se": 0.653, "ts": 1.000, "map": 2.353, "obs": 4, "own": 0.467, "comp": {"cins": -0.6891, "dshield": 12.1766, "crowdsec": -5.0279, "vulncheck": -0.7426, "blocklist_de": -3.4677}, "mass": 3.3, "listed": false}}, "abq": true, "bot": 0.860, "det": null, "oid": "ADC-96-ARIN", "org": "Ace Data Centers, Inc.", "pdb": {"t": "Enterprise", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "http://acedatacenter.com"}, "pfx": 194, "reg": "2006-11-01", "rir": "arin", "s24": 250, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 64000, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01322297198872}, {"a": 11805, "h": "ENNWISE-AS", "n": "Ennwise", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 3.143, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 3.436, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.981, "det": {"shodan": {"compromised": 1}}, "oid": "ENNWI-ARIN", "org": "Ennwise", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": null}, "pfx": 7, "reg": "2020-02-28", "rir": "arin", "s24": 7, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11814, "h": "DISTRIBUTEL-AS11814", "n": "Distributel Communications Limited", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0542, "hi": 3.06, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.087, 0.008, 0, false], ["2026-10-12", 0.033, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.817, "ts": null, "map": 0.122, "obs": 0, "own": 0.588, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.033, "se": 1.042, "ts": 1.000, "map": 0.168, "obs": 1, "own": 0.279, "comp": {"cins": 4.6186, "dshield": -0.6136, "crowdsec": -2.4219, "vulncheck": -0.5099, "blocklist_de": -1.4623}, "mass": 1.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "DISTRI-47-ARIN", "org": "Distributel Communications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.distributel.ca"}, "pfx": 90, "reg": "1998-12-30", "rir": "arin", "s24": 1299, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 416512, "abuse": "abuse@distributel.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00866716484277}, {"a": 11830, "h": "", "n": "ICE (Costa Rica)", "t": "Broadband & mobile", "w": 4, "cc": "CR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.0001, "hi": 1.16, "lo": 0.09, "ips": 1, "mean": 0.49, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.48, "lo": 0.08, "ips": 3, "mean": 0.25, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.66, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}}, "h2": [["2026-10-12", 0.075, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.711, "ts": null, "map": 0.072, "obs": 0, "own": 0.324, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.075, "se": 0.588, "ts": 0.600, "map": 0.165, "obs": 5, "own": 0.257, "comp": {"cins": -1.0129, "dshield": 1.0722, "crowdsec": 1.5533, "vulncheck": -0.8268, "blocklist_de": -1.1966}, "mass": 5.3, "listed": false}}, "abq": true, "bot": 0.148, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-11830-LACNIC", "org": "Instituto Costarricense de Electricidad y Telecom.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.grupoice.com"}, "pfx": 1852, "reg": "1999-01-06", "rir": "lacnic", "s24": 5746, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3548672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01653656012106}, {"a": 11831, "h": "ESECUREDATA", "n": "eSecureData", "t": "Other", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1493, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 1, "p": 0.1390, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 0.978, 0.011, 0, false], ["2026-10-12", 0.228, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 0.620, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.228, "se": 1.248, "ts": 1.000, "map": 1.765, "obs": 1, "own": 1.129, "comp": {"cins": -0.1397, "dshield": -0.3213, "crowdsec": 3.48, "vulncheck": -0.3296, "blocklist_de": -0.7276}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.765, "det": {"shodan": {"compromised": 1}}, "oid": "ESECU-4-ARIN", "org": "eSecureData", "pdb": null, "pfx": 52, "reg": "2011-03-25", "rir": "arin", "s24": 59, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "noc@esecuredata.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00032169176284}, {"a": 11840, "h": "VGRS-REGISTRY-AS", "n": "Verisign Anycast US 0D", "t": "Other", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 4, "web_exploit": 2}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 4, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.360, 0.011, 0, false], ["2026-10-12", 0.384, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 2.326, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.983, "det": null, "oid": "VIO-2-ARIN", "org": "VeriSign Infrastructure & Operations", "pdb": null, "pfx": 23, "reg": "1999-01-13", "rir": "arin", "s24": 23, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11845, "h": "Vox-Telecom", "n": "Vox Telecom", "t": "Broadband & mobile", "w": 12, "cc": "ZA", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 6, "router_or_botnet": 4, "cve:CVE-2026-8181": 1}, "n": 6}, "ev": {"cins": {"n": 2, "p": 0.2067, "hi": 4.47, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}, "dshield": {"n": 1, "p": 0.0578, "hi": 3.12, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "crowdsec": {"n": 6, "p": 0.0909, "hi": 3.31, "lo": 0.92, "ips": 6, "mean": 1.96, "above": false}, "blocklist_de": {"n": 4, "p": 0.2704, "hi": 4.49, "lo": 0.97, "ips": 4, "mean": 2.45, "above": false}}, "h2": [["2026-10-05", 0.820, 0.008, 0, false], ["2026-10-12", 1.489, 0.009, 0, false]], "sh": false, "uc": 423.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.132, "obs": 0, "own": 0.657, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.489, "se": 0.462, "ts": 0.462, "map": 2.627, "obs": 13, "own": 4.051, "comp": {"cins": 3.8856, "dshield": -0.9942, "crowdsec": -0.8026, "vulncheck": -0.9367, "blocklist_de": 1.2073}, "mass": 14.1, "listed": false}}, "abq": false, "bot": 0.183, "det": {"blocklist_de": {"bots": 3, "mail": 1}}, "oid": "ORG-DPBO1-AFRINIC", "org": "Vox Telecom Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.vox.co.za"}, "pfx": 188, "reg": "1999-01-14", "rir": "afrinic", "s24": 968, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 631296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02417050124071}, {"a": 11878, "h": "TZULO", "n": "TZULO", "t": "Other", "w": 61, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 31, "data_centre": 24, "web_exploit": 39, "bad_crawling": 26, "proxy_or_vpn": 10, "ssh_bruteforce": 6, "web_bruteforce": 32, "mail_bruteforce": 3, "cve:CVE-2017-9841": 4, "cve:CVE-2021-3129": 13, "cve:CVE-2025-4396": 5, "cve:CVE-2018-20062": 4, "cve:CVE-2025-55182": 4}, "n": 43}, "ev": {"shodan": {"n": 4, "p": 0.3044, "hi": 4.69, "lo": 1.01, "ips": 4, "mean": 2.56, "above": false}, "dshield": {"n": 6, "p": 0.9162, "hi": 9.55, "lo": 2.65, "ips": 7, "mean": 5.64, "above": true}, "crowdsec": {"n": 31, "p": 1.0000, "hi": 19.14, "lo": 10.66, "ips": 43, "mean": 14.64, "above": true}, "threatfox": {"n": 4, "p": 0.7797, "hi": 8.57, "lo": 1.84, "ips": 4, "mean": 4.68, "above": false}, "vulncheck": {"n": 2, "p": 0.2851, "hi": 5.10, "lo": 0.66, "ips": 4, "mean": 2.43, "above": false}, "blocklist_de": {"n": 3, "p": 0.3536, "hi": 5.25, "lo": 0.92, "ips": 3, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 7.543, 1.143, 0, false], ["2026-10-12", 8.218, 1.141, 0, false]], "sh": false, "uc": 115.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 1.141, "se": 0.962, "ts": 1.000, "map": 3.364, "obs": 4, "own": 3.508, "comp": {"urlhaus": -0.7878, "threatfox": 4.4864, "phishing_db": -0.8593}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 31, "vulncheck": 2, "blocklist_de": 3}, "lo": 8.218, "se": 0.383, "ts": 0.738, "map": 12.670, "obs": 42, "own": 7.101, "comp": {"cins": -2.8455, "dshield": 1.9336, "crowdsec": 13.253, "vulncheck": -0.5919, "blocklist_de": -7.8164}, "mass": 31.1, "listed": false}}, "abq": false, "bot": 0.594, "det": {"shodan": {"c2": 1, "compromised": 3}, "threatfox": {"family:pupy": 1, "family:Remcos": 1, "family:PureRAT": 1, "family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 2, "other_infrastructure": 2}, "blocklist_de": {"imap": 1, "mail": 3}}, "oid": "TZULO-ARIN", "org": "tzulo, inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.tzulo.com"}, "pfx": 192, "reg": "2007-04-02", "rir": "arin", "s24": 446, "sib": 0, "tor": 0, "w24": 41, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 114176, "abuse": "abuse@tzulo.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield"], "traffic": 0.02016420381986}, {"a": 11942, "h": "IPGLOBAL", "n": "IP Global, LLC.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 0.641, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.891, "ts": null, "map": 0.187, "obs": 0, "own": 0.255, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.411, "det": {"shodan": {"malware": 1}}, "oid": "IGL-20-ARIN", "org": "IP Global, LLC.", "pdb": null, "pfx": 7, "reg": "1999-02-10", "rir": "arin", "s24": 51, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": "abuse@pslightwave.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11960, "h": "", "n": "EMPRESA DE TELECOMUNICACIONES DE CUBA S.A. (IXP CUBA)", "t": "Broadband & mobile", "w": 0, "cc": "CU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.727, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-11960-LACNIC", "org": "EMPRESA DE TELECOMUNICACIONES DE CUBA S.A. (IXP CUBA)", "pdb": null, "pfx": 1, "reg": "1999-02-12", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@etecsa.cu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11976, "h": "FIDN", "n": "Fidelity Communications", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1013, "hi": 3.67, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}, "crowdsec": {"n": 3, "p": 0.0302, "hi": 2.74, "lo": 0.48, "ips": 3, "mean": 1.41, "above": false}, "blocklist_de": {"n": 2, "p": 0.1077, "hi": 3.62, "lo": 0.47, "ips": 2, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 0.664, 0.009, 0, false], ["2026-10-12", 0.762, 0.010, 0, false]], "sh": false, "uc": 81.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.866, "ts": null, "map": 0.143, "obs": 0, "own": 0.743, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.762, "se": 0.566, "ts": 0.500, "map": 1.632, "obs": 6, "own": 2.533, "comp": {"cins": 2.7269, "dshield": -1.8476, "crowdsec": 0.2777, "vulncheck": -0.8521, "blocklist_de": 1.5783}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.160, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "FIDN-ARIN", "org": "Fidelity Communication International Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.fidelitycommunications.com"}, "pfx": 403, "reg": "1999-02-19", "rir": "arin", "s24": 689, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 214016, "abuse": "abuse@cableone.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00561905244852}, {"a": 11982, "h": "SHWISP", "n": "Sandhills Wireless, LLC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.173, "det": {"shodan": {"compromised": 2}}, "oid": "SWL-42-ARIN", "org": "Sandhills Wireless, LLC", "pdb": null, "pfx": 1, "reg": "2013-08-27", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 11992, "h": "LIBERTY-MOB-PR", "n": "Liberty Mobile Puerto Rico Inc.", "t": "Broadband & mobile", "w": 1, "cc": "PR", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0241, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "crowdsec": {"n": 1, "p": 0.0140, "hi": 2.28, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}}, "h2": [["2026-10-05", 0.065, 0.230, 0, false], ["2026-10-12", 0.067, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.158, "obs": 0, "own": 0.891, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.067, "se": 1.102, "ts": 1.000, "map": 0.392, "obs": 1, "own": 0.656, "comp": {"cins": -0.2112, "dshield": -0.471, "crowdsec": 2.6659, "vulncheck": -0.4314, "blocklist_de": -1.0947}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.363, "det": {"shodan": {"c2": 1}}, "oid": "LMPR-ARIN", "org": "Liberty Mobile Puerto Rico Inc.", "pdb": null, "pfx": 41, "reg": "1999-02-23", "rir": "arin", "s24": 408, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 117504, "abuse": "noc@libertypr.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00094211998398}, {"a": 11994, "h": "CZIO-ASN", "n": "Gatespeed Broadband", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1117, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "crowdsec": {"n": 1, "p": 0.0966, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.573, 0.011, 0, false], ["2026-10-12", 0.152, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 1.298, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.152, "se": 1.191, "ts": 1.000, "map": 1.050, "obs": 1, "own": 1.800, "comp": {"cins": -0.1639, "dshield": -0.373, "crowdsec": 3.1988, "vulncheck": -0.3674, "blocklist_de": -0.8522}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 1}}, "oid": "CZIO-ARIN", "org": "Cruzio", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-100Mbps", "pol": "Open", "web": "http://www.gatespeed.com"}, "pfx": 13, "reg": "2006-09-18", "rir": "arin", "s24": 117, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34048, "abuse": "noc@cruzio.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12025, "h": "IMDC-AS12025", "n": "Iron Mountain Data Centers (fka IO Data Centers)", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0592, "hi": 3.11, "lo": 0.40, "ips": 2, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.895, "ts": null, "map": 0.154, "obs": 0, "own": 0.130, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.599, "ts": null, "map": 0.081, "obs": 0, "own": 0.024, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.802, "det": {"shodan": {"compromised": 2}}, "oid": "IMIML-ARIN", "org": "Iron Mountain Data Center", "pdb": {"t": "NSP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.ironmountain.com/digital-transformation/data-centers"}, "pfx": 142, "reg": "2007-05-30", "rir": "arin", "s24": 478, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 192256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12083, "h": "WOW-INTERNET", "n": "WOW Finance", "t": "Broadband & mobile", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0051, "hi": 1.92, "lo": 0.14, "ips": 1, "mean": 0.81, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.56, "lo": 0.04, "ips": 1, "mean": 0.24, "above": false}, "dshield": {"n": 2, "p": 0.0084, "hi": 2.19, "lo": 0.28, "ips": 2, "mean": 1.04, "above": false}, "blocklist_de": {"n": 3, "p": 0.0004, "hi": 1.64, "lo": 0.29, "ips": 3, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.014, 0.006, 0, false], ["2026-10-12", 0.180, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.744, "ts": null, "map": 0.088, "obs": 0, "own": 0.398, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.180, "se": 0.561, "ts": 0.500, "map": 0.380, "obs": 6, "own": 0.591, "comp": {"cins": 2.4151, "dshield": 2.6646, "crowdsec": -7.7669, "vulncheck": -0.8732, "blocklist_de": 3.9856}, "mass": 7.4, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"c2": 1}, "blocklist_de": {"bots": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "WOPW-ARIN", "org": "WideOpenWest Finance LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.wowway.com"}, "pfx": 779, "reg": "1999-03-19", "rir": "arin", "s24": 3480, "sib": 9, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1371648, "abuse": "abuse@wideopenwest.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03471601754156}, {"a": 12091, "h": "MTNNS-1", "n": "MTN SA", "t": "Other", "w": 10, "cc": "ZA", "cf": {"rb": "hi", "wb": "hi", "rep": 1.17, "waf": 1.02}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0002, "hi": 1.31, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}, "blocklist_de": {"n": 9, "p": 0.0108, "hi": 2.53, "lo": 0.87, "ips": 9, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.012, 0.006, 0, false], ["2026-10-12", 0.277, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.722, "ts": null, "map": 0.077, "obs": 0, "own": 0.140, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 9}, "lo": 0.277, "se": 0.487, "ts": 0.900, "map": 0.516, "obs": 10, "own": 0.292, "comp": {"cins": -1.9569, "dshield": -0.9726, "crowdsec": -9.7975, "vulncheck": -0.9358, "blocklist_de": 14.3957}, "mass": 14.0, "listed": false}}, "abq": false, "bot": 0.089, "det": {"blocklist_de": {"bots": 9}}, "oid": "ORG-VSA1-AFRINIC", "org": "MTN SA", "pdb": null, "pfx": 129, "reg": "2002-06-21", "rir": "afrinic", "s24": 4866, "sib": 8, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1524992, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.062649}, {"a": 12093, "h": "UWATERLOO", "n": "University of Waterloo", "t": "Other", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2014-8739": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2018-12031": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0388, "hi": 2.82, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.089, 0.010, 0, false], ["2026-10-12", 0.092, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.092, "se": 1.133, "ts": 1.000, "map": 0.567, "obs": 1, "own": 0.350, "comp": {"cins": -0.1932, "dshield": -0.4343, "crowdsec": 2.8656, "vulncheck": -0.4085, "blocklist_de": -1.0028}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.167, "det": null, "oid": "UNIVER-312-ARIN", "org": "University of Waterloo", "pdb": null, "pfx": 2, "reg": "1999-03-22", "rir": "arin", "s24": 257, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65792, "abuse": "abuse@uwaterloo.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007107611056}, {"a": 12129, "h": "123NET", "n": "123NET", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0068, "hi": 2.01, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.872, "ts": null, "map": 0.145, "obs": 0, "own": 1.087, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.563, "ts": null, "map": 0.070, "obs": 0, "own": 0.311, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.629, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "NETIN-6-ARIN", "org": "123.Net, Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.123.net"}, "pfx": 48, "reg": "1999-03-30", "rir": "arin", "s24": 636, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 180480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12150, "h": "", "n": "COTELCAM", "t": "Broadband & mobile", "w": 2, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1319, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "dshield": {"n": 1, "p": 0.1797, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1623, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.798, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.016, "ts": null, "map": 0.186, "obs": 0, "own": 1.414, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.798, "se": 0.910, "ts": 0.500, "map": 3.235, "obs": 2, "own": 5.176, "comp": {"cins": -0.3472, "dshield": 3.4319, "crowdsec": -2.8894, "vulncheck": -0.5652, "blocklist_de": 2.9376}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.238, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-12150-LACNIC", "org": "COTELCAM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.cotelcam.com.ar"}, "pfx": 72, "reg": "1999-04-06", "rir": "lacnic", "s24": 84, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 37376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007413488838}, {"a": 12173, "h": "UA", "n": "The University of Alabama", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"c2": 1}}, "oid": "THEUNI-36-ARIN", "org": "The University of Alabama", "pdb": null, "pfx": 6, "reg": "1999-04-12", "rir": "arin", "s24": 256, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "abuse@ua.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12208, "h": "TRUVISTA", "n": "TruVista Communications", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0492, "hi": 2.99, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "blocklist_de": {"n": 1, "p": 0.1152, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.098, 0.010, 0, false], ["2026-10-12", 0.367, 0.011, 0, false]], "sh": false, "uc": 240.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.172, "obs": 0, "own": 1.083, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.367, "se": 0.875, "ts": 0.500, "map": 1.391, "obs": 2, "own": 2.220, "comp": {"cins": -0.3887, "dshield": -0.8072, "crowdsec": 0.8461, "vulncheck": -0.5959, "blocklist_de": 2.6694}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.173, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "TRUVI-ARIN", "org": "TruVista Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.truvista.net/"}, "pfx": 219, "reg": "2008-12-08", "rir": "arin", "s24": 221, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59904, "abuse": "abuse@truvista.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12213, "h": "CNSQ-AS12213", "n": "Centersquare-AS12213", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0921, "hi": 3.56, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 0.186, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.747, "ts": null, "map": 0.135, "obs": 0, "own": 0.048, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.828, "det": {"shodan": {"compromised": 1}}, "oid": "PIL-188-ARIN", "org": "Centersquare", "pdb": {"t": "Network Services", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://centersquaredc.com/"}, "pfx": 36, "reg": "2017-10-20", "rir": "arin", "s24": 155, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40704, "abuse": "networkabuse@csquare.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12252, "h": "", "n": "CLARO PERU", "t": "Broadband & mobile", "w": 11, "cc": "PE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.80, "waf": 0.70}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"cins": {"n": 2, "p": 0.0535, "hi": 3.04, "lo": 0.40, "ips": 2, "mean": 1.45, "above": false}, "dshield": {"n": 1, "p": 0.0067, "hi": 2.01, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.19, "lo": 0.26, "ips": 5, "mean": 0.65, "above": false}, "blocklist_de": {"n": 5, "p": 0.0348, "hi": 2.83, "lo": 0.70, "ips": 5, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.342, 0.007, 0, false], ["2026-10-12", 0.570, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.767, "ts": null, "map": 0.098, "obs": 0, "own": 0.453, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.570, "se": 0.470, "ts": 0.417, "map": 1.028, "obs": 12, "own": 1.590, "comp": {"cins": 3.8037, "dshield": -1.0347, "crowdsec": -3.9692, "vulncheck": -0.9383, "blocklist_de": 3.56}, "mass": 14.5, "listed": false}}, "abq": true, "bot": 0.127, "det": {"blocklist_de": {"ssh": 1, "bots": 3, "mail": 1}}, "oid": "@aut-12252-LACNIC", "org": "America Movil Peru S.A.C.", "pdb": {"t": "NSP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.claro.com.pe"}, "pfx": 678, "reg": "2000-11-17", "rir": "lacnic", "s24": 2528, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1491712, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.091094}, {"a": 12271, "h": "TWC-12271-NYC", "n": "Charter Communications Inc", "t": "Broadband & mobile", "w": 15, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.63, "waf": 0.55}, "cs": {"c": {"data_centre": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 3}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 1.10, "lo": 0.14, "ips": 2, "mean": 0.52, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.68, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.30, "lo": 0.06, "ips": 4, "mean": 0.16, "above": false}, "vulncheck": {"n": 7, "p": 0.0005, "hi": 1.92, "lo": 0.58, "ips": 7, "mean": 1.17, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.60, "lo": 0.11, "ips": 3, "mean": 0.31, "above": false}}, "h2": [["2026-10-05", 0.323, 0.005, 0, false], ["2026-10-12", 0.127, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.672, "ts": null, "map": 0.054, "obs": 0, "own": 0.245, "comp": null, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 4, "vulncheck": 7, "blocklist_de": 3}, "lo": 0.127, "se": 0.467, "ts": 0.412, "map": 0.225, "obs": 17, "own": 0.351, "comp": {"cins": 3.9272, "dshield": -0.9735, "crowdsec": -3.7313, "vulncheck": 1.9757, "blocklist_de": -1.2958}, "mass": 14.1, "listed": false}}, "abq": false, "bot": 0.127, "det": {"vulncheck": {"c2_server": 7}, "blocklist_de": {"imap": 2, "mail": 3}}, "oid": "CC-3517-ARIN", "org": "Charter Communications Inc", "pdb": null, "pfx": 111, "reg": "2000-06-09", "rir": "arin", "s24": 11168, "sib": 31, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2866688, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.116713}, {"a": 12297, "h": "TELECOM-ARMENIA", "n": "TELECOM ARMENIA", "t": "Broadband & mobile", "w": 10, "cc": "AM", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.71}, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0228, "hi": 2.51, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "urlhaus": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 3, "p": 0.1239, "hi": 3.67, "lo": 0.65, "ips": 4, "mean": 1.89, "above": false}, "vulncheck": {"n": 2, "p": 0.2926, "hi": 5.16, "lo": 0.67, "ips": 5, "mean": 2.46, "above": false}, "blocklist_de": {"n": 2, "p": 0.1919, "hi": 4.35, "lo": 0.56, "ips": 2, "mean": 2.07, "above": false}}, "h2": [["2026-10-05", 0.833, 0.227, 0, false], ["2026-10-12", 1.108, 0.250, 0, false]], "sh": false, "uc": 262.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.250, "se": 1.441, "ts": 1.000, "map": 2.026, "obs": 1, "own": 5.827, "comp": {"urlhaus": 3.391, "threatfox": -0.3612, "phishing_db": -0.6975}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 2}, "lo": 1.108, "se": 0.560, "ts": 0.429, "map": 2.310, "obs": 7, "own": 3.601, "comp": {"cins": -1.0295, "dshield": -1.7114, "crowdsec": 1.3979, "vulncheck": 1.0907, "blocklist_de": 2.4833}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.374, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 5}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "ORG-ATCH1-RIPE", "org": "Telecom Armenia OJSC", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://telecomarmenia.am"}, "pfx": 46, "reg": "1999-02-24", "rir": "ripencc", "s24": 418, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 123392, "abuse": "abuse@telecomarmenia.am", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00914148824569}, {"a": 12301, "h": "Invitech", "n": "One Hungary Ltd._12301", "t": "Transit & backbone", "w": 1, "cc": "HU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.30, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}, "phishing_db": {"n": 1, "p": 0.0471, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.004, 0.081, 0, false], ["2026-10-12", 0.004, 0.086, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.086, "se": 1.348, "ts": 1.000, "map": 0.520, "obs": 1, "own": 2.329, "comp": {"urlhaus": -0.3933, "threatfox": -0.3215, "phishing_db": 1.6873}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.481, "ts": null, "map": 0.048, "obs": 0, "own": 0.197, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.701, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DC2-RIPE", "org": "Invitech ICT Services Kft.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.one.hu/kozep-nagyvallalatok"}, "pfx": 189, "reg": "1999-02-25", "rir": "ripencc", "s24": 1239, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 342016, "abuse": "abuse.hu@one.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0032625812151}, {"a": 12302, "h": "Vodafone_Ro", "n": "Vodafone Romania", "t": "Broadband & mobile", "w": 4, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.0000, "hi": 0.79, "lo": 0.17, "ips": 4, "mean": 0.43, "above": false}}, "h2": [["2026-10-05", 0.124, 0.071, 0, false], ["2026-10-12", 0.075, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.735, "ts": null, "map": 0.083, "obs": 0, "own": 0.377, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.075, "se": 0.631, "ts": 1.000, "map": 0.178, "obs": 4, "own": 0.279, "comp": {"cins": -0.8064, "dshield": -1.4406, "crowdsec": 6.7245, "vulncheck": -0.7787, "blocklist_de": -4.0291}, "mass": 4.0, "listed": false}}, "abq": true, "bot": 0.090, "det": null, "oid": "ORG-MS15-RIPE", "org": "Vodafone Romania S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.vodafone.ro"}, "pfx": 363, "reg": "1999-02-25", "rir": "ripencc", "s24": 3983, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1929728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03541732656282}, {"a": 12310, "h": "iNES", "n": "iNES Group", "t": "Transit & backbone", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2226, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.969, "ts": null, "map": 0.177, "obs": 0, "own": 1.655, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.732, "ts": null, "map": 0.129, "obs": 0, "own": 0.713, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.474, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "ORG-IGS3-RIPE", "org": "iNES GROUP SRL", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.ines.ro"}, "pfx": 17, "reg": "1999-03-02", "rir": "ripencc", "s24": 173, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59904, "abuse": "abuse@ines.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045830413413}, {"a": 12312, "h": "ECOTEL", "n": "ecotel communication ag", "t": "Transit & backbone", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.91, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.76, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}}, "h2": [["2026-10-05", 0.144, 0.007, 0, false], ["2026-10-12", 0.022, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.785, "ts": null, "map": 0.107, "obs": 0, "own": 0.711, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.022, "se": 1.012, "ts": 1.000, "map": 0.108, "obs": 1, "own": 0.359, "comp": {"cins": -0.2761, "dshield": -0.5997, "crowdsec": 1.9682, "vulncheck": -0.5029, "blocklist_de": -1.4257}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-ECA1-RIPE", "org": "ecotel communication ag", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.ecotel.de"}, "pfx": 35, "reg": "1999-03-03", "rir": "ripencc", "s24": 1976, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 536576, "abuse": "abuse@ecotel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00347475447105}, {"a": 12322, "h": "PROXAD", "n": "Free SAS", "t": "Broadband & mobile", "w": 67, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 0.60, "waf": 0.52}, "cs": {"c": {"http_flood": 13, "data_centre": 1, "web_exploit": 20, "bad_crawling": 7, "proxy_or_vpn": 5, "first_seen_30d": 2, "ssh_bruteforce": 21, "web_bruteforce": 21, "home_connection": 26, "mail_bruteforce": 9, "router_or_botnet": 2, "cve:CVE-2017-9841": 4, "cve:CVE-2019-9082": 4, "cve:CVE-2018-10562": 1, "cve:CVE-2018-20062": 4, "cve:CVE-2026-63030": 2}, "n": 34}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.59, "lo": 0.13, "ips": 4, "mean": 0.32, "above": false}, "shodan": {"n": 14, "p": 0.0000, "hi": 0.29, "lo": 0.12, "ips": 14, "mean": 0.20, "above": false}, "dshield": {"n": 7, "p": 0.0000, "hi": 0.67, "lo": 0.20, "ips": 7, "mean": 0.41, "above": false}, "urlhaus": {"n": 2, "p": 0.0003, "hi": 1.50, "lo": 0.20, "ips": 2, "mean": 0.72, "above": false}, "crowdsec": {"n": 34, "p": 0.0000, "hi": 0.49, "lo": 0.28, "ips": 34, "mean": 0.38, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.75, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}, "phishing_db": {"n": 4, "p": 0.0000, "hi": 0.51, "lo": 0.11, "ips": 4, "mean": 0.28, "above": false}, "blocklist_de": {"n": 22, "p": 0.0000, "hi": 0.83, "lo": 0.41, "ips": 22, "mean": 0.61, "above": false}}, "h2": [["2026-10-05", 0.214, 0.095, 0, false], ["2026-10-12", 0.260, 0.101, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 1, "phishing_db": 4}, "lo": 0.101, "se": 1.020, "ts": 0.571, "map": 0.288, "obs": 7, "own": 0.913, "comp": {"urlhaus": 0.7332, "threatfox": -0.3228, "phishing_db": -0.0298}, "mass": 17.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 7, "crowdsec": 34, "vulncheck": 0, "blocklist_de": 22}, "lo": 0.260, "se": 0.384, "ts": 0.507, "map": 0.399, "obs": 67, "own": 0.617, "comp": {"cins": 0.3581, "dshield": -0.7128, "crowdsec": -0.4886, "vulncheck": -1.0008, "blocklist_de": 2.3193}, "mass": 76.6, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"c2": 1, "malware": 2, "compromised": 9, "doublepulsar": 2}, "threatfox": {"family:AsyncRAT": 1}, "blocklist_de": {"ssh": 5, "bots": 7, "imap": 7, "mail": 9, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PISP1-RIPE", "org": "Free SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Tbps", "pol": "Selective", "web": "http://www.free.fr/"}, "pfx": 538, "reg": "1999-03-11", "rir": "ripencc", "s24": 34464, "sib": 1, "tor": 0, "w24": 67, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15704064, "abuse": "abuse@proxad.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.335103}, {"a": 12332, "h": "PRIMORYE-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0033, "hi": 1.80, "lo": 0.14, "ips": 1, "mean": 0.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.0413, "hi": 2.86, "lo": 0.21, "ips": 1, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.276, 0.009, 0, false], ["2026-10-12", 0.160, 0.010, 0, false]], "sh": false, "uc": 96, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.146, "obs": 0, "own": 0.774, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.160, "se": 0.844, "ts": 0.500, "map": 0.567, "obs": 2, "own": 0.904, "comp": {"cins": -0.4356, "dshield": -0.8884, "crowdsec": 0.4088, "vulncheck": -0.6264, "blocklist_de": 2.3688}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.496, "det": {"blocklist_de": {"ftp": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 31, "reg": "1999-03-17", "rir": "ripencc", "s24": 614, "sib": 120, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 499712, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12337, "h": "NORIS-NETWORK", "n": "noris network AG", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0193, "hi": 2.42, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.061, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.155, "obs": 0, "own": 1.226, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.607, "ts": null, "map": 0.084, "obs": 0, "own": 0.392, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.862, "det": {"shodan": {"c2": 1}}, "oid": "ORG-NNA1-RIPE", "org": "noris network AG", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://www.noris.net"}, "pfx": 77, "reg": "1999-03-22", "rir": "ripencc", "s24": 449, "sib": 2, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 118016, "abuse": "abuse@noris.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011773102308}, {"a": 12353, "h": "VODAFONE-PT", "n": "Vodafone Portugal", "t": "Broadband & mobile", "w": 10, "cc": "PT", "cf": {"rb": "hi", "wb": "", "rep": 0.99, "waf": 0.90}, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 5, "mail_bruteforce": 4}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0013, "hi": 1.59, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.70, "lo": 0.12, "ips": 3, "mean": 0.36, "above": false}, "dshield": {"n": 1, "p": 0.0003, "hi": 1.34, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.78, "lo": 0.19, "ips": 5, "mean": 0.44, "above": false}, "phishing_db": {"n": 1, "p": 0.0005, "hi": 1.44, "lo": 0.11, "ips": 1, "mean": 0.61, "above": false}, "blocklist_de": {"n": 4, "p": 0.0001, "hi": 1.51, "lo": 0.33, "ips": 4, "mean": 0.83, "above": false}}, "h2": [["2026-10-05", 0.278, 0.037, 0, false], ["2026-10-12", 0.262, 0.039, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.039, "se": 1.328, "ts": 1.000, "map": 0.214, "obs": 1, "own": 0.733, "comp": {"urlhaus": -0.5758, "threatfox": -0.3854, "phishing_db": 1.0452}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.262, "se": 0.481, "ts": 0.455, "map": 0.478, "obs": 11, "own": 0.741, "comp": {"cins": 1.2453, "dshield": -0.7669, "crowdsec": -1.29, "vulncheck": -0.9273, "blocklist_de": 2.3938}, "mass": 12.6, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 2}}, "oid": "ORG-VTCP1-RIPE", "org": "Vodafone Portugal - Communicacoes Pessoais S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.vodafone.pt"}, "pfx": 28, "reg": "1999-04-06", "rir": "ripencc", "s24": 4715, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1207040, "abuse": "abuse.pt@vodafone.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.074375}, {"a": 12365, "h": "SARKOR-AS", "n": "Sarkor Telecom", "t": "Broadband & mobile", "w": 5, "cc": "UZ", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2386, "hi": 4.73, "lo": 0.61, "ips": 2, "mean": 2.25, "above": false}, "vulncheck": {"n": 1, "p": 0.1716, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 3, "p": 0.5580, "hi": 6.84, "lo": 1.20, "ips": 3, "mean": 3.53, "above": false}}, "h2": [["2026-10-05", 0.547, 0.010, 0, false], ["2026-10-12", 3.275, 0.011, 0, false]], "sh": false, "uc": 418.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.991, "ts": null, "map": 0.181, "obs": 0, "own": 1.275, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 3}, "lo": 3.275, "se": 0.584, "ts": 0.500, "map": 7.231, "obs": 6, "own": 11.228, "comp": {"cins": -0.978, "dshield": -1.6523, "crowdsec": -0.8977, "vulncheck": 0.1936, "blocklist_de": 6.7064}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.312, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2, "mail": 1}}, "oid": "ORG-SA72-RIPE", "org": "JC LLC Sarkor-Telecom", "pdb": {"t": "Content", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "https://sarkor.uz"}, "pfx": 15, "reg": "2002-10-21", "rir": "ripencc", "s24": 125, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32000, "abuse": "abuse@sarkor.uz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0017205539776}, {"a": 12389, "h": "ROSTELECOM-AS", "n": "Rostelecom", "t": "Broadband & mobile", "w": 181, "cc": "RU", "cf": {"rb": "", "wb": "", "rep": 1.31, "waf": 1.93}, "cs": {"c": {"http_flood": 4, "web_exploit": 14, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 39, "web_bruteforce": 30, "home_connection": 47, "mail_bruteforce": 32, "router_or_botnet": 2, "cve:CVE-2024-6387": 8, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2025-22457": 3}, "n": 55}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.57, "lo": 0.12, "ips": 4, "mean": 0.31, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.06, "lo": 0.00, "ips": 1, "mean": 0.03, "above": false}, "dshield": {"n": 79, "p": 0.9889, "hi": 4.69, "lo": 3.24, "ips": 80, "mean": 3.94, "above": true}, "urlhaus": {"n": 4, "p": 0.0039, "hi": 2.12, "lo": 0.46, "ips": 4, "mean": 1.16, "above": false}, "crowdsec": {"n": 54, "p": 0.0000, "hi": 0.70, "lo": 0.45, "ips": 55, "mean": 0.57, "above": false}, "vulncheck": {"n": 12, "p": 0.0000, "hi": 0.98, "lo": 0.39, "ips": 12, "mean": 0.66, "above": false}, "blocklist_de": {"n": 51, "p": 0.0000, "hi": 1.64, "lo": 1.03, "ips": 51, "mean": 1.32, "above": false}}, "h2": [["2026-10-05", 0.422, 0.079, 0, false], ["2026-10-12", 0.648, 0.127, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 4, "threatfox": 0, "phishing_db": 0}, "lo": 0.127, "se": 1.018, "ts": 1.000, "map": 0.370, "obs": 4, "own": 1.126, "comp": {"urlhaus": 2.3755, "threatfox": -0.5712, "phishing_db": -1.1717}, "mass": 22.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 79, "crowdsec": 54, "vulncheck": 12, "blocklist_de": 51}, "lo": 0.648, "se": 0.365, "ts": 0.395, "map": 0.973, "obs": 200, "own": 1.500, "comp": {"cins": -2.316, "dshield": 8.7162, "crowdsec": -5.3161, "vulncheck": -0.6214, "blocklist_de": 0.9032}, "mass": 193.3, "listed": false}}, "abq": false, "bot": 0.400, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 2, "botnet_node": 9, "attack_tooling": 1}, "blocklist_de": {"ftp": 2, "ssh": 16, "bots": 9, "imap": 11, "mail": 20, "apache": 4, "bruteforcelogin": 4}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.company.rt.ru/en/"}, "pfx": 3127, "reg": "2005-07-01", "rir": "ripencc", "s24": 35809, "sib": 120, "tor": 0, "w24": 178, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17183744, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.129177}, {"a": 12390, "h": "KINGSTON-UK-AS", "n": "Kingston Communications", "t": "Broadband & mobile", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0010, "hi": 1.54, "lo": 0.12, "ips": 1, "mean": 0.65, "above": false}, "crowdsec": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.0154, "hi": 2.32, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}}, "h2": [["2026-10-05", 0.005, 0.008, 0, false], ["2026-10-12", 0.108, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.839, "ts": null, "map": 0.131, "obs": 0, "own": 0.655, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.108, "se": 0.831, "ts": 0.500, "map": 0.377, "obs": 2, "own": 0.600, "comp": {"cins": -0.4574, "dshield": -0.9251, "crowdsec": 0.2106, "vulncheck": -0.6394, "blocklist_de": 2.2293}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.134, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TCL3-RIPE", "org": "KCOM Group Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.kcom.com"}, "pfx": 17, "reg": "1999-04-27", "rir": "ripencc", "s24": 976, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 259072, "abuse": "abuse@kcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00991557646587}, {"a": 12400, "h": "PARTNER-AS", "n": "Partner Communications", "t": "Broadband & mobile", "w": 36, "cc": "IL", "cf": {"rb": "", "wb": "", "rep": 1.42, "waf": 1.31}, "cs": {"c": {"http_flood": 1, "web_exploit": 8, "bad_crawling": 1, "proxy_or_vpn": 4, "first_seen_30d": 1, "ssh_bruteforce": 14, "web_bruteforce": 13, "home_connection": 19, "mail_bruteforce": 19}, "n": 21}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.41, "lo": 0.07, "ips": 3, "mean": 0.21, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "urlhaus": {"n": 6, "p": 0.7142, "hi": 6.68, "lo": 1.85, "ips": 6, "mean": 3.95, "above": false}, "crowdsec": {"n": 19, "p": 0.0000, "hi": 1.20, "lo": 0.57, "ips": 21, "mean": 0.86, "above": false}, "vulncheck": {"n": 3, "p": 0.0001, "hi": 1.44, "lo": 0.25, "ips": 3, "mean": 0.74, "above": false}, "blocklist_de": {"n": 17, "p": 0.0077, "hi": 2.56, "lo": 1.17, "ips": 18, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.448, 0.640, 0, false], ["2026-10-12", 0.579, 0.712, 0, false]], "sh": false, "uc": 71.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 6, "threatfox": 0, "phishing_db": 0}, "lo": 0.712, "se": 0.901, "ts": 1.000, "map": 1.818, "obs": 6, "own": 4.760, "comp": {"urlhaus": 3.9766, "threatfox": -0.5741, "phishing_db": -1.1786}, "mass": 22.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 19, "vulncheck": 3, "blocklist_de": 17}, "lo": 0.579, "se": 0.396, "ts": 0.475, "map": 0.923, "obs": 40, "own": 1.424, "comp": {"cins": -3.1521, "dshield": -2.5232, "crowdsec": -0.5065, "vulncheck": -0.5592, "blocklist_de": 8.0545}, "mass": 42.8, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 2, "botnet_node": 1}, "blocklist_de": {"ftp": 2, "bots": 1, "imap": 5, "mail": 15}}, "oid": "ORG-PCL2-RIPE", "org": "Partner Communications Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.partner.co.il"}, "pfx": 308, "reg": "1999-05-03", "rir": "ripencc", "s24": 8358, "sib": 2, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4226816, "abuse": "abuse@partner.co.il", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.057507}, {"a": 12406, "h": "BN-AS", "n": "Business Network Ltd", "t": "Other", "w": 0, "cc": "BY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.009, 0.450, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.577, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.201, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.333, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BNJ1-RIPE", "org": "Business Network Ltd", "pdb": null, "pfx": 18, "reg": "1999-11-18", "rir": "ripencc", "s24": 80, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": "ripe@bn.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00060333637104}, {"a": 12414, "h": "NL-SOLCON", "n": "Solcon Internetdiensten B.V.", "t": "Broadband & mobile", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.005, 0.182, 0, false], ["2026-10-12", 0.005, 0.200, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.200, "se": 1.413, "ts": 1.000, "map": 1.525, "obs": 1, "own": 4.381, "comp": {"urlhaus": 3.188, "threatfox": -0.387, "phishing_db": -0.7528}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.557, "ts": null, "map": 0.068, "obs": 0, "own": 0.148, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SB2-RIPE", "org": "Solcon Internetdiensten B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.solcon.nl"}, "pfx": 16, "reg": "1999-05-10", "rir": "ripencc", "s24": 669, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 187648, "abuse": "abuse@solcon.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00388495449}, {"a": 12430, "h": "VODAFONE_ES", "n": "Vodafone España", "t": "Broadband & mobile", "w": 17, "cc": "ES", "cf": {"rb": "hi", "wb": "hi", "rep": 0.54, "waf": 0.48}, "cs": {"c": {"ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.67, "lo": 0.05, "ips": 1, "mean": 0.28, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.20, "lo": 0.03, "ips": 2, "mean": 0.10, "above": false}, "dshield": {"n": 5, "p": 0.0000, "hi": 1.21, "lo": 0.30, "ips": 5, "mean": 0.69, "above": false}, "urlhaus": {"n": 3, "p": 0.0837, "hi": 3.34, "lo": 0.59, "ips": 3, "mean": 1.72, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.27, "lo": 0.07, "ips": 5, "mean": 0.15, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.56, "lo": 0.04, "ips": 1, "mean": 0.24, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.48, "lo": 0.08, "ips": 3, "mean": 0.25, "above": false}}, "h2": [["2026-10-05", 0.133, 0.164, 0, false], ["2026-10-12", 0.110, 0.183, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.183, "se": 1.040, "ts": 1.000, "map": 0.592, "obs": 3, "own": 1.698, "comp": {"urlhaus": 2.802, "threatfox": -0.5586, "phishing_db": -1.1416}, "mass": 13.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.110, "se": 0.457, "ts": 0.333, "map": 0.194, "obs": 15, "own": 0.301, "comp": {"cins": 0.7554, "dshield": 4.6493, "crowdsec": -2.9845, "vulncheck": -0.5619, "blocklist_de": -2.1065}, "mass": 15.5, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"doublepulsar": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-AMS1-RIPE", "org": "VODAFONE ESPANA S.A.U.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.vodafone.es"}, "pfx": 44, "reg": "1999-05-18", "rir": "ripencc", "s24": 14284, "sib": 1, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4579328, "abuse": "abuse@corp.vodafone.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.134704}, {"a": 12479, "h": "UNI2-AS", "n": "Orange Spain", "t": "Broadband & mobile", "w": 29, "cc": "ES", "cf": {"rb": "", "wb": "", "rep": 0.51, "waf": 0.41}, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 9, "web_bruteforce": 8, "home_connection": 13, "mail_bruteforce": 9, "router_or_botnet": 5, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-63030": 1}, "n": 15}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.50, "lo": 0.07, "ips": 2, "mean": 0.24, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.49, "lo": 0.09, "ips": 3, "mean": 0.25, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 0.30, "lo": 0.13, "ips": 15, "mean": 0.20, "above": false}, "threatfox": {"n": 1, "p": 0.0000, "hi": 0.91, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.31, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.43, "lo": 0.13, "ips": 7, "mean": 0.26, "above": false}}, "h2": [["2026-10-05", 0.153, 0.003, 0, false], ["2026-10-12", 0.120, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.013, "se": 1.349, "ts": 1.000, "map": 0.064, "obs": 1, "own": 0.259, "comp": {"urlhaus": -0.8796, "threatfox": 0.6486, "phishing_db": -0.8965}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 14, "vulncheck": 1, "blocklist_de": 7}, "lo": 0.120, "se": 0.419, "ts": 0.519, "map": 0.194, "obs": 27, "own": 0.301, "comp": {"cins": 1.1852, "dshield": -0.3748, "crowdsec": 0.329, "vulncheck": -0.7706, "blocklist_de": -0.6163}, "mass": 29.6, "listed": false}}, "abq": false, "bot": 0.111, "det": {"shodan": {"malware": 1, "compromised": 1}, "threatfox": {"family:NetSupportManager RAT": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1, "bots": 6}}, "oid": "ORG-ULT1-RIPE", "org": "Orange Espagne SA", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.orange.es/"}, "pfx": 6957, "reg": "1999-06-09", "rir": "ripencc", "s24": 27340, "sib": 0, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14554112, "abuse": "abuse.es@masorange.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.196547}, {"a": 12488, "h": "KRYSTAL", "n": "Krystal Hosting", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1428, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "phishing_db": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.009, 0.343, 0, false], ["2026-10-12", 0.009, 0.357, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.357, "se": 1.490, "ts": 1.000, "map": 3.237, "obs": 1, "own": 1.457, "comp": {"urlhaus": -0.1461, "threatfox": -0.1705, "phishing_db": 3.1175}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.076, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.977, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KSL2-RIPE", "org": "Krystal Hosting Ltd", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Gbps", "pol": "Selective", "web": "https://krystal.uk"}, "pfx": 20, "reg": "2007-04-10", "rir": "ripencc", "s24": 68, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "abuse@krystal.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075406146481}, {"a": 12491, "h": "GILAT-TELECOM-LTD", "n": "Gilat Telecom", "t": "Broadband & mobile", "w": 1, "cc": "IL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0818, "hi": 3.44, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "urlhaus": {"n": 1, "p": 0.1919, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.008, 0.333, 0, false], ["2026-10-12", 0.008, 0.359, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.359, "se": 1.500, "ts": 1.000, "map": 3.310, "obs": 1, "own": 9.682, "comp": {"urlhaus": 3.7176, "threatfox": -0.3082, "phishing_db": -0.5865}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.728, "ts": null, "map": 0.128, "obs": 0, "own": 0.345, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.274, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IPNL1-RIPE", "org": "Gilat Telecom Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Selective", "web": "https://gilat.net"}, "pfx": 220, "reg": "1999-06-14", "rir": "ripencc", "s24": 178, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 73216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00399641370759}, {"a": 12552, "h": "GlobalConnect-AS12552", "n": "GlobalConnect AS12552", "t": "Transit & backbone", "w": 35, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "mail_bruteforce": 5, "cve:CVE-2026-8181": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0212, "hi": 2.47, "lo": 0.18, "ips": 28, "mean": 1.04, "above": false}, "urlhaus": {"n": 2, "p": 0.3018, "hi": 5.24, "lo": 0.68, "ips": 2, "mean": 2.50, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.35, "lo": 0.29, "ips": 5, "mean": 0.74, "above": false}, "blocklist_de": {"n": 2, "p": 0.0027, "hi": 1.89, "lo": 0.25, "ips": 3, "mean": 0.90, "above": false}}, "h2": [["2026-10-05", 0.342, 0.358, 0, false], ["2026-10-12", 0.310, 0.400, 0, false]], "sh": false, "uc": 100.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.400, "se": 1.121, "ts": 1.000, "map": 1.682, "obs": 2, "own": 6.246, "comp": {"urlhaus": 3.7088, "threatfox": -0.5175, "phishing_db": -1.0449}, "mass": 5.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.310, "se": 0.538, "ts": 0.571, "map": 0.625, "obs": 7, "own": 1.974, "comp": {"cins": 2.3519, "dshield": -2.0195, "crowdsec": 1.1156, "vulncheck": -0.877, "blocklist_de": 0.3528}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.694, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-ITCA1-RIPE", "org": "GlobalConnect AB", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.globalconnect.net/"}, "pfx": 447, "reg": "1999-07-12", "rir": "ripencc", "s24": 2181, "sib": 3, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 663552, "abuse": "abuse@ip-only.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0117704180278}, {"a": 12556, "h": "internet-solutions-ke", "n": "Internet Solutions (Kenya)", "t": "Transit & backbone", "w": 0, "cc": "KE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 344.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 2.117, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 1.217, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.678, "det": null, "oid": "ORG-IL11-AFRINIC", "org": "Internet Solutions (Kenya)", "pdb": {"t": "NSP", "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.is.co.ke"}, "pfx": 9, "reg": "2009-01-15", "rir": "afrinic", "s24": 68, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035637316647}, {"a": 12570, "h": "ITSELF", "n": "itself s.r.o.", "t": "Transit & backbone", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0753, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 1.600, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.717, "ts": null, "map": 0.123, "obs": 0, "own": 0.666, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.163, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-STAN1-RIPE", "org": "O2 Czech Republic, a.s.", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.itself.cz/"}, "pfx": 11, "reg": "1999-07-28", "rir": "ripencc", "s24": 194, "sib": 15, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53760, "abuse": "abuse@o2.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00097722945785}, {"a": 12578, "h": "APOLLO-AS", "n": "SIA Tet", "t": "Transit & backbone", "w": 8, "cc": "LV", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.53}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 2}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0285, "hi": 2.63, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.94, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "dshield": {"n": 1, "p": 0.0161, "hi": 2.34, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "crowdsec": {"n": 4, "p": 0.0001, "hi": 1.51, "lo": 0.32, "ips": 4, "mean": 0.82, "above": false}, "threatfox": {"n": 1, "p": 0.1010, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}, "blocklist_de": {"n": 1, "p": 0.0011, "hi": 1.56, "lo": 0.12, "ips": 1, "mean": 0.66, "above": false}}, "h2": [["2026-10-05", 0.148, 0.061, 0, false], ["2026-10-12", 0.333, 0.063, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.063, "se": 1.342, "ts": 1.000, "map": 0.367, "obs": 1, "own": 1.712, "comp": {"urlhaus": -0.4227, "threatfox": 1.6864, "phishing_db": -0.6394}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.333, "se": 0.538, "ts": 0.571, "map": 0.671, "obs": 7, "own": 2.118, "comp": {"cins": 2.4811, "dshield": 0.409, "crowdsec": 1.6679, "vulncheck": -0.8691, "blocklist_de": -2.6949}, "mass": 7.2, "listed": false}}, "abq": false, "bot": 0.299, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:AsyncRAT": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-LA16-RIPE", "org": "SIA Tet", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.tet.lv/"}, "pfx": 59, "reg": "1999-08-03", "rir": "ripencc", "s24": 1906, "sib": 3, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 536320, "abuse": "abuse@tet.lv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01480426090869}, {"a": 12586, "h": "ASGHOSTNET", "n": "GHOSTnet", "t": "Hosting & VPS", "w": 6, "cc": "DE", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0418, "hi": 2.89, "lo": 0.38, "ips": 2, "mean": 1.38, "above": false}, "crowdsec": {"n": 1, "p": 0.0051, "hi": 1.92, "lo": 0.14, "ips": 1, "mean": 0.81, "above": false}, "threatfox": {"n": 2, "p": 0.3687, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}, "phishing_db": {"n": 3, "p": 0.4716, "hi": 6.11, "lo": 1.08, "ips": 3, "mean": 3.15, "above": false}}, "h2": [["2026-10-05", 0.159, 1.280, 0, false], ["2026-10-12", 0.055, 1.329, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 3}, "lo": 1.329, "se": 0.921, "ts": 0.600, "map": 3.662, "obs": 5, "own": 1.442, "comp": {"urlhaus": -0.978, "threatfox": 1.4943, "phishing_db": 2.4078}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.055, "se": 1.083, "ts": 1.000, "map": 0.307, "obs": 1, "own": 0.065, "comp": {"cins": -0.2232, "dshield": -0.4953, "crowdsec": 2.534, "vulncheck": -0.4459, "blocklist_de": -1.1561}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.660, "det": {"shodan": {"c2": 2}, "threatfox": {"family:PureRAT": 1, "family:Unknown malware": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-GG3-RIPE", "org": "GHOSTnet GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.ghostnet.de"}, "pfx": 473, "reg": "1999-08-05", "rir": "ripencc", "s24": 552, "sib": 8, "tor": 1, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 305408, "abuse": "abuse@ghostnet.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0020027184105}, {"a": 12615, "h": "GCN-AS", "n": "Global Communication Net AD", "t": "Broadband & mobile", "w": 3, "cc": "BG", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "vulncheck": {"n": 2, "p": 0.4034, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.229, 0.355, 0, false], ["2026-10-12", 0.651, 0.368, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.368, "se": 1.497, "ts": 1.000, "map": 3.371, "obs": 1, "own": 9.909, "comp": {"urlhaus": -0.1283, "threatfox": 3.2516, "phishing_db": -0.282}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.651, "se": 0.931, "ts": 1.000, "map": 2.624, "obs": 2, "own": 4.411, "comp": {"cins": -0.1979, "dshield": -0.444, "crowdsec": -1.7553, "vulncheck": 5.7825, "blocklist_de": -1.0271}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-GCN3-RIPE", "org": "Global Communication Net Plc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.gcn.bg/"}, "pfx": 47, "reg": "2004-04-21", "rir": "ripencc", "s24": 57, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "abuse@gcn.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015221693279}, {"a": 12637, "h": "SEEWEB", "n": "Seeweb", "t": "Hosting & VPS", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0409, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.927, "ts": null, "map": 0.165, "obs": 0, "own": 0.151, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.655, "ts": null, "map": 0.101, "obs": 0, "own": 0.031, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.986, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SS18-RIPE", "org": "SEEWEB s.r.l.", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.seeweb.it/"}, "pfx": 34, "reg": "1999-09-07", "rir": "ripencc", "s24": 310, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 86272, "abuse": "abuse@seeweb.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00032761712072}, {"a": 12668, "h": "MIRALOGIC-AS", "n": "MiraLogic Telecommunication Systems", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0714, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "crowdsec": {"n": 2, "p": 0.0043, "hi": 2.00, "lo": 0.26, "ips": 2, "mean": 0.95, "above": false}, "blocklist_de": {"n": 2, "p": 0.0823, "hi": 3.37, "lo": 0.44, "ips": 2, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.288, 0.009, 0, false], ["2026-10-12", 0.488, 0.010, 0, false]], "sh": false, "uc": 136.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.854, "ts": null, "map": 0.138, "obs": 0, "own": 0.701, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.488, "se": 0.598, "ts": 0.400, "map": 1.105, "obs": 5, "own": 1.720, "comp": {"cins": -0.9698, "dshield": 1.1947, "crowdsec": -0.8324, "vulncheck": -0.8181, "blocklist_de": 2.9193}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.437, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-EP3-RIPE", "org": "LLC \"KomTehCentr\"", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://miralogic.ru"}, "pfx": 211, "reg": "1999-09-21", "rir": "ripencc", "s24": 809, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 208128, "abuse": "noc@itmh.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002150078546}, {"a": 12676, "h": "NCORE-AS", "n": "HKN GmbH", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0452, "hi": 2.93, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 1.414, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.664, "ts": null, "map": 0.103, "obs": 0, "own": 0.518, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.926, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NG9-RIPE", "org": "HKN GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.hkn.de"}, "pfx": 12, "reg": "1999-09-23", "rir": "ripencc", "s24": 291, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 74496, "abuse": "abuse@hkn.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12695, "h": "DINET-AS", "n": "CJSC Digital Network", "t": "Transit & backbone", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0259, "hi": 2.63, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}, "vulncheck": {"n": 3, "p": 0.4685, "hi": 6.08, "lo": 1.07, "ips": 3, "mean": 3.14, "above": false}}, "h2": [["2026-10-12", 0.421, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.887, "ts": null, "map": 0.151, "obs": 0, "own": 1.163, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.421, "se": 0.632, "ts": 0.600, "map": 0.984, "obs": 5, "own": 3.180, "comp": {"cins": -0.616, "dshield": -1.1753, "crowdsec": 2.3489, "vulncheck": 3.9342, "blocklist_de": -3.1138}, "mass": 3.0, "listed": false}}, "abq": true, "bot": 0.872, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-DNJ1-RIPE", "org": "LLC Digital Network", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://tech.ru/"}, "pfx": 120, "reg": "1999-09-30", "rir": "ripencc", "s24": 524, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 145920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007478092545}, {"a": 12714, "h": "MEGAFON-AS", "n": "PJSC MegaFon", "t": "Broadband & mobile", "w": 33, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 7, "ssh_bruteforce": 12, "web_bruteforce": 5, "mail_bruteforce": 5}, "n": 14}, "ev": {"cins": {"n": 1, "p": 0.0016, "hi": 1.63, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}, "dshield": {"n": 6, "p": 0.1129, "hi": 3.45, "lo": 0.96, "ips": 6, "mean": 2.04, "above": false}, "urlhaus": {"n": 2, "p": 0.2037, "hi": 4.44, "lo": 0.58, "ips": 2, "mean": 2.12, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 1.69, "lo": 0.71, "ips": 14, "mean": 1.16, "above": false}, "vulncheck": {"n": 2, "p": 0.0026, "hi": 1.87, "lo": 0.24, "ips": 2, "mean": 0.89, "above": false}, "blocklist_de": {"n": 11, "p": 0.0690, "hi": 3.13, "lo": 1.19, "ips": 11, "mean": 2.06, "above": false}}, "h2": [["2026-10-05", 0.854, 0.212, 0, false], ["2026-10-12", 0.881, 0.237, 0, false]], "sh": false, "uc": 56.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.237, "se": 1.122, "ts": 1.000, "map": 0.964, "obs": 2, "own": 2.632, "comp": {"urlhaus": 3.1879, "threatfox": -0.5282, "phishing_db": -1.0698}, "mass": 6.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 14, "vulncheck": 2, "blocklist_de": 11}, "lo": 0.881, "se": 0.401, "ts": 0.412, "map": 1.384, "obs": 34, "own": 2.133, "comp": {"cins": -1.1595, "dshield": 1.4933, "crowdsec": -1.4904, "vulncheck": -0.6302, "blocklist_de": 3.5053}, "mass": 34.6, "listed": false}}, "abq": false, "bot": 0.409, "det": {"vulncheck": {"botnet_node": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 8, "bots": 1, "imap": 2, "mail": 2}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://wifire.ru/"}, "pfx": 313, "reg": "1999-10-08", "rir": "ripencc", "s24": 4504, "sib": 39, "tor": 0, "w24": 33, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1663488, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.006799103927}, {"a": 12735, "h": "ASTurkNet", "n": "TurkNet Iletisim Hizmetleri A.S", "t": "Transit & backbone", "w": 267, "cc": "TR", "cf": {"rb": "", "wb": "", "rep": 2.73, "waf": 0.85}, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-41940": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.0336, "hi": 2.76, "lo": 0.36, "ips": 2, "mean": 1.32, "above": false}, "dshield": {"n": 3, "p": 0.4398, "hi": 5.86, "lo": 1.03, "ips": 258, "mean": 3.02, "above": false}, "urlhaus": {"n": 1, "p": 0.1757, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 3, "p": 0.0495, "hi": 2.99, "lo": 0.53, "ips": 3, "mean": 1.54, "above": false}, "blocklist_de": {"n": 5, "p": 0.6296, "hi": 6.41, "lo": 1.59, "ips": 5, "mean": 3.66, "above": false}}, "h2": [["2026-10-05", 1.375, 0.009, 0, false], ["2026-10-12", 1.890, 0.211, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.211, "se": 1.420, "ts": 1.000, "map": 1.633, "obs": 1, "own": 6.670, "comp": {"urlhaus": 3.2379, "threatfox": -0.381, "phishing_db": -0.74}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.890, "se": 0.477, "ts": 0.455, "map": 3.418, "obs": 11, "own": 10.705, "comp": {"cins": -1.7335, "dshield": 2.9939, "crowdsec": -3.9401, "vulncheck": -0.9191, "blocklist_de": 6.2216}, "mass": 11.3, "listed": false}}, "abq": true, "bot": 0.161, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 5}}, "oid": "ORG-SN10-RIPE", "org": "TurkNet Iletisim Hizmetleri A.S.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.turk.net"}, "pfx": 589, "reg": "1999-10-18", "rir": "ripencc", "s24": 598, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 154880, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.096988}, {"a": 12737, "h": "RIGHTSIDE16", "n": "KrasPromStroy, LLC", "t": "Other", "w": 7, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6303, "hi": 7.56, "lo": 1.33, "ips": 7, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 0.822, 0.011, 0, false], ["2026-10-12", 1.421, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 1.421, "se": 0.789, "ts": 1.000, "map": 4.370, "obs": 3, "own": 2.631, "comp": {"cins": -0.2728, "dshield": -0.5932, "crowdsec": -2.342, "vulncheck": 7.485, "blocklist_de": -1.4087}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.436, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "ORG-KL237-RIPE", "org": "KrasPromStroy, LLC", "pdb": null, "pfx": 27, "reg": "2015-09-23", "rir": "ripencc", "s24": 48, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": "abuse@rightside.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00118861285235}, {"a": 12741, "h": "AS-NETIA", "n": "Netia", "t": "Transit & backbone", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.42, "lo": 0.03, "ips": 1, "mean": 0.18, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.46, "lo": 0.06, "ips": 2, "mean": 0.22, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}}, "h2": [["2026-10-05", 0.026, 0.006, 0, false], ["2026-10-12", 0.048, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.723, "ts": null, "map": 0.078, "obs": 0, "own": 0.497, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.048, "se": 0.693, "ts": 0.667, "map": 0.127, "obs": 3, "own": 0.407, "comp": {"cins": -0.7081, "dshield": -1.308, "crowdsec": 1.4429, "vulncheck": -0.749, "blocklist_de": 0.6541}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.215, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-NTS2-RIPE", "org": "Netia SA", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.netia.pl"}, "pfx": 165, "reg": "1999-10-21", "rir": "ripencc", "s24": 4775, "sib": 19, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1237760, "abuse": "abuse@inetia.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00921727225302}, {"a": 12764, "h": "AKNET-AS", "n": "AKNET", "t": "Other", "w": 5, "cc": "KG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3369, "hi": 5.53, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}, "blocklist_de": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 2, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 3.798, 0.523, 0, false], ["2026-10-12", 2.523, 0.559, 0, false]], "sh": false, "uc": 758.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.559, "se": 1.603, "ts": 1.000, "map": 6.236, "obs": 1, "own": 7.848, "comp": {"urlhaus": 4.0886, "threatfox": -0.2211, "phishing_db": -0.411}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.523, "se": 0.763, "ts": 0.667, "map": 7.764, "obs": 3, "own": 4.454, "comp": {"cins": -0.497, "dshield": -0.9904, "crowdsec": 3.6148, "vulncheck": -0.6612, "blocklist_de": 1.9771}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.193, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-AL6-RIPE", "org": "AKNET Ltd.", "pdb": null, "pfx": 62, "reg": "1999-10-29", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41728, "abuse": "ripe@aknet.kg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00225504832098}, {"a": 12804, "h": "ADISAM", "n": "Adisam Telecom S.A.", "t": "Broadband & mobile", "w": 4, "cc": "RO", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4214, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 4.149, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.149, "se": 1.031, "ts": 1.000, "map": 20.305, "obs": 2, "own": 34.671, "comp": {"cins": -0.1363, "dshield": -0.3139, "crowdsec": -1.2424, "vulncheck": 6.8074, "blocklist_de": -0.7101}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.426, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-ATS22-RIPE", "org": "Adisam Telecom S.A.", "pdb": null, "pfx": 5, "reg": "1999-11-15", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@ip.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 12810, "h": "VIPNET-AS", "n": "A1 Hrvatska d.o.o.", "t": "Other", "w": 4, "cc": "HR", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.2630, "hi": 4.92, "lo": 0.64, "ips": 2, "mean": 2.35, "above": false}, "threatfox": {"n": 2, "p": 0.3720, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 0.006, 0.694, 0, false], ["2026-10-12", 0.172, 0.390, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 0.390, "se": 1.140, "ts": 1.000, "map": 1.613, "obs": 2, "own": 1.813, "comp": {"urlhaus": -0.4914, "threatfox": 3.2887, "phishing_db": -0.6928}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.172, "se": 0.845, "ts": 1.000, "map": 0.614, "obs": 2, "own": 0.358, "comp": {"cins": -0.4005, "dshield": 7.224, "crowdsec": -3.2616, "vulncheck": -0.6039, "blocklist_de": -2.0516}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:DanaBot": 2}}, "oid": "ORG-VGD1-RIPE", "org": "A1 Hrvatska d.o.o.", "pdb": null, "pfx": 11, "reg": "1999-11-18", "rir": "ripencc", "s24": 517, "sib": 5, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 132864, "abuse": "abuse@A1net.hr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01465670526282}, {"a": 12816, "h": "MWN-AS", "n": "Leibniz-Rechenzentrum", "t": "Other", "w": 2, "cc": "DE", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0420, "hi": 2.87, "lo": 0.22, "ips": 2, "mean": 1.21, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 1.10, "lo": 0.08, "ips": 1, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 0.027, 0.008, 0, false], ["2026-10-12", 0.029, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.804, "ts": null, "map": 0.116, "obs": 0, "own": 0.222, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.029, "se": 1.033, "ts": 1.000, "map": 0.146, "obs": 1, "own": 0.088, "comp": {"cins": 4.601, "dshield": -0.629, "crowdsec": -2.4825, "vulncheck": -0.5176, "blocklist_de": -1.5033}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.775, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LA54-RIPE", "org": "Leibniz-Rechenzentrum", "pdb": null, "pfx": 9, "reg": "2002-10-21", "rir": "ripencc", "s24": 1543, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 395008, "abuse": "abuse@lrz.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0019747772262}, {"a": 12824, "h": "HOMEPL-AS", "n": "home.pl S.A.", "t": "Hosting & VPS", "w": 15, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.0394, "hi": 2.87, "lo": 0.51, "ips": 3, "mean": 1.48, "above": false}, "phishing_db": {"n": 14, "p": 1.0000, "hi": 15.75, "lo": 6.65, "ips": 15, "mean": 10.80, "above": true}}, "h2": [["2026-10-05", 0.005, 3.050, 0, false], ["2026-10-12", 0.005, 3.063, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 14}, "lo": 3.063, "se": 0.802, "ts": 1.000, "map": 6.745, "obs": 14, "own": 2.524, "comp": {"urlhaus": -1.7288, "threatfox": -0.5398, "phishing_db": 5.8036}, "mass": 7.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.535, "ts": null, "map": 0.062, "obs": 0, "own": 0.017, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.995, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-HA12-RIPE", "org": "home.pl sp. z o.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://home.pl"}, "pfx": 21, "reg": "1999-11-26", "rir": "ripencc", "s24": 797, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 409600, "abuse": "abuse@home.pl", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00030940151112}, {"a": 12843, "h": "TELEMAXX", "n": "TelemaxX", "t": "Transit & backbone", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0324, "hi": 2.74, "lo": 0.36, "ips": 2, "mean": 1.31, "above": false}}, "h2": [["2026-10-05", 0.173, 0.009, 0, false], ["2026-10-12", 0.179, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.153, "obs": 0, "own": 1.193, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.179, "se": 0.847, "ts": 1.000, "map": 0.643, "obs": 2, "own": 2.079, "comp": {"cins": -0.3954, "dshield": -0.8189, "crowdsec": 4.7929, "vulncheck": -0.6005, "blocklist_de": -2.0261}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TTG2-RIPE", "org": "TelemaxX Telekommunikation GmbH", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.telemaxx.de"}, "pfx": 53, "reg": "1999-12-06", "rir": "ripencc", "s24": 487, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 193024, "abuse": "abuse@telemaxx.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00101136679275}, {"a": 12849, "h": "HOTNET-IL", "n": "HotNet Internet Services", "t": "Broadband & mobile", "w": 8, "cc": "IL", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.48}, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2025-55182": 1}, "n": 4}, "ev": {"urlhaus": {"n": 1, "p": 0.1408, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "crowdsec": {"n": 4, "p": 0.0004, "hi": 1.71, "lo": 0.37, "ips": 4, "mean": 0.93, "above": false}, "vulncheck": {"n": 1, "p": 0.0249, "hi": 2.55, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "blocklist_de": {"n": 3, "p": 0.0355, "hi": 2.82, "lo": 0.50, "ips": 3, "mean": 1.45, "above": false}}, "h2": [["2026-10-05", 0.393, 0.115, 0, false], ["2026-10-12", 0.426, 0.127, 0, false]], "sh": false, "uc": 70.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.127, "se": 1.370, "ts": 1.000, "map": 0.870, "obs": 1, "own": 2.529, "comp": {"urlhaus": 2.7613, "threatfox": -0.4295, "phishing_db": -0.8455}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.426, "se": 0.527, "ts": 0.500, "map": 0.839, "obs": 8, "own": 1.304, "comp": {"cins": -1.3344, "dshield": -2.0258, "crowdsec": 1.0543, "vulncheck": -0.1636, "blocklist_de": 3.6876}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.228, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MN3-RIPE", "org": "Hot-Net internet services Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.hotnet.net.il"}, "pfx": 82, "reg": "1999-12-08", "rir": "ripencc", "s24": 1637, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 446464, "abuse": "abuse@hot.net.il", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03790214561861}, {"a": 12874, "h": "FASTWEB", "n": "Fastweb", "t": "Broadband & mobile", "w": 44, "cc": "IT", "cf": {"rb": "hi", "wb": "hi", "rep": 0.69, "waf": 0.60}, "cs": {"c": {"http_flood": 2, "web_exploit": 21, "proxy_or_vpn": 2, "ssh_bruteforce": 9, "web_bruteforce": 28, "home_connection": 15, "mail_bruteforce": 29, "router_or_botnet": 4, "cve:CVE-2026-8181": 2, "cve:CVE-2026-63030": 7}, "n": 35}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.69, "lo": 0.05, "ips": 1, "mean": 0.29, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.20, "lo": 0.03, "ips": 2, "mean": 0.10, "above": false}, "urlhaus": {"n": 3, "p": 0.0893, "hi": 3.39, "lo": 0.60, "ips": 3, "mean": 1.75, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 0.54, "lo": 0.22, "ips": 35, "mean": 0.37, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.61, "lo": 0.05, "ips": 1, "mean": 0.26, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 0.83, "lo": 0.25, "ips": 8, "mean": 0.50, "above": false}}, "h2": [["2026-10-05", 0.344, 0.192, 0, false], ["2026-10-12", 0.182, 0.211, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 1}, "lo": 0.211, "se": 1.012, "ts": 0.750, "map": 0.643, "obs": 4, "own": 1.840, "comp": {"urlhaus": 2.5821, "threatfox": -0.5605, "phishing_db": -0.8368}, "mass": 14.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.182, "se": 0.429, "ts": 0.619, "map": 0.304, "obs": 21, "own": 0.472, "comp": {"cins": -0.2741, "dshield": -2.8703, "crowdsec": 2.157, "vulncheck": -0.9671, "blocklist_de": 2.1587}, "mass": 23.6, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 3, "imap": 5, "mail": 5}}, "oid": "ORG-FA7-RIPE", "org": "Fastweb SpA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.fastweb.it"}, "pfx": 110, "reg": "1999-12-17", "rir": "ripencc", "s24": 13917, "sib": 3, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7365120, "abuse": "abuse@fastweb.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.106391}, {"a": 12876, "h": "AS12876", "n": "Scaleway", "t": "Hosting & VPS", "w": 165, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 1.58, "waf": 1.52}, "cs": {"c": {"http_flood": 47, "data_centre": 59, "web_exploit": 46, "bad_crawling": 32, "proxy_or_vpn": 12, "first_seen_30d": 9, "ssh_bruteforce": 30, "web_bruteforce": 42, "mail_bruteforce": 5, "router_or_botnet": 1, "cve:CVE-2017-9841": 10, "cve:CVE-2019-9082": 6, "cve:CVE-2018-20062": 10, "cve:CVE-2023-50164": 7, "cve:CVE-2024-28000": 6}, "n": 63}, "ev": {"cins": {"n": 18, "p": 1.0000, "hi": 13.95, "lo": 6.50, "ips": 19, "mean": 9.93, "above": true}, "shodan": {"n": 129, "p": 1.0000, "hi": 26.58, "lo": 19.91, "ips": 129, "mean": 23.14, "above": true}, "dshield": {"n": 3, "p": 0.1120, "hi": 3.58, "lo": 0.63, "ips": 3, "mean": 1.85, "above": false}, "crowdsec": {"n": 43, "p": 1.0000, "hi": 8.22, "lo": 5.00, "ips": 63, "mean": 6.52, "above": true}, "threatfox": {"n": 6, "p": 0.8899, "hi": 8.89, "lo": 2.47, "ips": 6, "mean": 5.26, "above": true}, "vulncheck": {"n": 52, "p": 1.0000, "hi": 30.71, "lo": 19.51, "ips": 63, "mean": 24.84, "above": true}, "phishing_db": {"n": 11, "p": 0.9759, "hi": 8.86, "lo": 3.37, "ips": 12, "mean": 5.84, "above": true}, "blocklist_de": {"n": 9, "p": 0.4646, "hi": 4.74, "lo": 1.64, "ips": 9, "mean": 3.02, "above": false}}, "h2": [["2026-10-05", 7.091, 1.547, 0, false], ["2026-10-12", 4.946, 1.443, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 6, "phishing_db": 11}, "lo": 1.443, "se": 0.824, "ts": 0.647, "map": 3.181, "obs": 17, "own": 1.250, "comp": {"urlhaus": -1.9226, "threatfox": 1.487, "phishing_db": 3.2188}, "mass": 9.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 18, "dshield": 3, "crowdsec": 43, "vulncheck": 52, "blocklist_de": 9}, "lo": 4.946, "se": 0.368, "ts": 0.416, "map": 7.430, "obs": 125, "own": 1.452, "comp": {"cins": 12.0463, "dshield": -2.3945, "crowdsec": 0.5464, "vulncheck": 2.6264, "blocklist_de": -9.4253}, "mass": 88.6, "listed": false}}, "abq": false, "bot": 0.548, "det": {"shodan": {"c2": 53, "malware": 1, "compromised": 71, "doublepulsar": 4}, "threatfox": {"family:Havoc": 1, "family:Sliver": 1, "family:AdaptixC2": 1, "family:FAKEUPDATES": 1, "family:Unknown malware": 2}, "vulncheck": {"c2_server": 13, "botnet_node": 38, "attack_tooling": 11, "other_infrastructure": 1}, "blocklist_de": {"ssh": 5, "bots": 1, "imap": 1, "mail": 3}}, "oid": "ORG-TT1-RIPE", "org": "Scaleway SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.scaleway.com"}, "pfx": 22, "reg": "1999-12-20", "rir": "ripencc", "s24": 2161, "sib": 3, "tor": 5, "w24": 123, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 631040, "abuse": "abuse@proxad.net", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "cins"], "traffic": 0.071781}, {"a": 12880, "h": "DCI-AS", "n": "TIC AS12880", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0767, "hi": 3.37, "lo": 0.25, "ips": 1, "mean": 1.42, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.128, 0.011, 0, false]], "sh": false, "uc": 120.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.978, "ts": null, "map": 0.178, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.128, "se": 1.171, "ts": 1.000, "map": 0.853, "obs": 1, "own": 0.532, "comp": {"cins": -0.1737, "dshield": -0.3936, "crowdsec": 3.0862, "vulncheck": -0.3817, "blocklist_de": -0.9027}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.982, "det": null, "oid": "ORG-TCOI1-RIPE", "org": "Iran Information Technology Company PJSC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Tbps", "pol": "Selective", "web": "http://tic.ir"}, "pfx": 71, "reg": "1999-12-22", "rir": "ripencc", "s24": 153, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1077504, "abuse": "abuse@ito.gov.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041167184865}, {"a": 12912, "h": "TMPL", "n": "T-Mobile Polska", "t": "Broadband & mobile", "w": 8, "cc": "PL", "cf": {"rb": "hi", "wb": "hi", "rep": 0.82, "waf": 0.72}, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.0030, "hi": 1.91, "lo": 0.25, "ips": 2, "mean": 0.91, "above": false}, "urlhaus": {"n": 3, "p": 0.3983, "hi": 5.56, "lo": 0.98, "ips": 3, "mean": 2.87, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.38, "lo": 0.03, "ips": 1, "mean": 0.16, "above": false}, "blocklist_de": {"n": 3, "p": 0.0001, "hi": 1.39, "lo": 0.25, "ips": 3, "mean": 0.72, "above": false}}, "h2": [["2026-10-05", 0.101, 0.430, 0, false], ["2026-10-12", 0.137, 0.476, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.476, "se": 1.012, "ts": 1.000, "map": 1.566, "obs": 3, "own": 4.105, "comp": {"urlhaus": 3.7447, "threatfox": -0.5497, "phishing_db": -1.1205}, "mass": 10.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.137, "se": 0.560, "ts": 0.500, "map": 0.289, "obs": 6, "own": 0.450, "comp": {"cins": -1.2362, "dshield": 2.9036, "crowdsec": -5.1568, "vulncheck": -0.8645, "blocklist_de": 4.5063}, "mass": 6.9, "listed": false}}, "abq": false, "bot": 0.097, "det": {"blocklist_de": {"ftp": 1, "imap": 1, "mail": 2}}, "oid": "ORG-EG4-RIPE", "org": "T-Mobile Polska S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.t-mobile.pl"}, "pfx": 48, "reg": "1999-12-30", "rir": "ripencc", "s24": 4269, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1359616, "abuse": "abuse@t-mobile.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.088822}, {"a": 12946, "h": "TeleCable", "n": "R Cable y Telecable Telecomunicaciones, S.A.U.", "t": "Broadband & mobile", "w": 2, "cc": "ES", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0004, "hi": 1.40, "lo": 0.10, "ips": 1, "mean": 0.59, "above": false}, "blocklist_de": {"n": 2, "p": 0.0671, "hi": 3.21, "lo": 0.42, "ips": 2, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.110, 0.008, 0, false], ["2026-10-12", 0.225, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.845, "ts": null, "map": 0.134, "obs": 0, "own": 0.675, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.225, "se": 0.717, "ts": 0.667, "map": 0.633, "obs": 3, "own": 0.995, "comp": {"cins": -0.6702, "dshield": -1.2544, "crowdsec": -1.5576, "vulncheck": -0.736, "blocklist_de": 5.1549}, "mass": 3.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-GGDC1-RIPE", "org": "R Cable y Telecable Telecomunicaciones, S.A.U.", "pdb": null, "pfx": 8, "reg": "2000-01-19", "rir": "ripencc", "s24": 899, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 230400, "abuse": "abuse.es@masorange.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00202975376854}, {"a": 12958, "h": "MCC", "n": "T2 Russia Network", "t": "Other", "w": 10, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 10, "p": 0.9993, "hi": 15.16, "lo": 5.51, "ips": 10, "mean": 9.83, "above": true}}, "h2": [["2026-10-12", 3.479, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 0.437, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 10, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.479, "se": 0.485, "ts": 1.000, "map": 6.506, "obs": 10, "own": 3.664, "comp": {"cins": -1.3734, "dshield": 20.1915, "crowdsec": -8.0368, "vulncheck": -0.8828, "blocklist_de": -6.6322}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.412, "det": null, "oid": "ORG-MCC1-RIPE", "org": "T2 Mobile LLC", "pdb": {"t": null, "sc": null, "tr": "1-5Tbps", "pol": "Selective", "web": "https://msk.t2.ru/"}, "pfx": 22, "reg": "2000-01-26", "rir": "ripencc", "s24": 220, "sib": 8, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 100096, "abuse": "abuse_ripe@t2.ru", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.008643122026}, {"a": 12975, "h": "PALTEL-AS", "n": "Palestinian Telecommunications", "t": "Broadband & mobile", "w": 23, "cc": "PS", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "bad_crawling": 2, "proxy_or_vpn": 3, "web_bruteforce": 8, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-63030": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0226, "hi": 2.50, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "shodan": {"n": 3, "p": 0.0001, "hi": 1.40, "lo": 0.25, "ips": 3, "mean": 0.72, "above": false}, "dshield": {"n": 2, "p": 0.0451, "hi": 2.93, "lo": 0.38, "ips": 2, "mean": 1.40, "above": false}, "urlhaus": {"n": 2, "p": 0.3047, "hi": 5.26, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}, "crowdsec": {"n": 9, "p": 0.0052, "hi": 2.36, "lo": 0.82, "ips": 9, "mean": 1.51, "above": false}, "threatfox": {"n": 1, "p": 0.0932, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "vulncheck": {"n": 2, "p": 0.0484, "hi": 2.98, "lo": 0.39, "ips": 2, "mean": 1.42, "above": false}, "blocklist_de": {"n": 6, "p": 0.1416, "hi": 3.62, "lo": 1.00, "ips": 6, "mean": 2.14, "above": false}}, "h2": [["2026-10-05", 0.586, 0.506, 0, false], ["2026-10-12", 0.975, 0.550, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 1, "phishing_db": 0}, "lo": 0.550, "se": 1.044, "ts": 0.667, "map": 1.947, "obs": 3, "own": 5.085, "comp": {"urlhaus": 3.3419, "threatfox": 0.0133, "phishing_db": -1.0628}, "mass": 6.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 9, "vulncheck": 2, "blocklist_de": 6}, "lo": 0.975, "se": 0.432, "ts": 0.450, "map": 1.655, "obs": 20, "own": 2.552, "comp": {"cins": 0.1765, "dshield": -0.3324, "crowdsec": -0.0309, "vulncheck": -0.3483, "blocklist_de": 2.4324}, "mass": 19.5, "listed": false}}, "abq": false, "bot": 0.173, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ftp": 2, "ssh": 1, "bots": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PTC2-RIPE", "org": "Palestine Telecommunications Company (PALTEL)", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.paltel.ps"}, "pfx": 244, "reg": "2000-05-22", "rir": "ripencc", "s24": 2123, "sib": 1, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 856320, "abuse": "RipeAdmin.TechEng@PaltelGroup.ps", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02014724629032}, {"a": 12989, "h": "BlackHOST", "n": "BlackHOST", "t": "Hosting & VPS", "w": 11, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 7, "web_exploit": 10, "bad_crawling": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 9, "web_bruteforce": 5, "mail_bruteforce": 1, "cve:CVE-2017-3506": 3, "cve:CVE-2017-12149": 5, "cve:CVE-2017-18362": 6, "cve:CVE-2018-13379": 6, "cve:CVE-2019-18935": 3}, "n": 10}, "ev": {"crowdsec": {"n": 2, "p": 0.3867, "hi": 5.96, "lo": 0.77, "ips": 10, "mean": 2.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 11.027, 0.011, 1, false], ["2026-10-12", 5.475, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.475, "se": 0.783, "ts": 0.667, "map": 17.543, "obs": 3, "own": 3.504, "comp": {"cins": -0.458, "dshield": -0.9261, "crowdsec": 4.0564, "vulncheck": -0.6397, "blocklist_de": 2.2257}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.655, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-BHL16-RIPE", "org": "Black HOST Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://black.host"}, "pfx": 20, "reg": "2003-05-12", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@black.host", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057453898874}, {"a": 12997, "h": "KTNET", "n": "Kyrgyztelecom", "t": "Broadband & mobile", "w": 4, "cc": "KG", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1456, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "dshield": {"n": 1, "p": 0.1333, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "crowdsec": {"n": 3, "p": 0.1924, "hi": 4.17, "lo": 0.73, "ips": 3, "mean": 2.15, "above": false}}, "h2": [["2026-10-05", 0.707, 0.010, 0, false], ["2026-10-12", 1.087, 0.011, 0, false]], "sh": false, "uc": 296.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.924, "ts": null, "map": 0.164, "obs": 0, "own": 0.961, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.087, "se": 0.603, "ts": 0.600, "map": 2.470, "obs": 5, "own": 3.840, "comp": {"cins": 3.3054, "dshield": 1.4358, "crowdsec": 2.7728, "vulncheck": -0.7998, "blocklist_de": -4.4162}, "mass": 4.5, "listed": false}}, "abq": true, "bot": 0.372, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-JK1-RIPE", "org": "OJSC Kyrgyztelecom", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.kt.kg"}, "pfx": 34, "reg": "2000-02-15", "rir": "ripencc", "s24": 324, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 166912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00140096907702}, {"a": 13009, "h": "VDATA", "n": "Redcentric", "t": "Transit & backbone", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.4732, "hi": 6.12, "lo": 1.08, "ips": 3, "mean": 3.16, "above": false}, "phishing_db": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.008, 0.264, 0, false], ["2026-10-12", 0.008, 0.275, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.275, "se": 1.448, "ts": 1.000, "map": 2.257, "obs": 1, "own": 9.356, "comp": {"urlhaus": -0.1849, "threatfox": -0.2022, "phishing_db": 2.8271}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.775, "ts": null, "map": 0.145, "obs": 0, "own": 0.864, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.283, "det": {"shodan": {"c2": 3}}, "oid": "ORG-RSL38-RIPE", "org": "Redcentric Solutions Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.redcentricplc.com/"}, "pfx": 28, "reg": "2000-02-17", "rir": "ripencc", "s24": 125, "sib": 8, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32512, "abuse": "abuse@redcentricplc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00104634239786}, {"a": 13022, "h": "STREAMS_GMBH", "n": "Streams Telecommunicationsservices GmbH", "t": "Broadband & mobile", "w": 1, "cc": "AT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.345, 0.011, 0, false], ["2026-10-12", 0.368, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 1.835, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.368, "se": 1.327, "ts": 1.000, "map": 3.298, "obs": 1, "own": 5.968, "comp": {"cins": -0.1113, "dshield": -0.2592, "crowdsec": 3.8181, "vulncheck": -0.2799, "blocklist_de": -0.5809}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.748, "det": null, "oid": "ORG-STG1-RIPE", "org": "Streams Telecommunicationsservices GmbH", "pdb": null, "pfx": 3, "reg": "2000-02-21", "rir": "ripencc", "s24": 25, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "abuse@streams.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13030, "h": "INIT7", "n": "Init7", "t": "Transit & backbone", "w": 8, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 2, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2023-30625": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0380, "hi": 2.83, "lo": 0.37, "ips": 2, "mean": 1.35, "above": false}, "vulncheck": {"n": 4, "p": 0.6826, "hi": 7.37, "lo": 1.59, "ips": 5, "mean": 4.03, "above": false}, "blocklist_de": {"n": 1, "p": 0.0622, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.542, 0.009, 0, false], ["2026-10-12", 0.748, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 1.216, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 4, "blocklist_de": 1}, "lo": 0.748, "se": 0.575, "ts": 0.571, "map": 1.605, "obs": 7, "own": 5.141, "comp": {"cins": -0.8323, "dshield": -1.4741, "crowdsec": 0.312, "vulncheck": 3.9697, "blocklist_de": -0.1084}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.375, "det": {"vulncheck": {"botnet_node": 5}, "blocklist_de": {"mail": 1, "apache": 1}}, "oid": "ORG-ISA1-RIPE", "org": "Init7 (Switzerland) Ltd.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.init7.net/"}, "pfx": 69, "reg": "2000-02-22", "rir": "ripencc", "s24": 460, "sib": 4, "tor": 1, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 183296, "abuse": "abuse@init7.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00554931747524}, {"a": 13036, "h": "TMOBILE-CZ", "n": "T-Mobile CZ AS13036", "t": "Broadband & mobile", "w": 3, "cc": "CZ", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.99, "lo": 0.21, "ips": 4, "mean": 0.54, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.69, "lo": 0.12, "ips": 3, "mean": 0.35, "above": false}}, "h2": [["2026-10-05", 0.075, 0.006, 0, false], ["2026-10-12", 0.053, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.737, "ts": null, "map": 0.084, "obs": 0, "own": 0.381, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.053, "se": 0.694, "ts": 1.000, "map": 0.143, "obs": 3, "own": 0.225, "comp": {"cins": -0.6544, "dshield": -1.2317, "crowdsec": 5.3637, "vulncheck": -0.7303, "blocklist_de": -3.3}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.117, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-RA2-RIPE", "org": "T-Mobile Czech Republic a.s.", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "No", "web": "http://www.t-mobile.cz"}, "pfx": 34, "reg": "2000-02-24", "rir": "ripencc", "s24": 3876, "sib": 7, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 992256, "abuse": "abuse@t-mobile.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0426261619331}, {"a": 13041, "h": "CESCA-AC", "n": "CSUC", "t": "Enterprise, edu & gov", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.822, "ts": null, "map": 0.124, "obs": 0, "own": 1.016, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.483, "ts": null, "map": 0.048, "obs": 0, "own": 0.357, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.253, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CDSD1-RIPE", "org": "Consorci de Serveis Universitaris de Catalunya", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.csuc.cat"}, "pfx": 8, "reg": "2000-02-25", "rir": "ripencc", "s24": 1218, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 311808, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00111723822835}, {"a": 13101, "h": "TNG-AS", "n": "TNG Stadtnetz GmbH", "t": "Broadband & mobile", "w": 2, "cc": "DE", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0993, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "blocklist_de": {"n": 1, "p": 0.0484, "hi": 2.97, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.534, 0.009, 0, false], ["2026-10-12", 0.174, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.883, "ts": null, "map": 0.149, "obs": 0, "own": 0.802, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.174, "se": 0.847, "ts": 0.500, "map": 0.623, "obs": 2, "own": 0.992, "comp": {"cins": -0.4323, "dshield": 3.0631, "crowdsec": -3.4763, "vulncheck": -0.6244, "blocklist_de": 2.3897}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TSG19-RIPE", "org": "TNG Stadtnetz GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.tng.de"}, "pfx": 33, "reg": "2000-03-20", "rir": "ripencc", "s24": 555, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 142080, "abuse": "abuse@tng.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0066527239272}, {"a": 13110, "h": "INEA-AS", "n": "INEA", "t": "Broadband & mobile", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "home_connection": 1, "cve:CVE-2024-34351": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0056, "hi": 1.95, "lo": 0.15, "ips": 1, "mean": 0.82, "above": false}, "dshield": {"n": 1, "p": 0.0856, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "crowdsec": {"n": 1, "p": 0.0022, "hi": 1.71, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}, "blocklist_de": {"n": 1, "p": 0.0356, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}}, "h2": [["2026-10-05", 0.540, 0.009, 0, false], ["2026-10-12", 0.272, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.144, "obs": 0, "own": 0.751, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.272, "se": 0.719, "ts": 0.333, "map": 0.768, "obs": 3, "own": 1.207, "comp": {"cins": -0.6148, "dshield": 2.3484, "crowdsec": -1.1237, "vulncheck": -0.7151, "blocklist_de": 1.235}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-ISZO91-RIPE", "org": "INEA sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.inea.pl"}, "pfx": 21, "reg": "2000-03-21", "rir": "ripencc", "s24": 670, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 171520, "abuse": "abuse@inea.com.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0172748146116}, {"a": 13122, "h": "MANX-AS", "n": "Manx Telecom", "t": "Broadband & mobile", "w": 0, "cc": "IM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0777, "hi": 3.38, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.175, "obs": 0, "own": 1.136, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.721, "ts": null, "map": 0.125, "obs": 0, "own": 0.334, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.138, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MT7-RIPE", "org": "Manx Telecom Trading Ltd", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.manxtelecom.com/"}, "pfx": 32, "reg": "2000-03-27", "rir": "ripencc", "s24": 188, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 86016, "abuse": "noc@manxtelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00168982241382}, {"a": 13124, "h": "A1BG_RSD", "n": "A1 Bulgaria AS13124", "t": "Broadband & mobile", "w": 2, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0003, "hi": 1.33, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "blocklist_de": {"n": 2, "p": 0.0328, "hi": 2.75, "lo": 0.36, "ips": 2, "mean": 1.31, "above": false}}, "h2": [["2026-10-05", 0.004, 0.135, 0, false], ["2026-10-12", 0.099, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.823, "ts": null, "map": 0.124, "obs": 0, "own": 0.606, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.099, "se": 0.829, "ts": 1.000, "map": 0.341, "obs": 2, "own": 0.543, "comp": {"cins": -0.5041, "dshield": -1.0018, "crowdsec": -3.941, "vulncheck": -0.6649, "blocklist_de": 6.4304}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"c2": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-MN1-RIPE", "org": "A1 Bulgaria EAD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Restrictive", "web": "http://www.a1.bg"}, "pfx": 438, "reg": "2000-03-24", "rir": "ripencc", "s24": 1202, "sib": 7, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 361728, "abuse": "RIPE.Abuse@a1.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00349505835861}, {"a": 13188, "h": "TRIOLAN", "n": "Triolan ISP", "t": "Broadband & mobile", "w": 15, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2025-4396": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2024-38475": 1}, "n": 3}, "ev": {"dshield": {"n": 2, "p": 0.0825, "hi": 3.37, "lo": 0.44, "ips": 2, "mean": 1.61, "above": false}, "urlhaus": {"n": 3, "p": 0.5485, "hi": 6.75, "lo": 1.19, "ips": 3, "mean": 3.48, "above": false}, "crowdsec": {"n": 3, "p": 0.0001, "hi": 1.47, "lo": 0.26, "ips": 3, "mean": 0.76, "above": false}, "blocklist_de": {"n": 8, "p": 0.5703, "hi": 5.31, "lo": 1.73, "ips": 8, "mean": 3.31, "above": false}}, "h2": [["2026-10-05", 0.575, 0.446, 0, false], ["2026-10-12", 0.963, 1.034, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 1.034, "se": 0.997, "ts": 1.000, "map": 3.465, "obs": 3, "own": 8.567, "comp": {"urlhaus": 4.5113, "threatfox": -0.5414, "phishing_db": -1.101}, "mass": 7.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.963, "se": 0.460, "ts": 0.615, "map": 1.715, "obs": 13, "own": 2.646, "comp": {"cins": -2.0581, "dshield": 0.3159, "crowdsec": -5.7899, "vulncheck": -0.9423, "blocklist_de": 10.4077}, "mass": 15.3, "listed": false}}, "abq": false, "bot": 0.203, "det": {"blocklist_de": {"bots": 2, "imap": 6, "mail": 6}}, "oid": "ORG-CDNL2-RIPE", "org": "CONTENT DELIVERY NETWORK LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://triolan.com/"}, "pfx": 1607, "reg": "2000-04-27", "rir": "ripencc", "s24": 1605, "sib": 1, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 414976, "abuse": "abuse@triolan.com.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01439375223237}, {"a": 13213, "h": "UK2NET-AS", "n": "THG Hosting", "t": "Hosting & VPS", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-41940": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0266, "hi": 2.59, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "crowdsec": {"n": 1, "p": 0.0158, "hi": 2.33, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1285, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-12", 0.070, 0.160, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.160, "se": 1.388, "ts": 1.000, "map": 1.107, "obs": 1, "own": 0.512, "comp": {"urlhaus": -0.2745, "threatfox": -0.2621, "phishing_db": 2.264}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.070, "se": 1.105, "ts": 1.000, "map": 0.407, "obs": 1, "own": 0.087, "comp": {"cins": -0.2094, "dshield": -0.4674, "crowdsec": 2.6855, "vulncheck": -0.4292, "blocklist_de": -1.0856}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.754, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-UL5-RIPE", "org": "THG HOSTING LIMITED", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.ingenuitycloudservices.com/"}, "pfx": 114, "reg": "2000-05-09", "rir": "ripencc", "s24": 390, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 101888, "abuse": "abuse@ingenuitycloudservices.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00043013482663}, {"a": 13280, "h": "H3GIE", "n": "Three Ireland (Hutchison) Ltd", "t": "Transit & backbone", "w": 5, "cc": "IE", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0931, "hi": 3.58, "lo": 0.27, "ips": 2, "mean": 1.51, "above": false}, "crowdsec": {"n": 2, "p": 0.0158, "hi": 2.41, "lo": 0.31, "ips": 2, "mean": 1.15, "above": false}, "blocklist_de": {"n": 3, "p": 0.2728, "hi": 4.70, "lo": 0.83, "ips": 3, "mean": 2.43, "above": false}}, "h2": [["2026-10-05", 0.441, 0.009, 0, false], ["2026-10-12", 0.861, 0.010, 0, false]], "sh": false, "uc": 184.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.876, "ts": null, "map": 0.147, "obs": 0, "own": 1.107, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.861, "se": 0.565, "ts": 0.500, "map": 1.821, "obs": 6, "own": 5.736, "comp": {"cins": -1.1375, "dshield": 0.7357, "crowdsec": -2.096, "vulncheck": -0.8493, "blocklist_de": 5.3399}, "mass": 6.1, "listed": false}}, "abq": false, "bot": 0.072, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 2}}, "oid": "ORG-HIL1-RIPE", "org": "Three Ireland (Hutchison) limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.three.ie"}, "pfx": 70, "reg": "2000-05-23", "rir": "ripencc", "s24": 605, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 241664, "abuse": "abuse@three.ie", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02303449339122}, {"a": 13285, "h": "OPALTELECOM-AS", "n": "PlatformX Communications", "t": "Broadband & mobile", "w": 13, "cc": "GB", "cf": {"rb": "hi", "wb": "", "rep": 0.67, "waf": 0.68}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 5, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 2}, "n": 6}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 1.03, "lo": 0.18, "ips": 3, "mean": 0.53, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.19, "lo": 0.02, "ips": 2, "mean": 0.09, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.28, "lo": 0.08, "ips": 6, "mean": 0.17, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.55, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 0.60, "lo": 0.15, "ips": 5, "mean": 0.34, "above": false}}, "h2": [["2026-10-05", 0.080, 0.018, 0, false], ["2026-10-12", 0.122, 0.019, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.019, "se": 1.333, "ts": 1.000, "map": 0.097, "obs": 1, "own": 0.368, "comp": {"urlhaus": -0.789, "threatfox": -0.4359, "phishing_db": 0.5214}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.122, "se": 0.460, "ts": 0.429, "map": 0.212, "obs": 14, "own": 0.330, "comp": {"cins": 5.5361, "dshield": -2.712, "crowdsec": -3.0258, "vulncheck": -0.9535, "blocklist_de": 0.9989}, "mass": 18.3, "listed": false}}, "abq": false, "bot": 0.117, "det": {"shodan": {"malware": 2}, "blocklist_de": {"ssh": 3, "bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-OTIS1-RIPE", "org": "TalkTalk Communications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Open", "web": "https://www.pxc.co.uk/"}, "pfx": 94, "reg": "2000-05-25", "rir": "ripencc", "s24": 15449, "sib": 9, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7725056, "abuse": "abuse-reports@pxc.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.109067}, {"a": 13333, "h": "CCI-PA-AS-1", "n": "Consolidated Communications - PA", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0394, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}}, "h2": [["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.967, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.652, "ts": null, "map": 0.099, "obs": 0, "own": 0.241, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"c2": 1}}, "oid": "CONSO-8-ARIN", "org": "Fidium", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.consolidated.com"}, "pfx": 38, "reg": "1999-05-13", "rir": "arin", "s24": 317, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 106240, "abuse": "abuse@consolidated.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13335, "h": "CLOUDFLARENET", "n": "Cloudflare", "t": "CDN & platforms", "w": 486, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.13, "waf": 0.81}, "cs": {"c": {"http_flood": 368, "data_centre": 321, "web_exploit": 366, "bad_crawling": 298, "proxy_or_vpn": 59, "first_seen_30d": 1, "ssh_bruteforce": 179, "web_bruteforce": 368, "mail_bruteforce": 137, "cve:CVE-2017-9841": 135, "cve:CVE-2025-4396": 50, "cve:CVE-2018-20062": 58, "cve:CVE-2021-41773": 32, "cve:CVE-2024-28000": 32}, "n": 381}, "ev": {"shodan": {"n": 6, "p": 0.0000, "hi": 0.93, "lo": 0.26, "ips": 6, "mean": 0.55, "above": false}, "dshield": {"n": 54, "p": 1.0000, "hi": 17.08, "lo": 10.94, "ips": 70, "mean": 13.87, "above": true}, "crowdsec": {"n": 73, "p": 0.9999, "hi": 5.68, "lo": 3.87, "ips": 381, "mean": 4.74, "above": true}, "phishing_db": {"n": 2, "p": 0.0012, "hi": 1.71, "lo": 0.22, "ips": 2, "mean": 0.81, "above": false}, "blocklist_de": {"n": 30, "p": 0.9799, "hi": 5.91, "lo": 3.26, "ips": 40, "mean": 4.50, "above": true}}, "h2": [["2026-10-05", 2.412, 0.072, 0, false], ["2026-10-12", 3.078, 0.077, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.077, "se": 1.164, "ts": 1.000, "map": 0.299, "obs": 2, "own": 2.626, "comp": {"urlhaus": -0.8437, "threatfox": -0.4462, "phishing_db": 1.7096}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 54, "crowdsec": 73, "vulncheck": 0, "blocklist_de": 30}, "lo": 3.078, "se": 0.360, "ts": 0.465, "map": 4.516, "obs": 157, "own": 9.043, "comp": {"cins": -3.9565, "dshield": 8.1207, "crowdsec": 1.9145, "vulncheck": -1.0078, "blocklist_de": -2.1696}, "mass": 137.2, "listed": false}}, "abq": false, "bot": 0.641, "det": {"shodan": {"malware": 2, "compromised": 4}, "blocklist_de": {"ssh": 6, "bots": 16, "imap": 5, "mail": 6, "apache": 13}}, "oid": "CLOUD14-ARIN", "org": "Cloudflare, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.cloudflare.com"}, "pfx": 2527, "reg": "2010-07-14", "rir": "arin", "s24": 5496, "sib": 6, "tor": 0, "w24": 133, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 1489920, "abuse": "abuse@cloudflare.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 2.495759}, {"a": 13347, "h": "MIDWEST-CABLE", "n": "MW-CABLE", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.984, "det": null, "oid": "MCTL-7-ARIN", "org": "Midwest Cable", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://midwestwirecable.com"}, "pfx": 5, "reg": "2022-05-16", "rir": "arin", "s24": 5, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13367, "h": "COMCAST-13367", "n": "Comcast - Minnesota", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.251, "det": {"shodan": {"compromised": 1}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": null}, "pfx": 7, "reg": "2001-12-20", "rir": "arin", "s24": 7, "sib": 55, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13389, "h": "AZUKI", "n": "AZUKI, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "AZUKI-ARIN", "org": "AZUKI, LLC", "pdb": null, "pfx": 16, "reg": "2002-06-24", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13444, "h": "TRS-GL-01", "n": "TRS", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.422, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.415, "det": null, "oid": "TRANS-810-ARIN", "org": "TRS", "pdb": null, "pfx": 18, "reg": "2020-03-02", "rir": "arin", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "ipadmin@transsss.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13445, "h": "WEBEX", "n": "WebEx Communications", "t": "Hosting & VPS", "w": 768, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.0681, "hi": 3.19, "lo": 0.56, "ips": 768, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.157, 0.008, 0, false], ["2026-10-12", 0.172, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.121, "obs": 0, "own": 0.090, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.172, "se": 0.712, "ts": 1.000, "map": 0.480, "obs": 3, "own": 0.096, "comp": {"cins": -0.7391, "dshield": -1.3507, "crowdsec": -5.297, "vulncheck": -0.759, "blocklist_de": 8.8045}, "mass": 3.6, "listed": false}}, "abq": true, "bot": 0.530, "det": {"blocklist_de": {"mail": 768, "apache": 768}}, "oid": "WEX-ARIN", "org": "Cisco Webex LLC", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.webex.com/"}, "pfx": 143, "reg": "1999-06-09", "rir": "arin", "s24": 1333, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 432128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13489, "h": "", "n": "TigoUne", "t": "Broadband & mobile", "w": 74, "cc": "CO", "cf": {"rb": "", "wb": "", "rep": 1.48, "waf": 0.70}, "cs": {"c": {"http_flood": 6, "data_centre": 3, "web_exploit": 9, "bad_crawling": 1, "proxy_or_vpn": 10, "first_seen_30d": 1, "ssh_bruteforce": 22, "web_bruteforce": 24, "home_connection": 25, "mail_bruteforce": 26, "router_or_botnet": 15, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 1}, "n": 35}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 0.97, "lo": 0.17, "ips": 3, "mean": 0.50, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.13, "lo": 0.01, "ips": 1, "mean": 0.06, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.63, "lo": 0.08, "ips": 2, "mean": 0.30, "above": false}, "urlhaus": {"n": 4, "p": 0.1255, "hi": 3.62, "lo": 0.78, "ips": 4, "mean": 1.98, "above": false}, "crowdsec": {"n": 34, "p": 0.0000, "hi": 1.01, "lo": 0.58, "ips": 35, "mean": 0.78, "above": false}, "threatfox": {"n": 3, "p": 0.0065, "hi": 2.19, "lo": 0.39, "ips": 4, "mean": 1.13, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.52, "lo": 0.04, "ips": 1, "mean": 0.22, "above": false}, "blocklist_de": {"n": 30, "p": 0.0001, "hi": 2.17, "lo": 1.20, "ips": 32, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.421, 0.278, 0, false], ["2026-10-12", 0.579, 0.302, 0, false]], "sh": false, "uc": 82.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 4, "threatfox": 3, "phishing_db": 1}, "lo": 0.302, "se": 0.945, "ts": 0.500, "map": 0.800, "obs": 8, "own": 2.258, "comp": {"urlhaus": 2.383, "threatfox": -0.0225, "phishing_db": -0.9577}, "mass": 21.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 2, "crowdsec": 34, "vulncheck": 1, "blocklist_de": 30}, "lo": 0.579, "se": 0.379, "ts": 0.486, "map": 0.896, "obs": 70, "own": 1.382, "comp": {"cins": -0.8637, "dshield": -2.6507, "crowdsec": -1.3861, "vulncheck": -0.9264, "blocklist_de": 7.1106}, "mass": 82.3, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"malware": 1}, "threatfox": {"family:DCRat": 3, "family:AsyncRAT": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 4, "bots": 10, "imap": 16, "mail": 18}}, "oid": "@family-59146", "org": "UNE EPM TELECOMUNICACIONES S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.tigo.com.co/"}, "pfx": 97, "reg": "1999-06-18", "rir": "lacnic", "s24": 16548, "sib": 6, "tor": 0, "w24": 70, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6857984, "abuse": "abuse.internet@tigo.com.co", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.096299}, {"a": 13490, "h": "BUCKEYECABLEVISION", "n": "Buckeye Cablevision", "t": "Broadband & mobile", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 5, "mail_bruteforce": 4}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0814, "hi": 3.43, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "crowdsec": {"n": 4, "p": 0.0254, "hi": 2.69, "lo": 0.58, "ips": 5, "mean": 1.47, "above": false}, "blocklist_de": {"n": 4, "p": 0.2974, "hi": 4.65, "lo": 1.00, "ips": 4, "mean": 2.54, "above": false}}, "h2": [["2026-10-05", 0.514, 0.008, 0, false], ["2026-10-12", 1.032, 0.009, 0, false]], "sh": false, "uc": 98.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.845, "ts": null, "map": 0.134, "obs": 0, "own": 0.673, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.032, "se": 0.503, "ts": 0.444, "map": 1.978, "obs": 9, "own": 3.058, "comp": {"cins": 1.7713, "dshield": -2.2545, "crowdsec": -1.1458, "vulncheck": -0.9067, "blocklist_de": 4.6118}, "mass": 10.0, "listed": false}}, "abq": false, "bot": 0.187, "det": {"blocklist_de": {"ssh": 1, "imap": 3, "mail": 3}}, "oid": "BUCKEY-4-ARIN", "org": "Buckeye Cablevision, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.buckeyebroadband.com"}, "pfx": 699, "reg": "1999-06-18", "rir": "arin", "s24": 905, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 406528, "abuse": "abuse@bex.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00915683703752}, {"a": 13614, "h": "ALLWEST", "n": "All West Communications, Inc.", "t": "Other", "w": 7, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 6, "ssh_bruteforce": 6, "web_bruteforce": 7, "home_connection": 1, "cve:CVE-2017-9841": 6, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 6, "cve:CVE-2021-41773": 4}, "n": 7}, "ev": {"crowdsec": {"n": 6, "p": 0.7274, "hi": 6.79, "lo": 1.88, "ips": 7, "mean": 4.01, "above": false}}, "h2": [["2026-10-05", 1.704, 0.010, 0, false], ["2026-10-12", 1.474, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.935, "ts": null, "map": 0.167, "obs": 0, "own": 0.406, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.474, "se": 0.564, "ts": 1.000, "map": 3.116, "obs": 6, "own": 1.765, "comp": {"cins": -0.9514, "dshield": -1.6209, "crowdsec": 10.6281, "vulncheck": -0.8141, "blocklist_de": -4.7114}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.193, "det": null, "oid": "AWST-ARIN", "org": "All West Communications, Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.allwest.com"}, "pfx": 32, "reg": "1999-07-14", "rir": "arin", "s24": 280, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110848, "abuse": "noc@allwest.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13638, "h": "METALINK", "n": "Metalink Technologies, Inc.", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 3, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.117, 0.010, 0, false], ["2026-10-12", 0.112, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 0.506, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.112, "se": 1.174, "ts": 1.000, "map": 0.721, "obs": 1, "own": 0.468, "comp": {"cins": -0.128, "dshield": -0.2959, "crowdsec": -1.1711, "vulncheck": 3.3286, "blocklist_de": -0.6672}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.189, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "MTLT-ARIN", "org": "Metalink Technologies, Inc.", "pdb": null, "pfx": 86, "reg": "1999-07-20", "rir": "arin", "s24": 132, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 55296, "abuse": "abuse@metalink.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13649, "h": "ASN-FLEXENTIAL", "n": "Flexential Internet Services", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.20, "lo": 0.16, "ips": 2, "mean": 0.57, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.75, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}, "phishing_db": {"n": 2, "p": 0.0658, "hi": 3.19, "lo": 0.41, "ips": 2, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.023, 0.156, 0, false], ["2026-10-12", 0.022, 0.161, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.161, "se": 1.145, "ts": 1.000, "map": 0.638, "obs": 2, "own": 1.905, "comp": {"urlhaus": -0.6926, "threatfox": -0.4155, "phishing_db": 2.2853}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.022, "se": 1.011, "ts": 1.000, "map": 0.107, "obs": 1, "own": 0.176, "comp": {"cins": -0.2764, "dshield": -0.6002, "crowdsec": 1.9653, "vulncheck": -0.5032, "blocklist_de": -1.4271}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.613, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "VINS-ARIN", "org": "Flexential Colorado Corp.", "pdb": {"t": "Content", "sc": "North America", "tr": "50-100Gbps", "pol": "Restrictive", "web": "https://www.flexential.com"}, "pfx": 563, "reg": "1999-07-22", "rir": "arin", "s24": 1989, "sib": 7, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 829440, "abuse": "abuse@flexential.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13737, "h": "AS-INCX", "n": "Interconnecx, LLC", "t": "Transit & backbone", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2019-9194": 1, "cve:CVE-2021-23394": 1, "cve:CVE-2022-46604": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1434, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 1.011, 0.011, 0, false], ["2026-10-12", 0.241, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 2.233, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.241, "se": 1.255, "ts": 1.000, "map": 1.885, "obs": 1, "own": 6.717, "comp": {"cins": -0.1367, "dshield": -0.3147, "crowdsec": 3.5157, "vulncheck": -0.3246, "blocklist_de": -0.712}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.278, "det": null, "oid": "IL-895-ARIN", "org": "Interconnecx, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Open", "web": "http://www.incx.net"}, "pfx": 48, "reg": "2014-10-09", "rir": "arin", "s24": 54, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": "abuse@as13737.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13760, "h": "UNITI-FIBER", "n": "Uniti Fiber", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0062, "hi": 1.98, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.870, "ts": null, "map": 0.144, "obs": 0, "own": 0.757, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.559, "ts": null, "map": 0.069, "obs": 0, "own": 0.150, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.188, "det": {"shodan": {"malware": 1}}, "oid": "UFH-4-ARIN", "org": "Uniti Fiber Holdings Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.uniti.com"}, "pfx": 171, "reg": "2006-02-10", "rir": "arin", "s24": 654, "sib": 9, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 229120, "abuse": "abuse@uniti.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00654999960718}, {"a": 13767, "h": "DATABANK-DFW", "n": "DataBank", "t": "Transit & backbone", "w": 9, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0017, "hi": 1.65, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}, "urlhaus": {"n": 1, "p": 0.1655, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "vulncheck": {"n": 2, "p": 0.1869, "hi": 4.31, "lo": 0.56, "ips": 8, "mean": 2.05, "above": false}}, "h2": [["2026-10-05", 0.033, 0.159, 0, false], ["2026-10-12", 0.071, 0.174, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.174, "se": 1.399, "ts": 1.000, "map": 1.288, "obs": 1, "own": 5.268, "comp": {"urlhaus": 3.0627, "threatfox": -0.4009, "phishing_db": -0.7829}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.071, "se": 0.853, "ts": 1.000, "map": 0.246, "obs": 2, "own": 0.833, "comp": {"cins": -0.2809, "dshield": -0.6088, "crowdsec": -2.4034, "vulncheck": 4.7338, "blocklist_de": -1.4498}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.603, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 8}}, "oid": "DHL-19-ARIN", "org": "DataBank Holdings, Ltd.", "pdb": {"t": "NSP", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.databank.com"}, "pfx": 233, "reg": "2006-02-10", "rir": "arin", "s24": 880, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 265728, "abuse": "abuse@databank.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13768, "h": "COGECO-PEER1", "n": "Aptum Technologies", "t": "Transit & backbone", "w": 3, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.77, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "phishing_db": {"n": 3, "p": 0.1098, "hi": 3.56, "lo": 0.63, "ips": 3, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.019, 0.221, 0, false], ["2026-10-12", 0.003, 0.228, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.228, "se": 1.056, "ts": 1.000, "map": 0.755, "obs": 3, "own": 3.122, "comp": {"urlhaus": -0.9072, "threatfox": -0.457, "phishing_db": 2.7089}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.404, "ts": null, "map": 0.031, "obs": 0, "own": 0.123, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"compromised": 1}}, "oid": "PER1-ARIN", "org": "Aptum Technologies", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://aptum.com/contact/"}, "pfx": 486, "reg": "2002-06-10", "rir": "arin", "s24": 2408, "sib": 5, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 649728, "abuse": "abuse@aptum.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00043684873043}, {"a": 13875, "h": "AS13875-MX-FIBER", "n": "MxFiber LLC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.376, "det": null, "oid": "ML-1471-ARIN", "org": "MxFiber LLC", "pdb": null, "pfx": 7, "reg": "2025-03-19", "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "support@mxfiber.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 13886, "h": "CLOUD-SOUTH", "n": "Cloud South", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1}, "n": 1}, "ev": {"shodan": {"n": 7, "p": 0.9544, "hi": 10.10, "lo": 3.06, "ips": 7, "mean": 6.15, "above": true}, "crowdsec": {"n": 1, "p": 0.0829, "hi": 3.45, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}}, "h2": [["2026-10-05", 0.129, 0.010, 0, false], ["2026-10-12", 0.135, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.983, "ts": null, "map": 0.180, "obs": 0, "own": 0.191, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.135, "se": 1.177, "ts": 1.000, "map": 0.909, "obs": 1, "own": 0.198, "comp": {"cins": -0.1707, "dshield": -0.3873, "crowdsec": 3.1206, "vulncheck": -0.3774, "blocklist_de": -0.8872}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.627, "det": {"shodan": {"compromised": 7}}, "oid": "CS-2846-ARIN", "org": "Cloud South", "pdb": null, "pfx": 117, "reg": "2012-06-12", "rir": "arin", "s24": 141, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 36608, "abuse": "abusenotice@cloudsouth.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 13999, "h": "", "n": "Mega Cable, S.A. de C.V.", "t": "Broadband & mobile", "w": 39, "cc": "MX", "cf": {"rb": "", "wb": "", "rep": 0.78, "waf": 0.48}, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 5, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 6}, "ev": {"cins": {"n": 5, "p": 0.0136, "hi": 2.50, "lo": 0.62, "ips": 5, "mean": 1.43, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.37, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}, "dshield": {"n": 15, "p": 0.5375, "hi": 4.53, "lo": 1.97, "ips": 15, "mean": 3.14, "above": false}, "urlhaus": {"n": 2, "p": 0.1158, "hi": 3.70, "lo": 0.48, "ips": 2, "mean": 1.76, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.56, "lo": 0.16, "ips": 6, "mean": 0.33, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 1.26, "lo": 0.16, "ips": 2, "mean": 0.60, "above": false}, "blocklist_de": {"n": 14, "p": 0.0037, "hi": 2.39, "lo": 1.01, "ips": 14, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.420, 0.145, 0, false], ["2026-10-12", 0.727, 0.162, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.162, "se": 1.126, "ts": 1.000, "map": 0.646, "obs": 2, "own": 1.828, "comp": {"urlhaus": 2.8098, "threatfox": -0.535, "phishing_db": -1.0859}, "mass": 7.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 15, "crowdsec": 6, "vulncheck": 2, "blocklist_de": 14}, "lo": 0.727, "se": 0.394, "ts": 0.357, "map": 1.147, "obs": 42, "own": 1.769, "comp": {"cins": 3.8087, "dshield": 5.3027, "crowdsec": -9.0385, "vulncheck": -0.7377, "blocklist_de": 2.1958}, "mass": 48.4, "listed": false}}, "abq": true, "bot": 0.119, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1, "bots": 11, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-262916-LACNIC", "org": "Mega Cable, S.A. de C.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.megacable.com.mx"}, "pfx": 2222, "reg": "1999-10-01", "rir": "lacnic", "s24": 7598, "sib": 2, "tor": 0, "w24": 39, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3053312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.189899}, {"a": 14061, "h": "DIGITALOCEAN-ASN", "n": "DigitalOcean", "t": "Hosting & VPS", "w": 5461, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 2.04, "waf": 2.97}, "cs": {"c": {"http_flood": 805, "data_centre": 1574, "web_exploit": 1262, "bad_crawling": 265, "proxy_or_vpn": 152, "first_seen_30d": 198, "ssh_bruteforce": 813, "web_bruteforce": 768, "mail_bruteforce": 113, "router_or_botnet": 18, "cve:CVE-2017-9841": 209, "cve:CVE-2021-3129": 121, "cve:CVE-2025-55182": 119, "cve:CVE-2026-27771": 91, "cve:CVE-2026-63030": 213}, "n": 1842}, "ev": {"cins": {"n": 921, "p": 1.0000, "hi": 157.22, "lo": 141.07, "ips": 1027, "mean": 149.05, "above": true}, "shodan": {"n": 1551, "p": 1.0000, "hi": 59.40, "lo": 54.64, "ips": 1551, "mean": 57.00, "above": true}, "dshield": {"n": 1158, "p": 1.0000, "hi": 159.45, "lo": 144.76, "ips": 1349, "mean": 152.03, "above": true}, "urlhaus": {"n": 2, "p": 0.0461, "hi": 2.95, "lo": 0.38, "ips": 2, "mean": 1.40, "above": false}, "crowdsec": {"n": 1628, "p": 1.0000, "hi": 50.43, "lo": 46.48, "ips": 1842, "mean": 48.44, "above": true}, "threatfox": {"n": 140, "p": 1.0000, "hi": 55.85, "lo": 42.32, "ips": 140, "mean": 48.89, "above": true}, "vulncheck": {"n": 287, "p": 1.0000, "hi": 42.54, "lo": 35.04, "ips": 293, "mean": 38.71, "above": true}, "phishing_db": {"n": 665, "p": 1.0000, "hi": 101.31, "lo": 89.18, "ips": 728, "mean": 95.16, "above": true}, "blocklist_de": {"n": 582, "p": 1.0000, "hi": 44.03, "lo": 38.42, "ips": 603, "mean": 41.19, "above": true}}, "h2": [["2026-10-05", 39.317, 11.360, 2, false], ["2026-10-12", 46.586, 10.488, 2, false]], "sh": false, "uc": 134.6, "v2": {"band": 2, "host": {"n": {"urlhaus": 2, "threatfox": 140, "phishing_db": 665}, "lo": 10.488, "se": 0.708, "ts": 0.824, "map": 20.044, "obs": 807, "own": 7.064, "comp": {"urlhaus": -2.9874, "threatfox": 0.8375, "phishing_db": 6.7741}, "mass": 319.3, "listed": true}, "prov": false, "attack": {"n": {"cins": 921, "dshield": 1158, "crowdsec": 1628, "vulncheck": 287, "blocklist_de": 582}, "lo": 46.586, "se": 0.340, "ts": 0.356, "map": 67.389, "obs": 4576, "own": 13.094, "comp": {"cins": 14.2827, "dshield": 4.1635, "crowdsec": -3.227, "vulncheck": -0.6224, "blocklist_de": -8.9927}, "mass": 4538.7, "listed": true}}, "abq": false, "bot": 0.918, "det": {"shodan": {"c2": 498, "malware": 57, "compromised": 914, "doublepulsar": 82}, "threatfox": {"family:Havoc": 14, "family:Aisuru": 20, "family:Drifter": 10, "family:Cobalt Strike": 18, "family:Unknown malware": 30}, "vulncheck": {"c2_server": 162, "botnet_node": 23, "attack_tooling": 99, "other_infrastructure": 9}, "blocklist_de": {"ftp": 44, "sip": 1, "ssh": 205, "bots": 85, "imap": 83, "mail": 99, "apache": 169, "bruteforcelogin": 72}}, "oid": "DO-13-ARIN", "org": "DigitalOcean, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.digitalocean.com"}, "pfx": 872, "reg": "2012-09-25", "rir": "arin", "s24": 12276, "sib": 4, "tor": 4, "w24": 4060, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 3142912, "abuse": "abuse@digitalocean.com", "score": 1.0000, "groups": ["sensors", "cloudflare", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": 0.445879}, {"a": 14080, "h": "", "n": "Telmex Colombia", "t": "Hosting & VPS", "w": 31, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 7, "first_seen_30d": 1, "ssh_bruteforce": 13, "web_bruteforce": 10, "home_connection": 5, "mail_bruteforce": 12, "router_or_botnet": 8, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 23}, "ev": {"dshield": {"n": 2, "p": 0.0272, "hi": 2.65, "lo": 0.34, "ips": 2, "mean": 1.27, "above": false}, "urlhaus": {"n": 3, "p": 0.4930, "hi": 6.28, "lo": 1.11, "ips": 3, "mean": 3.24, "above": false}, "crowdsec": {"n": 22, "p": 0.4501, "hi": 4.05, "lo": 2.03, "ips": 23, "mean": 2.97, "above": false}, "threatfox": {"n": 1, "p": 0.0799, "hi": 3.41, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "phishing_db": {"n": 1, "p": 0.0093, "hi": 2.12, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "blocklist_de": {"n": 9, "p": 0.3222, "hi": 4.22, "lo": 1.46, "ips": 9, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 1.103, 0.779, 0, false], ["2026-10-12", 1.431, 0.944, 0, false]], "sh": false, "uc": 134.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 1, "phishing_db": 1}, "lo": 0.944, "se": 0.942, "ts": 0.600, "map": 2.736, "obs": 5, "own": 1.074, "comp": {"urlhaus": 3.5819, "threatfox": -0.2154, "phishing_db": -0.7339}, "mass": 10.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 22, "vulncheck": 0, "blocklist_de": 9}, "lo": 1.431, "se": 0.399, "ts": 0.667, "map": 2.253, "obs": 33, "own": 0.442, "comp": {"cins": -2.8594, "dshield": -1.3949, "crowdsec": 5.7896, "vulncheck": -0.9795, "blocklist_de": 1.6504}, "mass": 31.7, "listed": false}}, "abq": true, "bot": 0.159, "det": {"threatfox": {"family:Remcos": 1}, "blocklist_de": {"ssh": 5, "imap": 4, "mail": 4}}, "oid": "@aut-27864-LACNIC", "org": "Telmex Colombia S.A.", "pdb": {"t": null, "sc": "South America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.claro.com.co"}, "pfx": 937, "reg": "1999-10-15", "rir": "lacnic", "s24": 2542, "sib": 3, "tor": 0, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1035008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02259061534997}, {"a": 14117, "h": "", "n": "Telefonica del Sur", "t": "Broadband & mobile", "w": 12, "cc": "CL", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 9}, "ev": {"urlhaus": {"n": 1, "p": 0.1342, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 8, "p": 0.0078, "hi": 2.43, "lo": 0.79, "ips": 9, "mean": 1.51, "above": false}, "vulncheck": {"n": 1, "p": 0.0185, "hi": 2.40, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "blocklist_de": {"n": 4, "p": 0.0558, "hi": 3.06, "lo": 0.66, "ips": 4, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.671, 0.107, 0, false], ["2026-10-12", 0.678, 0.120, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.120, "se": 1.365, "ts": 1.000, "map": 0.801, "obs": 1, "own": 2.339, "comp": {"urlhaus": 2.6967, "threatfox": -0.4348, "phishing_db": -0.8574}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 4}, "lo": 0.678, "se": 0.466, "ts": 0.615, "map": 1.197, "obs": 13, "own": 1.850, "comp": {"cins": -1.824, "dshield": -2.4307, "crowdsec": 3.7733, "vulncheck": -0.461, "blocklist_de": 2.5155}, "mass": 12.4, "listed": false}}, "abq": true, "bot": 0.177, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 3, "mail": 1}}, "oid": "@aut-14117-LACNIC", "org": "Telefonica del Sur S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.telsur.cl"}, "pfx": 579, "reg": "1999-10-22", "rir": "lacnic", "s24": 1859, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 855040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01328930458812}, {"a": 14178, "h": "", "n": "Megacable Comunicaciones de Mexico", "t": "Broadband & mobile", "w": 3, "cc": "MX", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0647, "hi": 3.21, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "crowdsec": {"n": 1, "p": 0.0486, "hi": 2.98, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "phishing_db": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 2, "mean": 1.80, "above": false}, "blocklist_de": {"n": 1, "p": 0.1147, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 1.133, 0.201, 0, false], ["2026-10-12", 0.364, 0.211, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.211, "se": 1.415, "ts": 1.000, "map": 1.578, "obs": 1, "own": 4.648, "comp": {"urlhaus": -0.2274, "threatfox": -0.2327, "phishing_db": 2.5427}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.364, "se": 0.875, "ts": 0.500, "map": 1.380, "obs": 2, "own": 2.202, "comp": {"cins": -0.3891, "dshield": -0.808, "crowdsec": 0.8422, "vulncheck": -0.5962, "blocklist_de": 2.6668}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.157, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-14178-LACNIC", "org": "Megacable Comunicaciones de Mexico, S.A. de C.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://mcmtelecom.com"}, "pfx": 347, "reg": "1999-11-02", "rir": "lacnic", "s24": 223, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 180224, "abuse": "abuse@mcmtelecom.com.mx", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022803709056}, {"a": 14237, "h": "BEAMSPEED1", "n": "Beamspeed", "t": "Broadband & mobile", "w": 512, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4005, "hi": 6.09, "lo": 0.79, "ips": 512, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 1.686, 0.011, 0, false], ["2026-10-12", 1.824, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.824, "se": 0.953, "ts": 1.000, "map": 8.002, "obs": 2, "own": 12.874, "comp": {"cins": -0.3286, "dshield": -0.6987, "crowdsec": -2.7559, "vulncheck": -0.5502, "blocklist_de": 7.8068}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.221, "det": {"blocklist_de": {"mail": 512, "apache": 512}}, "oid": "BEAMS-ARIN", "org": "Beamspeed LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.beamspeed.com"}, "pfx": 13, "reg": "2007-06-15", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@beamspeed.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14265, "h": "US-TELEPACIFIC", "n": "TelePacific Communications", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.68, "lo": 0.05, "ips": 1, "mean": 0.29, "above": false}}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.760, "ts": null, "map": 0.095, "obs": 0, "own": 0.618, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.387, "ts": null, "map": 0.028, "obs": 0, "own": 0.110, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.253, "det": {"shodan": {"malware": 1}}, "oid": "TPAC-ARIN", "org": "TPx Communications", "pdb": {"t": "NSP", "sc": "North America", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.tpx.com/"}, "pfx": 358, "reg": "1999-11-17", "rir": "arin", "s24": 2800, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 772352, "abuse": "abuse@telepacific.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14315, "h": "1GSERVERS", "n": "1GServers", "t": "Hosting & VPS", "w": 14, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.3993, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "urlhaus": {"n": 1, "p": 0.1964, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3146, "hi": 5.34, "lo": 0.69, "ips": 2, "mean": 2.55, "above": false}, "threatfox": {"n": 6, "p": 0.9649, "hi": 11.72, "lo": 3.25, "ips": 8, "mean": 6.93, "above": true}, "vulncheck": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 10.084, 17.189, 1, false], ["2026-10-12", 3.721, 14.785, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 6, "phishing_db": 0}, "lo": 14.785, "se": 0.837, "ts": 0.857, "map": 37.895, "obs": 7, "own": 13.275, "comp": {"urlhaus": 1.8306, "threatfox": 4.4101, "phishing_db": -0.9797}, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.721, "se": 0.622, "ts": 0.400, "map": 8.790, "obs": 5, "own": 1.745, "comp": {"cins": -0.6898, "dshield": 5.4436, "crowdsec": 1.6181, "vulncheck": 0.6665, "blocklist_de": -3.4711}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.727, "det": {"threatfox": {"family:PureRAT": 8}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "GL-329-ARIN", "org": "1GSERVERS, LLC", "pdb": {"t": "Content", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://1gservers.com"}, "pfx": 53, "reg": "2019-02-22", "rir": "arin", "s24": 67, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 17152, "abuse": "abuse@1gservers.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00938022727838}, {"a": 14369, "h": "NMAX", "n": "NMAX", "t": "Broadband & mobile", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4172, "hi": 6.24, "lo": 0.81, "ips": 6, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 1.826, 0.011, 0, false], ["2026-10-12", 1.659, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.659, "se": 0.976, "ts": 1.000, "map": 7.319, "obs": 2, "own": 12.385, "comp": {"cins": -0.1659, "dshield": -0.3773, "crowdsec": -1.4924, "vulncheck": 6.2826, "blocklist_de": -0.8628}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.128, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "KBL-47-ARIN", "org": "Nmax", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.nmax.net"}, "pfx": 17, "reg": "1999-12-03", "rir": "arin", "s24": 17, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "admin@nmax.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14522, "h": "", "n": "Satnet", "t": "Broadband & mobile", "w": 9, "cc": "EC", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "home_connection": 2, "router_or_botnet": 1, "cve:CVE-2018-10562": 1}, "n": 3}, "ev": {"dshield": {"n": 3, "p": 0.0876, "hi": 3.38, "lo": 0.59, "ips": 3, "mean": 1.74, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.85, "lo": 0.11, "ips": 3, "mean": 0.41, "above": false}, "blocklist_de": {"n": 4, "p": 0.0181, "hi": 2.56, "lo": 0.55, "ips": 5, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 0.293, 0.007, 0, false], ["2026-10-12", 0.384, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.771, "ts": null, "map": 0.100, "obs": 0, "own": 0.462, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.384, "se": 0.502, "ts": 0.444, "map": 0.732, "obs": 9, "own": 1.135, "comp": {"cins": -1.5778, "dshield": 3.656, "crowdsec": -4.8636, "vulncheck": -0.9051, "blocklist_de": 4.7726}, "mass": 9.8, "listed": false}}, "abq": true, "bot": 0.242, "det": {"blocklist_de": {"ssh": 2, "bots": 3}}, "oid": "@aut-14522-LACNIC", "org": "SERVICIOS DE TELECOMUNICACIONES SETEL S.A. (XTRIM EC)", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.xtrim.com.ec/"}, "pfx": 245, "reg": "1999-12-28", "rir": "lacnic", "s24": 2404, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1618688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01011016914492}, {"a": 14551, "h": "UUNET-SA", "n": "Verizon - LATAM", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.880, "ts": null, "map": 0.148, "obs": 0, "own": 0.793, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.576, "ts": null, "map": 0.074, "obs": 0, "own": 0.164, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.216, "det": null, "oid": "MCICS-ARIN", "org": "Verizon Business", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Selective", "web": "https://www.verizon.com/business/"}, "pfx": 9, "reg": "2000-01-05", "rir": "arin", "s24": 574, "sib": 229, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 199424, "abuse": "abuse-mail@verizonbusiness.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14576, "h": "HOSTING-SOLUTIONS", "n": "King Servers", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1471, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "threatfox": {"n": 2, "p": 0.4168, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.184, 1.699, 0, false], ["2026-10-12", 0.010, 1.710, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.710, "se": 1.156, "ts": 1.000, "map": 7.991, "obs": 2, "own": 3.113, "comp": {"urlhaus": -0.3112, "threatfox": 4.5494, "phishing_db": -0.5337}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.866, "ts": null, "map": 0.179, "obs": 0, "own": 0.080, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:RansomHub": 2}, "vulncheck": {"c2_server": 1}}, "oid": "HSL-50-ARIN", "org": "Hosting Solution Ltd.", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.king-servers.com"}, "pfx": 59, "reg": "2013-10-17", "rir": "arin", "s24": 62, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": "abuse@king-servers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045216479}, {"a": 14593, "h": "SPACEX-STARLINK", "n": "SpaceX Starlink", "t": "Broadband & mobile", "w": 133, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.59, "waf": 0.50}, "cs": {"c": {"http_flood": 11, "web_exploit": 17, "bad_crawling": 10, "ssh_bruteforce": 19, "web_bruteforce": 22, "home_connection": 23, "mail_bruteforce": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2018-10562": 1}, "n": 26}, "ev": {"cins": {"n": 5, "p": 0.2108, "hi": 4.05, "lo": 1.01, "ips": 5, "mean": 2.31, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.69, "lo": 0.09, "ips": 2, "mean": 0.33, "above": false}, "dshield": {"n": 36, "p": 1.0000, "hi": 15.63, "lo": 9.07, "ips": 39, "mean": 12.17, "above": true}, "crowdsec": {"n": 12, "p": 0.0000, "hi": 1.76, "lo": 0.70, "ips": 26, "mean": 1.18, "above": false}, "phishing_db": {"n": 1, "p": 0.0019, "hi": 1.67, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}, "blocklist_de": {"n": 58, "p": 1.0000, "hi": 14.28, "lo": 9.29, "ips": 63, "mean": 11.67, "above": true}}, "h2": [["2026-10-05", 2.476, 0.042, 0, false], ["2026-10-12", 4.283, 0.045, 0, false]], "sh": false, "uc": 62.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.045, "se": 1.330, "ts": 1.000, "map": 0.248, "obs": 1, "own": 0.836, "comp": {"urlhaus": -0.5418, "threatfox": -0.3753, "phishing_db": 1.1479}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 36, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 58}, "lo": 4.283, "se": 0.363, "ts": 0.523, "map": 6.493, "obs": 111, "own": 9.958, "comp": {"cins": -0.912, "dshield": 4.3465, "crowdsec": -10.7266, "vulncheck": -1.0077, "blocklist_de": 11.5642}, "mass": 135.6, "listed": false}}, "abq": true, "bot": 0.152, "det": {"shodan": {"malware": 1, "doublepulsar": 1}, "blocklist_de": {"ftp": 1, "ssh": 7, "bots": 34, "imap": 13, "mail": 14, "apache": 7, "bruteforcelogin": 6}}, "oid": "SETC-3-ARIN", "org": "Space Exploration Technologies Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.spacex.com"}, "pfx": 2191, "reg": "2018-09-05", "rir": "arin", "s24": 3783, "sib": 2, "tor": 0, "w24": 101, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 1020928, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["dshield", "blocklist_de"], "traffic": 0.675851}, {"a": 14618, "h": "AMAZON-AES", "n": "Amazon AES", "t": "Hyperscale cloud", "w": 2089, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.74, "waf": 0.86}, "cs": {"c": {"http_flood": 129, "data_centre": 213, "web_exploit": 105, "bad_crawling": 96, "proxy_or_vpn": 6, "first_seen_30d": 9, "ssh_bruteforce": 109, "web_bruteforce": 92, "mail_bruteforce": 6, "cve:CVE-2021-41773": 36, "cve:CVE-2021-43798": 32, "cve:CVE-2024-56159": 16, "cve:CVE-2025-55182": 16, "cve:CVE-2026-63030": 14}, "n": 236}, "ev": {"cins": {"n": 254, "p": 1.0000, "hi": 7.69, "lo": 6.26, "ips": 368, "mean": 6.96, "above": true}, "shodan": {"n": 130, "p": 0.0000, "hi": 0.83, "lo": 0.62, "ips": 130, "mean": 0.72, "above": false}, "dshield": {"n": 32, "p": 0.0000, "hi": 0.92, "lo": 0.52, "ips": 33, "mean": 0.71, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.54, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}, "crowdsec": {"n": 223, "p": 0.0000, "hi": 1.11, "lo": 0.89, "ips": 236, "mean": 0.99, "above": false}, "threatfox": {"n": 9, "p": 0.0000, "hi": 1.13, "lo": 0.39, "ips": 9, "mean": 0.72, "above": false}, "vulncheck": {"n": 749, "p": 1.0000, "hi": 17.59, "lo": 15.59, "ips": 756, "mean": 16.58, "above": true}, "phishing_db": {"n": 719, "p": 1.0000, "hi": 18.12, "lo": 16.03, "ips": 728, "mean": 17.06, "above": true}, "blocklist_de": {"n": 32, "p": 0.0000, "hi": 0.47, "lo": 0.26, "ips": 47, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 1.497, 1.641, 0, false], ["2026-10-12", 1.268, 1.628, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 9, "phishing_db": 719}, "lo": 1.628, "se": 0.781, "ts": 0.986, "map": 3.301, "obs": 729, "own": 2.402, "comp": {"urlhaus": -3.0888, "threatfox": -0.5123, "phishing_db": 6.4214}, "mass": 402.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 254, "dshield": 32, "crowdsec": 223, "vulncheck": 749, "blocklist_de": 32}, "lo": 1.268, "se": 0.356, "ts": 0.581, "map": 1.899, "obs": 1290, "own": 0.782, "comp": {"cins": 21.8827, "dshield": -2.4642, "crowdsec": -6.2812, "vulncheck": 4.2898, "blocklist_de": -15.3922}, "mass": 887.2, "listed": false}}, "abq": true, "bot": 0.964, "det": {"shodan": {"c2": 55, "malware": 20, "compromised": 54, "doublepulsar": 1}, "threatfox": {"family:Havoc": 2, "family:Deimos": 1, "family:AdaptixC2": 2, "family:Cobalt Strike": 1, "family:Unknown malware": 3}, "vulncheck": {"c2_server": 705, "botnet_node": 2, "attack_tooling": 44, "other_infrastructure": 5}, "blocklist_de": {"ftp": 3, "ssh": 15, "bots": 6, "imap": 12, "mail": 14, "apache": 9, "bruteforcelogin": 4}}, "oid": "AMAZO-4-ARIN", "org": "Amazon.com, Inc.", "pdb": null, "pfx": 1522, "reg": "2005-11-04", "rir": "arin", "s24": 84338, "sib": 3, "tor": 0, "w24": 1906, "drop": 0, "hist": [["2026-10-05", 0.8443], ["2026-10-12", 0.8651]], "ipv4": 24012288, "abuse": null, "score": 0.8651, "groups": ["vulncheck", "phishing"], "sensors": ["cins"], "traffic": 2.274962}, {"a": 14638, "h": "LCPRL", "n": "Liberty Cablevision of Puerto Rico", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1512, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.0062, "hi": 1.98, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}}, "h2": [["2026-10-12", 0.032, 0.143, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.143, "se": 1.380, "ts": 1.000, "map": 1.005, "obs": 1, "own": 2.910, "comp": {"urlhaus": 2.8745, "threatfox": -0.4195, "phishing_db": -0.8235}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.032, "se": 1.040, "ts": 1.000, "map": 0.165, "obs": 1, "own": 0.273, "comp": {"cins": -0.2795, "dshield": -0.6062, "crowdsec": -2.3929, "vulncheck": -0.5062, "blocklist_de": 3.3772}, "mass": 1.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "LCPRL-1-ARIN", "org": "Liberty Communications of Puerto Rico LLC", "pdb": {"t": null, "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "https://libertynetworks.com/"}, "pfx": 559, "reg": "2005-11-04", "rir": "arin", "s24": 1304, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 764416, "abuse": "noc@libertypr.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02284014064052}, {"a": 14670, "h": "WHG-USE1", "n": "hosting.com USE1", "t": "Hosting & VPS", "w": 7, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2026-8181": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "dshield": {"n": 1, "p": 0.1872, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 5, "p": 0.8697, "hi": 9.26, "lo": 2.30, "ips": 5, "mean": 5.28, "above": true}, "phishing_db": {"n": 1, "p": 0.1883, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 6.829, 0.384, 0, false], ["2026-10-12", 9.422, 0.402, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.402, "se": 1.511, "ts": 1.000, "map": 3.813, "obs": 1, "own": 1.723, "comp": {"urlhaus": -0.1298, "threatfox": -0.1558, "phishing_db": 3.2503}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.422, "se": 0.543, "ts": 0.714, "map": 19.525, "obs": 7, "own": 3.835, "comp": {"cins": 2.9458, "dshield": 0.9582, "crowdsec": 6.4837, "vulncheck": -0.8347, "blocklist_de": -5.1876}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.765, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "http://hosting.com"}, "pfx": 45, "reg": "2007-06-22", "rir": "ripencc", "s24": 51, "sib": 11, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "abuse@worldhost.group", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 14754, "h": "", "n": "Telgua", "t": "Enterprise, edu & gov", "w": 10, "cc": "GT", "cf": {"rb": "hi", "wb": "hi", "rep": 0.77, "waf": 0.68}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0037, "hi": 1.83, "lo": 0.14, "ips": 1, "mean": 0.77, "above": false}, "dshield": {"n": 2, "p": 0.0058, "hi": 2.08, "lo": 0.27, "ips": 2, "mean": 0.99, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.57, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}, "blocklist_de": {"n": 5, "p": 0.0027, "hi": 2.09, "lo": 0.52, "ips": 6, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.239, 0.006, 0, false], ["2026-10-12", 0.314, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.739, "ts": null, "map": 0.085, "obs": 0, "own": 0.651, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.314, "se": 0.490, "ts": 0.500, "map": 0.581, "obs": 10, "own": 3.272, "comp": {"cins": 1.3182, "dshield": 1.0023, "crowdsec": -6.0405, "vulncheck": -0.9247, "blocklist_de": 5.4958}, "mass": 12.2, "listed": false}}, "abq": true, "bot": 0.107, "det": {"blocklist_de": {"ssh": 2, "bots": 3, "imap": 1, "mail": 1}}, "oid": "@aut-13682-LACNIC", "org": "TELECOMUNICACIONES DE GUATEMALA, SOCIEDAD ANONIMA", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.claro.com.gt"}, "pfx": 490, "reg": "2000-02-03", "rir": "lacnic", "s24": 3756, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1769472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.094688}, {"a": 14828, "h": "HBCI-1999TA", "n": "Hiawatha Broadband Communications, Inc", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0461, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}}, "h2": [["2026-10-05", 0.095, 0.010, 0, false], ["2026-10-12", 0.098, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.949, "ts": null, "map": 0.171, "obs": 0, "own": 1.068, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.098, "se": 1.141, "ts": 1.000, "map": 0.617, "obs": 1, "own": 1.043, "comp": {"cins": -0.1891, "dshield": -0.4258, "crowdsec": 2.9113, "vulncheck": -0.4031, "blocklist_de": -0.9819}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "HBC-73-ARIN", "org": "Hiawatha Broadband Communications, Inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.hbci.com"}, "pfx": 17, "reg": "2000-02-10", "rir": "arin", "s24": 231, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59136, "abuse": "abuse@exchange.hbci.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14840, "h": "", "n": "BR.Digital", "t": "Transit & backbone", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0467, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "crowdsec": {"n": 1, "p": 0.0322, "hi": 2.70, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}, "blocklist_de": {"n": 1, "p": 0.0979, "hi": 3.63, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.281, 0.010, 0, false], ["2026-10-12", 0.299, 0.011, 0, false]], "sh": false, "uc": 259, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.934, "ts": null, "map": 0.167, "obs": 0, "own": 1.423, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.299, "se": 0.867, "ts": 0.500, "map": 1.114, "obs": 2, "own": 3.608, "comp": {"cins": -0.4002, "dshield": -0.8274, "crowdsec": 0.7372, "vulncheck": -0.6038, "blocklist_de": 2.5955}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-61889-LACNIC", "org": "BR.Digital Telecom", "pdb": {"t": "NSP", "sc": "South America", "tr": "5-10Tbps", "pol": "Selective", "web": "https://br.digital/"}, "pfx": 82, "reg": "2009-07-21", "rir": "lacnic", "s24": 285, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 76288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00329434199577}, {"a": 14868, "h": "", "n": "Ligga Telecomunicações S.A.", "t": "Broadband & mobile", "w": 7, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.4985, "hi": 5.55, "lo": 1.38, "ips": 5, "mean": 3.17, "above": false}, "blocklist_de": {"n": 2, "p": 0.2266, "hi": 4.63, "lo": 0.60, "ips": 2, "mean": 2.21, "above": false}}, "h2": [["2026-10-05", 1.495, 0.010, 0, false], ["2026-10-12", 1.667, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.921, "ts": null, "map": 0.163, "obs": 0, "own": 0.949, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.667, "se": 0.539, "ts": 0.714, "map": 3.416, "obs": 7, "own": 5.284, "comp": {"cins": -1.1727, "dshield": -1.8662, "crowdsec": 5.0655, "vulncheck": -0.855, "blocklist_de": 1.4505}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"bots": 2}}, "oid": "@aut-262756-LACNIC", "org": "LIGGA SERVICOS EM TELECOM S.A.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.liggatelecom.com.br/site/"}, "pfx": 73, "reg": "2000-03-22", "rir": "lacnic", "s24": 336, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 171008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01963266020457}, {"a": 14929, "h": "IQNT-VIT", "n": "Inteliquent, inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1664, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.686, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.301, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.958, "det": {"shodan": {"compromised": 1}}, "oid": "NTAJC-ARIN", "org": "Inteliquent, inc.", "pdb": null, "pfx": 31, "reg": "2007-07-02", "rir": "arin", "s24": 37, "sib": 9, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14956, "h": "ROUTERHOSTING", "n": "ROUTERHOSTING", "t": "Hosting & VPS", "w": 121, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 26, "data_centre": 34, "web_exploit": 36, "bad_crawling": 23, "proxy_or_vpn": 4, "first_seen_30d": 14, "ssh_bruteforce": 11, "web_bruteforce": 21, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 4, "cve:CVE-2019-18935": 3, "cve:CVE-2025-55182": 4, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 3}, "n": 44}, "ev": {"cins": {"n": 14, "p": 1.0000, "hi": 20.00, "lo": 8.45, "ips": 16, "mean": 13.71, "above": true}, "shodan": {"n": 16, "p": 1.0000, "hi": 16.46, "lo": 7.34, "ips": 16, "mean": 11.51, "above": true}, "dshield": {"n": 1, "p": 0.1513, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "crowdsec": {"n": 38, "p": 1.0000, "hi": 31.27, "lo": 18.41, "ips": 44, "mean": 24.49, "above": true}, "threatfox": {"n": 9, "p": 0.9986, "hi": 15.19, "lo": 5.25, "ips": 9, "mean": 9.67, "above": true}, "vulncheck": {"n": 5, "p": 0.8767, "hi": 9.41, "lo": 2.34, "ips": 9, "mean": 5.37, "above": true}, "phishing_db": {"n": 21, "p": 1.0000, "hi": 27.27, "lo": 13.43, "ips": 27, "mean": 19.84, "above": true}, "blocklist_de": {"n": 9, "p": 0.9950, "hi": 12.68, "lo": 4.38, "ips": 19, "mean": 8.07, "above": true}}, "h2": [["2026-10-05", 23.354, 22.297, 1, false], ["2026-10-12", 34.347, 19.436, 2, false]], "sh": true, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 0, "threatfox": 9, "phishing_db": 21}, "lo": 19.436, "se": 0.711, "ts": 0.700, "map": 39.121, "obs": 30, "own": 13.349, "comp": {"urlhaus": -2.102, "threatfox": 1.887, "phishing_db": 5.5078}, "mass": 11.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 14, "dshield": 1, "crowdsec": 38, "vulncheck": 5, "blocklist_de": 9}, "lo": 34.347, "se": 0.368, "ts": 0.567, "map": 52.779, "obs": 67, "own": 10.263, "comp": {"cins": 12.2624, "dshield": -2.8596, "crowdsec": 3.2548, "vulncheck": -0.5244, "blocklist_de": -6.7734}, "mass": 64.6, "listed": true}}, "abq": false, "bot": 0.923, "det": {"shodan": {"c2": 2, "compromised": 14}, "threatfox": {"family:PureRAT": 2, "family:AsyncRAT": 1, "family:Evilginx": 2, "family:Cobalt Strike": 1, "family:Unknown malware": 3}, "vulncheck": {"c2_server": 9}, "blocklist_de": {"ftp": 14, "ssh": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "RL-896-ARIN", "org": "RouterHosting LLC", "pdb": null, "pfx": 155, "reg": "2023-05-15", "rir": "arin", "s24": 223, "sib": 0, "tor": 1, "w24": 72, "drop": 1, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 58624, "abuse": "abuse-reports@cloudzy.com", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.00771811585338}, {"a": 14987, "h": "RETHEMHOSTING", "n": "Rethem Hosting LLC", "t": "Hosting & VPS", "w": 68, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 63, "web_exploit": 1, "ssh_bruteforce": 44, "web_bruteforce": 8, "mail_bruteforce": 40, "cve:CVE-2023-1389": 1, "cve:CVE-2022-22947": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2025-31324": 1}, "n": 68}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 68, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.791, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 6543, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 2.871, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "RHL-18-ARIN", "org": "Rethem Hosting LLC", "pdb": {"t": "Non-Profit", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.rethemhosting.net"}, "pfx": 5, "reg": "2011-03-21", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "noc@rethemhosting.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 14988, "h": "BTC-GATE1", "n": "Botswana Telecommunications Corporation", "t": "Broadband & mobile", "w": 2, "cc": "BW", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.1577, "hi": 4.06, "lo": 0.53, "ips": 2, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.0388, "hi": 2.82, "lo": 0.21, "ips": 2, "mean": 1.19, "above": false}, "blocklist_de": {"n": 1, "p": 0.1052, "hi": 3.72, "lo": 0.28, "ips": 2, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.307, 0.010, 0, false], ["2026-10-12", 0.327, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 1.034, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.327, "se": 0.871, "ts": 0.500, "map": 1.219, "obs": 2, "own": 1.945, "comp": {"cins": -0.3955, "dshield": -0.8192, "crowdsec": 0.7815, "vulncheck": -0.6006, "blocklist_de": 2.6256}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.170, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-BTC2-AFRINIC", "org": "Botswana Telecommunications Corporation", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.btc.bw"}, "pfx": 89, "reg": "2000-03-02", "rir": "afrinic", "s24": 257, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 139008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00318264814719}, {"a": 14992, "h": "CRYSTALTECH", "n": "NewtekOne, Inc.", "t": "Other", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0060, "hi": 1.97, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "urlhaus": {"n": 1, "p": 0.1735, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.89, "above": false}, "phishing_db": {"n": 3, "p": 0.4401, "hi": 5.87, "lo": 1.03, "ips": 3, "mean": 3.03, "above": false}}, "h2": [["2026-10-05", 0.005, 1.227, 0, false], ["2026-10-12", 0.005, 1.275, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 3}, "lo": 1.275, "se": 0.977, "ts": 0.750, "map": 3.988, "obs": 4, "own": 4.103, "comp": {"urlhaus": 1.7684, "threatfox": -0.4922, "phishing_db": 1.7333}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.559, "ts": null, "map": 0.068, "obs": 0, "own": 0.055, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.934, "det": {"shodan": {"compromised": 1}}, "oid": "NEWTE-8-ARIN", "org": "NewtekOne, Inc.", "pdb": null, "pfx": 14, "reg": "2000-03-03", "rir": "arin", "s24": 659, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 168704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15108, "h": "ALLO-COMM", "n": "ALLO Communications", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0013, "hi": 1.73, "lo": 0.22, "ips": 2, "mean": 0.82, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.820, "ts": null, "map": 0.123, "obs": 0, "own": 0.599, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.481, "ts": null, "map": 0.047, "obs": 0, "own": 0.097, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.236, "det": {"shodan": {"c2": 1, "malware": 1}}, "oid": "ACL-99-ARIN", "org": "Allo Communications LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.allocommunications.com/"}, "pfx": 57, "reg": "2006-10-27", "rir": "arin", "s24": 1240, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 318208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01716644314238}, {"a": 15146, "h": "CABLEBAHAMAS", "n": "Cable Bahamas", "t": "Broadband & mobile", "w": 0, "cc": "BS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0281, "hi": 2.62, "lo": 0.20, "ips": 1, "mean": 1.10, "above": false}}, "h2": [["2026-10-05", 0.073, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.912, "ts": null, "map": 0.160, "obs": 0, "own": 0.912, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.629, "ts": null, "map": 0.091, "obs": 0, "own": 0.215, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"doublepulsar": 1}}, "oid": "BAHA-ARIN", "org": "Cable Bahamas, Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.cablebahamas.com/"}, "pfx": 72, "reg": "2000-03-24", "rir": "arin", "s24": 380, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 183552, "abuse": "hostmaster@cablebahamas.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00460853894349}, {"a": 15169, "h": "GOOGLE", "n": "Google LLC", "t": "Hyperscale cloud", "w": 416, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.28, "waf": 0.86}, "cs": {"c": {"http_flood": 84, "data_centre": 331, "web_exploit": 251, "bad_crawling": 232, "proxy_or_vpn": 3, "first_seen_30d": 230, "ssh_bruteforce": 1, "web_bruteforce": 218, "home_connection": 5, "cve:CVE-2024-4577": 1, "cve:CVE-2025-55182": 243}, "n": 373}, "ev": {"cins": {"n": 3, "p": 0.0018, "hi": 1.88, "lo": 0.33, "ips": 3, "mean": 0.97, "above": false}, "shodan": {"n": 18, "p": 0.0000, "hi": 1.59, "lo": 0.74, "ips": 18, "mean": 1.13, "above": false}, "dshield": {"n": 16, "p": 0.6700, "hi": 4.88, "lo": 2.18, "ips": 16, "mean": 3.41, "above": false}, "crowdsec": {"n": 324, "p": 1.0000, "hi": 17.24, "lo": 14.36, "ips": 373, "mean": 15.77, "above": true}, "threatfox": {"n": 3, "p": 0.1192, "hi": 3.64, "lo": 0.64, "ips": 3, "mean": 1.88, "above": false}, "vulncheck": {"n": 2, "p": 0.0001, "hi": 1.29, "lo": 0.17, "ips": 2, "mean": 0.62, "above": false}, "phishing_db": {"n": 2, "p": 0.0001, "hi": 1.37, "lo": 0.18, "ips": 2, "mean": 0.65, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 1.03, "lo": 0.22, "ips": 18, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 5.630, 0.147, 0, false], ["2026-10-12", 4.079, 0.150, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 2}, "lo": 0.150, "se": 1.013, "ts": 0.600, "map": 0.427, "obs": 5, "own": 0.376, "comp": {"urlhaus": -1.3036, "threatfox": 1.5368, "phishing_db": 0.543}, "mass": 5.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 16, "crowdsec": 324, "vulncheck": 2, "blocklist_de": 4}, "lo": 4.079, "se": 0.353, "ts": 0.928, "map": 5.998, "obs": 349, "own": 2.461, "comp": {"cins": -3.0993, "dshield": -1.5468, "crowdsec": 24.9455, "vulncheck": -0.9606, "blocklist_de": -16.1536}, "mass": 244.3, "listed": false}}, "abq": false, "bot": 0.960, "det": {"shodan": {"c2": 4, "compromised": 11, "doublepulsar": 3}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"ssh": 1, "bots": 6, "apache": 11, "bruteforcelogin": 11}}, "oid": "GOGL-ARIN", "org": "Google LLC", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://about.google/intl/en/"}, "pfx": 1072, "reg": "2000-03-30", "rir": "arin", "s24": 7376, "sib": 8, "tor": 0, "w24": 352, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 3522560, "abuse": "network-abuse@google.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.816242}, {"a": 15311, "h": "", "n": "Telefonica Empresas Network", "t": "Broadband & mobile", "w": 3, "cc": "CL", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0335, "hi": 2.76, "lo": 0.36, "ips": 2, "mean": 1.32, "above": false}, "phishing_db": {"n": 1, "p": 0.1157, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.515, 0.136, 0, false], ["2026-10-12", 0.181, 0.143, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.143, "se": 1.379, "ts": 1.000, "map": 0.967, "obs": 1, "own": 2.915, "comp": {"urlhaus": -0.2937, "threatfox": -0.273, "phishing_db": 2.159}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.181, "se": 0.847, "ts": 1.000, "map": 0.650, "obs": 2, "own": 1.035, "comp": {"cins": -0.3948, "dshield": -0.818, "crowdsec": 4.7993, "vulncheck": -0.6001, "blocklist_de": -2.0234}, "mass": 1.8, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "@aut-23416-LACNIC", "org": "TELEFONICA EMPRESAS CHILE SA", "pdb": {"t": null, "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://ww2.movistar.cl/empresas/"}, "pfx": 54, "reg": "2000-04-14", "rir": "lacnic", "s24": 481, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 153600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00136791069768}, {"a": 15373, "h": "CZESTMAN-AS", "n": "Politechnika Czestochowska", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.422, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PC2-RIPE", "org": "Politechnika Czestochowska", "pdb": null, "pfx": 7, "reg": "2000-06-07", "rir": "ripencc", "s24": 18, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@man.pcz.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15377, "h": "FREGAT", "n": "Fregat", "t": "Broadband & mobile", "w": 3, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.5433, "hi": 5.82, "lo": 1.45, "ips": 5, "mean": 3.32, "above": false}, "dshield": {"n": 1, "p": 0.1247, "hi": 3.94, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}, "blocklist_de": {"n": 2, "p": 0.2087, "hi": 4.48, "lo": 0.58, "ips": 2, "mean": 2.14, "above": false}}, "h2": [["2026-10-05", 0.073, 0.010, 0, false], ["2026-10-12", 0.485, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.913, "ts": null, "map": 0.160, "obs": 0, "own": 0.914, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.485, "se": 0.730, "ts": 0.667, "map": 1.401, "obs": 3, "own": 2.199, "comp": {"cins": -0.6287, "dshield": 2.2977, "crowdsec": -4.6891, "vulncheck": -0.7205, "blocklist_de": 5.4715}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-TL892-RIPE", "org": "TRADITIONAL LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.fregat.com"}, "pfx": 15, "reg": "2000-06-07", "rir": "ripencc", "s24": 377, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 96512, "abuse": "abuse@fregat.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00385686081516}, {"a": 15378, "h": "TELE2-RU-AS", "n": "T2 North-West", "t": "Enterprise, edu & gov", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.7819, "hi": 8.60, "lo": 1.85, "ips": 4, "mean": 4.70, "above": false}}, "h2": [["2026-10-12", 1.858, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 2.180, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.858, "se": 0.660, "ts": 1.000, "map": 4.674, "obs": 4, "own": 26.395, "comp": {"cins": -0.6572, "dshield": 12.4885, "crowdsec": -4.8508, "vulncheck": -0.7313, "blocklist_de": -3.3135}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.434, "det": null, "oid": "ORG-MCC1-RIPE", "org": "T2 Mobile LLC", "pdb": {"t": "Enterprise", "sc": null, "tr": "500-1000Gbps", "pol": "Selective", "web": "https://spb.t2.ru/"}, "pfx": 7, "reg": "2004-12-10", "rir": "ripencc", "s24": 119, "sib": 8, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 30464, "abuse": "abuse_ripe@t2.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0039823010535}, {"a": 15395, "h": "RACKSPACE-LON", "n": "Rackspace Ltd.", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 1.09, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.802, "ts": null, "map": 0.115, "obs": 0, "own": 0.084, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.453, "ts": null, "map": 0.041, "obs": 0, "own": 0.010, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.965, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RA33-RIPE", "org": "Rackspace Ltd.", "pdb": null, "pfx": 34, "reg": "2000-06-21", "rir": "ripencc", "s24": 1571, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 403712, "abuse": "abuse@rackspace.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082915749005}, {"a": 15399, "h": "WANANCHI-KE", "n": "Wananchi Group AS15399", "t": "Broadband & mobile", "w": 7, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 3}, "ev": {"dshield": {"n": 2, "p": 0.1798, "hi": 4.25, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}, "crowdsec": {"n": 3, "p": 0.0095, "hi": 2.30, "lo": 0.41, "ips": 3, "mean": 1.19, "above": false}, "blocklist_de": {"n": 3, "p": 0.1631, "hi": 3.96, "lo": 0.70, "ips": 3, "mean": 2.04, "above": false}}, "h2": [["2026-10-05", 0.545, 0.008, 0, false], ["2026-10-12", 0.823, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.846, "ts": null, "map": 0.134, "obs": 0, "own": 0.677, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.823, "se": 0.518, "ts": 0.375, "map": 1.615, "obs": 8, "own": 2.499, "comp": {"cins": -1.3804, "dshield": 2.3633, "crowdsec": -1.5338, "vulncheck": -0.8836, "blocklist_de": 3.3072}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.202, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-WOL1-AFRINIC", "org": "Wananchi Group (Kenya) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.wananchi.com"}, "pfx": 810, "reg": "2007-09-19", "rir": "afrinic", "s24": 893, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 894208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00619216949996}, {"a": 15419, "h": "LRTC-AS", "n": "Lithuanian Radio and Television Centre", "t": "Broadband & mobile", "w": 0, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1648, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 1.684, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 0.801, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.606, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-SRAT1-RIPE", "org": "SC \"Lithuanian Radio and TV Center\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.telecentras.lt"}, "pfx": 19, "reg": "2002-11-19", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000020180204}, {"a": 15425, "h": "COMA", "n": "PODA a.s.", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0211, "hi": 2.47, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.902, "ts": null, "map": 0.157, "obs": 0, "own": 0.352, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.612, "ts": null, "map": 0.086, "obs": 0, "own": 0.072, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PS2-RIPE", "org": "PODA a.s.", "pdb": null, "pfx": 8, "reg": "2004-07-14", "rir": "ripencc", "s24": 432, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110592, "abuse": "abuse@poda.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025161799325}, {"a": 15435, "h": "KABELFOON", "n": "DELTA Fiber - AS15435", "t": "Broadband & mobile", "w": 4, "cc": "NL", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0851, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "shodan": {"n": 3, "p": 0.0297, "hi": 2.73, "lo": 0.48, "ips": 3, "mean": 1.41, "above": false}, "dshield": {"n": 1, "p": 0.0666, "hi": 3.24, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "blocklist_de": {"n": 2, "p": 0.0732, "hi": 3.27, "lo": 0.43, "ips": 2, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.123, 0.009, 0, false], ["2026-10-12", 0.378, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.849, "ts": null, "map": 0.136, "obs": 0, "own": 0.686, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.378, "se": 0.647, "ts": 0.500, "map": 0.936, "obs": 4, "own": 1.462, "comp": {"cins": 3.2948, "dshield": 1.421, "crowdsec": -6.0703, "vulncheck": -0.8009, "blocklist_de": 3.483}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"c2": 1, "malware": 2}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-ZB1-RIPE", "org": "DELTA Fiber Nederland B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.deltafibernederland.nl/en/"}, "pfx": 15, "reg": "2000-06-28", "rir": "ripencc", "s24": 861, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 220416, "abuse": "abuse@deltafiber.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02761973559244}, {"a": 15440, "h": "Baltneta", "n": "Baltnetos Komunikacijos Customers", "t": "Transit & backbone", "w": 2, "cc": "LT", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.2021, "hi": 4.43, "lo": 0.58, "ips": 2, "mean": 2.11, "above": false}, "crowdsec": {"n": 1, "p": 0.0577, "hi": 3.11, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "threatfox": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1225, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.783, 0.205, 0, false], ["2026-10-12", 0.405, 0.213, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.213, "se": 1.419, "ts": 1.000, "map": 1.599, "obs": 1, "own": 6.756, "comp": {"urlhaus": -0.2051, "threatfox": 2.7039, "phishing_db": -0.4032}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.405, "se": 0.879, "ts": 0.500, "map": 1.538, "obs": 2, "own": 4.986, "comp": {"cins": -0.3836, "dshield": -0.7981, "crowdsec": 0.8953, "vulncheck": -0.5923, "blocklist_de": 2.7026}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.585, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BA18-RIPE", "org": "UAB \"Baltnetos komunikacijos\"", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.balt.net"}, "pfx": 35, "reg": "2000-06-29", "rir": "ripencc", "s24": 197, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 55040, "abuse": "abuse@balt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0024712873726}, {"a": 15456, "h": "INTERNETX-AS", "n": "InterNetX", "t": "Transit & backbone", "w": 4, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3000, "hi": 5.22, "lo": 0.68, "ips": 2, "mean": 2.49, "above": false}, "vulncheck": {"n": 2, "p": 0.3902, "hi": 5.99, "lo": 0.78, "ips": 4, "mean": 2.86, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.431, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.944, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.431, "se": 0.914, "ts": 1.000, "map": 1.679, "obs": 2, "own": 5.722, "comp": {"cins": -0.2126, "dshield": -0.474, "crowdsec": -1.8732, "vulncheck": 5.5736, "blocklist_de": -1.1021}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.915, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 4}}, "oid": "ORG-IG16-RIPE", "org": "InterNetX GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.internetx.com/"}, "pfx": 6, "reg": "2000-07-04", "rir": "ripencc", "s24": 96, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26112, "abuse": "abuse@internetx.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15493, "h": "RUSCOMP-AS", "n": "\"Russian company\" LLC", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1365, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "vulncheck": {"n": 1, "p": 0.1850, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.771, 0.011, 0, false], ["2026-10-12", 1.649, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.613, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.649, "se": 0.773, "ts": 0.333, "map": 5.109, "obs": 3, "own": 2.981, "comp": {"cins": -0.3995, "dshield": 3.2023, "crowdsec": 0.744, "vulncheck": 1.5247, "blocklist_de": -2.0468}, "mass": 1.8, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-JSCC1-RIPE", "org": "\"Russian company\" LLC", "pdb": null, "pfx": 62, "reg": "2002-03-21", "rir": "ripencc", "s24": 62, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075750351215}, {"a": 15497, "h": "Colocall", "n": "Colocall Ltd.", "t": "Hosting & VPS", "w": 1, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3353, "hi": 5.52, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "vulncheck": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.177, 0.011, 0, false], ["2026-10-12", 0.172, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 0.232, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.172, "se": 1.226, "ts": 1.000, "map": 1.225, "obs": 1, "own": 0.282, "comp": {"cins": -0.1092, "dshield": -0.2545, "crowdsec": -1.0077, "vulncheck": 3.5376, "blocklist_de": -0.5699}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.928, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-CLS14-RIPE", "org": "1 Cloud Lab s.r.o.", "pdb": {"t": "Content", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.colocall.net"}, "pfx": 18, "reg": "2000-07-17", "rir": "ripencc", "s24": 66, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@1cloudlab.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15557, "h": "LDCOMNET", "n": "SFR Group", "t": "Broadband & mobile", "w": 36, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 0.43, "waf": 0.35}, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 9, "web_bruteforce": 4, "home_connection": 10, "mail_bruteforce": 5, "cve:CVE-2025-22457": 1}, "n": 12}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 0.29, "lo": 0.05, "ips": 3, "mean": 0.15, "above": false}, "dshield": {"n": 8, "p": 0.0000, "hi": 0.42, "lo": 0.14, "ips": 8, "mean": 0.26, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.71, "lo": 0.05, "ips": 1, "mean": 0.30, "above": false}, "crowdsec": {"n": 12, "p": 0.0000, "hi": 0.12, "lo": 0.05, "ips": 12, "mean": 0.08, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.25, "lo": 0.04, "ips": 3, "mean": 0.13, "above": false}, "blocklist_de": {"n": 14, "p": 0.0000, "hi": 0.33, "lo": 0.14, "ips": 14, "mean": 0.22, "above": false}}, "h2": [["2026-10-05", 0.059, 0.031, 0, false], ["2026-10-12", 0.084, 0.034, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 3}, "lo": 0.034, "se": 1.130, "ts": 0.750, "map": 0.111, "obs": 4, "own": 0.404, "comp": {"urlhaus": -0.0753, "threatfox": -0.5509, "phishing_db": 0.0587}, "mass": 14.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 8, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 14}, "lo": 0.084, "se": 0.405, "ts": 0.378, "map": 0.134, "obs": 37, "own": 0.208, "comp": {"cins": 1.1812, "dshield": 1.5589, "crowdsec": -5.3642, "vulncheck": -0.9907, "blocklist_de": 3.0005}, "mass": 46.3, "listed": false}}, "abq": false, "bot": 0.114, "det": {"blocklist_de": {"ssh": 3, "bots": 5, "imap": 5, "mail": 5, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-VF1-RIPE", "org": "Societe Francaise Du Radiotelephone - SFR SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Selective", "web": "http://alticefrance.com/"}, "pfx": 147, "reg": "2000-08-03", "rir": "ripencc", "s24": 61762, "sib": 15, "tor": 0, "w24": 36, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15829760, "abuse": "abuse@gaoland.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.298992}, {"a": 15623, "h": "CYBERLINK", "n": "Cyberlink", "t": "Other", "w": 3, "cc": "CH", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0880, "hi": 3.43, "lo": 0.45, "ips": 2, "mean": 1.63, "above": false}, "crowdsec": {"n": 1, "p": 0.0157, "hi": 2.33, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1242, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "blocklist_de": {"n": 1, "p": 0.0745, "hi": 3.34, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.067, 0.009, 0, false], ["2026-10-12", 0.355, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.910, "ts": null, "map": 0.159, "obs": 0, "own": 0.364, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.355, "se": 0.746, "ts": 0.333, "map": 1.042, "obs": 3, "own": 0.609, "comp": {"cins": -0.501, "dshield": -0.9968, "crowdsec": -0.1753, "vulncheck": 1.1559, "blocklist_de": 1.9519}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.323, "det": {"shodan": {"c2": 2}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-CISA1-RIPE", "org": "Cyberlink AG", "pdb": {"t": null, "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.cyberlink.ch"}, "pfx": 36, "reg": "2000-08-25", "rir": "ripencc", "s24": 391, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 101120, "abuse": "abuse@cyberlink.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00087002886586}, {"a": 15681, "h": "ENGIE-BE", "n": "ENGIE Belgium", "t": "Enterprise, edu & gov", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-GDF1-RIPE", "org": "ENGIE SA", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://www.engie.com"}, "pfx": 4, "reg": "2000-09-11", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15685, "h": "CASABLANCA-AS", "n": "Casablanca INT a.s.", "t": "Hosting & VPS", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1089, "hi": 3.76, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.123, 0.257, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.993, "ts": null, "map": 0.182, "obs": 0, "own": 0.198, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.778, "ts": null, "map": 0.147, "obs": 0, "own": 0.055, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.984, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-CI1-RIPE", "org": "CASABLANCA INT a.s.", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.casablanca.cz"}, "pfx": 59, "reg": "2000-09-11", "rir": "ripencc", "s24": 122, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31744, "abuse": "abuse@casablanca.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006557215396}, {"a": 15695, "h": "Expereo", "n": "Expereo International bv", "t": "Transit & backbone", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1517, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 2.666, 0.010, 0, false], ["2026-10-12", 0.101, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.172, "obs": 0, "own": 1.539, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.101, "se": 1.144, "ts": 1.000, "map": 0.642, "obs": 1, "own": 2.203, "comp": {"cins": -0.1881, "dshield": 4.1918, "crowdsec": -1.6754, "vulncheck": -0.4017, "blocklist_de": -0.9767}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ENNB1-RIPE", "org": "Expereo International BV", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.expereo.com"}, "pfx": 215, "reg": "2006-09-29", "rir": "ripencc", "s24": 221, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 57088, "abuse": "abuse@expereo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001228702365}, {"a": 15704, "h": "AS15704", "n": "MásMóvil", "t": "Broadband & mobile", "w": 20, "cc": "ES", "cf": {"rb": "hi", "wb": "hi", "rep": 0.55, "waf": 0.48}, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 4, "router_or_botnet": 6, "cve:CVE-2026-4020": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1}, "n": 9}, "ev": {"cins": {"n": 3, "p": 0.0745, "hi": 3.26, "lo": 0.57, "ips": 3, "mean": 1.68, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.59, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}, "dshield": {"n": 3, "p": 0.0347, "hi": 2.80, "lo": 0.49, "ips": 3, "mean": 1.45, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 1.62, "lo": 0.56, "ips": 9, "mean": 1.03, "above": false}, "phishing_db": {"n": 1, "p": 0.0036, "hi": 1.83, "lo": 0.14, "ips": 1, "mean": 0.77, "above": false}, "blocklist_de": {"n": 6, "p": 0.0191, "hi": 2.63, "lo": 0.73, "ips": 6, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.510, 0.046, 0, false], ["2026-10-12", 0.776, 0.049, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.049, "se": 1.331, "ts": 1.000, "map": 0.273, "obs": 1, "own": 0.912, "comp": {"urlhaus": -0.5203, "threatfox": -0.3686, "phishing_db": 1.2165}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 3, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 6}, "lo": 0.776, "se": 0.426, "ts": 0.429, "map": 1.303, "obs": 21, "own": 2.011, "comp": {"cins": 4.2215, "dshield": 0.2497, "crowdsec": -1.9845, "vulncheck": -0.9674, "blocklist_de": 0.1393}, "mass": 23.7, "listed": false}}, "abq": false, "bot": 0.109, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 2, "bots": 4}}, "oid": "ORG-PTS1-RIPE", "org": "XTRA TELECOM S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.masmovil.es"}, "pfx": 314, "reg": "2000-09-20", "rir": "ripencc", "s24": 3271, "sib": 2, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 961792, "abuse": "abuse.es@masorange.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.132135}, {"a": 15723, "h": "AZERONLINE-AS", "n": "AZERONLINE", "t": "Broadband & mobile", "w": 7, "cc": "AZ", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"dshield": {"n": 3, "p": 0.6258, "hi": 7.51, "lo": 1.32, "ips": 3, "mean": 3.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1390, "hi": 4.10, "lo": 0.31, "ips": 2, "mean": 1.73, "above": false}, "blocklist_de": {"n": 2, "p": 0.3821, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}}, "h2": [["2026-10-12", 7.062, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 1.539, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.062, "se": 0.572, "ts": 0.500, "map": 15.388, "obs": 6, "own": 23.744, "comp": {"cins": -0.9814, "dshield": 6.7964, "crowdsec": -3.7012, "vulncheck": -0.8205, "blocklist_de": 2.834}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.193, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-AIS1-RIPE", "org": "\"AZERONLINE LTD\" JOINT ENTERPRISE", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://azeronline.com"}, "pfx": 59, "reg": "2000-09-28", "rir": "ripencc", "s24": 59, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "abuse@azeronline.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0054330489752}, {"a": 15736, "h": "MBS-AS", "n": "\"Mobile Business Solutions\" MBS LLP", "t": "Broadband & mobile", "w": 1, "cc": "KZ", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 9895.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.249, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OA11-RIPE", "org": "\"Mobile Business Solutions\" MBS LLP", "pdb": null, "pfx": 3, "reg": "2000-10-02", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@mbs763.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000162751022}, {"a": 15743, "h": "NETDE", "n": "net.DE AG", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5464, "hi": 6.73, "lo": 1.19, "ips": 3, "mean": 3.47, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.187, "obs": 0, "own": 0.228, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.849, "ts": null, "map": 0.172, "obs": 0, "own": 0.075, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.776, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-IPHG1-RIPE", "org": "net.de AG", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.net.de"}, "pfx": 18, "reg": "2000-10-03", "rir": "ripencc", "s24": 71, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@net.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15755, "h": "VERITEKNIK", "n": "Veriteknik Bilisim Basin Ve Yayin Limited Sirketi", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.862, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VBL2-RIPE", "org": "Veriteknik Bilisim Basin Ve Yayin Limited Sirketi", "pdb": null, "pfx": 8, "reg": "2000-10-05", "rir": "ripencc", "s24": 8, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@veriteknik.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15774, "h": "TTK-RTL", "n": "Limited Liability Company \"TTK-Svyaz\"", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.0519, "hi": 3.03, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "crowdsec": {"n": 1, "p": 0.0001, "hi": 1.25, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}, "vulncheck": {"n": 1, "p": 0.0540, "hi": 3.06, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "blocklist_de": {"n": 2, "p": 0.0473, "hi": 2.96, "lo": 0.38, "ips": 2, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.081, 0.147, 0, false], ["2026-10-12", 0.336, 0.009, 0, false]], "sh": false, "uc": 57.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.129, "obs": 0, "own": 0.257, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.336, "se": 0.611, "ts": 0.400, "map": 0.771, "obs": 5, "own": 0.442, "comp": {"cins": -0.8957, "dshield": 1.4136, "crowdsec": -3.1552, "vulncheck": 0.3059, "blocklist_de": 3.4649}, "mass": 4.6, "listed": false}}, "abq": true, "bot": 0.416, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-LLC51-RIPE", "org": "Limited Liability Company \"TTK-Svyaz\"", "pdb": null, "pfx": 353, "reg": "2009-07-31", "rir": "ripencc", "s24": 1049, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 385280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00348530044555}, {"a": 15796, "h": "SALT-CH", "n": "SALT MOBILE", "t": "Broadband & mobile", "w": 8, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1236, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "crowdsec": {"n": 1, "p": 0.0165, "hi": 2.35, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "blocklist_de": {"n": 6, "p": 0.8635, "hi": 8.39, "lo": 2.33, "ips": 6, "mean": 4.96, "above": true}}, "h2": [["2026-10-12", 2.152, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.911, "ts": null, "map": 0.160, "obs": 0, "own": 0.909, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 6}, "lo": 2.152, "se": 0.518, "ts": 0.750, "map": 4.254, "obs": 8, "own": 6.558, "comp": {"cins": -1.5024, "dshield": -0.1188, "crowdsec": -6.4564, "vulncheck": -0.8974, "blocklist_de": 11.8167}, "mass": 9.1, "listed": false}}, "abq": false, "bot": 0.103, "det": {"blocklist_de": {"ssh": 2, "imap": 4, "mail": 4}}, "oid": "ORG-OCS1-RIPE", "org": "Salt Mobile SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.salt.ch"}, "pfx": 2, "reg": "2000-10-16", "rir": "ripencc", "s24": 384, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 98304, "abuse": "abuse-contact@salt.ch", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.02965289154522}, {"a": 15802, "h": "DU-AS1", "n": "du", "t": "Transit & backbone", "w": 32, "cc": "AE", "cf": {"rb": "", "wb": "", "rep": 1.11, "waf": 0.70}, "cs": {"c": {"http_flood": 3, "web_exploit": 8, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 13, "web_bruteforce": 12, "mail_bruteforce": 12, "router_or_botnet": 1, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-22457": 2}, "n": 15}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.59, "lo": 0.08, "ips": 2, "mean": 0.28, "above": false}, "dshield": {"n": 2, "p": 0.0022, "hi": 1.83, "lo": 0.24, "ips": 2, "mean": 0.87, "above": false}, "urlhaus": {"n": 1, "p": 0.0748, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "crowdsec": {"n": 15, "p": 0.0000, "hi": 1.78, "lo": 0.77, "ips": 15, "mean": 1.23, "above": false}, "blocklist_de": {"n": 22, "p": 0.8819, "hi": 5.39, "lo": 2.70, "ips": 22, "mean": 3.94, "above": true}}, "h2": [["2026-10-05", 0.890, 0.065, 0, false], ["2026-10-12", 1.195, 0.073, 0, false]], "sh": false, "uc": 99.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.073, "se": 1.335, "ts": 1.000, "map": 0.448, "obs": 1, "own": 1.925, "comp": {"urlhaus": 2.2235, "threatfox": -0.4679, "phishing_db": -0.9314}, "mass": 3.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 15, "vulncheck": 0, "blocklist_de": 22}, "lo": 1.195, "se": 0.392, "ts": 0.564, "map": 1.885, "obs": 39, "own": 5.895, "comp": {"cins": -3.2403, "dshield": -2.0307, "crowdsec": -3.8551, "vulncheck": -0.9913, "blocklist_de": 12.1451}, "mass": 47.1, "listed": false}}, "abq": false, "bot": 0.137, "det": {"shodan": {"malware": 1, "compromised": 1}, "blocklist_de": {"ftp": 1, "ssh": 1, "bots": 8, "imap": 1, "mail": 8, "apache": 4, "bruteforcelogin": 4}}, "oid": "ORG-DIC1-RIPE", "org": "Emirates Integrated Telecommunications Company PJSC", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.du.ae"}, "pfx": 167, "reg": "2000-10-17", "rir": "ripencc", "s24": 4508, "sib": 1, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2298112, "abuse": "abuse@du.ae", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.090953}, {"a": 15808, "h": "ACCESSKENYA-KE", "n": "AccessKenya Group", "t": "Broadband & mobile", "w": 9, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 6, "home_connection": 6, "mail_bruteforce": 4, "router_or_botnet": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2024-28000": 1}, "n": 8}, "ev": {"shodan": {"n": 2, "p": 0.1123, "hi": 3.66, "lo": 0.48, "ips": 2, "mean": 1.75, "above": false}, "crowdsec": {"n": 8, "p": 0.8785, "hi": 7.63, "lo": 2.48, "ips": 8, "mean": 4.75, "above": true}, "phishing_db": {"n": 1, "p": 0.1367, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 2.102, 0.164, 0, false], ["2026-10-12", 1.767, 0.172, 0, false]], "sh": false, "uc": 2400.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.172, "se": 1.394, "ts": 1.000, "map": 1.217, "obs": 1, "own": 3.626, "comp": {"urlhaus": -0.2613, "threatfox": -0.2543, "phishing_db": 2.3385}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.767, "se": 0.516, "ts": 1.000, "map": 3.454, "obs": 8, "own": 5.334, "comp": {"cins": -1.1823, "dshield": -1.8761, "crowdsec": 12.3226, "vulncheck": -0.8565, "blocklist_de": -5.7745}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.235, "det": {"shodan": {"doublepulsar": 2}, "blocklist_de": {"bots": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.dimensiondata.com/"}, "pfx": 71, "reg": "2000-10-18", "rir": "ripencc", "s24": 336, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 191232, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00125491570944}, {"a": 15819, "h": "GLOBALMENKUL-NET", "n": "Global Menkul Degerler SA", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.282, "det": {"shodan": {"malware": 1}}, "oid": "ORG-GMDS1-RIPE", "org": "Global Menkul Degerler SA", "pdb": null, "pfx": 1, "reg": "2000-10-19", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15830, "h": "Equinix", "n": "Equinix as15830", "t": "Hosting & VPS", "w": 11, "cc": "NL", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "router_or_botnet": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.0021, "hi": 1.83, "lo": 0.24, "ips": 2, "mean": 0.87, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.56, "lo": 0.12, "ips": 4, "mean": 0.30, "above": false}, "vulncheck": {"n": 3, "p": 0.0021, "hi": 1.92, "lo": 0.34, "ips": 3, "mean": 0.99, "above": false}, "phishing_db": {"n": 2, "p": 0.0008, "hi": 1.64, "lo": 0.21, "ips": 2, "mean": 0.78, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.87, "lo": 0.11, "ips": 2, "mean": 0.42, "above": false}}, "h2": [["2026-10-05", 0.194, 0.071, 0, false], ["2026-10-12", 0.169, 0.074, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.074, "se": 1.166, "ts": 1.000, "map": 0.288, "obs": 2, "own": 0.144, "comp": {"urlhaus": -0.8524, "threatfox": -0.4477, "phishing_db": 1.6803}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 4, "vulncheck": 3, "blocklist_de": 2}, "lo": 0.169, "se": 0.500, "ts": 0.364, "map": 0.321, "obs": 11, "own": 0.064, "comp": {"cins": 5.0095, "dshield": -2.2855, "crowdsec": -1.4435, "vulncheck": 0.7316, "blocklist_de": -1.7563}, "mass": 10.4, "listed": false}}, "abq": true, "bot": 0.563, "det": {"vulncheck": {"c2_server": 2, "botnet_node": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-TP3-RIPE", "org": "Equinix (EMEA) Acquisition Enterprises B.V.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.equinix.com"}, "pfx": 1083, "reg": "2000-10-20", "rir": "ripencc", "s24": 5798, "sib": 7, "tor": 0, "w24": 11, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1605888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0164348743287}, {"a": 15870, "h": "BST-AS", "n": "BS-Telecom llc", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.732, 0.011, 0, false], ["2026-10-12", 0.666, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.666, "se": 1.469, "ts": 1.000, "map": 7.430, "obs": 1, "own": 15.182, "comp": {"cins": -0.0509, "dshield": -0.1216, "crowdsec": -0.4821, "vulncheck": 4.3202, "blocklist_de": -0.2664}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.499, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-BL646-RIPE", "org": "BS-Telecom llc", "pdb": null, "pfx": 5, "reg": "2015-08-28", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@bs-telecom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15874, "h": "INTERKAM", "n": "Interkam", "t": "Broadband & mobile", "w": 1, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1768, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.269, 0.012, 0, false]], "sh": false, "uc": 6008.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.269, "se": 1.274, "ts": 1.000, "map": 2.176, "obs": 1, "own": 3.855, "comp": {"cins": -0.1429, "dshield": -0.3282, "crowdsec": -1.2989, "vulncheck": -0.3349, "blocklist_de": 4.276}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.166, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SZKS1-RIPE", "org": "INTERKAM sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.interkam.pl"}, "pfx": 5, "reg": "2012-03-12", "rir": "ripencc", "s24": 49, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15894, "h": "LEITWERK-AS", "n": "LEITWERK", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.144, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.283, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-LA1646-RIPE", "org": "LEITWERK AG", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.leitwerk.de"}, "pfx": 5, "reg": "2000-10-30", "rir": "ripencc", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@leitwerk.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15895, "h": "KSNET-AS", "n": "Kyivstar", "t": "Transit & backbone", "w": 269, "cc": "UA", "cf": {"rb": "hi", "wb": "hi", "rep": 0.96, "waf": 0.84}, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0041, "hi": 1.86, "lo": 0.14, "ips": 1, "mean": 0.78, "above": false}, "dshield": {"n": 3, "p": 0.0220, "hi": 2.60, "lo": 0.46, "ips": 3, "mean": 1.34, "above": false}, "urlhaus": {"n": 1, "p": 0.0901, "hi": 3.54, "lo": 0.27, "ips": 1, "mean": 1.49, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.44, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}, "vulncheck": {"n": 1, "p": 0.0015, "hi": 1.62, "lo": 0.12, "ips": 1, "mean": 0.68, "above": false}, "blocklist_de": {"n": 5, "p": 0.0032, "hi": 2.13, "lo": 0.53, "ips": 262, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.124, 0.074, 0, false], ["2026-10-12", 0.331, 0.082, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.082, "se": 1.341, "ts": 1.000, "map": 0.513, "obs": 1, "own": 2.183, "comp": {"urlhaus": 2.3357, "threatfox": -0.461, "phishing_db": -0.9157}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 5}, "lo": 0.331, "se": 0.485, "ts": 0.455, "map": 0.606, "obs": 11, "own": 1.909, "comp": {"cins": 1.2691, "dshield": 2.6228, "crowdsec": -7.8002, "vulncheck": -0.4622, "blocklist_de": 5.2638}, "mass": 12.4, "listed": false}}, "abq": false, "bot": 0.122, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 5, "mail": 257, "apache": 257}}, "oid": "ORG-KG8-RIPE", "org": "\"Kyivstar\" PJSC", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://kyivstar.ua"}, "pfx": 45, "reg": "2000-10-30", "rir": "ripencc", "s24": 3677, "sib": 2, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1206528, "abuse": "abuse@kyivstar.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.076497}, {"a": 15897, "h": "VodafoneTurkey", "n": "Vodafone Telekomunikasyon A.S.", "t": "Broadband & mobile", "w": 3, "cc": "TR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.66, "waf": 0.58}, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 0.72, "lo": 0.09, "ips": 2, "mean": 0.34, "above": false}, "blocklist_de": {"n": 1, "p": 0.0001, "hi": 1.15, "lo": 0.09, "ips": 1, "mean": 0.49, "above": false}}, "h2": [["2026-10-05", 0.016, 0.007, 0, false], ["2026-10-12", 0.074, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.757, "ts": null, "map": 0.094, "obs": 0, "own": 0.428, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.074, "se": 0.699, "ts": 0.667, "map": 0.200, "obs": 3, "own": 0.315, "comp": {"cins": -0.6837, "dshield": -1.2736, "crowdsec": 1.6774, "vulncheck": -0.7407, "blocklist_de": 0.8055}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.057, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-RIHV1-RIPE", "org": "Vodafone Telekomunikasyon A.S.", "pdb": null, "pfx": 552, "reg": "2000-10-30", "rir": "ripencc", "s24": 2912, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1315072, "abuse": "abuse-tr@vodafone.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.110565}, {"a": 15924, "h": "BORUSANTELEKOM-AS", "n": "VODAFONE NET ILETISIM HIZMETLERI AS15924", "t": "Broadband & mobile", "w": 6, "cc": "TR", "cf": {"rb": "lo", "wb": null, "rep": 2.23, "waf": null}, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.0011, "hi": 1.70, "lo": 0.22, "ips": 2, "mean": 0.81, "above": false}, "dshield": {"n": 3, "p": 0.2586, "hi": 4.61, "lo": 0.81, "ips": 3, "mean": 2.38, "above": false}, "crowdsec": {"n": 3, "p": 0.0010, "hi": 1.78, "lo": 0.31, "ips": 3, "mean": 0.92, "above": false}, "threatfox": {"n": 1, "p": 0.1275, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.0069, "hi": 2.01, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.358, 0.077, 0, false], ["2026-10-12", 0.455, 0.080, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.080, "se": 1.349, "ts": 1.000, "map": 0.482, "obs": 1, "own": 1.543, "comp": {"urlhaus": -0.3741, "threatfox": 1.8662, "phishing_db": -0.5965}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.455, "se": 0.536, "ts": 0.429, "map": 0.924, "obs": 7, "own": 1.433, "comp": {"cins": -1.1875, "dshield": 5.5856, "crowdsec": 0.0, "vulncheck": -0.8573, "blocklist_de": -2.2266}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.237, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BIHA1-RIPE", "org": "Vodafone Net Iletisim Hizmetler AS", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.vodafone.com.tr"}, "pfx": 352, "reg": "2000-11-02", "rir": "ripencc", "s24": 1264, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 673024, "abuse": "abuse@vodafone.net.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01778067967825}, {"a": 15943, "h": "WTNET-AS", "n": "wilhelm.tel", "t": "Broadband & mobile", "w": 5, "cc": "DE", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"dshield": {"n": 4, "p": 0.3994, "hi": 5.24, "lo": 1.13, "ips": 4, "mean": 2.86, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.01, "lo": 0.08, "ips": 1, "mean": 0.43, "above": false}}, "h2": [["2026-10-05", 1.244, 0.008, 0, false], ["2026-10-12", 0.265, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.119, "obs": 0, "own": 0.574, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.265, "se": 0.593, "ts": 0.800, "map": 0.590, "obs": 5, "own": 0.919, "comp": {"cins": -0.9027, "dshield": 10.2565, "crowdsec": -3.201, "vulncheck": -0.8032, "blocklist_de": -4.4836}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.141, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-WN1-RIPE", "org": "wilhelm.tel GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.wilhelm-tel.de"}, "pfx": 62, "reg": "2000-11-07", "rir": "ripencc", "s24": 1384, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 354560, "abuse": "abuse@wilhelm-tel.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0128053086615}, {"a": 15954, "h": "Tecnocratica", "n": "Tecnocratica", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1516, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.879, "ts": null, "map": 0.183, "obs": 0, "own": 0.243, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.747, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NS101-RIPE", "org": "Tecnocratica Centro de Datos, S.L.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.tecnocratica.net"}, "pfx": 14, "reg": "2000-11-10", "rir": "ripencc", "s24": 56, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "abuse@tecnocratica.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 15958, "h": "CETIN_doo_AS", "n": "CETIN Ltd. Belgrade", "t": "Transit & backbone", "w": 6, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0500, "hi": 3.00, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "dshield": {"n": 2, "p": 0.3320, "hi": 5.49, "lo": 0.71, "ips": 2, "mean": 2.62, "above": false}, "phishing_db": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "blocklist_de": {"n": 3, "p": 0.4584, "hi": 6.00, "lo": 1.06, "ips": 3, "mean": 3.10, "above": false}}, "h2": [["2026-10-05", 0.085, 0.182, 0, false], ["2026-10-12", 1.453, 0.192, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.192, "se": 1.404, "ts": 1.000, "map": 1.393, "obs": 1, "own": 5.860, "comp": {"urlhaus": -0.2434, "threatfox": -0.2431, "phishing_db": 2.444}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.453, "se": 0.604, "ts": 0.600, "map": 3.290, "obs": 5, "own": 10.368, "comp": {"cins": -0.9704, "dshield": 4.0292, "crowdsec": -6.4282, "vulncheck": -0.8182, "blocklist_de": 6.7722}, "mass": 5.0, "listed": false}}, "abq": true, "bot": 0.165, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 3}}, "oid": "ORG-CLB1-RIPE", "org": "CETIN Ltd. Belgrade", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.cetin.rs"}, "pfx": 9, "reg": "2000-11-13", "rir": "ripencc", "s24": 272, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 84992, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02383038486225}, {"a": 15962, "h": "OSK-DNI", "n": "Orange Slovensko", "t": "Broadband & mobile", "w": 0, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0008, "hi": 1.49, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.099, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.836, "ts": null, "map": 0.130, "obs": 0, "own": 0.644, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.505, "ts": null, "map": 0.053, "obs": 0, "own": 0.111, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.107, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-OSA4-RIPE", "org": "Orange Slovensko a.s.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.orange.sk"}, "pfx": 16, "reg": "2000-11-14", "rir": "ripencc", "s24": 1020, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 261120, "abuse": "abuse@orange.sk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01665075036114}, {"a": 15964, "h": "CAMNET-AS", "n": "CAMTEL", "t": "Hosting & VPS", "w": 12, "cc": "CM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 5, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-87902": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1685, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "shodan": {"n": 1, "p": 0.0835, "hi": 3.46, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}, "dshield": {"n": 1, "p": 0.1608, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "urlhaus": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 6, "p": 0.8452, "hi": 8.10, "lo": 2.25, "ips": 7, "mean": 4.79, "above": true}, "blocklist_de": {"n": 3, "p": 0.5239, "hi": 6.54, "lo": 1.15, "ips": 3, "mean": 3.37, "above": false}}, "h2": [["2026-10-05", 3.646, 0.339, 0, false], ["2026-10-12", 5.832, 0.362, 0, false]], "sh": false, "uc": 415.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.362, "se": 1.502, "ts": 1.000, "map": 3.351, "obs": 1, "own": 1.516, "comp": {"urlhaus": 3.7256, "threatfox": -0.3067, "phishing_db": -0.5834}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.832, "se": 0.477, "ts": 0.545, "map": 10.751, "obs": 11, "own": 2.108, "comp": {"cins": 1.6731, "dshield": -0.3995, "crowdsec": 2.2111, "vulncheck": -0.9109, "blocklist_de": 1.195}, "mass": 10.4, "listed": false}}, "abq": false, "bot": 0.145, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 3}}, "oid": "ORG-IA6-AFRINIC", "org": "CAMTEL", "pdb": {"t": "Network Services", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.camtel.cm"}, "pfx": 129, "reg": "2007-09-20", "rir": "afrinic", "s24": 174, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 74496, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00257010504174}, {"a": 16010, "h": "MagticomAS", "n": "Magticom Broadband", "t": "Broadband & mobile", "w": 15, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 2}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.0160, "hi": 2.55, "lo": 0.63, "ips": 5, "mean": 1.45, "above": false}, "vulncheck": {"n": 1, "p": 0.0457, "hi": 2.93, "lo": 0.22, "ips": 8, "mean": 1.24, "above": false}, "blocklist_de": {"n": 2, "p": 0.0349, "hi": 2.78, "lo": 0.36, "ips": 2, "mean": 1.33, "above": false}}, "h2": [["2026-10-05", 0.852, 0.008, 0, false], ["2026-10-12", 0.550, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.610, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.550, "se": 0.526, "ts": 0.625, "map": 1.083, "obs": 8, "own": 1.683, "comp": {"cins": -1.2661, "dshield": -1.9602, "crowdsec": 4.0208, "vulncheck": -0.1076, "blocklist_de": 0.7868}, "mass": 7.1, "listed": false}}, "abq": false, "bot": 0.114, "det": {"vulncheck": {"botnet_node": 8}, "blocklist_de": {"apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-ML2-RIPE", "org": "Magticom Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.magticom.ge/"}, "pfx": 45, "reg": "2000-11-23", "rir": "ripencc", "s24": 1177, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 449024, "abuse": "abuse@magtinet.ge", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03230750410992}, {"a": 16019, "h": "VODAFONE-CZ-AS", "n": "Vodafone Czech Republic", "t": "Broadband & mobile", "w": 16, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 1, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 9, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 8, "home_connection": 8, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2024-6569": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2024-28000": 2}, "n": 11}, "ev": {"shodan": {"n": 4, "p": 0.0000, "hi": 0.82, "lo": 0.18, "ips": 4, "mean": 0.45, "above": false}, "dshield": {"n": 1, "p": 0.0003, "hi": 1.34, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 0.97, "lo": 0.29, "ips": 11, "mean": 0.59, "above": false}, "blocklist_de": {"n": 6, "p": 0.0009, "hi": 1.95, "lo": 0.54, "ips": 6, "mean": 1.15, "above": false}}, "h2": [["2026-10-05", 0.298, 0.006, 0, false], ["2026-10-12", 0.337, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.724, "ts": null, "map": 0.078, "obs": 0, "own": 0.351, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 6}, "lo": 0.337, "se": 0.457, "ts": 0.500, "map": 0.589, "obs": 14, "own": 0.912, "comp": {"cins": -2.0716, "dshield": -1.1592, "crowdsec": -0.2278, "vulncheck": -0.9432, "blocklist_de": 5.2669}, "mass": 15.5, "listed": false}}, "abq": false, "bot": 0.122, "det": {"shodan": {"c2": 1, "compromised": 3}, "blocklist_de": {"ssh": 5, "imap": 1, "mail": 1}}, "oid": "ORG-CMA1-RIPE", "org": "Vodafone Czech Republic a.s.", "pdb": {"t": null, "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.vodafone.cz"}, "pfx": 90, "reg": "2000-11-24", "rir": "ripencc", "s24": 4728, "sib": 2, "tor": 8, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2295808, "abuse": "abuse@vodafone.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04871220676803}, {"a": 16058, "h": "Gabon-Telecom", "n": "Gabon Telecom / Office of Posts and Telecommunications of Gabon", "t": "Broadband & mobile", "w": 2, "cc": "GA", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.1593, "hi": 4.08, "lo": 0.53, "ips": 2, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.035, 0.008, 0, false], ["2026-10-12", 0.099, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.837, "ts": null, "map": 0.130, "obs": 0, "own": 0.647, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.099, "se": 0.827, "ts": 1.000, "map": 0.341, "obs": 2, "own": 0.542, "comp": {"cins": -0.4298, "dshield": 7.026, "crowdsec": -3.4593, "vulncheck": -0.6228, "blocklist_de": -2.1976}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-OOPA1-AFRINIC", "org": "Gabon Telecom / Office of Posts and Telecommunications of Gabon", "pdb": null, "pfx": 46, "reg": "2007-09-20", "rir": "afrinic", "s24": 1008, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 441344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00202203916752}, {"a": 16086, "h": "DNA", "n": "DNA", "t": "Transit & backbone", "w": 3, "cc": "FI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.28, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.95, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.97, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.03, "lo": 0.08, "ips": 1, "mean": 0.43, "above": false}}, "h2": [["2026-10-12", 0.015, 0.030, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.030, "se": 1.328, "ts": 1.000, "map": 0.159, "obs": 1, "own": 0.801, "comp": {"urlhaus": -0.65, "threatfox": -0.4053, "phishing_db": 0.8411}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.015, "se": 0.799, "ts": 0.500, "map": 0.047, "obs": 2, "own": 0.155, "comp": {"cins": -0.4326, "dshield": 3.0619, "crowdsec": -3.4782, "vulncheck": 1.3936, "blocklist_de": -2.2117}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.100, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-FNL1-RIPE", "org": "DNA Oyj", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://corporate.dna.fi/"}, "pfx": 78, "reg": "2000-12-18", "rir": "ripencc", "s24": 7380, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1890304, "abuse": "abuse@dnaip.fi", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04664608069506}, {"a": 16116, "h": "", "n": "Pelephone Communications Ltd.", "t": "Other", "w": 20, "cc": "IL", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 12, "web_bruteforce": 4, "mail_bruteforce": 13, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2026-8181": 2, "cve:CVE-2018-20062": 1}, "n": 16}, "ev": {"dshield": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 2, "mean": 1.86, "above": false}, "crowdsec": {"n": 11, "p": 0.9988, "hi": 13.19, "lo": 5.02, "ips": 16, "mean": 8.70, "above": true}, "blocklist_de": {"n": 9, "p": 0.9969, "hi": 13.62, "lo": 4.70, "ips": 10, "mean": 8.67, "above": true}}, "h2": [["2026-10-05", 12.310, 0.010, 1, false], ["2026-10-12", 15.623, 0.011, 1, false]], "sh": false, "uc": 4072.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.180, "obs": 0, "own": 0.495, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 9}, "lo": 15.623, "se": 0.416, "ts": 0.524, "map": 26.061, "obs": 21, "own": 14.591, "comp": {"cins": -2.3958, "dshield": -1.636, "crowdsec": 1.6082, "vulncheck": -0.9607, "blocklist_de": 8.0384}, "mass": 20.5, "listed": false}}, "abq": false, "bot": 0.070, "det": {"blocklist_de": {"bots": 1, "imap": 3, "mail": 9}}, "oid": "ORG-PCL4-RIPE", "org": "Pelephone Communications Ltd.", "pdb": null, "pfx": 88, "reg": "2000-12-27", "rir": "ripencc", "s24": 143, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 48896, "abuse": "hostmaster@pelephone.co.il", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.01157731328466}, {"a": 16125, "h": "CHERRYSERVERS1-AS", "n": "Cherry Servers", "t": "Hosting & VPS", "w": 3, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 8, "p": 0.9858, "hi": 11.63, "lo": 3.78, "ips": 8, "mean": 7.25, "above": true}, "crowdsec": {"n": 1, "p": 0.0991, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "blocklist_de": {"n": 1, "p": 0.1511, "hi": 4.23, "lo": 0.32, "ips": 2, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.149, 0.011, 0, false], ["2026-10-12", 0.629, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.998, "ts": null, "map": 0.183, "obs": 0, "own": 0.202, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.629, "se": 0.899, "ts": 0.500, "map": 2.494, "obs": 2, "own": 0.508, "comp": {"cins": -0.3589, "dshield": -0.7541, "crowdsec": 1.1331, "vulncheck": -0.5743, "blocklist_de": 2.8616}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.835, "det": {"shodan": {"compromised": 8}, "blocklist_de": {"sip": 2}}, "oid": "ORG-UDC69-RIPE", "org": "UAB \"Cherry Servers\"", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "http://cherryservers.com"}, "pfx": 65, "reg": "2011-03-29", "rir": "ripencc", "s24": 113, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 30976, "abuse": "abuse@cherryservers.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.005215749341}, {"a": 16135, "h": "TURKCELL-AS", "n": "TURKCELL", "t": "Broadband & mobile", "w": 49, "cc": "TR", "cf": {"rb": "", "wb": "hi", "rep": 0.97, "waf": 0.45}, "cs": {"c": {"web_exploit": 13, "proxy_or_vpn": 7, "ssh_bruteforce": 11, "web_bruteforce": 15, "mail_bruteforce": 26, "router_or_botnet": 1, "cve:CVE-2019-8318": 2, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 2}, "n": 38}, "ev": {"dshield": {"n": 2, "p": 0.0001, "hi": 1.38, "lo": 0.18, "ips": 2, "mean": 0.66, "above": false}, "urlhaus": {"n": 1, "p": 0.0465, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "crowdsec": {"n": 26, "p": 0.0000, "hi": 1.94, "lo": 1.03, "ips": 38, "mean": 1.46, "above": false}, "blocklist_de": {"n": 14, "p": 0.0178, "hi": 2.71, "lo": 1.14, "ips": 20, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.570, 0.052, 0, false], ["2026-10-12", 0.746, 0.059, 0, false]], "sh": false, "uc": 114.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.059, "se": 1.326, "ts": 1.000, "map": 0.348, "obs": 1, "own": 1.071, "comp": {"urlhaus": 2.0085, "threatfox": -0.4802, "phishing_db": -0.9591}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 26, "vulncheck": 0, "blocklist_de": 14}, "lo": 0.746, "se": 0.392, "ts": 0.619, "map": 1.182, "obs": 42, "own": 1.822, "comp": {"cins": -3.1628, "dshield": -1.9088, "crowdsec": 3.6149, "vulncheck": -0.9891, "blocklist_de": 4.0065}, "mass": 43.3, "listed": false}}, "abq": true, "bot": 0.056, "det": {"blocklist_de": {"bots": 2, "imap": 11, "mail": 17, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TA62-RIPE", "org": "TURKCELL ILETISIM HIZMETLERI A.S.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.turkcell.com.tr"}, "pfx": 304, "reg": "2004-04-21", "rir": "ripencc", "s24": 6604, "sib": 0, "tor": 0, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1690624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.142651}, {"a": 16185, "h": "RINGNETT-NORWAY", "n": "MODUM KABEL-TV AS", "t": "Other", "w": 0, "cc": "NO", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7565, "hi": 8.24, "lo": 1.77, "ips": 4, "mean": 4.50, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.253, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.163, "det": {"shodan": {"doublepulsar": 4}}, "oid": "ORG-RA16-RIPE", "org": "MODUM KABEL-TV AS", "pdb": null, "pfx": 3, "reg": "2001-01-17", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": "abuse@mkrn.no", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034792329328}, {"a": 16186, "h": "ASN-SSC", "n": "IP Group", "t": "Transit & backbone", "w": 0, "cc": "NO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 2.172, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.179, "obs": 0, "own": 1.290, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.595, "det": {"shodan": {"malware": 1}}, "oid": "ORG-WAON1-RIPE", "org": "IP Group AS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.ssc.net"}, "pfx": 10, "reg": "2001-01-17", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005034833688}, {"a": 16190, "h": "AS16190", "n": "WEB LLC", "t": "Broadband & mobile", "w": 3, "cc": "AM", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 30.955, 0.011, 1, false], ["2026-10-12", 21.886, 0.012, 1, false]], "sh": false, "uc": 7812.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 21.886, "se": 0.694, "ts": 0.750, "map": 59.373, "obs": 4, "own": 92.029, "comp": {"cins": -0.5735, "dshield": -1.1111, "crowdsec": 6.3659, "vulncheck": -0.6978, "blocklist_de": 1.494}, "mass": 2.6, "listed": false}}, "abq": true, "bot": 0.781, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LL377-RIPE", "org": "LIR LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.web.am"}, "pfx": 7, "reg": "2001-01-18", "rir": "ripencc", "s24": 8, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022889605568}, {"a": 16202, "h": "TC-PRIMACOM", "n": "PŸUR - Mitte", "t": "Broadband & mobile", "w": 1, "cc": "DE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.0703, "hi": 3.29, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}}, "h2": [["2026-10-05", 0.695, 0.009, 0, false], ["2026-10-12", 0.072, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.906, "ts": null, "map": 0.158, "obs": 0, "own": 0.887, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.072, "se": 1.109, "ts": 1.000, "map": 0.421, "obs": 1, "own": 0.706, "comp": {"cins": -0.2283, "dshield": -0.5057, "crowdsec": -1.9982, "vulncheck": -0.452, "blocklist_de": 3.7121}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BBG1-RIPE", "org": "Tele Columbus AG", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "https://www.pyur.com"}, "pfx": 17, "reg": "2001-01-22", "rir": "ripencc", "s24": 413, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 200704, "abuse": "abuse@mip-platform.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.006928452978}, {"a": 16223, "h": "COLUMBUS-PE-TE", "n": "Columbus AS16223", "t": "Broadband & mobile", "w": 4, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0498, "hi": 3.00, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "dshield": {"n": 2, "p": 0.3317, "hi": 5.49, "lo": 0.71, "ips": 2, "mean": 2.61, "above": false}, "crowdsec": {"n": 1, "p": 0.0349, "hi": 2.75, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "vulncheck": {"n": 1, "p": 0.1435, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 1.852, 0.010, 0, false], ["2026-10-12", 0.729, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.014, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.729, "se": 0.667, "ts": 0.500, "map": 1.861, "obs": 4, "own": 2.926, "comp": {"cins": -0.6079, "dshield": 5.9105, "crowdsec": -1.0685, "vulncheck": 0.8545, "blocklist_de": -3.0742}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.258, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-MTL12-RIPE", "org": "MAXNET TELECOM, LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://columbus.te.ua"}, "pfx": 12, "reg": "2001-01-31", "rir": "ripencc", "s24": 273, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 135936, "abuse": "noc@columbus.in.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00516520732896}, {"a": 16232, "h": "ASN-TIM", "n": "Telecom Italia S.p.A.", "t": "Broadband & mobile", "w": 3, "cc": "IT", "cf": {"rb": "hi", "wb": "hi", "rep": 1.04, "waf": 0.91}, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.0004, "hi": 1.63, "lo": 0.29, "ips": 3, "mean": 0.84, "above": false}}, "h2": [["2026-10-05", 0.009, 0.005, 0, false], ["2026-10-12", 0.032, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.699, "ts": null, "map": 0.067, "obs": 0, "own": 0.299, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.032, "se": 0.687, "ts": 1.000, "map": 0.084, "obs": 3, "own": 0.133, "comp": {"cins": -0.6872, "dshield": 8.8267, "crowdsec": -5.0174, "vulncheck": -0.742, "blocklist_de": -3.4584}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.078, "det": null, "oid": "ORG-TIM1-RIPE", "org": "Telecom Italia S.p.A.", "pdb": null, "pfx": 20, "reg": "2001-02-02", "rir": "ripencc", "s24": 6944, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2040064, "abuse": "abuse@telecomitalia.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.070286}, {"a": 16276, "h": "OVH", "n": "OVHcloud", "t": "Hosting & VPS", "w": 2770, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 0.42, "waf": 0.93}, "cs": {"c": {"http_flood": 801, "data_centre": 888, "web_exploit": 790, "bad_crawling": 394, "proxy_or_vpn": 148, "first_seen_30d": 80, "ssh_bruteforce": 214, "web_bruteforce": 269, "home_connection": 51, "mail_bruteforce": 42, "router_or_botnet": 60, "cve:CVE-2025-4396": 216, "cve:CVE-2021-44228": 28, "cve:CVE-2024-28000": 50, "cve:CVE-2026-21859": 40, "cve:CVE-2026-63030": 43}, "n": 1144}, "ev": {"cins": {"n": 32, "p": 0.8951, "hi": 4.96, "lo": 2.78, "ips": 35, "mean": 3.80, "above": true}, "shodan": {"n": 1076, "p": 1.0000, "hi": 28.43, "lo": 25.71, "ips": 1076, "mean": 27.06, "above": true}, "dshield": {"n": 22, "p": 0.0351, "hi": 2.91, "lo": 1.46, "ips": 24, "mean": 2.13, "above": false}, "urlhaus": {"n": 3, "p": 0.0413, "hi": 2.89, "lo": 0.51, "ips": 3, "mean": 1.49, "above": false}, "crowdsec": {"n": 565, "p": 1.0000, "hi": 12.29, "lo": 10.70, "ips": 1144, "mean": 11.49, "above": true}, "threatfox": {"n": 31, "p": 1.0000, "hi": 11.05, "lo": 6.15, "ips": 31, "mean": 8.45, "above": true}, "vulncheck": {"n": 348, "p": 1.0000, "hi": 36.12, "lo": 30.29, "ips": 439, "mean": 33.15, "above": true}, "phishing_db": {"n": 94, "p": 1.0000, "hi": 11.30, "lo": 8.06, "ips": 96, "mean": 9.62, "above": true}, "blocklist_de": {"n": 223, "p": 1.0000, "hi": 12.18, "lo": 9.77, "ips": 1155, "mean": 10.95, "above": true}}, "h2": [["2026-10-05", 6.584, 1.556, 0, false], ["2026-10-12", 5.815, 1.481, 0, false]], "sh": false, "uc": 72.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 31, "phishing_db": 94}, "lo": 1.481, "se": 0.791, "ts": 0.734, "map": 3.023, "obs": 128, "own": 1.194, "comp": {"urlhaus": -1.8943, "threatfox": 0.82, "phishing_db": 3.8068}, "mass": 79.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 32, "dshield": 22, "crowdsec": 565, "vulncheck": 348, "blocklist_de": 223}, "lo": 5.815, "se": 0.349, "ts": 0.475, "map": 8.648, "obs": 1190, "own": 1.689, "comp": {"cins": -1.0086, "dshield": -2.7928, "crowdsec": 5.4794, "vulncheck": 1.4977, "blocklist_de": 0.3754}, "mass": 866.5, "listed": false}}, "abq": false, "bot": 0.880, "det": {"shodan": {"c2": 101, "malware": 24, "compromised": 907, "doublepulsar": 44}, "threatfox": {"family:Havoc": 5, "family:Sliver": 3, "family:PureRAT": 5, "family:Evilginx": 4, "family:Unknown malware": 4}, "vulncheck": {"c2_server": 44, "botnet_node": 372, "attack_tooling": 17, "other_infrastructure": 6}, "blocklist_de": {"ftp": 17, "sip": 4, "ssh": 119, "bots": 1002, "imap": 3, "mail": 6, "apache": 7, "bruteforcelogin": 7}}, "oid": "ORG-OS3-RIPE", "org": "OVH SAS", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Tbps", "pol": "Open", "web": "https://www.ovhcloud.com"}, "pfx": 731, "reg": "2001-02-15", "rir": "ripencc", "s24": 18164, "sib": 1, "tor": 13, "w24": 1127, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 4686080, "abuse": "abuse@ovh.net", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.820692}, {"a": 16284, "h": "Inq-Digital-Nigeria-AS", "n": "inq. Digital Nigeria", "t": "Transit & backbone", "w": 1, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1043, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-12", 0.162, 0.012, 0, false]], "sh": false, "uc": 264.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.002, "ts": null, "map": 0.184, "obs": 0, "own": 1.900, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.162, "se": 1.200, "ts": 1.000, "map": 1.141, "obs": 1, "own": 3.985, "comp": {"cins": -0.16, "dshield": -0.3647, "crowdsec": 3.2438, "vulncheck": -0.3616, "blocklist_de": -0.8321}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.675, "det": null, "oid": "ORG-GTN1-AFRINIC", "org": "Inq. Digital Nigeria", "pdb": {"t": "NSP", "sc": "Africa", "tr": null, "pol": "Selective", "web": "http://www.inq.inc"}, "pfx": 105, "reg": "2007-09-20", "rir": "afrinic", "s24": 105, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 29184, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036562268174}, {"a": 16302, "h": "SUOMICOMMUNICATIONS", "n": "SuomiCommunications", "t": "Broadband & mobile", "w": 0, "cc": "FI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1035, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 1.256, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.768, "ts": null, "map": 0.143, "obs": 0, "own": 0.412, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.353, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SCO1-RIPE", "org": "Suomi Communications Oy", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.suomicom.fi/"}, "pfx": 14, "reg": "2001-02-21", "rir": "ripencc", "s24": 132, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 33792, "abuse": "hostmaster@suomicommunications.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00097806740346}, {"a": 16345, "h": "BEE-AS", "n": "BEE", "t": "Other", "w": 28, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 2}, "n": 3}, "ev": {"dshield": {"n": 23, "p": 1.0000, "hi": 20.35, "lo": 10.34, "ips": 24, "mean": 14.99, "above": true}, "urlhaus": {"n": 1, "p": 0.1575, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 3, "p": 0.0025, "hi": 1.96, "lo": 0.34, "ips": 3, "mean": 1.01, "above": false}, "blocklist_de": {"n": 1, "p": 0.0105, "hi": 2.16, "lo": 0.16, "ips": 1, "mean": 0.91, "above": false}}, "h2": [["2026-10-05", 0.164, 0.008, 0, false], ["2026-10-12", 2.162, 0.156, 0, false]], "sh": false, "uc": 115.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.156, "se": 1.387, "ts": 1.000, "map": 1.111, "obs": 1, "own": 1.292, "comp": {"urlhaus": 2.951, "threatfox": -0.4122, "phishing_db": -0.8076}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 23, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.162, "se": 0.405, "ts": 0.852, "map": 3.512, "obs": 27, "own": 1.976, "comp": {"cins": -2.4498, "dshield": 22.8123, "crowdsec": -7.6697, "vulncheck": -0.9632, "blocklist_de": -9.0797}, "mass": 21.6, "listed": false}}, "abq": true, "bot": 0.415, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-JA8-RIPE", "org": "PJSC \"Vimpelcom\"", "pdb": null, "pfx": 176, "reg": "2001-03-07", "rir": "ripencc", "s24": 1114, "sib": 1, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 285184, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.0215273606933}, {"a": 16347, "h": "INHERENT", "n": "ADISTA SAS", "t": "Broadband & mobile", "w": 3, "cc": "FR", "cf": null, "cs": {"c": {"data_centre": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 2, "p": 0.3616, "hi": 5.74, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "crowdsec": {"n": 1, "p": 0.0002, "hi": 1.26, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.093, 0.606, 0, false], ["2026-10-12", 0.035, 0.676, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.676, "se": 1.126, "ts": 1.000, "map": 2.961, "obs": 2, "own": 7.448, "comp": {"urlhaus": 4.233, "threatfox": -0.5051, "phishing_db": -1.0162}, "mass": 4.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.035, "se": 1.046, "ts": 1.000, "map": 0.183, "obs": 1, "own": 0.302, "comp": {"cins": -0.2491, "dshield": -0.547, "crowdsec": 2.2538, "vulncheck": -0.4752, "blocklist_de": -1.2883}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-RI9-RIPE", "org": "ADISTA SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.adista.fr"}, "pfx": 156, "reg": "2001-03-07", "rir": "ripencc", "s24": 1042, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 268288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00923616599136}, {"a": 16371, "h": "acens_AS", "n": "Acens Technologies", "t": "Hosting & VPS", "w": 2, "cc": "ES", "cf": null, "cs": {"c": {"data_centre": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0332, "hi": 2.72, "lo": 0.20, "ips": 1, "mean": 1.15, "above": false}, "crowdsec": {"n": 1, "p": 0.0209, "hi": 2.46, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}, "phishing_db": {"n": 1, "p": 0.1347, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.006, 0.161, 0, false], ["2026-10-12", 0.075, 0.169, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.169, "se": 1.393, "ts": 1.000, "map": 1.188, "obs": 1, "own": 0.547, "comp": {"urlhaus": -0.2646, "threatfox": -0.2562, "phishing_db": 2.3195}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.075, "se": 1.112, "ts": 1.000, "map": 0.445, "obs": 1, "own": 0.095, "comp": {"cins": -0.205, "dshield": -0.4585, "crowdsec": 2.7337, "vulncheck": -0.4238, "blocklist_de": -1.0634}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.898, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-RE1-RIPE", "org": "acens Technologies, S.L.", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.acens.com"}, "pfx": 116, "reg": "2001-03-09", "rir": "ripencc", "s24": 349, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 184320, "abuse": "abuse@acens.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005900799418}, {"a": 16504, "h": "GRANITE", "n": "Granite Telecommunications", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0063, "hi": 2.10, "lo": 0.27, "ips": 2, "mean": 1.00, "above": false}}, "h2": [["2026-10-05", 0.005, 0.008, 0, false], ["2026-10-12", 0.005, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.842, "ts": null, "map": 0.133, "obs": 0, "own": 0.665, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.515, "ts": null, "map": 0.056, "obs": 0, "own": 0.118, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.235, "det": {"shodan": {"malware": 1, "compromised": 1}}, "oid": "GRANI-25-ARIN", "org": "Granite Telecommunications LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://granitenet.com"}, "pfx": 201, "reg": "2013-10-14", "rir": "arin", "s24": 935, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 456448, "abuse": "abuse@granitenet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00446533300264}, {"a": 16509, "h": "AMAZON-02", "n": "Amazon.com", "t": "Hyperscale cloud", "w": 2508, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.31, "waf": 1.07}, "cs": {"c": {"http_flood": 258, "data_centre": 300, "web_exploit": 251, "bad_crawling": 157, "proxy_or_vpn": 22, "first_seen_30d": 27, "ssh_bruteforce": 21, "web_bruteforce": 205, "mail_bruteforce": 23, "router_or_botnet": 1, "cve:CVE-2017-9841": 24, "cve:CVE-2021-41773": 45, "cve:CVE-2021-43798": 44, "cve:CVE-2025-55182": 33, "cve:CVE-2026-63030": 31}, "n": 343}, "ev": {"cins": {"n": 30, "p": 0.0000, "hi": 0.16, "lo": 0.09, "ips": 30, "mean": 0.12, "above": false}, "shodan": {"n": 503, "p": 0.0000, "hi": 0.41, "lo": 0.36, "ips": 503, "mean": 0.38, "above": false}, "dshield": {"n": 44, "p": 0.0000, "hi": 0.17, "lo": 0.10, "ips": 48, "mean": 0.14, "above": false}, "urlhaus": {"n": 2, "p": 0.0000, "hi": 0.11, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "crowdsec": {"n": 262, "p": 0.0000, "hi": 0.18, "lo": 0.14, "ips": 343, "mean": 0.16, "above": false}, "threatfox": {"n": 42, "p": 0.0000, "hi": 0.57, "lo": 0.34, "ips": 42, "mean": 0.45, "above": false}, "vulncheck": {"n": 1041, "p": 0.9881, "hi": 3.39, "lo": 3.06, "ips": 1048, "mean": 3.22, "above": true}, "phishing_db": {"n": 840, "p": 0.0164, "hi": 2.95, "lo": 2.63, "ips": 865, "mean": 2.79, "above": false}, "blocklist_de": {"n": 122, "p": 0.0000, "hi": 0.21, "lo": 0.16, "ips": 137, "mean": 0.19, "above": false}}, "h2": [["2026-10-05", 0.303, 0.326, 0, false], ["2026-10-12", 0.131, 0.325, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 42, "phishing_db": 840}, "lo": 0.325, "se": 0.865, "ts": 0.950, "map": 0.686, "obs": 884, "own": 0.572, "comp": {"urlhaus": -3.0819, "threatfox": -0.3433, "phishing_db": 4.6747}, "mass": 699.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 30, "dshield": 44, "crowdsec": 262, "vulncheck": 1041, "blocklist_de": 122}, "lo": 0.131, "se": 0.366, "ts": 0.694, "map": 0.197, "obs": 1499, "own": 0.082, "comp": {"cins": -0.2816, "dshield": -1.5624, "crowdsec": -2.1719, "vulncheck": 8.7243, "blocklist_de": -4.9385}, "mass": 676.1, "listed": false}}, "abq": true, "bot": 0.939, "det": {"shodan": {"c2": 373, "malware": 16, "compromised": 111, "doublepulsar": 3}, "threatfox": {"family:Havoc": 3, "family:PureRAT": 8, "family:Cobalt Strike": 5, "family:Brute Ratel C4": 6, "family:Unknown malware": 8}, "vulncheck": {"c2_server": 865, "botnet_node": 4, "attack_tooling": 173, "other_infrastructure": 6}, "blocklist_de": {"ftp": 2, "ssh": 7, "bots": 91, "imap": 4, "mail": 9, "apache": 28, "bruteforcelogin": 12}}, "oid": "AMAZON-4-ARIN", "org": "Amazon.com, Inc.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.amazon.com"}, "pfx": 17624, "reg": "2000-05-04", "rir": "arin", "s24": 614713, "sib": 4, "tor": 0, "w24": 2363, "drop": 3, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 218438656, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 3.223841}, {"a": 16591, "h": "GOOGLE-FIBER", "n": "GFiber", "t": "Broadband & mobile", "w": 11, "cc": "US", "cf": {"rb": "", "wb": "hi", "rep": 0.68, "waf": 0.53}, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 3}, "n": 5}, "ev": {"dshield": {"n": 6, "p": 0.0018, "hi": 2.07, "lo": 0.57, "ips": 6, "mean": 1.22, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.43, "lo": 0.11, "ips": 5, "mean": 0.25, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.75, "lo": 0.13, "ips": 3, "mean": 0.38, "above": false}}, "h2": [["2026-10-05", 0.104, 0.005, 0, false], ["2026-10-12", 0.165, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.686, "ts": null, "map": 0.061, "obs": 0, "own": 0.271, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.165, "se": 0.458, "ts": 0.429, "map": 0.289, "obs": 14, "own": 0.449, "comp": {"cins": -1.9673, "dshield": 6.7165, "crowdsec": -2.2877, "vulncheck": -0.9365, "blocklist_de": -1.3717}, "mass": 14.2, "listed": false}}, "abq": false, "bot": 0.143, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "GF-ARIN", "org": "Google Fiber Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Open", "web": "https://gfiber.com/"}, "pfx": 341, "reg": "2012-01-11", "rir": "arin", "s24": 8768, "sib": 2, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3600640, "abuse": "abuse@googlefiber.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.120945}, {"a": 16592, "h": "", "n": "ICOMSA S.A. de C.V.", "t": "Other", "w": 0, "cc": "SV", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.151, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-16592-LACNIC", "org": "ICOMSA S.A. de C.V.", "pdb": null, "pfx": 64, "reg": "2000-05-23", "rir": "lacnic", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "abuse.sv@movistar.com.sv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000562369662}, {"a": 16612, "h": "NEIT-AS1", "n": "NEIT Services, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 0.378, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.185, "det": {"shodan": {"doublepulsar": 1}}, "oid": "NSL-113-ARIN", "org": "NEIT Services, LLC", "pdb": null, "pfx": 7, "reg": "2015-01-12", "rir": "arin", "s24": 23, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 16625, "h": "AKAMAI-AS", "n": "Akamai Technologies, Inc.", "t": "CDN & platforms", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.0000, "hi": 0.65, "lo": 0.08, "ips": 2, "mean": 0.31, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.54, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}}, "h2": [["2026-10-05", 0.010, 0.017, 0, false], ["2026-10-12", 0.009, 0.019, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.019, "se": 1.333, "ts": 1.000, "map": 0.095, "obs": 1, "own": 0.981, "comp": {"urlhaus": -0.7964, "threatfox": -0.4374, "phishing_db": 0.5064}, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.009, "se": 0.766, "ts": 1.000, "map": 0.029, "obs": 2, "own": 0.060, "comp": {"cins": -0.5585, "dshield": 6.2049, "crowdsec": -4.2767, "vulncheck": -0.6911, "blocklist_de": -2.8333}, "mass": 2.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "AKAMAI-ARIN", "org": "Akamai Technologies, Inc.", "pdb": null, "pfx": 1816, "reg": "2000-05-30", "rir": "arin", "s24": 16082, "sib": 22, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4116992, "abuse": "abuse@akamai.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 16628, "h": "DEDICATED-FIBER-COMMUNICATIONS", "n": "DedFiberCo", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1874, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "phishing_db": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 2.105, 0.353, 0, false], ["2026-10-12", 0.997, 0.366, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.366, "se": 1.494, "ts": 1.000, "map": 3.352, "obs": 1, "own": 1.510, "comp": {"urlhaus": -0.1426, "threatfox": -0.1674, "phishing_db": 3.1457}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.997, "se": 0.922, "ts": 0.500, "map": 4.134, "obs": 2, "own": 0.845, "comp": {"cins": 4.4985, "dshield": -0.7173, "crowdsec": 1.332, "vulncheck": -0.5585, "blocklist_de": -1.7418}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.773, "det": {"shodan": {"c2": 1}}, "oid": "DFC-52-ARIN", "org": "DedFiberCo", "pdb": null, "pfx": 64, "reg": "2014-01-27", "rir": "arin", "s24": 64, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "noc@dedfiber.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 16629, "h": "", "n": "CTCCORP", "t": "Broadband & mobile", "w": 5, "cc": "CL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0937, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "dshield": {"n": 1, "p": 0.0754, "hi": 3.36, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "urlhaus": {"n": 1, "p": 0.1695, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 4, "p": 0.0512, "hi": 3.01, "lo": 0.65, "ips": 4, "mean": 1.65, "above": false}, "blocklist_de": {"n": 1, "p": 0.0273, "hi": 2.60, "lo": 0.20, "ips": 1, "mean": 1.10, "above": false}}, "h2": [["2026-10-05", 0.436, 0.170, 0, false], ["2026-10-12", 0.778, 0.187, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.187, "se": 1.406, "ts": 1.000, "map": 1.402, "obs": 1, "own": 4.030, "comp": {"urlhaus": 3.1262, "threatfox": -0.394, "phishing_db": -0.768}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.778, "se": 0.539, "ts": 0.571, "map": 1.589, "obs": 7, "own": 2.464, "comp": {"cins": 2.5742, "dshield": 0.5135, "crowdsec": 2.0782, "vulncheck": -0.8629, "blocklist_de": -2.4463}, "mass": 6.8, "listed": false}}, "abq": true, "bot": 0.138, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-16629-LACNIC", "org": "CTC. CORP S.A. (TELEFONICA EMPRESAS)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "https://ww2.movistar.cl/empresas/"}, "pfx": 18, "reg": "2000-05-30", "rir": "lacnic", "s24": 767, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 214784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00753440854086}, {"a": 16637, "h": "MTNNS-AS", "n": "MTN South Africa", "t": "Transit & backbone", "w": 7, "cc": "ZA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.93, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.76, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.18, "lo": 0.01, "ips": 1, "mean": 0.08, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 0.93, "lo": 0.23, "ips": 5, "mean": 0.53, "above": false}}, "h2": [["2026-10-05", 0.026, 0.005, 0, false], ["2026-10-12", 0.103, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.680, "ts": null, "map": 0.058, "obs": 0, "own": 0.370, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.103, "se": 0.517, "ts": 0.625, "map": 0.201, "obs": 8, "own": 0.635, "comp": {"cins": 1.5914, "dshield": -0.4726, "crowdsec": -7.2134, "vulncheck": -0.9143, "blocklist_de": 6.7977}, "mass": 10.9, "listed": false}}, "abq": false, "bot": 0.192, "det": {"blocklist_de": {"ssh": 1, "bots": 4}}, "oid": "ORG-VSA1-AFRINIC", "org": "MTN SA", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.mtn.com"}, "pfx": 212, "reg": "2007-09-20", "rir": "afrinic", "s24": 9654, "sib": 8, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5363200, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00640867658332}, {"a": 16668, "h": "GBPSW-AS", "n": "GBP Software, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.660, "det": {"shodan": {"c2": 1}}, "oid": "GBPSOF-ARIN", "org": "GBP Software, LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.cluetrust.net"}, "pfx": 6, "reg": "2000-05-16", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 16700, "h": "CNSNEXT", "n": "SGGSA", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2438, "hi": 4.77, "lo": 0.62, "ips": 2, "mean": 2.27, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 1.212, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.751, "ts": null, "map": 0.136, "obs": 0, "own": 0.382, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"malware": 2}}, "oid": "SGGSA-ARIN", "org": "CNSNext", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://cnsnext.com/"}, "pfx": 12, "reg": "2000-05-19", "rir": "arin", "s24": 150, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38400, "abuse": "noc@cnsnext.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 16724, "h": "WOW-DATACENTER-NET", "n": "WOW Business - Datacenters", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.221, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.070, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.665, "det": {"shodan": {"malware": 1}}, "oid": "WFL-17-ARIN", "org": "WideOpenWest Finance LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.wowforbusiness.com"}, "pfx": 42, "reg": "2000-06-01", "rir": "arin", "s24": 80, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 16735, "h": "", "n": "Algar", "t": "Broadband & mobile", "w": 22, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 4, "home_connection": 8, "mail_bruteforce": 3}, "n": 9}, "ev": {"cins": {"n": 4, "p": 0.3322, "hi": 4.85, "lo": 1.04, "ips": 4, "mean": 2.65, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "dshield": {"n": 2, "p": 0.0461, "hi": 2.95, "lo": 0.38, "ips": 2, "mean": 1.41, "above": false}, "urlhaus": {"n": 1, "p": 0.1273, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 9, "p": 0.0057, "hi": 2.38, "lo": 0.82, "ips": 9, "mean": 1.52, "above": false}, "vulncheck": {"n": 3, "p": 0.1255, "hi": 3.69, "lo": 0.65, "ips": 3, "mean": 1.90, "above": false}, "phishing_db": {"n": 2, "p": 0.0583, "hi": 3.10, "lo": 0.40, "ips": 2, "mean": 1.48, "above": false}, "blocklist_de": {"n": 5, "p": 0.0766, "hi": 3.23, "lo": 0.80, "ips": 5, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.895, 0.149, 0, false], ["2026-10-12", 1.199, 0.375, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 2}, "lo": 0.375, "se": 1.061, "ts": 0.667, "map": 1.321, "obs": 3, "own": 3.645, "comp": {"urlhaus": 1.6662, "threatfox": -0.4969, "phishing_db": 0.7355}, "mass": 4.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 2, "crowdsec": 9, "vulncheck": 3, "blocklist_de": 5}, "lo": 1.199, "se": 0.425, "ts": 0.391, "map": 1.999, "obs": 23, "own": 3.082, "comp": {"cins": 6.5605, "dshield": -0.7613, "crowdsec": -1.8562, "vulncheck": -0.1964, "blocklist_de": -1.6602}, "mass": 23.3, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"malware": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 2}, "blocklist_de": {"ssh": 1, "bots": 2, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-53006-LACNIC", "org": "ALGAR TELECOM S/A", "pdb": {"t": "NSP", "sc": "South America", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.algar.com.br"}, "pfx": 46, "reg": "2000-08-17", "rir": "lacnic", "s24": 2104, "sib": 2, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 569856, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02708850510261}, {"a": 16814, "h": "", "n": "IPLAN Telecomunicaciones - NSS S.A.", "t": "Broadband & mobile", "w": 4, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0075, "hi": 2.04, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}, "dshield": {"n": 1, "p": 0.0913, "hi": 3.55, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}, "urlhaus": {"n": 1, "p": 0.1749, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.0032, "hi": 1.79, "lo": 0.13, "ips": 1, "mean": 0.76, "above": false}, "phishing_db": {"n": 1, "p": 0.0985, "hi": 3.64, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.142, 1.353, 0, false], ["2026-10-12", 0.148, 0.578, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.578, "se": 1.158, "ts": 0.500, "map": 2.595, "obs": 2, "own": 6.942, "comp": {"urlhaus": 2.5836, "threatfox": -0.4437, "phishing_db": 0.4397}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.148, "se": 0.840, "ts": 0.500, "map": 0.522, "obs": 2, "own": 0.830, "comp": {"cins": -0.4071, "dshield": 3.1698, "crowdsec": 0.6729, "vulncheck": -0.6083, "blocklist_de": -2.0846}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"malware": 1}}, "oid": "@aut-16814-LACNIC", "org": "NSS S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.iplan.com.ar"}, "pfx": 362, "reg": "2000-06-13", "rir": "lacnic", "s24": 620, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 359424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01012628682135}, {"a": 16863, "h": "HOMESC", "n": "Home Telecom", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "blocklist_de": {"n": 1, "p": 0.1197, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.365, 0.010, 0, false], ["2026-10-12", 0.389, 0.011, 0, false]], "sh": false, "uc": 300.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.106, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.389, "se": 0.878, "ts": 0.500, "map": 1.479, "obs": 2, "own": 2.360, "comp": {"cins": -0.3856, "dshield": -0.8017, "crowdsec": 0.8762, "vulncheck": -0.5937, "blocklist_de": 2.6897}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.165, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "HOMETE-ARIN", "org": "Home Telephone Company, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.homesc.com"}, "pfx": 168, "reg": "2010-03-08", "rir": "arin", "s24": 206, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 91904, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0045589529791}, {"a": 16904, "h": "ARVIG-16904", "n": "Arvig", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0162, "hi": 2.34, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 0.050, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.894, "ts": null, "map": 0.154, "obs": 0, "own": 0.843, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.598, "ts": null, "map": 0.081, "obs": 0, "own": 0.184, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"compromised": 1}}, "oid": "ARVG-ARIN", "org": "Arvig Enterprises Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://arvig.com/"}, "pfx": 30, "reg": "2000-06-28", "rir": "arin", "s24": 481, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 123392, "abuse": "abuse@arvig.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00512098181468}, {"a": 17055, "h": "UTAH", "n": "University of Utah", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 1.11, "lo": 0.08, "ips": 1, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.804, "ts": null, "map": 0.116, "obs": 0, "own": 0.222, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.455, "ts": null, "map": 0.042, "obs": 0, "own": 0.030, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.140, "det": {"shodan": {"compromised": 1}}, "oid": "UNIVER-15-ARIN", "org": "University of Utah", "pdb": null, "pfx": 17, "reg": "2000-07-18", "rir": "arin", "s24": 1539, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 403200, "abuse": "abuse@utah.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17069, "h": "", "n": "Cotel Argentina", "t": "Broadband & mobile", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 2257.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.599, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.287, "det": null, "oid": "@aut-17069-LACNIC", "org": "Coop Telefonica Villa Gesell Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.cotel.com.ar"}, "pfx": 68, "reg": "2000-07-19", "rir": "lacnic", "s24": 68, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034278014694}, {"a": 17072, "h": "", "n": "TOTAL PLAY TELECOMUNICACIONES AS17072", "t": "Broadband & mobile", "w": 37, "cc": "MX", "cf": {"rb": "", "wb": "", "rep": 0.64, "waf": 0.40}, "cs": {"c": {"web_exploit": 1, "home_connection": 1}, "n": 1}, "ev": {"cins": {"n": 4, "p": 0.7446, "hi": 8.08, "lo": 1.74, "ips": 4, "mean": 4.41, "above": false}, "dshield": {"n": 19, "p": 1.0000, "hi": 23.84, "lo": 11.33, "ips": 19, "mean": 17.10, "above": true}, "crowdsec": {"n": 1, "p": 0.0265, "hi": 2.59, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "blocklist_de": {"n": 13, "p": 0.9999, "hi": 15.47, "lo": 6.33, "ips": 13, "mean": 10.48, "above": true}}, "h2": [["2026-10-05", 4.352, 0.010, 0, false], ["2026-10-12", 14.596, 0.011, 1, false]], "sh": false, "uc": 83.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.927, "ts": null, "map": 0.165, "obs": 0, "own": 0.970, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 19, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 13}, "lo": 14.596, "se": 0.387, "ts": 0.514, "map": 23.004, "obs": 37, "own": 35.176, "comp": {"cins": 3.3762, "dshield": 9.5834, "crowdsec": -11.4309, "vulncheck": -0.987, "blocklist_de": 3.9876}, "mass": 39.7, "listed": false}}, "abq": true, "bot": 0.119, "det": {"blocklist_de": {"ssh": 1, "bots": 11, "imap": 1, "mail": 1}}, "oid": "@aut-28414-LACNIC", "org": "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.totalplay.com.mx"}, "pfx": 314, "reg": "2000-07-20", "rir": "lacnic", "s24": 314, "sib": 2, "tor": 0, "w24": 36, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 80384, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["dshield", "blocklist_de"], "traffic": 0.238704}, {"a": 17222, "h": "", "n": "Mundivox do Brasil Ltda", "t": "Hosting & VPS", "w": 10, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 6, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1183, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "shodan": {"n": 2, "p": 0.0456, "hi": 2.94, "lo": 0.38, "ips": 2, "mean": 1.40, "above": false}, "crowdsec": {"n": 6, "p": 0.4120, "hi": 4.89, "lo": 1.36, "ips": 6, "mean": 2.89, "above": false}, "blocklist_de": {"n": 3, "p": 0.3071, "hi": 4.93, "lo": 0.87, "ips": 5, "mean": 2.54, "above": false}}, "h2": [["2026-10-05", 1.437, 0.009, 0, false], ["2026-10-12", 1.832, 0.010, 0, false]], "sh": false, "uc": 223.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.886, "ts": null, "map": 0.151, "obs": 0, "own": 0.126, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.832, "se": 0.490, "ts": 0.600, "map": 3.387, "obs": 10, "own": 0.666, "comp": {"cins": 1.7487, "dshield": -2.263, "crowdsec": 2.5613, "vulncheck": -0.9077, "blocklist_de": 1.4744}, "mass": 10.0, "listed": false}}, "abq": false, "bot": 0.173, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 5}}, "oid": "@aut-17222-LACNIC", "org": "MUNDIVOX DO BRASIL LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.mundivox.com/homepage"}, "pfx": 78, "reg": "2000-08-17", "rir": "lacnic", "s24": 534, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 282880, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01096397980965}, {"a": 17252, "h": "AS2-COLOAM", "n": "Colocation America AS17252", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5801, "hi": 7.05, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}, "dshield": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1497, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.248, 0.011, 0, false], ["2026-10-12", 1.181, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 0.250, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.181, "se": 0.927, "ts": 0.500, "map": 4.944, "obs": 2, "own": 1.009, "comp": {"cins": -0.3002, "dshield": 3.6461, "crowdsec": 1.7193, "vulncheck": -0.5256, "blocklist_de": -1.5477}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.611, "det": {"shodan": {"compromised": 3}}, "oid": "CAC-89-ARIN", "org": "Colocation America Corporation", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.colocationamerica.com"}, "pfx": 12, "reg": "2015-09-28", "rir": "arin", "s24": 47, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29952, "abuse": "Abuse@colocationamerica.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17306, "h": "RISE-BROADBAND", "n": "Rise Broadband", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.95, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}}, "h2": [["2026-10-05", 0.019, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.789, "ts": null, "map": 0.109, "obs": 0, "own": 0.510, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.432, "ts": null, "map": 0.037, "obs": 0, "own": 0.072, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.162, "det": {"shodan": {"compromised": 1}}, "oid": "JABWI-ARIN", "org": "JAB Wireless, INC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.riseinternet.com/"}, "pfx": 185, "reg": "2000-08-17", "rir": "arin", "s24": 1878, "sib": 34, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 511744, "abuse": "abuse@skybeam.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00517165401316}, {"a": 17356, "h": "VERMONT-TELE", "n": "Vermont Telephone", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.944, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.810, "ts": null, "map": 0.158, "obs": 0, "own": 1.006, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.144, "det": null, "oid": "VRTC-ARIN", "org": "Vermont Telephone Company, Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.vermontel.com"}, "pfx": 4, "reg": "2000-08-23", "rir": "arin", "s24": 96, "sib": 0, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24576, "abuse": "abuse@vermontel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17378, "h": "AS17378", "n": "TierPoint LLC", "t": "Transit & backbone", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.80, "lo": 0.10, "ips": 2, "mean": 0.38, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.50, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "vulncheck": {"n": 1, "p": 0.0028, "hi": 1.76, "lo": 0.13, "ips": 1, "mean": 0.74, "above": false}, "phishing_db": {"n": 3, "p": 0.0511, "hi": 3.01, "lo": 0.53, "ips": 3, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.015, 0.238, 0, false], ["2026-10-12", 0.029, 0.182, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.182, "se": 1.064, "ts": 1.000, "map": 0.601, "obs": 3, "own": 2.541, "comp": {"urlhaus": -0.9487, "threatfox": -0.4635, "phishing_db": 2.5291}, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.029, "se": 0.816, "ts": 0.500, "map": 0.097, "obs": 2, "own": 0.322, "comp": {"cins": -0.3963, "dshield": -0.8205, "crowdsec": 0.7747, "vulncheck": 1.5382, "blocklist_de": -2.0305}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.634, "det": {"shodan": {"c2": 2}, "vulncheck": {"c2_server": 1}}, "oid": "TL-801-ARIN", "org": "TierPoint, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.tierpoint.com"}, "pfx": 390, "reg": "2000-08-24", "rir": "arin", "s24": 3220, "sib": 21, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1138432, "abuse": "abuse@tierpoint.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17400, "h": "MSTelcom", "n": "MSTELCOM, SARL", "t": "Broadband & mobile", "w": 3, "cc": "AO", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5241, "hi": 6.54, "lo": 1.15, "ips": 3, "mean": 3.37, "above": false}}, "h2": [["2026-10-05", 1.731, 0.011, 0, false], ["2026-10-12", 1.836, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.188, "obs": 0, "own": 1.479, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.836, "se": 0.755, "ts": 1.000, "map": 5.522, "obs": 3, "own": 8.648, "comp": {"cins": -0.4781, "dshield": -0.9595, "crowdsec": 7.6285, "vulncheck": -0.6511, "blocklist_de": -2.4375}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.401, "det": null, "oid": "ORG-PA11-AFRINIC", "org": "MSTelcom-Mercury Servicos de Telecomunicacoes, S.A.R.L", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "5-10Gbps", "pol": "Selective", "web": "http://www.mstelcom.co.ao"}, "pfx": 68, "reg": "2000-08-28", "rir": "afrinic", "s24": 70, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018061383368}, {"a": 17408, "h": "ABOVE-AS-AP", "n": "Chief", "t": "Broadband & mobile", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.959, "ts": null, "map": 0.174, "obs": 0, "own": 1.112, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.712, "ts": null, "map": 0.121, "obs": 0, "own": 0.320, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.800, "det": null, "oid": "ORG-ACTC1-AP-APNIC", "org": "AboveNet Communications Taiwan Co., Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.chief.com.tw"}, "pfx": 106, "reg": "2001-01-12", "rir": "apnic", "s24": 202, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 68096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008415085118}, {"a": 17411, "h": "IO-GLOBAL-AP", "n": "IO-GLOBAL-AP", "t": "Broadband & mobile", "w": 1, "cc": "AF", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-12", 0.236, 0.012, 0, false]], "sh": false, "uc": 676.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.236, "se": 1.252, "ts": 1.000, "map": 1.835, "obs": 1, "own": 3.214, "comp": {"cins": -0.1379, "dshield": -0.3174, "crowdsec": 3.5011, "vulncheck": -0.3267, "blocklist_de": -0.7184}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.166, "det": null, "oid": "ORG-ISPL13-AP-APNIC", "org": "Io-Global Services Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.io-global.com/"}, "pfx": 56, "reg": "2005-06-17", "rir": "apnic", "s24": 56, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "abuse@io-global.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003413727717}, {"a": 17421, "h": "EMOME-NET", "n": "Emome (Chunghwa Telecom)", "t": "Broadband & mobile", "w": 113, "cc": "TW", "cf": {"rb": "hi", "wb": "hi", "rep": 1.22, "waf": 1.07}, "cs": {"c": {"web_exploit": 11, "proxy_or_vpn": 7, "ssh_bruteforce": 93, "web_bruteforce": 66, "home_connection": 101, "mail_bruteforce": 108, "router_or_botnet": 1}, "n": 108}, "ev": {"crowdsec": {"n": 42, "p": 0.0467, "hi": 2.99, "lo": 1.80, "ips": 108, "mean": 2.36, "above": false}, "blocklist_de": {"n": 39, "p": 0.9985, "hi": 6.42, "lo": 3.81, "ips": 90, "mean": 5.04, "above": true}}, "h2": [["2026-10-05", 1.556, 0.006, 0, false], ["2026-10-12", 1.683, 0.006, 0, false]], "sh": false, "uc": 584.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.704, "ts": null, "map": 0.069, "obs": 0, "own": 0.308, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 42, "vulncheck": 0, "blocklist_de": 39}, "lo": 1.683, "se": 0.372, "ts": 0.519, "map": 2.585, "obs": 81, "own": 3.974, "comp": {"cins": -3.7474, "dshield": -3.374, "crowdsec": -0.2897, "vulncheck": -1.0036, "blocklist_de": 10.7579}, "mass": 92.5, "listed": false}}, "abq": false, "bot": 0.085, "det": {"blocklist_de": {"ssh": 1, "imap": 41, "mail": 89}}, "oid": null, "org": null, "pdb": null, "pfx": 191, "reg": "2000-10-16", "rir": "apnic", "s24": 6468, "sib": 0, "tor": 0, "w24": 45, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1689600, "abuse": "abuse@hinet.net", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.059841}, {"a": 17426, "h": "PRIMENET-AS-AP", "n": "Primenet Global Ltd", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "phishing_db": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.677, 0.328, 0, false], ["2026-10-12", 0.009, 0.342, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.342, "se": 1.482, "ts": 1.000, "map": 3.035, "obs": 1, "own": 8.836, "comp": {"urlhaus": -0.1528, "threatfox": -0.1762, "phishing_db": 3.0653}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.169, "obs": 0, "own": 0.564, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.240, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.primenet.in"}, "pfx": 76, "reg": "2000-10-18", "rir": "apnic", "s24": 76, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00110642382762}, {"a": 17439, "h": "NCINSPL-IN", "n": "NTT Communications India Network Services Private Limited", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.2181, "hi": 4.19, "lo": 0.90, "ips": 4, "mean": 2.29, "above": false}, "crowdsec": {"n": 1, "p": 0.0051, "hi": 1.92, "lo": 0.14, "ips": 1, "mean": 0.81, "above": false}}, "h2": [["2026-10-05", 0.314, 0.009, 0, false], ["2026-10-12", 0.055, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.883, "ts": null, "map": 0.149, "obs": 0, "own": 0.803, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.055, "se": 1.083, "ts": 1.000, "map": 0.306, "obs": 1, "own": 0.510, "comp": {"cins": -0.2233, "dshield": -0.4956, "crowdsec": 2.5324, "vulncheck": -0.4461, "blocklist_de": -1.1568}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.890, "det": {"shodan": {"malware": 1, "compromised": 3}}, "oid": "ORG-NA158-AP-APNIC", "org": "NTTCINS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://services.global.ntt/en-us/"}, "pfx": 492, "reg": "2000-10-30", "rir": "apnic", "s24": 554, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 270592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00088570771689}, {"a": 17451, "h": "BIZNET-AS-AP", "n": "Biznet Networks", "t": "Transit & backbone", "w": 38, "cc": "ID", "cf": {"rb": "", "wb": "hi", "rep": 2.25, "waf": 1.06}, "cs": {"c": {"http_flood": 12, "web_exploit": 11, "bad_crawling": 2, "proxy_or_vpn": 6, "ssh_bruteforce": 6, "web_bruteforce": 13, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 6, "cve:CVE-2017-9841": 2, "cve:CVE-2022-46604": 1, "cve:CVE-2024-28000": 3, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 3}, "n": 18}, "ev": {"cins": {"n": 2, "p": 0.3056, "hi": 5.27, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}, "shodan": {"n": 86, "p": 1.0000, "hi": 51.84, "lo": 36.40, "ips": 86, "mean": 43.83, "above": true}, "dshield": {"n": 8, "p": 0.9853, "hi": 11.56, "lo": 3.76, "ips": 8, "mean": 7.21, "above": true}, "urlhaus": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 2, "mean": 1.92, "above": false}, "crowdsec": {"n": 17, "p": 0.9998, "hi": 11.46, "lo": 5.23, "ips": 18, "mean": 8.09, "above": true}, "phishing_db": {"n": 1, "p": 0.1184, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "blocklist_de": {"n": 10, "p": 0.9935, "hi": 11.35, "lo": 4.13, "ips": 10, "mean": 7.36, "above": true}}, "h2": [["2026-10-05", 6.381, 0.670, 0, false], ["2026-10-12", 8.889, 0.712, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.712, "se": 1.161, "ts": 0.500, "map": 3.227, "obs": 2, "own": 12.151, "comp": {"urlhaus": 2.6983, "threatfox": -0.4347, "phishing_db": 0.5343}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 8, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 10}, "lo": 8.889, "se": 0.389, "ts": 0.459, "map": 14.043, "obs": 37, "own": 43.690, "comp": {"cins": 0.4993, "dshield": 2.8015, "crowdsec": 0.2607, "vulncheck": -0.9837, "blocklist_de": 1.458}, "mass": 35.7, "listed": false}}, "abq": false, "bot": 0.140, "det": {"shodan": {"compromised": 86}, "blocklist_de": {"ssh": 7, "bots": 3}}, "oid": "@aut-38498-APNIC", "org": "BIZNET ISP", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.biznetnetworks.com"}, "pfx": 432, "reg": "2000-11-07", "rir": "apnic", "s24": 461, "sib": 1, "tor": 0, "w24": 33, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 121856, "abuse": "abuse@biz.net.id", "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.060215}, {"a": 17465, "h": "ASIANET", "n": "Asianet Satellite Communications Ltd", "t": "Broadband & mobile", "w": 13, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 2}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0440, "hi": 2.91, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "dshield": {"n": 1, "p": 0.1381, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "urlhaus": {"n": 1, "p": 0.1872, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 4, "p": 0.3797, "hi": 5.12, "lo": 1.10, "ips": 5, "mean": 2.80, "above": false}, "vulncheck": {"n": 2, "p": 0.3272, "hi": 5.45, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}, "blocklist_de": {"n": 6, "p": 0.8943, "hi": 8.99, "lo": 2.49, "ips": 6, "mean": 5.31, "above": true}}, "h2": [["2026-10-05", 3.595, 0.267, 0, false], ["2026-10-12", 4.070, 0.290, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.290, "se": 1.464, "ts": 1.000, "map": 2.481, "obs": 1, "own": 7.168, "comp": {"urlhaus": 3.5297, "threatfox": -0.3407, "phishing_db": -0.6541}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 6}, "lo": 4.070, "se": 0.468, "ts": 0.462, "map": 7.293, "obs": 13, "own": 11.225, "comp": {"cins": -1.7917, "dshield": -0.6849, "crowdsec": -2.6087, "vulncheck": 0.0325, "blocklist_de": 8.4335}, "mass": 12.0, "listed": false}}, "abq": false, "bot": 0.140, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-ASCP2-AP-APNIC", "org": "Asianet Satellite Communications Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.asianetbroadband.in"}, "pfx": 317, "reg": "2000-11-16", "rir": "apnic", "s24": 296, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 135680, "abuse": "abuse-reports@asianet.co.in", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01200162667878}, {"a": 17466, "h": "GENPACT-AS-AP", "n": "Genpact India Private Limited", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 0.602, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.856, "ts": null, "map": 0.175, "obs": 0, "own": 0.221, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.302, "det": null, "oid": "ORG-GI5-AP-APNIC", "org": "Genpact India Private Limited", "pdb": null, "pfx": 25, "reg": "2005-01-31", "rir": "apnic", "s24": 67, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22272, "abuse": "abuse@genpact.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17469, "h": "ACCESSTEL-AS-AP", "n": "Access Telecom", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 2, "p": 0.2798, "hi": 5.06, "lo": 0.66, "ips": 2, "mean": 2.41, "above": false}, "blocklist_de": {"n": 1, "p": 0.1591, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-12", 2.648, 0.012, 0, false]], "sh": false, "uc": 293, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 1.382, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.648, "se": 0.668, "ts": 0.500, "map": 6.843, "obs": 4, "own": 10.655, "comp": {"cins": 3.6499, "dshield": -1.3378, "crowdsec": 1.2398, "vulncheck": -0.756, "blocklist_de": 0.5211}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.168, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-ATL6-AP-APNIC", "org": "Access Telecom (BD) Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.accesstel.net"}, "pfx": 140, "reg": "2000-11-17", "rir": "apnic", "s24": 92, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 69376, "abuse": "abuse.report@accesstel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081489818818}, {"a": 17480, "h": "CANL", "n": "Can'l", "t": "Broadband & mobile", "w": 0, "cc": "NC", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1242, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.810, "ts": null, "map": 0.158, "obs": 0, "own": 0.495, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CA13-AP-APNIC", "org": "CAN'L", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.canl.nc"}, "pfx": 8, "reg": "2000-11-21", "rir": "apnic", "s24": 96, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24576, "abuse": "abuse@canl.nc", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004419837796}, {"a": 17483, "h": "CITYON-AS-AP", "n": "City Online services Limited", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 3, "router_or_botnet": 3}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7620, "hi": 8.31, "lo": 1.79, "ips": 4, "mean": 4.54, "above": false}, "blocklist_de": {"n": 1, "p": 0.1816, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 5.095, 0.011, 0, false], ["2026-10-12", 7.654, 0.012, 0, false]], "sh": false, "uc": 4800.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 1.693, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.654, "se": 0.614, "ts": 0.800, "map": 17.996, "obs": 5, "own": 27.824, "comp": {"cins": -0.7816, "dshield": -1.4079, "crowdsec": 7.0432, "vulncheck": -0.7717, "blocklist_de": 0.2018}, "mass": 3.8, "listed": false}}, "abq": true, "bot": 0.243, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-17483-APNIC", "org": "CityOnline Services Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.cityonlines.com"}, "pfx": 38, "reg": "2000-11-24", "rir": "apnic", "s24": 38, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00066761187825}, {"a": 17488, "h": "HATHWAY-NET-AP", "n": "Hathway IP Over Cable Internet", "t": "Broadband & mobile", "w": 24, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 3, "web_bruteforce": 7, "home_connection": 6, "mail_bruteforce": 5, "router_or_botnet": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0032, "hi": 1.79, "lo": 0.13, "ips": 1, "mean": 0.76, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.83, "lo": 0.15, "ips": 3, "mean": 0.43, "above": false}, "dshield": {"n": 6, "p": 0.1794, "hi": 3.81, "lo": 1.06, "ips": 6, "mean": 2.25, "above": false}, "urlhaus": {"n": 2, "p": 0.2262, "hi": 4.63, "lo": 0.60, "ips": 2, "mean": 2.20, "above": false}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 1.27, "lo": 0.41, "ips": 9, "mean": 0.79, "above": false}, "vulncheck": {"n": 2, "p": 0.0056, "hi": 2.07, "lo": 0.27, "ips": 2, "mean": 0.98, "above": false}, "blocklist_de": {"n": 6, "p": 0.0054, "hi": 2.29, "lo": 0.63, "ips": 6, "mean": 1.35, "above": false}}, "h2": [["2026-10-05", 0.557, 0.459, 0, false], ["2026-10-12", 0.618, 0.263, 0, false]], "sh": false, "uc": 68.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.263, "se": 1.121, "ts": 1.000, "map": 1.076, "obs": 2, "own": 2.910, "comp": {"urlhaus": 3.2911, "threatfox": -0.5262, "phishing_db": -1.0651}, "mass": 6.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 8, "vulncheck": 2, "blocklist_de": 6}, "lo": 0.618, "se": 0.423, "ts": 0.348, "map": 1.032, "obs": 23, "own": 1.593, "comp": {"cins": -0.1528, "dshield": 3.6969, "crowdsec": -2.4945, "vulncheck": -0.4293, "blocklist_de": 0.8047}, "mass": 22.4, "listed": false}}, "abq": false, "bot": 0.101, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 2, "bots": 1, "imap": 3, "mail": 3}}, "oid": "ORG-HCAD1-AP-APNIC", "org": "HATHWAY CABLE AND DATACOM LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.hathway.net"}, "pfx": 1246, "reg": "2000-11-28", "rir": "apnic", "s24": 3903, "sib": 0, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1007872, "abuse": "abuse@hathway.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0350475329655}, {"a": 17494, "h": "BTTB-AS-AP", "n": "Bangladesh Telecommunications", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1769, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "shodan": {"n": 1, "p": 0.1078, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "crowdsec": {"n": 2, "p": 0.2398, "hi": 4.74, "lo": 0.62, "ips": 2, "mean": 2.26, "above": false}}, "h2": [["2026-10-05", 1.139, 0.010, 0, false], ["2026-10-12", 1.204, 0.011, 0, false]], "sh": false, "uc": 384, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.181, "obs": 0, "own": 1.278, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.204, "se": 0.748, "ts": 0.667, "map": 3.595, "obs": 3, "own": 5.645, "comp": {"cins": 4.0562, "dshield": -1.0629, "crowdsec": 3.118, "vulncheck": -0.6837, "blocklist_de": -2.7545}, "mass": 2.5, "listed": false}}, "abq": true, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BTTB1-AP-APNIC", "org": "Bangladesh Telegraph & Telephone Board", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.btcl.gov.bd/en"}, "pfx": 36, "reg": "2000-12-07", "rir": "apnic", "s24": 124, "sib": 7, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 81920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17497, "h": "LGHL-AS-AP", "n": "Liasail", "t": "Transit & backbone", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0621, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "crowdsec": {"n": 1, "p": 0.0461, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "blocklist_de": {"n": 1, "p": 0.1124, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.336, 0.010, 0, false], ["2026-10-12", 0.354, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.949, "ts": null, "map": 0.171, "obs": 0, "own": 1.519, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.354, "se": 0.874, "ts": 0.500, "map": 1.338, "obs": 2, "own": 4.338, "comp": {"cins": -0.3907, "dshield": -0.8108, "crowdsec": 0.8272, "vulncheck": -0.5973, "blocklist_de": 2.6566}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.813, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-LGHL1-AP-APNIC", "org": "liasail global hongkong limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.liasail.net"}, "pfx": 67, "reg": "2018-10-23", "rir": "apnic", "s24": 231, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 62208, "abuse": "network@liasail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00947981875924}, {"a": 17501, "h": "WLINK-NEPAL-AS-AP", "n": "Worldlink Communications", "t": "Broadband & mobile", "w": 9, "cc": "NP", "cf": {"rb": "lo", "wb": null, "rep": 2.00, "waf": null}, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 3, "web_bruteforce": 4, "home_connection": 2, "router_or_botnet": 3, "cve:CVE-2024-28000": 2}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0455, "hi": 2.93, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "dshield": {"n": 2, "p": 0.3265, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "crowdsec": {"n": 4, "p": 0.3875, "hi": 5.17, "lo": 1.11, "ips": 4, "mean": 2.82, "above": false}, "blocklist_de": {"n": 3, "p": 0.4468, "hi": 5.92, "lo": 1.04, "ips": 3, "mean": 3.05, "above": false}}, "h2": [["2026-10-05", 4.275, 0.010, 0, false], ["2026-10-12", 2.714, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.995, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.714, "se": 0.502, "ts": 0.444, "map": 5.217, "obs": 9, "own": 8.045, "comp": {"cins": -1.4268, "dshield": 2.1986, "crowdsec": 0.2373, "vulncheck": -0.8891, "blocklist_de": 2.9255}, "mass": 8.4, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 3}}, "oid": "ORG-WC2-AP-APNIC", "org": "WorldLink Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Selective", "web": "http://www.worldlink.com.np"}, "pfx": 54, "reg": "2000-12-12", "rir": "apnic", "s24": 290, "sib": 4, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 120832, "abuse": "abuse@worldlink.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03464581481256}, {"a": 17506, "h": "usen", "n": "ARTERIA Networks Corporation (UCOM)", "t": "Transit & backbone", "w": 3, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 1.27, "waf": 1.11}, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.14, "lo": 0.02, "ips": 2, "mean": 0.07, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.38, "lo": 0.03, "ips": 1, "mean": 0.16, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.27, "lo": 0.03, "ips": 2, "mean": 0.13, "above": false}}, "h2": [["2026-10-05", 0.008, 0.004, 0, false], ["2026-10-12", 0.014, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.642, "ts": null, "map": 0.041, "obs": 0, "own": 0.266, "comp": null, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.014, "se": 0.679, "ts": 0.667, "map": 0.035, "obs": 3, "own": 0.114, "comp": {"cins": -0.8382, "dshield": 1.5908, "crowdsec": -5.8035, "vulncheck": -0.7872, "blocklist_de": 3.8915}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.088, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-17699-APNIC", "org": "UCOM Corp.", "pdb": {"t": "NSP", "sc": null, "tr": null, "pol": "No", "web": "http://www.arteria-net.com/en/"}, "pfx": 40, "reg": "2000-12-12", "rir": "apnic", "s24": 21024, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5508096, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.05747}, {"a": 17511, "h": "OPTAGE", "n": "OPTAGE", "t": "Broadband & mobile", "w": 2, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.74, "waf": 0.65}, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.15, "lo": 0.01, "ips": 1, "mean": 0.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.35, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}}, "h2": [["2026-10-05", 0.043, 0.005, 0, false], ["2026-10-12", 0.013, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.670, "ts": null, "map": 0.053, "obs": 0, "own": 0.240, "comp": null, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.013, "se": 0.775, "ts": 0.500, "map": 0.041, "obs": 2, "own": 0.066, "comp": {"cins": -0.5803, "dshield": -1.1215, "crowdsec": -0.845, "vulncheck": -0.7008, "blocklist_de": 1.4511}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.064, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-9358-JPNIC", "org": "OPTAGE Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://optage.co.jp/en/"}, "pfx": 66, "reg": "2000-12-12", "rir": "apnic", "s24": 11697, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2998528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.099085}, {"a": 17538, "h": "CIRCLECOM-AS-ID-AP", "n": "Circlecom Nusantara Indonesia", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1347.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.193, "det": null, "oid": "@aut-17538-APNIC", "org": "PT. Circlecom Nusantara Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.circleone.net.id"}, "pfx": 20, "reg": "2000-12-14", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001040859094}, {"a": 17547, "h": "M1NET-SG-AP", "n": "M1 Net Ltd", "t": "Broadband & mobile", "w": 2, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.0175, "hi": 2.51, "lo": 0.44, "ips": 3, "mean": 1.29, "above": false}, "urlhaus": {"n": 1, "p": 0.1621, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.0153, "hi": 2.32, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}}, "h2": [["2026-10-05", 0.166, 0.151, 0, false], ["2026-10-12", 0.108, 0.166, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.166, "se": 1.393, "ts": 1.000, "map": 1.205, "obs": 1, "own": 3.473, "comp": {"urlhaus": 3.0132, "threatfox": -0.4061, "phishing_db": -0.7941}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.108, "se": 0.831, "ts": 0.500, "map": 0.376, "obs": 2, "own": 0.599, "comp": {"cins": -0.4575, "dshield": -0.9253, "crowdsec": 0.2097, "vulncheck": -0.6395, "blocklist_de": 2.2287}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.180, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MNL2-AP-APNIC", "org": "M1 NET LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.m1.com.sg"}, "pfx": 46, "reg": "2000-12-29", "rir": "apnic", "s24": 978, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 394496, "abuse": "abuse@m1net.sg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00455256089002}, {"a": 17552, "h": "TRUEONLINE-AS-AP", "n": "True Internet Co.", "t": "Other", "w": 14, "cc": "TH", "cf": {"rb": "", "wb": "", "rep": 2.39, "waf": 0.50}, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 2, "p": 0.0030, "hi": 1.91, "lo": 0.25, "ips": 2, "mean": 0.91, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.72, "lo": 0.16, "ips": 4, "mean": 0.40, "above": false}, "dshield": {"n": 6, "p": 0.0509, "hi": 3.01, "lo": 0.83, "ips": 6, "mean": 1.78, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.31, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "vulncheck": {"n": 2, "p": 0.0008, "hi": 1.63, "lo": 0.21, "ips": 2, "mean": 0.78, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 1.13, "lo": 0.20, "ips": 3, "mean": 0.59, "above": false}}, "h2": [["2026-10-05", 0.135, 0.006, 0, false], ["2026-10-12", 0.264, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.715, "ts": null, "map": 0.074, "obs": 0, "own": 0.133, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 3}, "lo": 0.264, "se": 0.466, "ts": 0.429, "map": 0.469, "obs": 14, "own": 0.267, "comp": {"cins": 3.8679, "dshield": 6.6644, "crowdsec": -8.3448, "vulncheck": -0.1174, "blocklist_de": -1.4326}, "mass": 14.3, "listed": false}}, "abq": false, "bot": 0.118, "det": {"shodan": {"compromised": 4}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 161, "reg": "2001-01-05", "rir": "apnic", "s24": 5442, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1666560, "abuse": "abuse@trueinternet.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.169659}, {"a": 17557, "h": "PKTELECOM-AS-PK", "n": "PTCL", "t": "Broadband & mobile", "w": 116, "cc": "PK", "cf": {"rb": "", "wb": "", "rep": 1.81, "waf": 1.00}, "cs": {"c": {"http_flood": 17, "web_exploit": 19, "bad_crawling": 4, "proxy_or_vpn": 15, "first_seen_30d": 1, "ssh_bruteforce": 10, "web_bruteforce": 25, "home_connection": 4, "mail_bruteforce": 9, "router_or_botnet": 12, "cve:CVE-2024-12847": 5, "cve:CVE-2024-28000": 6, "cve:CVE-2025-55182": 1}, "n": 30}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 1.28, "lo": 0.28, "ips": 4, "mean": 0.70, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.24, "lo": 0.04, "ips": 3, "mean": 0.12, "above": false}, "dshield": {"n": 16, "p": 0.0199, "hi": 2.75, "lo": 1.23, "ips": 16, "mean": 1.92, "above": false}, "crowdsec": {"n": 30, "p": 0.0000, "hi": 1.03, "lo": 0.57, "ips": 30, "mean": 0.78, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.59, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}, "blocklist_de": {"n": 67, "p": 0.9922, "hi": 4.96, "lo": 3.32, "ips": 70, "mean": 4.11, "above": true}}, "h2": [["2026-10-05", 0.793, 0.018, 0, false], ["2026-10-12", 1.237, 0.020, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.020, "se": 1.332, "ts": 1.000, "map": 0.101, "obs": 1, "own": 0.381, "comp": {"urlhaus": -0.7765, "threatfox": -0.4335, "phishing_db": 0.5473}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 16, "crowdsec": 30, "vulncheck": 0, "blocklist_de": 67}, "lo": 1.237, "se": 0.367, "ts": 0.573, "map": 1.882, "obs": 117, "own": 2.896, "comp": {"cins": -1.7865, "dshield": -0.3299, "crowdsec": -7.616, "vulncheck": -1.0086, "blocklist_de": 12.7667}, "mass": 151.3, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"c2": 1, "compromised": 2}, "blocklist_de": {"ssh": 8, "bots": 45, "imap": 8, "mail": 9, "apache": 8, "bruteforcelogin": 8}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.ptcl.com.pk/"}, "pfx": 1296, "reg": "2001-01-05", "rir": "apnic", "s24": 14521, "sib": 0, "tor": 0, "w24": 111, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7917568, "abuse": "abuse.irt@ptcl.net", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.094002}, {"a": 17561, "h": "LCS-AS-AP", "n": "LARUS Limited", "t": "Other", "w": 5, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0001, "hi": 1.19, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}, "phishing_db": {"n": 3, "p": 0.2574, "hi": 4.60, "lo": 0.81, "ips": 5, "mean": 2.37, "above": false}}, "h2": [["2026-10-05", 0.025, 0.293, 0, false], ["2026-10-12", 0.004, 0.349, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.349, "se": 1.042, "ts": 1.000, "map": 1.156, "obs": 3, "own": 1.306, "comp": {"urlhaus": -0.8346, "threatfox": -0.4445, "phishing_db": 3.0503}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.466, "ts": null, "map": 0.044, "obs": 0, "own": 0.033, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.619, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LCSL2-AP-APNIC", "org": "Larus Limited", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "https://larus.net/"}, "pfx": 1390, "reg": "2024-06-06", "rir": "apnic", "s24": 1402, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 358912, "abuse": "abuse@larus.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000010662858}, {"a": 17573, "h": "SKB-MINS-AS-KR", "n": "SK Broadband Co Ltd", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0449, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.1112, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.331, 0.010, 0, false], ["2026-10-12", 0.349, 0.011, 0, false]], "sh": false, "uc": 237.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.063, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.349, "se": 0.873, "ts": 0.500, "map": 1.318, "obs": 2, "own": 2.103, "comp": {"cins": -0.3915, "dshield": -0.8121, "crowdsec": 0.8198, "vulncheck": -0.5978, "blocklist_de": 2.6516}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"mail": 1}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": null, "pfx": 13, "reg": "2001-01-17", "rir": "apnic", "s24": 235, "sib": 23, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 60160, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003118891468}, {"a": 17575, "h": "CAUNET-AS-KR", "n": "Chung-Ang University", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.279, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17575-APNIC", "org": "Chung-Ang University", "pdb": null, "pfx": 5, "reg": "2001-01-17", "rir": "apnic", "s24": 256, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 77824, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002273673976}, {"a": 17577, "h": "GIGAPASS-AS-KR", "n": "GIGAPASS", "t": "Other", "w": 2, "cc": "KR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1406, "hi": 4.12, "lo": 0.31, "ips": 2, "mean": 1.74, "above": false}}, "h2": [["2026-10-12", 0.079, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.916, "ts": null, "map": 0.161, "obs": 0, "own": 0.374, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.079, "se": 1.120, "ts": 1.000, "map": 0.476, "obs": 1, "own": 0.294, "comp": {"cins": 4.7442, "dshield": -0.5, "crowdsec": -1.9757, "vulncheck": -0.4487, "blocklist_de": -1.168}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.lghellovision.net"}, "pfx": 74, "reg": "2001-01-17", "rir": "apnic", "s24": 360, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 108544, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005584483408}, {"a": 17589, "h": "GABIA-AS-KR", "n": "GABIA Inc.", "t": "Other", "w": 1, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.5690, "hi": 6.38, "lo": 1.37, "ips": 4, "mean": 3.48, "above": false}, "vulncheck": {"n": 1, "p": 0.1561, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.007, 0.203, 0, false], ["2026-10-12", 0.084, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.958, "ts": null, "map": 0.174, "obs": 0, "own": 0.447, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.084, "se": 1.145, "ts": 1.000, "map": 0.513, "obs": 1, "own": 0.330, "comp": {"cins": -0.1405, "dshield": -0.3229, "crowdsec": -1.2778, "vulncheck": 3.1995, "blocklist_de": -0.7315}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.758, "det": {"shodan": {"c2": 1, "compromised": 3}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-17589-APNIC", "org": "GABIA Inc.", "pdb": null, "pfx": 144, "reg": "2001-01-17", "rir": "apnic", "s24": 204, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52736, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000528747464}, {"a": 17598, "h": "YBNTV-AS-KR", "n": "YBNTV", "t": "Other", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1001, "hi": 3.55, "lo": 0.46, "ips": 2, "mean": 1.69, "above": false}, "blocklist_de": {"n": 1, "p": 0.0964, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.536, 0.010, 0, false], ["2026-10-12", 0.565, 0.011, 0, false]], "sh": false, "uc": 221.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.401, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.565, "se": 0.732, "ts": 0.667, "map": 1.635, "obs": 3, "own": 0.939, "comp": {"cins": -0.5742, "dshield": -1.1122, "crowdsec": 2.7805, "vulncheck": -0.6981, "blocklist_de": 1.4892}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.lghellovision.net"}, "pfx": 209, "reg": "2001-01-17", "rir": "apnic", "s24": 291, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 74496, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005175048438}, {"a": 17612, "h": "RINNAI-AS-KR", "n": "Rinnai Korea", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.975, "ts": null, "map": 0.178, "obs": 0, "own": 0.480, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.742, "ts": null, "map": 0.133, "obs": 0, "own": 0.135, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.263, "det": null, "oid": "@aut-17612-APNIC", "org": "Rinnai Korea", "pdb": null, "pfx": 40, "reg": "2001-01-17", "rir": "apnic", "s24": 160, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40960, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17621, "h": "CNCGROUP-SH", "n": "China Unicom Shanghai Network", "t": "Broadband & mobile", "w": 34, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 3, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 11, "web_bruteforce": 9, "mail_bruteforce": 6, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 6}, "n": 18}, "ev": {"cins": {"n": 5, "p": 0.3019, "hi": 4.51, "lo": 1.12, "ips": 5, "mean": 2.57, "above": false}, "shodan": {"n": 15, "p": 0.0483, "hi": 2.99, "lo": 1.30, "ips": 15, "mean": 2.07, "above": false}, "dshield": {"n": 5, "p": 0.1825, "hi": 3.90, "lo": 0.97, "ips": 6, "mean": 2.22, "above": false}, "crowdsec": {"n": 14, "p": 0.0026, "hi": 2.34, "lo": 0.99, "ips": 18, "mean": 1.60, "above": false}, "threatfox": {"n": 1, "p": 0.0637, "hi": 3.20, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "blocklist_de": {"n": 11, "p": 0.3408, "hi": 4.16, "lo": 1.58, "ips": 14, "mean": 2.74, "above": false}}, "h2": [["2026-10-05", 1.142, 0.045, 0, false], ["2026-10-12", 1.474, 0.047, 0, false]], "sh": false, "uc": 75.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.047, "se": 1.335, "ts": 1.000, "map": 0.263, "obs": 1, "own": 0.892, "comp": {"urlhaus": -0.489, "threatfox": 1.472, "phishing_db": -0.6911}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 5, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 11}, "lo": 1.474, "se": 0.397, "ts": 0.400, "map": 2.315, "obs": 35, "own": 3.562, "comp": {"cins": 4.9329, "dshield": 0.186, "crowdsec": -3.0554, "vulncheck": -0.9872, "blocklist_de": 1.1568}, "mass": 40.4, "listed": false}}, "abq": true, "bot": 0.465, "det": {"shodan": {"c2": 1, "compromised": 14}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 1, "ssh": 6, "imap": 3, "mail": 6, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.chinaunicom.cn"}, "pfx": 269, "reg": "2001-01-18", "rir": "apnic", "s24": 3149, "sib": 25, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1189888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01661024149096}, {"a": 17622, "h": "CNCGROUP-GZ", "n": "China Unicom Guangdong Province Network", "t": "Broadband & mobile", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0273, "hi": 2.60, "lo": 0.19, "ips": 2, "mean": 1.10, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.77, "lo": 0.06, "ips": 1, "mean": 0.32, "above": false}, "blocklist_de": {"n": 1, "p": 0.0010, "hi": 1.54, "lo": 0.12, "ips": 1, "mean": 0.65, "above": false}}, "h2": [["2026-10-05", 0.107, 0.007, 0, false], ["2026-10-12", 0.116, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.786, "ts": null, "map": 0.107, "obs": 0, "own": 0.503, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.116, "se": 0.708, "ts": 0.333, "map": 0.318, "obs": 3, "own": 0.501, "comp": {"cins": 3.6716, "dshield": -1.324, "crowdsec": -1.9299, "vulncheck": -0.7528, "blocklist_de": 0.5828}, "mass": 3.5, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 458, "reg": "2001-01-18", "rir": "apnic", "s24": 1948, "sib": 25, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1231360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00714808908008}, {"a": 17623, "h": "CNCGROUP-SZ", "n": "China Unicom Guangdong Province Shenzhen Network", "t": "Broadband & mobile", "w": 12, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 9}, "ev": {"shodan": {"n": 2, "p": 0.0001, "hi": 1.31, "lo": 0.17, "ips": 2, "mean": 0.62, "above": false}, "dshield": {"n": 2, "p": 0.0673, "hi": 3.21, "lo": 0.42, "ips": 2, "mean": 1.53, "above": false}, "crowdsec": {"n": 6, "p": 0.0018, "hi": 2.06, "lo": 0.57, "ips": 9, "mean": 1.22, "above": false}, "vulncheck": {"n": 1, "p": 0.0205, "hi": 2.45, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}, "blocklist_de": {"n": 3, "p": 0.0256, "hi": 2.66, "lo": 0.47, "ips": 3, "mean": 1.37, "above": false}}, "h2": [["2026-10-05", 0.446, 0.008, 0, false], ["2026-10-12", 0.611, 0.008, 0, false]], "sh": false, "uc": 68.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.793, "ts": null, "map": 0.111, "obs": 0, "own": 0.520, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.611, "se": 0.474, "ts": 0.500, "map": 1.113, "obs": 12, "own": 1.723, "comp": {"cins": -1.7025, "dshield": 1.3011, "crowdsec": 1.6031, "vulncheck": -0.4006, "blocklist_de": 0.7}, "mass": 11.1, "listed": false}}, "abq": true, "bot": 0.537, "det": {"shodan": {"c2": 1, "compromised": 1}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ssh": 1, "imap": 2, "mail": 2}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 808, "reg": "2001-01-18", "rir": "apnic", "s24": 1783, "sib": 25, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 688128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00722407382164}, {"a": 17625, "h": "BLAZENET-IN-AP", "n": "BlazeNet Ltd.", "t": "Broadband & mobile", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2024-28000": 2}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0627, "hi": 3.19, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "crowdsec": {"n": 5, "p": 0.6465, "hi": 6.54, "lo": 1.62, "ips": 5, "mean": 3.73, "above": false}, "blocklist_de": {"n": 1, "p": 0.1129, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 3.134, 0.010, 0, false], ["2026-10-12", 1.887, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.950, "ts": null, "map": 0.171, "obs": 0, "own": 1.071, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.887, "se": 0.566, "ts": 0.833, "map": 4.003, "obs": 6, "own": 6.197, "comp": {"cins": -0.9888, "dshield": -1.6648, "crowdsec": 7.3093, "vulncheck": -0.822, "blocklist_de": -1.0529}, "mass": 5.1, "listed": false}}, "abq": true, "bot": 0.197, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BPL3-AP-APNIC", "org": "Blazenet Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.blazenet.biz"}, "pfx": 228, "reg": "2001-01-22", "rir": "apnic", "s24": 229, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00374838285045}, {"a": 17638, "h": "CHINATELECOM-TJ-AS-AP", "n": "China Telecom Tianjin Province Network", "t": "Broadband & mobile", "w": 16, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2019-8318": 2, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.0666, "hi": 3.20, "lo": 0.42, "ips": 10, "mean": 1.53, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.81, "lo": 0.06, "ips": 1, "mean": 0.34, "above": false}, "dshield": {"n": 2, "p": 0.0370, "hi": 2.82, "lo": 0.37, "ips": 2, "mean": 1.34, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 1.09, "lo": 0.19, "ips": 4, "mean": 0.56, "above": false}, "blocklist_de": {"n": 2, "p": 0.0021, "hi": 1.82, "lo": 0.24, "ips": 2, "mean": 0.87, "above": false}}, "h2": [["2026-10-05", 0.369, 0.007, 0, false], ["2026-10-12", 0.419, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.774, "ts": null, "map": 0.102, "obs": 0, "own": 0.472, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.419, "se": 0.504, "ts": 0.333, "map": 0.789, "obs": 9, "own": 1.223, "comp": {"cins": 5.1108, "dshield": 1.6093, "crowdsec": -3.1057, "vulncheck": -0.9075, "blocklist_de": -1.5506}, "mass": 10.1, "listed": false}}, "abq": true, "bot": 0.566, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-17638-APNIC", "org": "TIANJIN Provincial Net of CT", "pdb": null, "pfx": 515, "reg": "2002-11-18", "rir": "apnic", "s24": 2288, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1140736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0031850494585}, {"a": 17639, "h": "CONVERGE-AS", "n": "CONVERGE ICT SOLUTION", "t": "Broadband & mobile", "w": 56, "cc": "PH", "cf": {"rb": "", "wb": "", "rep": 1.75, "waf": 0.59}, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 6, "home_connection": 7, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.0284, "hi": 2.63, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}, "dshield": {"n": 7, "p": 0.7313, "hi": 6.48, "lo": 1.96, "ips": 7, "mean": 3.94, "above": false}, "crowdsec": {"n": 8, "p": 0.0062, "hi": 2.38, "lo": 0.77, "ips": 8, "mean": 1.48, "above": false}, "blocklist_de": {"n": 9, "p": 0.5690, "hi": 5.15, "lo": 1.78, "ips": 41, "mean": 3.28, "above": false}}, "h2": [["2026-10-05", 1.642, 0.007, 0, false], ["2026-10-12", 1.538, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.788, "ts": null, "map": 0.108, "obs": 0, "own": 0.506, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 7, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 9}, "lo": 1.538, "se": 0.412, "ts": 0.360, "map": 2.514, "obs": 25, "own": 3.869, "comp": {"cins": -0.5693, "dshield": 3.6799, "crowdsec": -3.9965, "vulncheck": -0.9727, "blocklist_de": 4.1739}, "mass": 26.6, "listed": false}}, "abq": false, "bot": 0.107, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Mirai": 1}, "blocklist_de": {"sip": 1, "ssh": 1, "bots": 36, "apache": 3, "bruteforcelogin": 3}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.convergeict.com/"}, "pfx": 567, "reg": "2001-02-16", "rir": "apnic", "s24": 1910, "sib": 0, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1029376, "abuse": "abuse@convergeict.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.259108}, {"a": 17660, "h": "DRUKNET-AS", "n": "Bhutan Telecom Ltd", "t": "Broadband & mobile", "w": 1, "cc": "BT", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 6.079, 0.011, 0, false], ["2026-10-12", 2.618, 0.012, 0, false]], "sh": false, "uc": 621.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.618, "se": 0.974, "ts": 0.500, "map": 12.039, "obs": 2, "own": 19.415, "comp": {"cins": -0.2813, "dshield": -0.6096, "crowdsec": 1.9148, "vulncheck": -0.5079, "blocklist_de": 3.3658}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.281, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BTL2-AP-APNIC", "org": "Bhutan Telecom Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.bt.bt"}, "pfx": 13, "reg": "2001-08-21", "rir": "apnic", "s24": 18, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001215519489}, {"a": 17665, "h": "ONEBROADBAND", "n": "ONEOTT iNTERTAINMENT LTD", "t": "Broadband & mobile", "w": 16, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 5, "web_bruteforce": 7, "home_connection": 9, "mail_bruteforce": 5, "router_or_botnet": 2}, "n": 11}, "ev": {"dshield": {"n": 1, "p": 0.1555, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "urlhaus": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "crowdsec": {"n": 9, "p": 0.9804, "hi": 10.24, "lo": 3.54, "ips": 11, "mean": 6.52, "above": true}, "vulncheck": {"n": 2, "p": 0.3562, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "blocklist_de": {"n": 5, "p": 0.8377, "hi": 8.65, "lo": 2.15, "ips": 5, "mean": 4.94, "above": true}}, "h2": [["2026-10-05", 9.282, 0.315, 0, false], ["2026-10-12", 7.447, 2.072, 0, false]], "sh": false, "uc": 1409, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 2.072, "se": 1.157, "ts": 1.000, "map": 10.292, "obs": 2, "own": 24.404, "comp": {"urlhaus": 5.3643, "threatfox": -0.4702, "phishing_db": -0.9366}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 9, "vulncheck": 2, "blocklist_de": 5}, "lo": 7.447, "se": 0.439, "ts": 0.529, "map": 12.879, "obs": 17, "own": 19.772, "comp": {"cins": -1.9898, "dshield": -1.0271, "crowdsec": 3.4878, "vulncheck": -0.1283, "blocklist_de": 3.6066}, "mass": 14.3, "listed": false}}, "abq": false, "bot": 0.127, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 3}}, "oid": "@aut-17665-APNIC", "org": "ONEOTT INTERTAINMENT LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.onebroadband.in/"}, "pfx": 197, "reg": "2001-03-14", "rir": "apnic", "s24": 201, "sib": 1, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 52224, "abuse": "info@onebroadband.in", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.01705691204697}, {"a": 17676, "h": "ULTINA", "n": "SoftBank Corp.", "t": "Broadband & mobile", "w": 14, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.13, "waf": 0.12}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 1, "mean": 0.03, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.02, "lo": 0.00, "ips": 2, "mean": 0.01, "above": false}, "dshield": {"n": 7, "p": 0.0000, "hi": 0.16, "lo": 0.05, "ips": 7, "mean": 0.10, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.32, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.02, "lo": 0.00, "ips": 3, "mean": 0.01, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.06, "lo": 0.00, "ips": 1, "mean": 0.03, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.06, "lo": 0.00, "ips": 1, "mean": 0.03, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.03, "lo": 0.00, "ips": 1, "mean": 0.01, "above": false}}, "h2": [["2026-10-05", 0.005, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.012, "se": 1.261, "ts": 0.500, "map": 0.047, "obs": 2, "own": 0.197, "comp": {"urlhaus": -0.1313, "threatfox": -0.5521, "phishing_db": -0.7428}, "mass": 16.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 7, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.009, "se": 0.476, "ts": 0.538, "map": 0.017, "obs": 13, "own": 0.026, "comp": {"cins": 1.0123, "dshield": 8.4291, "crowdsec": -5.1782, "vulncheck": -0.5146, "blocklist_de": -6.4564}, "mass": 14.0, "listed": false}}, "abq": false, "bot": 0.044, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-17676-APNIC", "org": "SoftBank Mobile Corp.", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.softbank.jp/en/"}, "pfx": 482, "reg": "2001-03-26", "rir": "apnic", "s24": 150176, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49651712, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.544807}, {"a": 17686, "h": "ACCELIA", "n": "Accelia, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0568, "hi": 3.10, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}}, "h2": [["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.944, "ts": null, "map": 0.170, "obs": 0, "own": 0.161, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.685, "ts": null, "map": 0.111, "obs": 0, "own": 0.036, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17686-APNIC", "org": "Accelia, Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.accelia.net"}, "pfx": 18, "reg": "2001-03-26", "rir": "apnic", "s24": 248, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 107008, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17716, "h": "NTU-TW", "n": "National Taiwan University", "t": "Enterprise, edu & gov", "w": 1, "cc": "TW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0431, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "crowdsec": {"n": 1, "p": 0.0291, "hi": 2.64, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}}, "h2": [["2026-10-05", 0.080, 0.010, 0, false], ["2026-10-12", 0.083, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.930, "ts": null, "map": 0.166, "obs": 0, "own": 1.661, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.083, "se": 1.122, "ts": 1.000, "map": 0.502, "obs": 1, "own": 3.064, "comp": {"cins": -0.1992, "dshield": -0.4465, "crowdsec": 2.7991, "vulncheck": -0.4163, "blocklist_de": -1.0333}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.224, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17716-APNIC", "org": "National Taiwan University", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.ntu.edu.tw"}, "pfx": 4, "reg": "2001-04-02", "rir": "apnic", "s24": 300, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 76800, "abuse": "noc@mail.moe.gov.tw", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082103637695}, {"a": 17726, "h": "CAMNET-AS", "n": "Telecom Cambodia", "t": "Broadband & mobile", "w": 0, "cc": "KH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 4166.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.833, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.221, "det": null, "oid": "ORG-TC1-AP-APNIC", "org": "Telecom Cambodia (T.C.)", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.tc.com.kh"}, "pfx": 42, "reg": "2001-04-12", "rir": "apnic", "s24": 36, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000117528909}, {"a": 17754, "h": "EXCELL-AS", "n": "Excell Media Pvt Ltd", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1679, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "dshield": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 4, "p": 0.5475, "hi": 6.21, "lo": 1.34, "ips": 4, "mean": 3.39, "above": false}, "blocklist_de": {"n": 2, "p": 0.3077, "hi": 5.29, "lo": 0.69, "ips": 3, "mean": 2.52, "above": false}}, "h2": [["2026-10-05", 2.260, 0.010, 0, false], ["2026-10-12", 3.872, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.176, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.872, "se": 0.520, "ts": 0.500, "map": 7.578, "obs": 8, "own": 11.691, "comp": {"cins": 2.3736, "dshield": 0.2914, "crowdsec": 1.2068, "vulncheck": -0.8757, "blocklist_de": 0.4229}, "mass": 7.5, "listed": false}}, "abq": false, "bot": 0.271, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "@aut-17754-APNIC", "org": "Excellmedia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.excellmedia.net"}, "pfx": 178, "reg": "2001-05-21", "rir": "apnic", "s24": 178, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45568, "abuse": "support@excellmedia.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00448033077108}, {"a": 17762, "h": "HTIL-TTML-IN-AP", "n": "Tata Teleservices (Maharastra)", "t": "Hosting & VPS", "w": 9, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 7, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 6, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 2}, "n": 8}, "ev": {"crowdsec": {"n": 8, "p": 0.3473, "hi": 4.39, "lo": 1.43, "ips": 8, "mean": 2.73, "above": false}, "blocklist_de": {"n": 1, "p": 0.0211, "hi": 2.47, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}}, "h2": [["2026-10-05", 1.206, 0.009, 0, false], ["2026-10-12", 0.883, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.849, "ts": null, "map": 0.136, "obs": 0, "own": 0.106, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.883, "se": 0.501, "ts": 0.889, "map": 1.655, "obs": 9, "own": 0.326, "comp": {"cins": -1.3702, "dshield": -2.0592, "crowdsec": 9.4906, "vulncheck": -0.8824, "blocklist_de": -3.2815}, "mass": 7.9, "listed": false}}, "abq": true, "bot": 0.168, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TTL2-AP-APNIC", "org": "Tata Teleservices (Maharashtra) Ltd", "pdb": {"t": null, "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.tatatelebusiness.com/"}, "pfx": 511, "reg": "2001-05-28", "rir": "apnic", "s24": 862, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 418560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00832794945813}, {"a": 17789, "h": "CNCGROUP-SH-IDC", "n": "CNCGROUP IP network of ShangHai IDC", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.418, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.681, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.860, "det": null, "oid": "@aut-17789-APNIC", "org": "CNCGROUP IP network of ShangHai IDC", "pdb": null, "pfx": 2, "reg": "2001-06-18", "rir": "apnic", "s24": 255, "sib": 9, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005726664268}, {"a": 17806, "h": "MANGOTELESERVICE-AS-BD", "n": "Mango Teleservices Limited", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1111, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "blocklist_de": {"n": 1, "p": 0.1579, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-12", 0.724, 0.012, 0, false]], "sh": false, "uc": 412, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 1.371, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.724, "se": 0.905, "ts": 0.500, "map": 2.898, "obs": 2, "own": 4.635, "comp": {"cins": -0.3513, "dshield": -0.7404, "crowdsec": 1.2072, "vulncheck": -0.5685, "blocklist_de": 2.9106}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.223, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-MTL1-AP-APNIC", "org": "Mango Teleservices Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.mango.com.bd"}, "pfx": 87, "reg": "2008-05-26", "rir": "apnic", "s24": 95, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 54784, "abuse": "abuse@mango.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17809, "h": "VEETIME-TW-AP", "n": "VeeTIME", "t": "Broadband & mobile", "w": 4, "cc": "TW", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0047, "hi": 1.89, "lo": 0.14, "ips": 1, "mean": 0.80, "above": false}, "dshield": {"n": 2, "p": 0.2184, "hi": 4.56, "lo": 0.59, "ips": 2, "mean": 2.17, "above": false}, "urlhaus": {"n": 1, "p": 0.1718, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.0017, "hi": 1.65, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.0324, "hi": 2.70, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 0.038, 0.177, 0, false], ["2026-10-12", 0.390, 0.196, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.196, "se": 1.411, "ts": 1.000, "map": 1.478, "obs": 1, "own": 4.247, "comp": {"urlhaus": 3.1651, "threatfox": -0.3896, "phishing_db": -0.7585}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.390, "se": 0.646, "ts": 0.500, "map": 0.961, "obs": 4, "own": 1.501, "comp": {"cins": -0.7749, "dshield": 4.9866, "crowdsec": -2.3306, "vulncheck": -0.7698, "blocklist_de": 0.2428}, "mass": 3.8, "listed": false}}, "abq": true, "bot": 0.393, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-17809-APNIC", "org": "VEE TIME CORP.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.veetime.com/"}, "pfx": 120, "reg": "2001-07-04", "rir": "apnic", "s24": 704, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 551424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022515362488}, {"a": 17813, "h": "MTNL-AP", "n": "Mahanagar Telephone Nigam Limited", "t": "Other", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"dshield": {"n": 8, "p": 0.6893, "hi": 5.93, "lo": 1.93, "ips": 9, "mean": 3.70, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.78, "lo": 0.10, "ips": 2, "mean": 0.37, "above": false}, "blocklist_de": {"n": 1, "p": 0.0001, "hi": 1.23, "lo": 0.09, "ips": 1, "mean": 0.52, "above": false}}, "h2": [["2026-10-05", 0.115, 0.007, 0, false], ["2026-10-12", 0.373, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.763, "ts": null, "map": 0.097, "obs": 0, "own": 0.179, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.373, "se": 0.478, "ts": 0.727, "map": 0.682, "obs": 11, "own": 0.387, "comp": {"cins": -1.6077, "dshield": 13.1741, "crowdsec": -5.0273, "vulncheck": -0.9079, "blocklist_de": -4.6196}, "mass": 10.1, "listed": false}}, "abq": false, "bot": 0.156, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-17813-APNIC", "org": "Mahanagar Telephone Nigam Limited", "pdb": null, "pfx": 65, "reg": "2001-07-09", "rir": "apnic", "s24": 2656, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1253632, "abuse": "abusemtnl@bol.net.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17816, "h": "CHINA169-GZ", "n": "CHINA169-GZ", "t": "Other", "w": 44, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 7, "web_bruteforce": 4, "mail_bruteforce": 5, "cve:CVE-2024-6387": 1}, "n": 9}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 1.16, "lo": 0.15, "ips": 2, "mean": 0.56, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.33, "lo": 0.06, "ips": 3, "mean": 0.17, "above": false}, "dshield": {"n": 18, "p": 0.3920, "hi": 4.03, "lo": 1.88, "ips": 19, "mean": 2.87, "above": false}, "urlhaus": {"n": 12, "p": 0.9923, "hi": 9.90, "lo": 3.91, "ips": 14, "mean": 6.62, "above": true}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 0.50, "lo": 0.16, "ips": 9, "mean": 0.31, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.73, "lo": 0.05, "ips": 1, "mean": 0.31, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 1.08, "lo": 0.33, "ips": 8, "mean": 0.66, "above": false}}, "h2": [["2026-10-05", 0.166, 1.067, 0, false], ["2026-10-12", 0.386, 1.290, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 12, "threatfox": 0, "phishing_db": 0}, "lo": 1.290, "se": 0.831, "ts": 1.000, "map": 2.922, "obs": 12, "own": 2.996, "comp": {"urlhaus": 4.4859, "threatfox": -0.5843, "phishing_db": -1.2032}, "mass": 44.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 18, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 7}, "lo": 0.386, "se": 0.401, "ts": 0.500, "map": 0.618, "obs": 36, "own": 0.349, "comp": {"cins": 0.5173, "dshield": 10.2216, "crowdsec": -6.1472, "vulncheck": -0.8128, "blocklist_de": -2.867}, "mass": 35.8, "listed": false}}, "abq": true, "bot": 0.428, "det": {"shodan": {"compromised": 3}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ssh": 3, "imap": 5, "mail": 5}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 117, "reg": "2001-07-11", "rir": "apnic", "s24": 10426, "sib": 25, "tor": 0, "w24": 40, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 3774464, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.01279834668216}, {"a": 17826, "h": "SATATANET-ID", "n": "SATNET India", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.304, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.113, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.267, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17826-APNIC", "org": "PT Satata Neka Tama", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.sat.net.id"}, "pfx": 13, "reg": "2001-10-19", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17853, "h": "LGTELECOM-AS-KR", "n": "LGTELECOM", "t": "Broadband & mobile", "w": 3, "cc": "KR", "cf": {"rb": "hi", "wb": "hi", "rep": 1.13, "waf": 0.99}, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.89, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "blocklist_de": {"n": 2, "p": 0.0114, "hi": 2.29, "lo": 0.30, "ips": 2, "mean": 1.09, "above": false}}, "h2": [["2026-10-05", 0.067, 0.008, 0, false], ["2026-10-12", 0.133, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.800, "ts": null, "map": 0.114, "obs": 0, "own": 0.539, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.133, "se": 0.709, "ts": 0.667, "map": 0.368, "obs": 3, "own": 0.579, "comp": {"cins": -0.7005, "dshield": -1.2973, "crowdsec": -1.7869, "vulncheck": -0.7465, "blocklist_de": 4.9254}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.048, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-17853-APNIC", "org": "LGTELECOM", "pdb": null, "pfx": 345, "reg": "2001-07-24", "rir": "apnic", "s24": 1629, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 741376, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.064648}, {"a": 17854, "h": "SKBCABLELINE-AS-KR", "n": "SK Broadband Co Ltd", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0174, "hi": 2.37, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.0774, "hi": 3.38, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}}, "h2": [["2026-10-05", 0.225, 0.010, 0, false], ["2026-10-12", 0.239, 0.010, 0, false]], "sh": false, "uc": 143.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.913, "ts": null, "map": 0.160, "obs": 0, "own": 0.915, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.239, "se": 0.859, "ts": 0.500, "map": 0.873, "obs": 2, "own": 1.393, "comp": {"cins": -0.4129, "dshield": -0.8494, "crowdsec": 0.6186, "vulncheck": -0.6121, "blocklist_de": 2.5142}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.158, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": null, "pfx": 52, "reg": "2001-07-24", "rir": "apnic", "s24": 376, "sib": 23, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 107776, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004593905274}, {"a": 17858, "h": "POWERVIS-AS-KR", "n": "LG POWERCOMM", "t": "Broadband & mobile", "w": 21, "cc": "KR", "cf": {"rb": "hi", "wb": "", "rep": 0.49, "waf": 1.37}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "ssh_bruteforce": 9, "web_bruteforce": 4, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-63030": 1}, "n": 10}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.51, "lo": 0.11, "ips": 4, "mean": 0.28, "above": false}, "dshield": {"n": 5, "p": 0.0000, "hi": 0.46, "lo": 0.11, "ips": 5, "mean": 0.26, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.16, "lo": 0.06, "ips": 10, "mean": 0.10, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}, "blocklist_de": {"n": 6, "p": 0.0000, "hi": 0.27, "lo": 0.07, "ips": 6, "mean": 0.16, "above": false}}, "h2": [["2026-10-05", 0.084, 0.003, 0, false], ["2026-10-12", 0.082, 0.003, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.003, "se": 1.618, "ts": null, "map": 0.030, "obs": 0, "own": 0.142, "comp": null, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 5, "crowdsec": 10, "vulncheck": 1, "blocklist_de": 6}, "lo": 0.082, "se": 0.423, "ts": 0.385, "map": 0.136, "obs": 26, "own": 0.211, "comp": {"cins": 4.9532, "dshield": 1.2346, "crowdsec": -3.3595, "vulncheck": -0.7783, "blocklist_de": -2.6517}, "mass": 30.6, "listed": false}}, "abq": false, "bot": 0.171, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 5, "mail": 1}}, "oid": "@aut-17858-APNIC", "org": "LG POWERCOMM", "pdb": null, "pfx": 212, "reg": "2001-07-24", "rir": "apnic", "s24": 40262, "sib": 0, "tor": 1, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20608512, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.150384}, {"a": 17864, "h": "SKB-TBROAD_HANVIT-AS-KR", "n": "SK Broadband Co Ltd", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0005, "hi": 1.41, "lo": 0.11, "ips": 1, "mean": 0.60, "above": false}, "blocklist_de": {"n": 1, "p": 0.0196, "hi": 2.43, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.112, 0.008, 0, false], ["2026-10-12", 0.118, 0.009, 0, false]], "sh": false, "uc": 67.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.846, "ts": null, "map": 0.135, "obs": 0, "own": 0.678, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.118, "se": 0.834, "ts": 0.500, "map": 0.410, "obs": 2, "own": 0.653, "comp": {"cins": -0.4529, "dshield": -0.9176, "crowdsec": 0.251, "vulncheck": -0.6368, "blocklist_de": 2.2579}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.166, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": null, "pfx": 31, "reg": "2001-07-24", "rir": "apnic", "s24": 888, "sib": 23, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 268544, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007590190804}, {"a": 17878, "h": "MARK1-AS-KR", "n": "DREAMMARK1", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0062, "hi": 1.98, "lo": 0.15, "ips": 1, "mean": 0.84, "above": false}}, "h2": [["2026-10-05", 0.050, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.870, "ts": null, "map": 0.145, "obs": 0, "own": 0.306, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.560, "ts": null, "map": 0.069, "obs": 0, "own": 0.055, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.614, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17878-APNIC", "org": "DREAMMARK1", "pdb": null, "pfx": 55, "reg": "2001-07-24", "rir": "apnic", "s24": 652, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 170496, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001461241222}, {"a": 17882, "h": "Univision-AS-AP", "n": "Univision Mongolia", "t": "Broadband & mobile", "w": 4, "cc": "MN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1676, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 3, "p": 0.4096, "hi": 5.64, "lo": 0.99, "ips": 3, "mean": 2.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1409, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 1.559, 0.363, 0, false], ["2026-10-12", 2.314, 0.011, 0, false]], "sh": false, "uc": 476.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.983, "ts": null, "map": 0.180, "obs": 0, "own": 1.234, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.314, "se": 0.606, "ts": 0.600, "map": 5.302, "obs": 5, "own": 8.218, "comp": {"cins": -0.8407, "dshield": 1.5829, "crowdsec": 3.2669, "vulncheck": -0.7879, "blocklist_de": -0.1594}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.141, "det": {"blocklist_de": {"mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.unitel.mn/unitel/"}, "pfx": 141, "reg": "2001-07-24", "rir": "apnic", "s24": 141, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36096, "abuse": "abuse@unitel.mn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01360458419876}, {"a": 17885, "h": "JKTXLNET-AS-AP", "n": "XLSmart AS17885", "t": "Transit & backbone", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1035, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 1.786, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.768, "ts": null, "map": 0.143, "obs": 0, "own": 0.837, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.553, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139994-APNIC", "org": "PT XL Axiata Tbk", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.xlsmart.co.id"}, "pfx": 132, "reg": "2001-10-30", "rir": "apnic", "s24": 132, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 33792, "abuse": "abuse@xlsmart.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004691228982}, {"a": 17897, "h": "CHINATELECOM-HLJ-AS-AP", "n": "Heilongjiang Provincial Net of CT", "t": "Broadband & mobile", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0088, "hi": 2.10, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.878, "ts": null, "map": 0.148, "obs": 0, "own": 0.785, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.572, "ts": null, "map": 0.073, "obs": 0, "own": 0.161, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.597, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17897-APNIC", "org": "Heilongjiang Provincial Net of CT", "pdb": null, "pfx": 16, "reg": "2002-11-18", "rir": "apnic", "s24": 591, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 161280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040727207768}, {"a": 17911, "h": "BRAINPK-AS-AP", "n": "Brain Telecommunication", "t": "Broadband & mobile", "w": 2, "cc": "SG", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "vulncheck": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1760, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 3.489, 0.011, 0, false], ["2026-10-12", 2.068, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 1.590, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.068, "se": 0.781, "ts": 0.333, "map": 6.498, "obs": 3, "own": 10.390, "comp": {"cins": -0.4163, "dshield": -0.8552, "crowdsec": 0.5872, "vulncheck": 1.4569, "blocklist_de": 2.4926}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.170, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BN16-AP-APNIC", "org": "Brain Net", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.brain.net.pk"}, "pfx": 51, "reg": "2001-08-17", "rir": "apnic", "s24": 51, "sib": 2, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026082676631}, {"a": 17917, "h": "QTLTELECOM-AS-AP", "n": "Quadrant Televentures", "t": "Broadband & mobile", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "mail_bruteforce": 2}, "n": 4}, "ev": {"dshield": {"n": 2, "p": 0.2246, "hi": 4.61, "lo": 0.60, "ips": 2, "mean": 2.20, "above": false}, "crowdsec": {"n": 4, "p": 0.0794, "hi": 3.27, "lo": 0.70, "ips": 4, "mean": 1.79, "above": false}, "blocklist_de": {"n": 7, "p": 0.8479, "hi": 7.62, "lo": 2.31, "ips": 7, "mean": 4.64, "above": true}}, "h2": [["2026-10-05", 0.773, 0.009, 0, false], ["2026-10-12", 2.116, 0.010, 0, false]], "sh": false, "uc": 172.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.143, "obs": 0, "own": 0.748, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 7}, "lo": 2.116, "se": 0.459, "ts": 0.538, "map": 3.777, "obs": 13, "own": 5.815, "comp": {"cins": -1.9747, "dshield": 0.5318, "crowdsec": -3.8428, "vulncheck": -0.937, "blocklist_de": 8.9454}, "mass": 14.1, "listed": false}}, "abq": true, "bot": 0.150, "det": {"blocklist_de": {"ssh": 1, "bots": 3, "imap": 2, "mail": 3}}, "oid": "@aut-17917-APNIC", "org": "Quadrant Televentures Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.connectzone.in"}, "pfx": 366, "reg": "2001-08-24", "rir": "apnic", "s24": 676, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 422400, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00751220858109}, {"a": 17924, "h": "SMARTONE-MB-AS-AP", "n": "SmarTone Mobile Communications", "t": "Broadband & mobile", "w": 25, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 5, "proxy_or_vpn": 2, "ssh_bruteforce": 7, "web_bruteforce": 6, "home_connection": 8, "mail_bruteforce": 7, "router_or_botnet": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 3, "cve:CVE-2018-20062": 1, "cve:CVE-2024-12847": 3, "cve:CVE-2026-63030": 1}, "n": 9}, "ev": {"cins": {"n": 2, "p": 0.1018, "hi": 3.57, "lo": 0.46, "ips": 2, "mean": 1.70, "above": false}, "dshield": {"n": 1, "p": 0.0184, "hi": 2.40, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "urlhaus": {"n": 7, "p": 0.9732, "hi": 11.26, "lo": 3.41, "ips": 11, "mean": 6.85, "above": true}, "crowdsec": {"n": 9, "p": 0.0207, "hi": 2.70, "lo": 0.93, "ips": 9, "mean": 1.72, "above": false}, "vulncheck": {"n": 2, "p": 0.0689, "hi": 3.23, "lo": 0.42, "ips": 2, "mean": 1.54, "above": false}, "blocklist_de": {"n": 5, "p": 0.1267, "hi": 3.57, "lo": 0.89, "ips": 5, "mean": 2.04, "above": false}}, "h2": [["2026-10-05", 0.697, 2.426, 0, false], ["2026-10-12", 1.114, 3.257, 0, false]], "sh": false, "uc": 129.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 7, "threatfox": 0, "phishing_db": 0}, "lo": 3.257, "se": 0.833, "ts": 1.000, "map": 7.893, "obs": 7, "own": 18.703, "comp": {"urlhaus": 5.4406, "threatfox": -0.5728, "phishing_db": -1.1756}, "mass": 19.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 9, "vulncheck": 2, "blocklist_de": 5}, "lo": 1.114, "se": 0.436, "ts": 0.474, "map": 1.869, "obs": 19, "own": 2.883, "comp": {"cins": 2.8195, "dshield": -1.4866, "crowdsec": 0.3629, "vulncheck": -0.3249, "blocklist_de": 0.6482}, "mass": 18.8, "listed": false}}, "abq": false, "bot": 0.114, "det": {"vulncheck": {"c2_server": 2}, "blocklist_de": {"ssh": 1, "imap": 4, "mail": 4}}, "oid": "ORG-SMCL2-AP-APNIC", "org": "Smartone Mobile communications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.smartone.com"}, "pfx": 121, "reg": "2001-09-04", "rir": "apnic", "s24": 1812, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 987392, "abuse": "abuse@ismart.net", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00985302695222}, {"a": 17962, "h": "Topway-Net", "n": "ShenZhen Topway Video Communication Co. Ltd", "t": "Other", "w": 12, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 9, "web_exploit": 2, "bad_crawling": 4}, "n": 9}, "ev": {"dshield": {"n": 1, "p": 0.0044, "hi": 1.88, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}, "crowdsec": {"n": 8, "p": 0.0001, "hi": 1.70, "lo": 0.55, "ips": 9, "mean": 1.06, "above": false}, "vulncheck": {"n": 2, "p": 0.0211, "hi": 2.54, "lo": 0.33, "ips": 2, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.336, 0.085, 0, false], ["2026-10-12", 0.290, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.759, "ts": null, "map": 0.095, "obs": 0, "own": 0.175, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 8, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.290, "se": 0.487, "ts": 0.727, "map": 0.538, "obs": 11, "own": 0.306, "comp": {"cins": -1.431, "dshield": 0.0347, "crowdsec": 8.6386, "vulncheck": 0.4186, "blocklist_de": -6.887}, "mass": 8.5, "listed": false}}, "abq": false, "bot": 0.816, "det": {"vulncheck": {"other_infrastructure": 2}}, "oid": "@aut-17962-APNIC", "org": "ShenZhen Topway Video Communication Co. Ltd", "pdb": null, "pfx": 29, "reg": "2001-09-25", "rir": "apnic", "s24": 2824, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1136896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00354404955372}, {"a": 17964, "h": "DXTNET", "n": "Beijing Dian-Xin-Tong Network Technologies Co.", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0949, "hi": 3.60, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.980, "ts": null, "map": 0.179, "obs": 0, "own": 0.490, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.752, "ts": null, "map": 0.137, "obs": 0, "own": 0.140, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": null, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-17964-APNIC", "org": "Beijing Dian-Xin-Tong Network Technologies Co., Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "https://www.drpeng.com.cn/"}, "pfx": 66, "reg": "2001-09-25", "rir": "apnic", "s24": 149, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 17976, "h": "CamGSM-CELLCARD-AS-AP", "n": "CamGSM", "t": "Other", "w": 1, "cc": "KH", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1764, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.266, 0.012, 0, false]], "sh": false, "uc": 734.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 0.644, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.266, "se": 1.272, "ts": 1.000, "map": 2.144, "obs": 1, "own": 1.389, "comp": {"cins": -0.1437, "dshield": -0.3298, "crowdsec": -1.3052, "vulncheck": -0.3361, "blocklist_de": 4.271}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.099, "det": {"blocklist_de": {"ftp": 1}}, "oid": "ORG-CCL3-AP-APNIC", "org": "CAMGSM Company Ltd", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.cellcard.com.kh"}, "pfx": 59, "reg": "2001-10-11", "rir": "apnic", "s24": 50, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 29952, "abuse": "noc@telcotech.com.kh", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0067203151282}, {"a": 17995, "h": "SOLUSINET-AS-ID", "n": "iForte Global Internet", "t": "Broadband & mobile", "w": 21, "cc": "ID", "cf": null, "cs": {"c": {"data_centre": 3, "web_exploit": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 9, "web_bruteforce": 1, "home_connection": 6, "router_or_botnet": 6, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 11}, "ev": {"cins": {"n": 2, "p": 0.3158, "hi": 5.35, "lo": 0.70, "ips": 2, "mean": 2.55, "above": false}, "shodan": {"n": 6, "p": 0.6597, "hi": 6.27, "lo": 1.74, "ips": 6, "mean": 3.71, "above": false}, "dshield": {"n": 2, "p": 0.2900, "hi": 5.14, "lo": 0.67, "ips": 2, "mean": 2.45, "above": false}, "urlhaus": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 11, "p": 0.9718, "hi": 8.65, "lo": 3.29, "ips": 11, "mean": 5.70, "above": true}, "vulncheck": {"n": 1, "p": 0.1204, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "blocklist_de": {"n": 8, "p": 0.9668, "hi": 9.98, "lo": 3.25, "ips": 8, "mean": 6.23, "above": true}}, "h2": [["2026-10-05", 3.626, 0.229, 0, false], ["2026-10-12", 6.517, 0.251, 0, false]], "sh": false, "uc": 55.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.251, "se": 1.442, "ts": 1.000, "map": 2.032, "obs": 1, "own": 5.844, "comp": {"urlhaus": 3.3929, "threatfox": -0.3609, "phishing_db": -0.6969}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 11, "vulncheck": 1, "blocklist_de": 8}, "lo": 6.517, "se": 0.412, "ts": 0.458, "map": 10.507, "obs": 24, "own": 16.113, "comp": {"cins": 1.8751, "dshield": -0.8469, "crowdsec": -0.2301, "vulncheck": -0.7209, "blocklist_de": 3.6685}, "mass": 24.1, "listed": false}}, "abq": false, "bot": 0.248, "det": {"shodan": {"malware": 1, "compromised": 5}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 5, "bots": 1, "imap": 2, "mail": 2}}, "oid": "@aut-17995-APNIC", "org": "PT iForte Global Internet", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://iforte.co.id/"}, "pfx": 632, "reg": "2002-11-18", "rir": "apnic", "s24": 416, "sib": 1, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 288768, "abuse": "hostmaster@iforte.co.id", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0085393983796}, {"a": 18001, "h": "DIALOG-AS", "n": "Dialog Axiata PLC", "t": "Broadband & mobile", "w": 6, "cc": "LK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0042, "hi": 1.87, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}, "dshield": {"n": 1, "p": 0.0802, "hi": 3.42, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "crowdsec": {"n": 3, "p": 0.0255, "hi": 2.66, "lo": 0.47, "ips": 3, "mean": 1.37, "above": false}, "blocklist_de": {"n": 2, "p": 0.1005, "hi": 3.55, "lo": 0.46, "ips": 2, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 1.103, 0.009, 0, false], ["2026-10-12", 0.690, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.863, "ts": null, "map": 0.141, "obs": 0, "own": 0.732, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.690, "se": 0.564, "ts": 0.500, "map": 1.450, "obs": 6, "own": 2.251, "comp": {"cins": -1.0928, "dshield": 0.8535, "crowdsec": 0.8215, "vulncheck": -0.8417, "blocklist_de": 2.0249}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.090, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Mirai": 1}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-DAP1-AP-APNIC", "org": "Dialog Axiata Plc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.dialog.lk"}, "pfx": 120, "reg": "2002-02-15", "rir": "apnic", "s24": 720, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 354304, "abuse": "abuse-noc@dialog.lk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03611928597531}, {"a": 18002, "h": "WORLDPHONE-IN", "n": "World Phone Internet Services", "t": "Broadband & mobile", "w": 9, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 5, "web_bruteforce": 6, "mail_bruteforce": 5, "router_or_botnet": 2}, "n": 8}, "ev": {"shodan": {"n": 2, "p": 0.2400, "hi": 4.74, "lo": 0.62, "ips": 2, "mean": 2.26, "above": false}, "crowdsec": {"n": 7, "p": 0.9341, "hi": 9.33, "lo": 2.82, "ips": 8, "mean": 5.68, "above": true}, "blocklist_de": {"n": 3, "p": 0.5377, "hi": 6.66, "lo": 1.17, "ips": 3, "mean": 3.43, "above": false}}, "h2": [["2026-10-05", 8.136, 0.010, 0, false], ["2026-10-12", 5.560, 0.011, 0, false]], "sh": false, "uc": 2779.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.203, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.560, "se": 0.488, "ts": 0.700, "map": 10.441, "obs": 10, "own": 16.063, "comp": {"cins": -1.4865, "dshield": -2.1632, "crowdsec": 5.8476, "vulncheck": -0.8957, "blocklist_de": 2.4372}, "mass": 8.9, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1, "imap": 2, "mail": 2}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.worldphone.in"}, "pfx": 154, "reg": "2002-02-15", "rir": "apnic", "s24": 154, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39424, "abuse": "abuse@worldphone.in", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00206025861885}, {"a": 18024, "h": "BTTELECOM-AS-AP", "n": "BT ACCESS", "t": "Broadband & mobile", "w": 1, "cc": "BT", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1323, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 1.806, 0.011, 0, false], ["2026-10-12", 0.212, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 1.494, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.212, "se": 1.237, "ts": 1.000, "map": 1.605, "obs": 1, "own": 2.794, "comp": {"cins": -0.1441, "dshield": -0.3307, "crowdsec": 3.4285, "vulncheck": -0.3368, "blocklist_de": -0.7503}, "mass": 0.7, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.bt.bt"}, "pfx": 6, "reg": "2018-02-26", "rir": "apnic", "s24": 67, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009151154266}, {"a": 18047, "h": "NTHU-TW", "n": "National Tsing-Hua University", "t": "Other", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 10, "p": 0.9889, "hi": 10.50, "lo": 3.82, "ips": 10, "mean": 6.81, "above": true}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.933, "ts": null, "map": 0.167, "obs": 0, "own": 0.402, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.665, "ts": null, "map": 0.104, "obs": 0, "own": 0.094, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"compromised": 1, "doublepulsar": 9}}, "oid": "@aut-18047-APNIC", "org": "National Tsing-Hua University", "pdb": null, "pfx": 2, "reg": "2001-11-09", "rir": "apnic", "s24": 288, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 73728, "abuse": "noc@mail.moe.gov.tw", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.000344432158}, {"a": 18049, "h": "TINP-TW", "n": "Taiwan Optical Platform Group", "t": "Broadband & mobile", "w": 3, "cc": "TW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.27, "lo": 0.10, "ips": 1, "mean": 0.54, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.08, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}, "vulncheck": {"n": 1, "p": 0.0402, "hi": 2.84, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "phishing_db": {"n": 1, "p": 0.0451, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.323, 0.082, 0, false], ["2026-10-12", 0.064, 0.084, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.084, "se": 1.347, "ts": 1.000, "map": 0.510, "obs": 1, "own": 1.610, "comp": {"urlhaus": -0.3967, "threatfox": -0.3229, "phishing_db": 1.6732}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.064, "se": 0.837, "ts": 0.500, "map": 0.221, "obs": 2, "own": 0.360, "comp": {"cins": -0.3587, "dshield": -0.7538, "crowdsec": 1.1348, "vulncheck": 1.7038, "blocklist_de": -1.8426}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.259, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-18049-APNIC", "org": "Taiwan Infrastructure Network Technologie", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.topmso.com.tw"}, "pfx": 250, "reg": "2001-11-09", "rir": "apnic", "s24": 1275, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 681984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0048499373967}, {"a": 18051, "h": "JARDIKNAS-AS-AP", "n": "Pustekkom", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.339, 0.011, 0, false], ["2026-10-12", 0.376, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.376, "se": 1.331, "ts": 1.000, "map": 3.394, "obs": 1, "own": 2.252, "comp": {"cins": -0.11, "dshield": -0.2563, "crowdsec": 3.8337, "vulncheck": -0.2774, "blocklist_de": -0.5742}, "mass": 0.5, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 24, "reg": "2008-01-08", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18053, "h": "SNET-AS-AP", "n": "Special Communication Organization", "t": "Broadband & mobile", "w": 2, "cc": "PK", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 2, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.733, 0.011, 0, false], ["2026-10-12", 1.885, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.885, "se": 0.954, "ts": 0.500, "map": 8.274, "obs": 2, "own": 13.307, "comp": {"cins": -0.2994, "dshield": -0.6441, "crowdsec": 1.7277, "vulncheck": -0.5249, "blocklist_de": 3.2476}, "mass": 1.3, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SCO1-AP-APNIC", "org": "Special Communication Organization", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.sco.gov.pk"}, "pfx": 11, "reg": "2019-01-29", "rir": "apnic", "s24": 28, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00371838418017}, {"a": 18068, "h": "Hypernet-Shizuoka", "n": "Dream Wave Shizuoka", "t": "Other", "w": 1, "cc": "JP", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.008, 0.217, 0, false], ["2026-10-12", 0.008, 0.227, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.227, "se": 1.423, "ts": 1.000, "map": 1.745, "obs": 1, "own": 2.064, "comp": {"urlhaus": -0.2151, "threatfox": -0.2242, "phishing_db": 2.622}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.720, "ts": null, "map": 0.124, "obs": 0, "own": 0.121, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.529, "det": null, "oid": "@aut-18068-APNIC", "org": "TOCOCHANNEL SHIZUOKA corporation", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.tocochannel.jp/index.html"}, "pfx": 51, "reg": "2001-12-27", "rir": "apnic", "s24": 190, "sib": 0, "tor": 0, "w24": 1, "drop": 13, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54016, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18097, "h": "DCN", "n": "D.C.N. Corporation", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.672, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.918, "ts": null, "map": 0.195, "obs": 0, "own": 0.286, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.098, "det": null, "oid": "@aut-18097-APNIC", "org": "D.C.N. Corporation", "pdb": null, "pfx": 7, "reg": "2001-12-27", "rir": "apnic", "s24": 41, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18103, "h": "NEUVIZ-AS-ID-AP", "n": "Neuviz Net", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1390, "hi": 4.10, "lo": 0.31, "ips": 2, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 0.933, 0.011, 0, false], ["2026-10-12", 0.228, 0.012, 0, false]], "sh": false, "uc": 337.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 1.539, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.228, "se": 1.248, "ts": 1.000, "map": 1.765, "obs": 1, "own": 3.086, "comp": {"cins": -0.1397, "dshield": -0.3213, "crowdsec": 3.48, "vulncheck": -0.3296, "blocklist_de": -0.7276}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.236, "det": null, "oid": "@aut-18103-APNIC", "org": "Neuviz Net", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.neuviz.net.id"}, "pfx": 44, "reg": "2002-01-23", "rir": "apnic", "s24": 59, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008800242748}, {"a": 18106, "h": "VIEWQWEST-SG-AP", "n": "ViewQwest", "t": "Transit & backbone", "w": 3, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.3188, "hi": 5.01, "lo": 0.88, "ips": 3, "mean": 2.58, "above": false}}, "h2": [["2026-10-12", 0.715, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.572, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.715, "se": 0.735, "ts": 1.000, "map": 2.078, "obs": 3, "own": 6.617, "comp": {"cins": -0.5234, "dshield": -1.0329, "crowdsec": 7.0169, "vulncheck": -0.6746, "blocklist_de": -2.6611}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.185, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-VPL3-AP-APNIC", "org": "Viewqwest Pte Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.viewqwest.com"}, "pfx": 25, "reg": "2002-01-25", "rir": "apnic", "s24": 206, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 53248, "abuse": "abuse@viewqwest.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00409439760021}, {"a": 18109, "h": "MAISHANET-AS-AP", "n": "MAISHA NET", "t": "Other", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 4, "router_or_botnet": 2}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6294, "hi": 7.55, "lo": 1.33, "ips": 4, "mean": 3.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 17.998, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 17.998, "se": 0.691, "ts": 0.750, "map": 48.386, "obs": 4, "own": 27.452, "comp": {"cins": -0.5828, "dshield": -1.1253, "crowdsec": 6.2474, "vulncheck": -0.7018, "blocklist_de": 1.4354}, "mass": 2.7, "listed": false}}, "abq": true, "bot": 0.162, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-MN1-AP-APNIC", "org": "Maisha Net", "pdb": null, "pfx": 10, "reg": "2017-03-02", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056250961109}, {"a": 18126, "h": "CTC", "n": "Chubu Telecommunications Co.,Inc. (ctc)", "t": "Broadband & mobile", "w": 6, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 1.19, "waf": 1.04}, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.35, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}, "dshield": {"n": 4, "p": 0.0053, "hi": 2.19, "lo": 0.47, "ips": 4, "mean": 1.20, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.86, "lo": 0.11, "ips": 2, "mean": 0.41, "above": false}}, "h2": [["2026-10-05", 0.120, 0.006, 0, false], ["2026-10-12", 0.114, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.710, "ts": null, "map": 0.072, "obs": 0, "own": 0.320, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.114, "se": 0.535, "ts": 0.571, "map": 0.229, "obs": 7, "own": 0.356, "comp": {"cins": -1.3142, "dshield": 7.2184, "crowdsec": -5.5587, "vulncheck": -0.8753, "blocklist_de": 0.4473}, "mass": 7.5, "listed": false}}, "abq": false, "bot": 0.063, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-18126-APNIC", "org": "Chubu Telecommunications Co.,Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.ctc.co.jp/"}, "pfx": 63, "reg": "2002-03-21", "rir": "apnic", "s24": 5881, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1505536, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.061694}, {"a": 18153, "h": "MULTIDATA-ID-AP", "n": "PT Multidata Rancana Prima", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"first_seen_30d": 2, "ssh_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 11.416, 0.011, 1, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.337, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-58552-APNIC", "org": "PT Multidata Rancana Prima", "pdb": null, "pfx": 8, "reg": "2002-03-25", "rir": "apnic", "s24": 8, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18180, "h": "TWNIC-AS", "n": "Taiwan Network Information Center", "t": "Other", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 0.378, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.653, "det": null, "oid": "@aut-18180-APNIC", "org": "Taiwan Network Information Center", "pdb": null, "pfx": 7, "reg": "2002-04-05", "rir": "apnic", "s24": 23, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "hostmaster@twnic.tw", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18182, "h": "SONET-TW", "n": "So-net Entertainment Taiwan Limited", "t": "Broadband & mobile", "w": 4, "cc": "TW", "cf": null, "cs": {"c": {"data_centre": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.29, "lo": 0.10, "ips": 1, "mean": 0.54, "above": false}, "dshield": {"n": 1, "p": 0.0396, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.10, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}, "vulncheck": {"n": 2, "p": 0.1273, "hi": 3.80, "lo": 0.49, "ips": 2, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.030, 0.008, 0, false], ["2026-10-12", 0.157, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.820, "ts": null, "map": 0.123, "obs": 0, "own": 0.597, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.157, "se": 0.667, "ts": 0.500, "map": 0.392, "obs": 4, "own": 0.624, "comp": {"cins": -0.5894, "dshield": 2.442, "crowdsec": -0.9193, "vulncheck": 2.5077, "blocklist_de": -2.9842}, "mass": 2.8, "listed": false}}, "abq": true, "bot": 0.358, "det": {"shodan": {"compromised": 1}, "vulncheck": {"attack_tooling": 2}}, "oid": "@aut-18182-APNIC", "org": "Sony Network Taiwan Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.so-net.net.tw"}, "pfx": 84, "reg": "2002-04-05", "rir": "apnic", "s24": 1251, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 913408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0021296243078}, {"a": 18186, "h": "NEBULA-GLOBAL", "n": "Nebula Global LLC", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0027, "hi": 1.75, "lo": 0.13, "ips": 1, "mean": 0.74, "above": false}, "crowdsec": {"n": 2, "p": 0.0045, "hi": 2.01, "lo": 0.26, "ips": 2, "mean": 0.96, "above": false}, "phishing_db": {"n": 2, "p": 0.2135, "hi": 4.52, "lo": 0.59, "ips": 2, "mean": 2.16, "above": false}}, "h2": [["2026-10-05", 0.115, 0.300, 0, false], ["2026-10-12", 0.120, 0.311, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.311, "se": 1.137, "ts": 1.000, "map": 1.265, "obs": 2, "own": 0.550, "comp": {"urlhaus": -0.5785, "threatfox": -0.3862, "phishing_db": 2.8257}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.120, "se": 0.833, "ts": 1.000, "map": 0.414, "obs": 2, "own": 0.084, "comp": {"cins": -0.417, "dshield": -0.8565, "crowdsec": 4.5342, "vulncheck": -0.6148, "blocklist_de": -2.1341}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.518, "det": {"shodan": {"compromised": 1}}, "oid": "SGL-197-ARIN", "org": "Nebula Global LLC", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "1-5Tbps", "pol": "Open", "web": "https://as18186.nebulaglobal.com/"}, "pfx": 595, "reg": "2024-09-25", "rir": "arin", "s24": 802, "sib": 1, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 325120, "abuse": "abuse@nebulaglobal.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00320471636743}, {"a": 18206, "h": "TTSSB-MY", "n": "VADS Berhad", "t": "Broadband & mobile", "w": 9, "cc": "MY", "cf": null, "cs": {"c": {"first_seen_30d": 4, "ssh_bruteforce": 8}, "n": 8}, "ev": {"dshield": {"n": 1, "p": 0.1784, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 5, "p": 0.8276, "hi": 8.48, "lo": 2.11, "ips": 8, "mean": 4.84, "above": true}, "blocklist_de": {"n": 6, "p": 0.9497, "hi": 10.80, "lo": 3.00, "ips": 7, "mean": 6.38, "above": true}}, "h2": [["2026-10-05", 11.521, 0.011, 1, false], ["2026-10-12", 13.102, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 1.390, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 6}, "lo": 13.102, "se": 0.465, "ts": 0.500, "map": 23.552, "obs": 12, "own": 36.105, "comp": {"cins": -1.7721, "dshield": -0.6492, "crowdsec": -0.7626, "vulncheck": -0.9222, "blocklist_de": 8.659}, "mass": 11.7, "listed": false}}, "abq": false, "bot": 0.713, "det": {"blocklist_de": {"ssh": 7}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Restrictive", "web": "https://www.tmone.com.my/"}, "pfx": 76, "reg": "2002-05-06", "rir": "apnic", "s24": 90, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 32000, "abuse": "abuse@tm.com.my", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00017065311848}, {"a": 18207, "h": "YOU-INDIA-AP", "n": "YOU Broadband India Pvt. Ltd.", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0371, "hi": 2.79, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "urlhaus": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "vulncheck": {"n": 1, "p": 0.1342, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.007, 0.255, 0, false], ["2026-10-12", 0.061, 0.277, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.277, "se": 1.457, "ts": 1.000, "map": 2.337, "obs": 1, "own": 6.741, "comp": {"urlhaus": 3.4893, "threatfox": -0.3469, "phishing_db": -0.6672}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.061, "se": 1.114, "ts": 1.000, "map": 0.353, "obs": 1, "own": 0.615, "comp": {"cins": -0.1546, "dshield": -0.3533, "crowdsec": -1.3976, "vulncheck": 3.0611, "blocklist_de": -0.8045}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-18207-APNIC", "org": "YOU Broadband & Cable India Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.youbroadband.in"}, "pfx": 332, "reg": "2002-05-07", "rir": "apnic", "s24": 328, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 87040, "abuse": "abuse@youbroadband.co.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00316757445399}, {"a": 18209, "h": "CABLELITE-AS-AP", "n": "Atria Convergence Technologies", "t": "Broadband & mobile", "w": 22, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 8, "bad_crawling": 4, "proxy_or_vpn": 8, "ssh_bruteforce": 6, "web_bruteforce": 11, "home_connection": 13, "mail_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.3355, "hi": 5.52, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "shodan": {"n": 3, "p": 0.2467, "hi": 4.53, "lo": 0.80, "ips": 3, "mean": 2.34, "above": false}, "dshield": {"n": 2, "p": 0.3137, "hi": 5.34, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}, "crowdsec": {"n": 13, "p": 0.9978, "hi": 10.96, "lo": 4.49, "ips": 14, "mean": 7.43, "above": true}, "blocklist_de": {"n": 7, "p": 0.9446, "hi": 9.69, "lo": 2.93, "ips": 7, "mean": 5.90, "above": true}}, "h2": [["2026-10-05", 7.333, 0.254, 0, false], ["2026-10-12", 7.950, 0.011, 0, false]], "sh": false, "uc": 190, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.922, "ts": null, "map": 0.163, "obs": 0, "own": 0.952, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 7}, "lo": 7.950, "se": 0.410, "ts": 0.542, "map": 12.968, "obs": 24, "own": 19.877, "comp": {"cins": 1.919, "dshield": -0.8203, "crowdsec": 1.9121, "vulncheck": -0.968, "blocklist_de": 1.9133}, "mass": 23.8, "listed": false}}, "abq": false, "bot": 0.137, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3, "bots": 3, "mail": 1}}, "oid": "ORG-ACTP1-AP-APNIC", "org": "Atria Convergence Technologies Pvt. Ltd.,", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Restrictive", "web": "http://www.actcorp.in"}, "pfx": 133, "reg": "2007-02-05", "rir": "apnic", "s24": 333, "sib": 4, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 85248, "abuse": "abuse@actcorp.in", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.02196836120256}, {"a": 18222, "h": "DATAHUB-AS-AP", "n": "Data Hub Nepal", "t": "Other", "w": 3, "cc": "NP", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "crowdsec": {"n": 2, "p": 0.3918, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.408, 0.011, 0, false], ["2026-10-12", 6.275, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.275, "se": 0.786, "ts": 0.667, "map": 20.142, "obs": 3, "own": 11.552, "comp": {"cins": -0.4514, "dshield": -0.9151, "crowdsec": 4.1315, "vulncheck": -0.6359, "blocklist_de": 2.2674}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.813, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-DHPL2-AP-APNIC", "org": "Data Hub Pvt. Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://datahub.com.np"}, "pfx": 16, "reg": "2017-04-12", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "support@datahub.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000128803773}, {"a": 18229, "h": "CTRLS-AS-IN", "n": "CtrlS Datacenters", "t": "Hosting & VPS", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1216, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "shodan": {"n": 11, "p": 0.9737, "hi": 8.74, "lo": 3.32, "ips": 11, "mean": 5.76, "above": true}, "urlhaus": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 2, "p": 0.0287, "hi": 2.68, "lo": 0.35, "ips": 2, "mean": 1.28, "above": false}, "phishing_db": {"n": 1, "p": 0.1123, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.664, 0.625, 0, false], ["2026-10-12", 0.351, 0.668, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.668, "se": 1.160, "ts": 0.500, "map": 3.009, "obs": 2, "own": 1.235, "comp": {"urlhaus": 2.6619, "threatfox": -0.4376, "phishing_db": 0.5036}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.351, "se": 0.725, "ts": 0.667, "map": 1.002, "obs": 3, "own": 0.201, "comp": {"cins": 3.9141, "dshield": -1.1632, "crowdsec": 2.4315, "vulncheck": -0.7123, "blocklist_de": -3.0744}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.476, "det": {"shodan": {"compromised": 11}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.ctrls.in"}, "pfx": 504, "reg": "2005-04-06", "rir": "apnic", "s24": 507, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 129792, "abuse": "abuse@ctrls.in", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00388450811064}, {"a": 18362, "h": "NETWAY-AS-AP", "n": "Netway Communication Co.,Ltd.", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NCCL1-AP-APNIC", "org": "Netway Communication Co., Ltd", "pdb": null, "pfx": 7, "reg": "2002-08-07", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@netway.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000123590241}, {"a": 18371, "h": "NCABLE-AP", "n": "Neighbourhood Cable", "t": "Broadband & mobile", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0658, "hi": 3.23, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 1.084, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.700, "ts": null, "map": 0.117, "obs": 0, "own": 0.303, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 25, "reg": "2002-08-22", "rir": "apnic", "s24": 220, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 56320, "abuse": "abuse1@aapt.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0018216917244}, {"a": 18385, "h": "LMCSCL-AS-AP", "n": "Laos Mobile Communications Sole Co., Ltd", "t": "Broadband & mobile", "w": 0, "cc": "LA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.805, "det": null, "oid": "ORG-AA358-AP-APNIC", "org": "Laos Mobile Communications Sole Co., Ltd", "pdb": null, "pfx": 2, "reg": "2002-10-21", "rir": "apnic", "s24": 2, "sib": 3, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18403, "h": "FPT-VN", "n": "FPT Telecom", "t": "Broadband & mobile", "w": 56, "cc": "VN", "cf": {"rb": "", "wb": "", "rep": 1.03, "waf": 0.94}, "cs": {"c": {"http_flood": 6, "web_exploit": 10, "bad_crawling": 3, "proxy_or_vpn": 7, "ssh_bruteforce": 19, "web_bruteforce": 10, "home_connection": 21, "mail_bruteforce": 8, "router_or_botnet": 5, "cve:CVE-2024-6387": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-87902": 1}, "n": 28}, "ev": {"cins": {"n": 1, "p": 0.0005, "hi": 1.42, "lo": 0.11, "ips": 1, "mean": 0.60, "above": false}, "shodan": {"n": 25, "p": 0.0132, "hi": 2.71, "lo": 1.42, "ips": 25, "mean": 2.02, "above": false}, "dshield": {"n": 8, "p": 0.1557, "hi": 3.61, "lo": 1.17, "ips": 8, "mean": 2.25, "above": false}, "urlhaus": {"n": 3, "p": 0.3354, "hi": 5.12, "lo": 0.90, "ips": 3, "mean": 2.64, "above": false}, "crowdsec": {"n": 26, "p": 0.0005, "hi": 2.29, "lo": 1.21, "ips": 28, "mean": 1.71, "above": false}, "vulncheck": {"n": 5, "p": 0.0239, "hi": 2.69, "lo": 0.67, "ips": 5, "mean": 1.53, "above": false}, "blocklist_de": {"n": 21, "p": 0.5703, "hi": 4.35, "lo": 2.14, "ips": 22, "mean": 3.16, "above": false}}, "h2": [["2026-10-05", 0.964, 0.401, 0, false], ["2026-10-12", 1.273, 0.387, 0, false]], "sh": false, "uc": 89.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.387, "se": 1.017, "ts": 1.000, "map": 1.265, "obs": 3, "own": 3.378, "comp": {"urlhaus": 3.5388, "threatfox": -0.5518, "phishing_db": -1.1254}, "mass": 10.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 8, "crowdsec": 26, "vulncheck": 5, "blocklist_de": 21}, "lo": 1.273, "se": 0.381, "ts": 0.426, "map": 1.986, "obs": 61, "own": 3.056, "comp": {"cins": -2.2736, "dshield": 0.394, "crowdsec": -1.0421, "vulncheck": -0.492, "blocklist_de": 5.4933}, "mass": 61.1, "listed": false}}, "abq": true, "bot": 0.241, "det": {"shodan": {"c2": 2, "malware": 1, "compromised": 22}, "vulncheck": {"c2_server": 1, "botnet_node": 4}, "blocklist_de": {"ssh": 12, "bots": 6, "imap": 3, "mail": 4}}, "oid": "@aut-18403-APNIC", "org": "FPT Telecom Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.fpt.vn"}, "pfx": 4725, "reg": "2003-01-03", "rir": "apnic", "s24": 5554, "sib": 0, "tor": 0, "w24": 54, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6209280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.280429}, {"a": 18427, "h": "WARNERLINK", "n": "SUSTAINATEGY LIMITED", "t": "Other", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.253, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-18427-APNIC", "org": "SUSTAINATEGY LIMITED", "pdb": null, "pfx": 3, "reg": "2002-12-20", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18429, "h": "EXTRALAN-TW", "n": "Extra-Lan Technologies", "t": "Other", "w": 2, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0861, "hi": 3.49, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "dshield": {"n": 1, "p": 0.1620, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "phishing_db": {"n": 1, "p": 0.1653, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.008, 0.230, 0, false], ["2026-10-12", 0.122, 0.241, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.241, "se": 1.430, "ts": 1.000, "map": 1.883, "obs": 1, "own": 2.222, "comp": {"urlhaus": -0.2059, "threatfox": -0.2177, "phishing_db": 2.6826}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.122, "se": 1.164, "ts": 1.000, "map": 0.796, "obs": 1, "own": 0.495, "comp": {"cins": -0.1778, "dshield": 4.2447, "crowdsec": -1.5906, "vulncheck": -0.3875, "blocklist_de": -0.9237}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.226, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-18429-APNIC", "org": "Extra-Lan Technologies Co., LTD", "pdb": null, "pfx": 49, "reg": "2002-12-20", "rir": "apnic", "s24": 168, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59392, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0012357912459}, {"a": 18447, "h": "AFFINITY-INTER", "n": "HDC/HW Enterprise, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.929, "det": {"shodan": {"compromised": 1}}, "oid": "WCP32-ARIN", "org": "HDC/HW Enterprise, LLC", "pdb": null, "pfx": 6, "reg": "2000-08-29", "rir": "arin", "s24": 6, "sib": 15, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@hostmysite.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18450, "h": "WEBNX", "n": "WebNX", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1}, "n": 2}, "ev": {"shodan": {"n": 11, "p": 0.9894, "hi": 9.98, "lo": 3.79, "ips": 11, "mean": 6.58, "above": true}, "crowdsec": {"n": 1, "p": 0.0162, "hi": 2.34, "lo": 0.18, "ips": 2, "mean": 0.99, "above": false}, "threatfox": {"n": 1, "p": 0.1741, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "vulncheck": {"n": 2, "p": 0.3014, "hi": 5.24, "lo": 0.68, "ips": 2, "mean": 2.49, "above": false}, "phishing_db": {"n": 1, "p": 0.1291, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.0754, "hi": 3.36, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.396, 0.490, 0, false], ["2026-10-12", 0.475, 0.501, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.501, "se": 1.138, "ts": 0.500, "map": 2.104, "obs": 2, "own": 0.885, "comp": {"urlhaus": -0.4803, "threatfox": 1.4983, "phishing_db": 1.352}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.475, "se": 0.681, "ts": 0.500, "map": 1.231, "obs": 4, "own": 0.250, "comp": {"cins": -0.5737, "dshield": -1.1113, "crowdsec": -0.7905, "vulncheck": 2.5841, "blocklist_de": 1.4928}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.621, "det": {"shodan": {"c2": 4, "compromised": 4, "doublepulsar": 3}, "threatfox": {"family:Tsundere": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"apache": 1}}, "oid": "WEBNX-ARIN", "org": "WebNX, Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://WebNX.com"}, "pfx": 161, "reg": "2007-07-27", "rir": "arin", "s24": 386, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 142848, "abuse": "abuse@webnx.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.01251448814046}, {"a": 18501, "h": "JOESD-18501", "n": "CyberCloud Professionals LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.6726, "hi": 7.27, "lo": 1.57, "ips": 4, "mean": 3.97, "above": false}, "crowdsec": {"n": 1, "p": 0.0942, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "phishing_db": {"n": 1, "p": 0.1742, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.142, 0.267, 0, false], ["2026-10-12", 0.149, 0.279, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.279, "se": 1.450, "ts": 1.000, "map": 2.302, "obs": 1, "own": 1.036, "comp": {"urlhaus": -0.1826, "threatfox": -0.2004, "phishing_db": 2.8429}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.149, "se": 1.189, "ts": 1.000, "map": 1.023, "obs": 1, "own": 0.223, "comp": {"cins": -0.1651, "dshield": -0.3755, "crowdsec": 3.1847, "vulncheck": -0.3692, "blocklist_de": -0.8585}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.928, "det": {"shodan": {"compromised": 4}}, "oid": "JOESD-ARIN", "org": "CyberCloud Professionals LLC", "pdb": null, "pfx": 121, "reg": "2024-08-09", "rir": "arin", "s24": 121, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51456, "abuse": "abuse@patmos.tech", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18526, "h": "DDPS", "n": "DDPS Networks (Global)", "t": "Broadband & mobile", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.598, "det": null, "oid": "DNL-50-ARIN", "org": "DDPS Networks, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://ddps.jp"}, "pfx": 31, "reg": "2020-02-19", "rir": "arin", "s24": 32, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "abuse@ddps.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005816815394}, {"a": 18530, "h": "ISOMEDIA-1", "n": "IsoFusion, Inc.", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0559, "hi": 3.09, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}}, "h2": [["2026-10-05", 0.090, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.170, "obs": 0, "own": 1.041, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.683, "ts": null, "map": 0.111, "obs": 0, "own": 0.280, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.243, "det": {"shodan": {"compromised": 1}}, "oid": "ISOM-ARIN", "org": "Isomedia, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.isofusion.com"}, "pfx": 83, "reg": "2000-09-08", "rir": "arin", "s24": 251, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80384, "abuse": "abuse@isomedia.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18678, "h": "", "n": "InterNexa", "t": "Transit & backbone", "w": 8, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 5, "router_or_botnet": 4, "cve:CVE-2017-9841": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0143, "hi": 2.29, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}, "crowdsec": {"n": 5, "p": 0.2993, "hi": 4.50, "lo": 1.12, "ips": 5, "mean": 2.57, "above": false}, "blocklist_de": {"n": 3, "p": 0.3229, "hi": 5.04, "lo": 0.89, "ips": 3, "mean": 2.60, "above": false}}, "h2": [["2026-10-05", 0.947, 0.009, 0, false], ["2026-10-12", 1.427, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.891, "ts": null, "map": 0.152, "obs": 0, "own": 1.180, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.427, "se": 0.518, "ts": 0.625, "map": 2.776, "obs": 8, "own": 8.719, "comp": {"cins": -1.3501, "dshield": -2.0406, "crowdsec": 3.1284, "vulncheck": -0.8799, "blocklist_de": 3.5571}, "mass": 7.8, "listed": false}}, "abq": false, "bot": 0.207, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "@aut-18678-LACNIC", "org": "INTERNEXA S.A. E.S.P", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.internexa.com"}, "pfx": 332, "reg": "2000-09-28", "rir": "lacnic", "s24": 503, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 247040, "abuse": "adminred@internexa.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01280125822261}, {"a": 18734, "h": "", "n": "Bestel", "t": "Broadband & mobile", "w": 9, "cc": "MX", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 6, "mail_bruteforce": 3, "router_or_botnet": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.0026, "hi": 1.74, "lo": 0.13, "ips": 1, "mean": 0.74, "above": false}, "dshield": {"n": 1, "p": 0.0717, "hi": 3.31, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "crowdsec": {"n": 6, "p": 0.1712, "hi": 3.77, "lo": 1.05, "ips": 6, "mean": 2.23, "above": false}, "vulncheck": {"n": 2, "p": 0.2016, "hi": 4.43, "lo": 0.57, "ips": 2, "mean": 2.11, "above": false}, "phishing_db": {"n": 1, "p": 0.0792, "hi": 3.40, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "blocklist_de": {"n": 1, "p": 0.0247, "hi": 2.55, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}}, "h2": [["2026-10-05", 0.722, 0.103, 0, false], ["2026-10-12", 0.906, 0.109, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.109, "se": 1.360, "ts": 1.000, "map": 0.691, "obs": 1, "own": 2.130, "comp": {"urlhaus": -0.3453, "threatfox": -0.2996, "phishing_db": 1.9015}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.906, "se": 0.500, "ts": 0.600, "map": 1.706, "obs": 10, "own": 2.644, "comp": {"cins": -1.3342, "dshield": 0.2531, "crowdsec": 5.533, "vulncheck": 0.5509, "blocklist_de": -3.0753}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-13440-LACNIC", "org": "Operbes, S.A. de C.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.bestel.com.mx"}, "pfx": 179, "reg": "2000-10-05", "rir": "lacnic", "s24": 805, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 270080, "abuse": "abuse@bestel.com.mx", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0082291494272}, {"a": 18779, "h": "EGIHOSTING", "n": "Energy Group Networks", "t": "Hosting & VPS", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 4, "bad_crawling": 5, "cve:CVE-2024-38475": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.0009, "hi": 1.66, "lo": 0.22, "ips": 5, "mean": 0.79, "above": false}, "phishing_db": {"n": 2, "p": 0.1694, "hi": 4.16, "lo": 0.54, "ips": 4, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.0126, "hi": 2.23, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}}, "h2": [["2026-10-05", 0.165, 0.249, 0, false], ["2026-10-12", 0.183, 0.257, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.257, "se": 1.138, "ts": 1.000, "map": 1.033, "obs": 2, "own": 0.457, "comp": {"urlhaus": -0.6104, "threatfox": -0.395, "phishing_db": 2.6638}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.183, "se": 0.713, "ts": 0.667, "map": 0.509, "obs": 3, "own": 0.102, "comp": {"cins": -0.6343, "dshield": -1.2023, "crowdsec": 2.1643, "vulncheck": -0.7227, "blocklist_de": 1.1129}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.897, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "EGNL-1-ARIN", "org": "EGIHosting", "pdb": {"t": "Enterprise", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://egihosting.com"}, "pfx": 786, "reg": "2007-08-02", "rir": "arin", "s24": 1049, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 340224, "abuse": "abuse@egihosting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01799140286834}, {"a": 18809, "h": "", "n": "Cable Onda", "t": "Broadband & mobile", "w": 13, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 6, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0268, "hi": 2.59, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.91, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "dshield": {"n": 1, "p": 0.0149, "hi": 2.30, "lo": 0.17, "ips": 1, "mean": 0.97, "above": false}, "urlhaus": {"n": 1, "p": 0.1312, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 9, "p": 0.0107, "hi": 2.52, "lo": 0.87, "ips": 9, "mean": 1.61, "above": false}, "blocklist_de": {"n": 3, "p": 0.0169, "hi": 2.50, "lo": 0.44, "ips": 3, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.543, 0.104, 0, false], ["2026-10-12", 0.728, 0.116, 0, false]], "sh": false, "uc": 50.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.116, "se": 1.362, "ts": 1.000, "map": 0.773, "obs": 1, "own": 2.260, "comp": {"urlhaus": 2.6683, "threatfox": -0.4371, "phishing_db": -0.8624}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.728, "se": 0.456, "ts": 0.643, "map": 1.279, "obs": 14, "own": 1.976, "comp": {"cins": 0.9855, "dshield": -0.973, "crowdsec": 3.8565, "vulncheck": -0.9358, "blocklist_de": -1.2935}, "mass": 14.0, "listed": false}}, "abq": true, "bot": 0.210, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-52264-LACNIC", "org": "Cable Onda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.tigo.com.pa"}, "pfx": 738, "reg": "2000-10-13", "rir": "lacnic", "s24": 1965, "sib": 8, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1606912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01936335550596}, {"a": 18859, "h": "GVEC-NET", "n": "GVEC", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1489, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 2, "p": 0.1350, "hi": 3.87, "lo": 0.50, "ips": 2, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1109, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.637, 0.010, 0, false], ["2026-10-12", 1.047, 0.011, 0, false]], "sh": false, "uc": 226.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.061, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.047, "se": 0.655, "ts": 0.500, "map": 2.637, "obs": 4, "own": 4.108, "comp": {"cins": -0.7226, "dshield": 1.9683, "crowdsec": 1.3064, "vulncheck": -0.7537, "blocklist_de": 0.5649}, "mass": 3.5, "listed": false}}, "abq": true, "bot": 0.163, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "GVEC-ARIN", "org": "GVEC.net, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.gvec.net"}, "pfx": 12, "reg": "2000-10-18", "rir": "arin", "s24": 236, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 60416, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18881, "h": "", "n": "TELEFÔNICA BRASIL AS18881", "t": "Broadband & mobile", "w": 71, "cc": "BR", "cf": {"rb": "", "wb": "", "rep": 0.60, "waf": 0.62}, "cs": {"c": {"http_flood": 2, "web_exploit": 11, "bad_crawling": 1, "proxy_or_vpn": 3, "first_seen_30d": 2, "ssh_bruteforce": 40, "web_bruteforce": 45, "home_connection": 47, "mail_bruteforce": 39, "router_or_botnet": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2026-27771": 1}, "n": 55}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.73, "lo": 0.10, "ips": 2, "mean": 0.35, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.16, "lo": 0.02, "ips": 2, "mean": 0.08, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.44, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}, "crowdsec": {"n": 52, "p": 0.0000, "hi": 1.34, "lo": 0.85, "ips": 55, "mean": 1.09, "above": false}, "blocklist_de": {"n": 44, "p": 0.0150, "hi": 2.79, "lo": 1.71, "ips": 44, "mean": 2.22, "above": false}}, "h2": [["2026-10-05", 0.687, 0.004, 0, false], ["2026-10-12", 0.755, 0.005, 0, false]], "sh": false, "uc": 83.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.649, "ts": null, "map": 0.044, "obs": 0, "own": 0.200, "comp": null, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 52, "vulncheck": 0, "blocklist_de": 44}, "lo": 0.755, "se": 0.372, "ts": 0.525, "map": 1.157, "obs": 99, "own": 1.783, "comp": {"cins": -2.4626, "dshield": -3.1601, "crowdsec": -0.3451, "vulncheck": -1.0061, "blocklist_de": 8.513}, "mass": 115.3, "listed": false}}, "abq": false, "bot": 0.126, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 11, "bots": 6, "imap": 14, "mail": 26, "apache": 1, "bruteforcelogin": 1}}, "oid": "@family-59211", "org": "TELEFÔNICA BRASIL S.A", "pdb": {"t": null, "sc": "South America", "tr": null, "pol": "Open", "web": "http://www.telefonica.com.br"}, "pfx": 948, "reg": "2000-10-23", "rir": "lacnic", "s24": 17968, "sib": 11, "tor": 0, "w24": 68, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8800768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.24929}, {"a": 18883, "h": "FIBERNET-NETWORK-OPERATIONS-CENTER", "n": "FiberNet Communications", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 1.101, 0.011, 0, false], ["2026-10-12", 0.250, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 1.590, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.250, "se": 1.260, "ts": 1.000, "map": 1.967, "obs": 1, "own": 3.456, "comp": {"cins": -0.1347, "dshield": -0.3105, "crowdsec": 3.5386, "vulncheck": -0.3213, "blocklist_de": -0.702}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "FCL-70-ARIN", "org": "FiberNet Communications L.C.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": null}, "pfx": 40, "reg": "2011-01-04", "rir": "arin", "s24": 51, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": "noc@premieronline.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 18978, "h": "ENZUINC-US", "n": "Enzu Inc.", "t": "Hosting & VPS", "w": 21, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1115, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "crowdsec": {"n": 3, "p": 0.0506, "hi": 3.01, "lo": 0.53, "ips": 3, "mean": 1.55, "above": false}, "threatfox": {"n": 1, "p": 0.1619, "hi": 4.35, "lo": 0.33, "ips": 2, "mean": 1.83, "above": false}, "vulncheck": {"n": 2, "p": 0.2478, "hi": 4.80, "lo": 0.62, "ips": 2, "mean": 2.29, "above": false}, "phishing_db": {"n": 6, "p": 0.9024, "hi": 9.18, "lo": 2.55, "ips": 14, "mean": 5.43, "above": true}, "blocklist_de": {"n": 1, "p": 0.0436, "hi": 2.90, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}}, "h2": [["2026-10-05", 0.241, 1.616, 0, false], ["2026-10-12", 0.798, 1.900, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 6}, "lo": 1.900, "se": 0.870, "ts": 0.857, "map": 4.739, "obs": 7, "own": 1.824, "comp": {"urlhaus": -1.2168, "threatfox": 0.2517, "phishing_db": 4.147}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.798, "se": 0.560, "ts": 0.429, "map": 1.683, "obs": 7, "own": 0.335, "comp": {"cins": 2.9392, "dshield": -1.7422, "crowdsec": 1.1441, "vulncheck": 1.0321, "blocklist_de": -1.4592}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.864, "det": {"threatfox": {"family:PureRAT": 2}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ENZUI-ARIN", "org": "Enzu Inc", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.enzu.com"}, "pfx": 99, "reg": "2011-01-04", "rir": "arin", "s24": 594, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 164608, "abuse": "abuse@scalabledns.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00708391155214}, {"a": 18988, "h": "CITYWEST-CORP", "n": "City West Cable & Telephone", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0729, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "blocklist_de": {"n": 1, "p": 0.1340, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-12", 0.473, 0.011, 0, false]], "sh": false, "uc": 131, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.473, "se": 0.886, "ts": 0.500, "map": 1.833, "obs": 2, "own": 2.928, "comp": {"cins": -0.3746, "dshield": -0.7821, "crowdsec": 0.9817, "vulncheck": -0.5858, "blocklist_de": 2.7607}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.129, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "CWCTC-ARIN", "org": "City West Cable & Telephone Corp.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.citywest.ca"}, "pfx": 32, "reg": "2000-11-06", "rir": "arin", "s24": 161, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 66304, "abuse": "abuse@cwct.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011131773198}, {"a": 19108, "h": "SUDDENLINK-COMMUNICATIONS", "n": "Suddenlink Communications", "t": "Broadband & mobile", "w": 22, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.83, "waf": 0.73}, "cs": {"c": {"web_exploit": 5, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 13, "home_connection": 6, "mail_bruteforce": 15, "router_or_botnet": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 16}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 1.36, "lo": 0.24, "ips": 3, "mean": 0.70, "above": false}, "shodan": {"n": 5, "p": 0.0000, "hi": 0.43, "lo": 0.11, "ips": 5, "mean": 0.24, "above": false}, "urlhaus": {"n": 2, "p": 0.0586, "hi": 3.11, "lo": 0.40, "ips": 2, "mean": 1.48, "above": false}, "crowdsec": {"n": 15, "p": 0.0000, "hi": 0.76, "lo": 0.33, "ips": 16, "mean": 0.52, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 1.02, "lo": 0.31, "ips": 8, "mean": 0.62, "above": false}}, "h2": [["2026-10-05", 0.261, 0.038, 0, false], ["2026-10-12", 0.281, 0.124, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.124, "se": 1.130, "ts": 1.000, "map": 0.483, "obs": 2, "own": 1.409, "comp": {"urlhaus": 2.5354, "threatfox": -0.5396, "phishing_db": -1.0967}, "mass": 8.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 15, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.281, "se": 0.419, "ts": 0.600, "map": 0.464, "obs": 25, "own": 0.718, "comp": {"cins": 3.304, "dshield": -2.9756, "crowdsec": 1.5428, "vulncheck": -0.9755, "blocklist_de": -0.2699}, "mass": 28.7, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"imap": 6, "mail": 8}}, "oid": "SUDDE-ARIN", "org": "Optimum", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.suddenlink.com"}, "pfx": 408, "reg": "2000-11-20", "rir": "arin", "s24": 11093, "sib": 1, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6973696, "abuse": "abuse@suddenlink.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.087789}, {"a": 19122, "h": "ESTRUXTURE-ON-19122", "n": "eStruxture AS19122", "t": "Hosting & VPS", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3910, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.360, 0.011, 0, false], ["2026-10-12", 0.384, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.288, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 0.810, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.457, "det": {"shodan": {"malware": 1, "compromised": 1}}, "oid": "EDC-83-ARIN", "org": "eStruxture Data Centers Inc.", "pdb": {"t": "Network Services", "sc": "North America", "tr": null, "pol": "Open", "web": "https://www.estruxture.com/"}, "pfx": 6, "reg": "2007-08-07", "rir": "arin", "s24": 23, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@estruxture.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19133, "h": "BIRD-HOSTING", "n": "Innovative Scaling Technologies, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3503, "hi": 5.64, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.884, "ts": null, "map": 0.184, "obs": 0, "own": 0.086, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.932, "det": {"shodan": {"compromised": 2}}, "oid": "BIRDH-ARIN", "org": "Bird Hosting Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://innoscale.net"}, "pfx": 25, "reg": "2011-01-05", "rir": "arin", "s24": 54, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19148, "h": "LEASEWEB-USA-PHX", "n": "LeaseWeb / PHX-01", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0559, "hi": 3.09, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "crowdsec": {"n": 1, "p": 0.0404, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.090, 0.010, 0, false], ["2026-10-12", 0.094, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.170, "obs": 0, "own": 0.161, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.094, "se": 1.135, "ts": 1.000, "map": 0.578, "obs": 1, "own": 0.124, "comp": {"cins": -0.1923, "dshield": -0.4324, "crowdsec": 2.8757, "vulncheck": -0.4073, "blocklist_de": -0.9982}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.674, "det": {"shodan": {"compromised": 1}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": null, "tr": null, "pol": "Selective", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 45, "reg": "2018-03-07", "rir": "arin", "s24": 251, "sib": 9, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65280, "abuse": "abuse@us.leaseweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19165, "h": "WEBPASS", "n": "GFiber | Webpass", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.98, "lo": 0.13, "ips": 2, "mean": 0.47, "above": false}, "threatfox": {"n": 1, "p": 0.0960, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "vulncheck": {"n": 1, "p": 0.0144, "hi": 2.29, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.0007, "hi": 1.49, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.096, 0.058, 0, false], ["2026-10-12", 0.125, 0.061, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.061, "se": 1.340, "ts": 1.000, "map": 0.351, "obs": 1, "own": 1.154, "comp": {"urlhaus": -0.4315, "threatfox": 1.656, "phishing_db": -0.6467}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.125, "se": 0.654, "ts": 0.500, "map": 0.309, "obs": 4, "own": 0.488, "comp": {"cins": -0.7326, "dshield": -1.3419, "crowdsec": 1.2121, "vulncheck": 0.58, "blocklist_de": 0.5028}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.177, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"mail": 1}}, "oid": "WEBPA-ARIN", "org": "Webpass Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://gfiber.com/"}, "pfx": 52, "reg": "2005-05-31", "rir": "arin", "s24": 2045, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 525056, "abuse": "abuse@googlefiber.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00943893287418}, {"a": 19182, "h": "", "n": "TELEFÔNICA BRASIL AS19182", "t": "Other", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 4, "p": 0.2737, "hi": 4.51, "lo": 0.97, "ips": 4, "mean": 2.46, "above": false}}, "h2": [["2026-10-12", 0.362, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.132, "obs": 0, "own": 0.266, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.362, "se": 0.645, "ts": 1.000, "map": 0.895, "obs": 4, "own": 0.511, "comp": {"cins": -0.9402, "dshield": -1.6076, "crowdsec": -6.2901, "vulncheck": -0.8117, "blocklist_de": 10.9327}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.206, "det": {"blocklist_de": {"ssh": 1, "bots": 3}}, "oid": "@family-59211", "org": "TELEFÔNICA BRASIL S.A", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.telefonica.com.br"}, "pfx": 20, "reg": "2001-06-20", "rir": "lacnic", "s24": 960, "sib": 11, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 303104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00552209895678}, {"a": 19211, "h": "HOSTINGYARD", "n": "HostingYard LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 545.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.189, "obs": 0, "own": 0.092, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.198, "det": null, "oid": "HL-736-ARIN", "org": "HostingYard LLC", "pdb": null, "pfx": 28, "reg": "2025-10-23", "rir": "arin", "s24": 48, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19224, "h": "QSGIT", "n": "QSGIT", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 2.476, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 1.767, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.195, "det": {"shodan": {"compromised": 1}}, "oid": "QSGL-3-ARIN", "org": "Quantum Services Group, LLC.", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Open", "web": "https://qsgit.com"}, "pfx": 14, "reg": "2015-03-20", "rir": "arin", "s24": 33, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": "noc@qsgit.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19233, "h": "DIALOGIX", "n": "Hawaii Dialogix Telecom LLC", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4024, "hi": 6.10, "lo": 0.79, "ips": 3, "mean": 2.91, "above": false}}, "h2": [["2026-10-12", 0.624, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 1.533, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.624, "se": 0.929, "ts": 1.000, "map": 2.511, "obs": 2, "own": 4.221, "comp": {"cins": -0.1994, "dshield": -0.4469, "crowdsec": -1.7668, "vulncheck": 5.7618, "blocklist_de": -1.0344}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.228, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "HONTE-1-ARIN", "org": "Dialogix Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.hawaiidt.com"}, "pfx": 20, "reg": "2007-08-07", "rir": "arin", "s24": 60, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19318, "h": "IS-AS-1", "n": "InterServer", "t": "Hosting & VPS", "w": 103, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.20, "waf": 1.05}, "cs": {"c": {"http_flood": 29, "data_centre": 19, "web_exploit": 30, "bad_crawling": 25, "proxy_or_vpn": 5, "first_seen_30d": 6, "ssh_bruteforce": 9, "web_bruteforce": 19, "home_connection": 1, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2017-9841": 7, "cve:CVE-2026-2652": 6, "cve:CVE-2018-13379": 3, "cve:CVE-2018-20062": 4, "cve:CVE-2026-63030": 3}, "n": 50}, "ev": {"cins": {"n": 9, "p": 0.9934, "hi": 12.16, "lo": 4.20, "ips": 9, "mean": 7.74, "above": true}, "shodan": {"n": 19, "p": 0.9999, "hi": 11.26, "lo": 5.35, "ips": 19, "mean": 8.08, "above": true}, "dshield": {"n": 2, "p": 0.2213, "hi": 4.59, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}, "crowdsec": {"n": 36, "p": 1.0000, "hi": 16.76, "lo": 9.73, "ips": 50, "mean": 13.04, "above": true}, "threatfox": {"n": 10, "p": 0.9993, "hi": 15.34, "lo": 5.58, "ips": 10, "mean": 9.95, "above": true}, "vulncheck": {"n": 8, "p": 0.9759, "hi": 10.59, "lo": 3.45, "ips": 8, "mean": 6.61, "above": true}, "phishing_db": {"n": 20, "p": 1.0000, "hi": 21.73, "lo": 10.52, "ips": 20, "mean": 15.70, "above": true}, "blocklist_de": {"n": 5, "p": 0.5772, "hi": 6.04, "lo": 1.50, "ips": 6, "mean": 3.45, "above": false}}, "h2": [["2026-10-05", 7.701, 8.525, 0, false], ["2026-10-12", 8.755, 6.876, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 10, "phishing_db": 20}, "lo": 6.876, "se": 0.746, "ts": 0.667, "map": 14.091, "obs": 30, "own": 5.050, "comp": {"urlhaus": -2.1806, "threatfox": 1.8876, "phishing_db": 4.5647}, "mass": 12.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 9, "dshield": 2, "crowdsec": 36, "vulncheck": 8, "blocklist_de": 5}, "lo": 8.755, "se": 0.377, "ts": 0.600, "map": 13.497, "obs": 60, "own": 2.635, "comp": {"cins": 8.7902, "dshield": -2.1548, "crowdsec": 6.2421, "vulncheck": -0.0413, "blocklist_de": -8.8401}, "mass": 51.4, "listed": false}}, "abq": false, "bot": 0.470, "det": {"shodan": {"c2": 3, "compromised": 16}, "threatfox": {"family:PureRAT": 4, "family:AsyncRAT": 4, "family:Evilginx": 1, "family:Unknown RAT": 1}, "vulncheck": {"c2_server": 4, "botnet_node": 3, "attack_tooling": 1}, "blocklist_de": {"ssh": 6}}, "oid": "INTER-83-ARIN", "org": "Interserver, Inc", "pdb": {"t": "Content", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://interserver.net"}, "pfx": 119, "reg": "2005-12-09", "rir": "arin", "s24": 691, "sib": 1, "tor": 1, "w24": 80, "drop": 1, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 214272, "abuse": "abusencc@interserver.net", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "cins"], "traffic": 0.061215}, {"a": 19429, "h": "", "n": "ETB - Colombia", "t": "Hosting & VPS", "w": 15, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2025-55182": 1}, "n": 3}, "ev": {"cins": {"n": 3, "p": 0.0666, "hi": 3.18, "lo": 0.56, "ips": 3, "mean": 1.64, "above": false}, "dshield": {"n": 1, "p": 0.0019, "hi": 1.67, "lo": 0.13, "ips": 1, "mean": 0.70, "above": false}, "urlhaus": {"n": 1, "p": 0.0957, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.77, "lo": 0.14, "ips": 3, "mean": 0.40, "above": false}, "blocklist_de": {"n": 7, "p": 0.0325, "hi": 2.83, "lo": 0.86, "ips": 7, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.329, 0.077, 0, false], ["2026-10-12", 0.561, 0.085, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.085, "se": 1.343, "ts": 1.000, "map": 0.540, "obs": 1, "own": 0.249, "comp": {"urlhaus": 2.3773, "threatfox": -0.4582, "phishing_db": -0.9096}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.561, "se": 0.455, "ts": 0.500, "map": 0.983, "obs": 14, "own": 0.193, "comp": {"cins": 5.4295, "dshield": -1.4688, "crowdsec": -6.8804, "vulncheck": -0.9548, "blocklist_de": 5.251}, "mass": 18.6, "listed": false}}, "abq": true, "bot": 0.150, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 5, "mail": 1, "apache": 1}}, "oid": "@aut-19429-LACNIC", "org": "ETB - Colombia", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.etb.com"}, "pfx": 681, "reg": "2001-01-05", "rir": "lacnic", "s24": 3407, "sib": 0, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2034688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03114208614642}, {"a": 19527, "h": "GOOGLE-2", "n": "Google LLC AS19527", "t": "Hyperscale cloud", "w": 227, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 73, "data_centre": 208, "web_exploit": 224, "bad_crawling": 182, "proxy_or_vpn": 4, "first_seen_30d": 213, "web_bruteforce": 201, "home_connection": 3, "router_or_botnet": 3, "cve:CVE-2025-55182": 216}, "n": 227}, "ev": {"shodan": {"n": 15, "p": 0.9517, "hi": 6.94, "lo": 3.01, "ips": 15, "mean": 4.81, "above": true}, "crowdsec": {"n": 190, "p": 1.0000, "hi": 54.99, "lo": 43.33, "ips": 227, "mean": 49.01, "above": true}}, "h2": [["2026-10-05", 18.047, 0.008, 2, false], ["2026-10-12", 14.301, 0.009, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.128, "obs": 0, "own": 0.180, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 190, "vulncheck": 0, "blocklist_de": 0}, "lo": 14.301, "se": 0.352, "ts": 1.000, "map": 21.097, "obs": 190, "own": 8.625, "comp": {"cins": -3.9207, "dshield": -3.4298, "crowdsec": 29.2612, "vulncheck": -1.0071, "blocklist_de": -16.4608}, "mass": 126.5, "listed": true}}, "abq": true, "bot": 0.977, "det": {"shodan": {"c2": 2, "compromised": 10, "doublepulsar": 3}}, "oid": "GOOGL-2-ARIN", "org": "Google LLC", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Restrictive", "web": "https://cloud.google.com/"}, "pfx": 89, "reg": "2007-08-17", "rir": "arin", "s24": 1090, "sib": 10, "tor": 0, "w24": 190, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.0690]], "ipv4": 279552, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.03431177087206}, {"a": 19531, "h": "NODESDIRECT", "n": "Nodes Direct Holdings", "t": "Broadband & mobile", "w": 11, "cc": "US", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 6, "p": 0.9532, "hi": 10.98, "lo": 3.05, "ips": 11, "mean": 6.49, "above": true}}, "h2": [["2026-10-05", 0.008, 5.028, 0, false], ["2026-10-12", 0.008, 5.063, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 6}, "lo": 5.063, "se": 0.856, "ts": 1.000, "map": 12.883, "obs": 6, "own": 30.338, "comp": {"urlhaus": -0.9915, "threatfox": -0.4699, "phishing_db": 5.6435}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.742, "ts": null, "map": 0.133, "obs": 0, "own": 0.368, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.623, "det": null, "oid": "SERVE-57-ARIN", "org": "Nodes Direct", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "http://nodesdirect.com"}, "pfx": 12, "reg": "2011-01-12", "rir": "arin", "s24": 160, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 43008, "abuse": "abuse@nodesdirect.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 19624, "h": "SERVERROOM", "n": "SERVERROOM", "t": "Hosting & VPS", "w": 9, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 6, "p": 0.9653, "hi": 11.75, "lo": 3.26, "ips": 9, "mean": 6.95, "above": true}}, "h2": [["2026-10-05", 6.962, 0.011, 0, false], ["2026-10-12", 10.071, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.309, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 6, "blocklist_de": 0}, "lo": 10.071, "se": 0.619, "ts": 1.000, "map": 22.968, "obs": 6, "own": 4.691, "comp": {"cins": -0.4312, "dshield": -0.8808, "crowdsec": -3.4686, "vulncheck": 11.5128, "blocklist_de": -2.2045}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.427, "det": {"vulncheck": {"c2_server": 1, "botnet_node": 8}}, "oid": null, "org": null, "pdb": null, "pfx": 13, "reg": "2006-03-29", "rir": "arin", "s24": 15, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 3840, "abuse": "support@serverroom.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00028636695855}, {"a": 19627, "h": "SOCANTEL-001", "n": "South Canaan Telephone Company of PA", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.898, 0.011, 0, false], ["2026-10-12", 2.174, 0.012, 0, false]], "sh": false, "uc": 1341.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.174, "se": 0.963, "ts": 0.500, "map": 9.781, "obs": 2, "own": 5.763, "comp": {"cins": -0.2913, "dshield": -0.6287, "crowdsec": 1.8111, "vulncheck": -0.5174, "blocklist_de": 3.3004}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.189, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "SCTCP-ARIN", "org": "South Canaan Telephone Company of PA", "pdb": null, "pfx": 13, "reg": "2001-01-26", "rir": "arin", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19711, "h": "SWAZINET", "n": "Swaziland PTC", "t": "Broadband & mobile", "w": 1, "cc": "SZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1097, "hi": 3.77, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.1572, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.668, 0.011, 0, false], ["2026-10-12", 0.713, 0.012, 0, false]], "sh": false, "uc": 575.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.007, "ts": null, "map": 0.184, "obs": 0, "own": 1.364, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.713, "se": 0.904, "ts": 0.500, "map": 2.846, "obs": 2, "own": 4.552, "comp": {"cins": -0.3522, "dshield": -0.742, "crowdsec": 1.1983, "vulncheck": -0.5692, "blocklist_de": 2.9047}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.184, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-SP2-AFRINIC", "org": "SWAZILAND PTC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "Open", "web": "http://www.eptc.co.sz"}, "pfx": 57, "reg": "2010-11-24", "rir": "afrinic", "s24": 97, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00053107246454}, {"a": 19750, "h": "AS-CRITEO", "n": "Criteo USA", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.727, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.727, "se": 1.480, "ts": 1.000, "map": 8.547, "obs": 1, "own": 2.170, "comp": {"cins": -0.0699, "dshield": 4.8261, "crowdsec": -0.6569, "vulncheck": -0.1943, "blocklist_de": -0.3657}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "CRITE-6-ARIN", "org": "Criteo Corp.", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.criteo.com/"}, "pfx": 6, "reg": "2009-11-05", "rir": "arin", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@criteo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19766, "h": "DRYDEN-FIBER", "n": "Dryden Fiber", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.148, "det": null, "oid": "TD-441-ARIN", "org": "Dryden Fiber", "pdb": null, "pfx": 5, "reg": "2023-01-18", "rir": "arin", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19871, "h": "NETWORK-SOLUTIONS-HOSTING", "n": "Network Solutions, LLC", "t": "Hosting & VPS", "w": 65, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 5, "web_exploit": 6, "bad_crawling": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 10, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-41940": 4}, "n": 11}, "ev": {"cins": {"n": 2, "p": 0.2800, "hi": 5.06, "lo": 0.66, "ips": 2, "mean": 2.41, "above": false}, "shodan": {"n": 7, "p": 0.6426, "hi": 5.88, "lo": 1.78, "ips": 7, "mean": 3.58, "above": false}, "crowdsec": {"n": 10, "p": 0.8527, "hi": 6.69, "lo": 2.43, "ips": 11, "mean": 4.34, "above": true}, "phishing_db": {"n": 32, "p": 1.0000, "hi": 33.52, "lo": 18.83, "ips": 52, "mean": 25.73, "above": true}, "blocklist_de": {"n": 3, "p": 0.2855, "hi": 4.79, "lo": 0.84, "ips": 3, "mean": 2.47, "above": false}}, "h2": [["2026-10-05", 3.681, 9.006, 0, false], ["2026-10-12", 2.645, 8.976, 0, false]], "sh": false, "uc": 189.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 32}, "lo": 8.976, "se": 0.734, "ts": 1.000, "map": 18.240, "obs": 32, "own": 6.450, "comp": {"urlhaus": -2.2356, "threatfox": -0.5654, "phishing_db": 7.3308}, "mass": 13.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.645, "se": 0.448, "ts": 0.667, "map": 4.624, "obs": 15, "own": 0.907, "comp": {"cins": 3.7015, "dshield": -2.5697, "crowdsec": 4.5482, "vulncheck": -0.9403, "blocklist_de": -1.8149}, "mass": 14.8, "listed": false}}, "abq": true, "bot": 0.987, "det": {"shodan": {"compromised": 7}, "blocklist_de": {"ssh": 3}}, "oid": "NETWO-59-ARIN", "org": "Network Solutions, LLC", "pdb": null, "pfx": 168, "reg": "2006-09-06", "rir": "arin", "s24": 578, "sib": 1, "tor": 0, "w24": 43, "drop": 0, "hist": [["2026-10-05", 0.9966], ["2026-10-12", 0.0810]], "ipv4": 217088, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": ["crowdsec"], "traffic": null}, {"a": 19901, "h": "BRIGHTSPEED", "n": "Brightspeed", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.50, "waf": 1.31}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "home_connection": 1, "cve:CVE-2025-4396": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.79, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.64, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.15, "lo": 0.01, "ips": 1, "mean": 0.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.35, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}}, "h2": [["2026-10-05", 0.006, 0.005, 0, false], ["2026-10-12", 0.032, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.669, "ts": null, "map": 0.053, "obs": 0, "own": 0.238, "comp": null, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.032, "se": 0.628, "ts": 0.250, "map": 0.076, "obs": 4, "own": 0.120, "comp": {"cins": 3.1136, "dshield": 1.1749, "crowdsec": -3.6718, "vulncheck": -0.8195, "blocklist_de": -0.9804}, "mass": 5.1, "listed": false}}, "abq": true, "bot": 0.145, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "CHIL-10-ARIN", "org": "Brightspeed", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.brightspeed.com"}, "pfx": 1271, "reg": "2022-11-07", "rir": "arin", "s24": 11870, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3081216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.048778}, {"a": 19969, "h": "JOESDATACENTER", "n": "Patmos Network", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.2555, "hi": 4.86, "lo": 0.63, "ips": 2, "mean": 2.32, "above": false}, "crowdsec": {"n": 1, "p": 0.0845, "hi": 3.47, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.131, 0.010, 0, false], ["2026-10-12", 0.137, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 0.192, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.137, "se": 1.178, "ts": 1.000, "map": 0.924, "obs": 1, "own": 0.201, "comp": {"cins": -0.1699, "dshield": -0.3857, "crowdsec": 3.1297, "vulncheck": -0.3763, "blocklist_de": -0.8832}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.933, "det": {"shodan": {"compromised": 2}}, "oid": "JOESD-ARIN", "org": "CyberCloud Professionals LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://patmos.tech"}, "pfx": 19, "reg": "2008-03-17", "rir": "arin", "s24": 138, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 37376, "abuse": "abuse@patmos.tech", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 19994, "h": "RACKSPACE", "n": "Rackspace Hosting", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.87, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.72, "lo": 0.05, "ips": 1, "mean": 0.30, "above": false}, "phishing_db": {"n": 3, "p": 0.1446, "hi": 3.83, "lo": 0.67, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.056, 0.249, 0, false], ["2026-10-12", 0.021, 0.256, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.256, "se": 1.052, "ts": 1.000, "map": 0.841, "obs": 3, "own": 0.374, "comp": {"urlhaus": -0.8881, "threatfox": -0.4539, "phishing_db": 2.7951}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.021, "se": 1.008, "ts": 1.000, "map": 0.102, "obs": 1, "own": 0.021, "comp": {"cins": -0.2787, "dshield": -0.6047, "crowdsec": 1.9413, "vulncheck": -0.5055, "blocklist_de": -1.4388}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.971, "det": {"shodan": {"compromised": 1}}, "oid": "RACKS-8-ARIN", "org": "Rackspace Hosting", "pdb": null, "pfx": 65, "reg": "2010-01-15", "rir": "arin", "s24": 2098, "sib": 9, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 537088, "abuse": "abuse@rackspace.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20001, "h": "TWC-20001-PACWEST", "n": "Charter Communications (20001)", "t": "Broadband & mobile", "w": 88, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.53, "waf": 0.32}, "cs": {"c": {"http_flood": 17, "data_centre": 23, "web_exploit": 20, "bad_crawling": 4, "proxy_or_vpn": 29, "first_seen_30d": 7, "ssh_bruteforce": 13, "web_bruteforce": 16, "home_connection": 16, "mail_bruteforce": 15, "router_or_botnet": 31, "cve:CVE-2018-10562": 1, "cve:CVE-2022-39290": 3, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 52}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.71, "lo": 0.15, "ips": 6, "mean": 0.39, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.10, "lo": 0.01, "ips": 2, "mean": 0.05, "above": false}, "dshield": {"n": 9, "p": 0.0000, "hi": 0.97, "lo": 0.33, "ips": 9, "mean": 0.62, "above": false}, "urlhaus": {"n": 6, "p": 0.0863, "hi": 3.28, "lo": 0.91, "ips": 6, "mean": 1.94, "above": false}, "crowdsec": {"n": 45, "p": 0.0000, "hi": 0.76, "lo": 0.47, "ips": 52, "mean": 0.61, "above": false}, "vulncheck": {"n": 6, "p": 0.0000, "hi": 0.75, "lo": 0.21, "ips": 6, "mean": 0.44, "above": false}, "blocklist_de": {"n": 23, "p": 0.0000, "hi": 1.04, "lo": 0.53, "ips": 24, "mean": 0.77, "above": false}}, "h2": [["2026-10-05", 0.455, 0.225, 0, false], ["2026-10-12", 0.364, 0.253, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 6, "threatfox": 0, "phishing_db": 0}, "lo": 0.253, "se": 0.947, "ts": 1.000, "map": 0.654, "obs": 6, "own": 1.881, "comp": {"urlhaus": 2.9663, "threatfox": -0.5776, "phishing_db": -1.1871}, "mass": 30.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 9, "crowdsec": 45, "vulncheck": 6, "blocklist_de": 23}, "lo": 0.364, "se": 0.378, "ts": 0.517, "map": 0.563, "obs": 87, "own": 0.870, "comp": {"cins": -0.178, "dshield": -0.4185, "crowdsec": 1.3358, "vulncheck": -0.5794, "blocklist_de": 0.6597}, "mass": 88.3, "listed": false}}, "abq": false, "bot": 0.143, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 5, "attack_tooling": 1}, "blocklist_de": {"ssh": 6, "bots": 5, "imap": 13, "mail": 13}}, "oid": "CC-3517-ARIN", "org": "Charter Communications Inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.spectrum.com"}, "pfx": 601, "reg": "2001-03-13", "rir": "arin", "s24": 28187, "sib": 31, "tor": 0, "w24": 79, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8243968, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.356733}, {"a": 20011, "h": "NTT-DATA-Inc", "n": "NTT DATA, Broadband, South Africa", "t": "Broadband & mobile", "w": 13, "cc": "ZA", "cf": {"rb": "lo", "wb": null, "rep": 1.68, "waf": null}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0084, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "dshield": {"n": 2, "p": 0.0148, "hi": 2.39, "lo": 0.31, "ips": 2, "mean": 1.14, "above": false}, "urlhaus": {"n": 1, "p": 0.1039, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.70, "lo": 0.09, "ips": 2, "mean": 0.33, "above": false}, "blocklist_de": {"n": 7, "p": 0.0617, "hi": 3.10, "lo": 0.94, "ips": 7, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.134, 0.084, 0, false], ["2026-10-12", 0.495, 0.092, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.092, "se": 1.347, "ts": 1.000, "map": 0.583, "obs": 1, "own": 1.729, "comp": {"urlhaus": 2.4404, "threatfox": -0.454, "phishing_db": -0.9}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.495, "se": 0.469, "ts": 0.583, "map": 0.892, "obs": 12, "own": 1.379, "comp": {"cins": 0.8107, "dshield": 0.3678, "crowdsec": -7.1222, "vulncheck": -0.9411, "blocklist_de": 8.164}, "mass": 15.0, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"ssh": 1, "bots": 4, "imap": 1, "mail": 2}}, "oid": "ORG-DD1-AFRINIC", "org": "Dimension Data", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Tbps", "pol": "Selective", "web": "https://services.global.ntt/en-us/"}, "pfx": 969, "reg": "2001-03-14", "rir": "afrinic", "s24": 3031, "sib": 7, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1360384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0360807637855}, {"a": 20052, "h": "ARBOR", "n": "ARBOR", "t": "Other", "w": 14, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 14, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.007, 0.011, 0, false], ["2026-10-12", 1.139, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.139, "se": 1.630, "ts": 1.000, "map": 16.742, "obs": 1, "own": 14.184, "comp": {"cins": 5.134, "dshield": -0.11, "crowdsec": -0.4361, "vulncheck": -0.1359, "blocklist_de": -0.2405}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ARBORN-ARIN", "org": "Arbor Networks, Inc.", "pdb": null, "pfx": 1, "reg": "2001-03-19", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "hostmaster@netscout.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20055, "h": "AS-WHOLESAIL", "n": "Ziply Fiber", "t": "Broadband & mobile", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "mail_bruteforce": 3}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.0012, "hi": 1.58, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.97, "lo": 0.24, "ips": 5, "mean": 0.55, "above": false}, "vulncheck": {"n": 2, "p": 0.0070, "hi": 2.13, "lo": 0.28, "ips": 2, "mean": 1.02, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.26, "lo": 0.16, "ips": 2, "mean": 0.60, "above": false}}, "h2": [["2026-10-05", 0.199, 0.006, 0, false], ["2026-10-12", 0.219, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.740, "ts": null, "map": 0.086, "obs": 0, "own": 0.387, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 2}, "lo": 0.219, "se": 0.502, "ts": 0.500, "map": 0.417, "obs": 10, "own": 0.650, "comp": {"cins": -1.452, "dshield": -0.011, "crowdsec": 2.1046, "vulncheck": 0.3919, "blocklist_de": -0.5135}, "mass": 8.7, "listed": false}}, "abq": true, "bot": 0.168, "det": {"vulncheck": {"c2_server": 2}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "WNL-35-ARIN", "org": "Wholesail networks LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.ziplyfiber.com"}, "pfx": 59, "reg": "2018-12-05", "rir": "arin", "s24": 3719, "sib": 2, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 955392, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04021549596074}, {"a": 20057, "h": "ATT-MOBILITY-LLC-AS20057", "n": "AT&T Enterprises, LLC", "t": "Broadband & mobile", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 7, "web_bruteforce": 1, "home_connection": 4, "mail_bruteforce": 2}, "n": 7}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 0.18, "lo": 0.03, "ips": 7, "mean": 0.09, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.51, "lo": 0.04, "ips": 2, "mean": 0.22, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.44, "lo": 0.08, "ips": 3, "mean": 0.22, "above": false}}, "h2": [["2026-10-05", 0.039, 0.004, 0, false], ["2026-10-12", 0.044, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.655, "ts": null, "map": 0.047, "obs": 0, "own": 0.212, "comp": null, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.044, "se": 0.545, "ts": 0.429, "map": 0.088, "obs": 7, "own": 0.137, "comp": {"cins": -1.3355, "dshield": -2.0269, "crowdsec": -1.1923, "vulncheck": -0.1645, "blocklist_de": 3.6783}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.095, "det": {"vulncheck": {"c2_server": 2}, "blocklist_de": {"imap": 3, "mail": 3}}, "oid": "AEL-360-ARIN", "org": "AT&T Enterprises, LLC", "pdb": null, "pfx": 1471, "reg": "2001-03-20", "rir": "arin", "s24": 15690, "sib": 122, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6572544, "abuse": "abuse@att.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03644041717398}, {"a": 20068, "h": "HAWKHOST", "n": "Hawk Host", "t": "Hosting & VPS", "w": 2, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "urlhaus": {"n": 1, "p": 0.1983, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 5.356, 0, false], ["2026-10-12", 0.011, 5.551, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 5.551, "se": 1.234, "ts": 0.500, "map": 31.407, "obs": 2, "own": 12.006, "comp": {"urlhaus": 3.6661, "threatfox": -0.3177, "phishing_db": 1.7248}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.980, "det": {"shodan": {"compromised": 2}}, "oid": "HH-63-ARIN", "org": "Hawk Host Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.hawkhost.com"}, "pfx": 19, "reg": "2014-01-28", "rir": "arin", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20081, "h": "NET2ATLANTA", "n": "Net2Atlanta", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 3, "cve:CVE-2021-3129": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3918, "hi": 6.01, "lo": 0.78, "ips": 3, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.309, 0.011, 0, false], ["2026-10-12", 6.275, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.275, "se": 0.786, "ts": 0.667, "map": 20.142, "obs": 3, "own": 4.023, "comp": {"cins": -0.4514, "dshield": -0.9151, "crowdsec": 4.1315, "vulncheck": -0.6359, "blocklist_de": 2.2674}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.678, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "NET2A-ARIN", "org": "NET2ATLANTA.COM LLC", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.net2atlanta.com"}, "pfx": 12, "reg": "2001-03-21", "rir": "arin", "s24": 18, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "support@net2atlanta.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20115, "h": "CHARTER-20115", "n": "Charter Communications", "t": "Broadband & mobile", "w": 51, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.49, "waf": 0.32}, "cs": {"c": {"http_flood": 3, "data_centre": 6, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 4, "ssh_bruteforce": 8, "web_bruteforce": 12, "home_connection": 10, "mail_bruteforce": 11, "router_or_botnet": 5, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 1}, "n": 17}, "ev": {"cins": {"n": 6, "p": 0.0000, "hi": 0.55, "lo": 0.15, "ips": 6, "mean": 0.33, "above": false}, "shodan": {"n": 7, "p": 0.0000, "hi": 0.13, "lo": 0.04, "ips": 7, "mean": 0.08, "above": false}, "dshield": {"n": 6, "p": 0.0000, "hi": 0.44, "lo": 0.12, "ips": 6, "mean": 0.26, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "crowdsec": {"n": 17, "p": 0.0000, "hi": 0.20, "lo": 0.09, "ips": 17, "mean": 0.14, "above": false}, "vulncheck": {"n": 14, "p": 0.0000, "hi": 0.83, "lo": 0.35, "ips": 15, "mean": 0.57, "above": false}, "blocklist_de": {"n": 12, "p": 0.0000, "hi": 0.37, "lo": 0.15, "ips": 13, "mean": 0.25, "above": false}}, "h2": [["2026-10-05", 0.182, 0.023, 0, false], ["2026-10-12", 0.125, 0.018, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.018, "se": 1.316, "ts": 1.000, "map": 0.090, "obs": 1, "own": 0.326, "comp": {"urlhaus": 0.8123, "threatfox": -0.5282, "phishing_db": -1.07}, "mass": 9.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 6, "dshield": 6, "crowdsec": 17, "vulncheck": 14, "blocklist_de": 12}, "lo": 0.125, "se": 0.397, "ts": 0.309, "map": 0.198, "obs": 55, "own": 0.306, "comp": {"cins": 4.5643, "dshield": -0.1083, "crowdsec": -3.8645, "vulncheck": 0.6277, "blocklist_de": -1.4472}, "mass": 53.5, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"malware": 2, "compromised": 4, "doublepulsar": 1}, "vulncheck": {"c2_server": 13, "attack_tooling": 2}, "blocklist_de": {"ssh": 6, "imap": 4, "mail": 6, "apache": 1, "bruteforcelogin": 1}}, "oid": "CC04-ARIN", "org": "Charter Communications LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "https://www.spectrum.com"}, "pfx": 2352, "reg": "2001-03-26", "rir": "arin", "s24": 48536, "sib": 128, "tor": 0, "w24": 49, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13127424, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.534115}, {"a": 20119, "h": "ARROW DATACENTERS", "n": "Arrow Datacenters Inc", "t": "Hosting & VPS", "w": 6, "cc": "CA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6409, "hi": 7.68, "lo": 1.35, "ips": 6, "mean": 3.96, "above": false}}, "h2": [["2026-10-12", 3.265, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 3.265, "se": 0.807, "ts": 1.000, "map": 10.450, "obs": 3, "own": 2.193, "comp": {"cins": -0.2462, "dshield": -0.5412, "crowdsec": -2.1378, "vulncheck": 7.939, "blocklist_de": -1.2735}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.508, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "AD-1147-ARIN", "org": "ARROW DATACENTERS INC", "pdb": {"t": "Enterprise", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://arrowcalgary.ca"}, "pfx": 15, "reg": "2019-02-05", "rir": "arin", "s24": 18, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20130, "h": "DEPAUL", "n": "DePaul University", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0356, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.921, "ts": null, "map": 0.163, "obs": 0, "own": 1.601, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.645, "ts": null, "map": 0.097, "obs": 0, "own": 0.845, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.108, "det": {"shodan": {"compromised": 1}}, "oid": "DEPAUL-ARIN", "org": "Depaul University", "pdb": {"t": "Educational/Research", "sc": "North America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.depaul.edu"}, "pfx": 3, "reg": "2001-03-28", "rir": "arin", "s24": 336, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 86016, "abuse": "abuse@depaul.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20161, "h": "TRGO", "n": "TeraGo Networks Inc.", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0135, "hi": 2.26, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}, "urlhaus": {"n": 1, "p": 0.1789, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.006, 0.207, 0, false], ["2026-10-12", 0.006, 0.226, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.226, "se": 1.429, "ts": 1.000, "map": 1.792, "obs": 1, "own": 5.148, "comp": {"urlhaus": 3.3045, "threatfox": -0.3727, "phishing_db": -0.7221}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.590, "ts": null, "map": 0.078, "obs": 0, "own": 0.177, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.164, "det": {"shodan": {"compromised": 1}}, "oid": "TRGO-ARIN", "org": "TeraGo Networks Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.terago.ca"}, "pfx": 219, "reg": "2001-03-30", "rir": "arin", "s24": 513, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 271360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050941229353}, {"a": 20205, "h": "AMPLEX", "n": "Amplex Electric", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4051, "hi": 6.13, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 0.771, 0.011, 0, false], ["2026-10-12", 0.702, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.702, "se": 0.934, "ts": 1.000, "map": 2.837, "obs": 2, "own": 4.773, "comp": {"cins": -0.1954, "dshield": -0.4388, "crowdsec": -1.7348, "vulncheck": 5.8198, "blocklist_de": -1.0141}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.179, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "AMPLEX-3-ARIN", "org": "Amplex Electric, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://amplex.net/"}, "pfx": 9, "reg": "2001-04-05", "rir": "arin", "s24": 52, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20207, "h": "", "n": "Gigared", "t": "Broadband & mobile", "w": 8, "cc": "AR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2021-43798": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0220, "hi": 2.49, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "dshield": {"n": 1, "p": 0.1173, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "urlhaus": {"n": 1, "p": 0.1822, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 3, "p": 0.1197, "hi": 3.64, "lo": 0.64, "ips": 3, "mean": 1.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.1892, "hi": 4.33, "lo": 0.56, "ips": 3, "mean": 2.06, "above": false}}, "h2": [["2026-10-05", 0.811, 0.226, 0, false], ["2026-10-12", 1.131, 0.248, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.248, "se": 1.440, "ts": 1.000, "map": 2.006, "obs": 1, "own": 5.769, "comp": {"urlhaus": 3.3841, "threatfox": -0.3621, "phishing_db": -0.6995}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.131, "se": 0.565, "ts": 0.500, "map": 2.384, "obs": 6, "own": 3.695, "comp": {"cins": -1.068, "dshield": 0.92, "crowdsec": 1.0441, "vulncheck": -0.8373, "blocklist_de": 2.2037}, "mass": 5.7, "listed": false}}, "abq": true, "bot": 0.196, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "@aut-20207-LACNIC", "org": "Gigared S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.gigared.com"}, "pfx": 170, "reg": "2001-04-05", "rir": "lacnic", "s24": 425, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 219648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00700696343739}, {"a": 20214, "h": "COMCAST-20214", "n": "Comcast - Miami/Pompano", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0122, "hi": 2.22, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}}, "h2": [["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.886, "ts": null, "map": 0.151, "obs": 0, "own": 0.814, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.586, "ts": null, "map": 0.077, "obs": 0, "own": 0.173, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.476, "det": {"shodan": {"compromised": 1}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": null}, "pfx": 22, "reg": "2001-04-06", "rir": "arin", "s24": 532, "sib": 55, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 140544, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20277, "h": "EOCNET", "n": "EOC Networks LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.861, "det": {"shodan": {"doublepulsar": 2}}, "oid": "EN-140-ARIN", "org": "EOC Networks LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Selective", "web": "https://eoc.systems"}, "pfx": 1, "reg": "2023-05-30", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "admin@eoc.systems", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20278, "h": "NEXEON", "n": "Nexeon Technologies", "t": "Hosting & VPS", "w": 12, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 9, "web_exploit": 9, "bad_crawling": 8, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 6, "mail_bruteforce": 3, "cve:CVE-2017-9841": 3, "cve:CVE-2020-5902": 2, "cve:CVE-2025-4396": 3, "cve:CVE-2021-43798": 2, "cve:CVE-2024-28000": 8}, "n": 9}, "ev": {"shodan": {"n": 1, "p": 0.0082, "hi": 2.07, "lo": 0.16, "ips": 1, "mean": 0.87, "above": false}, "crowdsec": {"n": 3, "p": 0.0482, "hi": 2.98, "lo": 0.52, "ips": 9, "mean": 1.54, "above": false}, "threatfox": {"n": 2, "p": 0.3639, "hi": 5.76, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "blocklist_de": {"n": 1, "p": 0.0426, "hi": 2.88, "lo": 0.22, "ips": 1, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.422, 0.116, 0, false], ["2026-10-12", 0.446, 0.349, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 0.349, "se": 1.141, "ts": 1.000, "map": 1.437, "obs": 2, "own": 0.624, "comp": {"urlhaus": -0.5074, "threatfox": 3.2002, "phishing_db": -0.7043}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.446, "se": 0.647, "ts": 0.750, "map": 1.103, "obs": 4, "own": 0.219, "comp": {"cins": -0.764, "dshield": -1.3844, "crowdsec": 4.0971, "vulncheck": -0.7666, "blocklist_de": 0.3098}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.859, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Remcos": 1, "family:AsyncRAT": 1}, "blocklist_de": {"mail": 1}}, "oid": "NEXEO-2-ARIN", "org": "Nexeon Technologies, Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://nexeon.com"}, "pfx": 261, "reg": "2014-08-12", "rir": "arin", "s24": 603, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 235264, "abuse": "abuse@nexeontech.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00715466724392}, {"a": 20294, "h": "MTN-UG", "n": "MTN Uganda", "t": "Other", "w": 5, "cc": "UG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1069, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 3, "p": 0.5749, "hi": 7.00, "lo": 1.23, "ips": 5, "mean": 3.61, "above": false}}, "h2": [["2026-10-05", 2.382, 0.011, 0, false], ["2026-10-12", 2.581, 0.012, 0, false]], "sh": false, "uc": 471.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 0.544, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.581, "se": 0.667, "ts": 0.750, "map": 6.657, "obs": 4, "own": 3.787, "comp": {"cins": -0.7707, "dshield": -1.3935, "crowdsec": -2.301, "vulncheck": -0.7685, "blocklist_de": 8.5231}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.085, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MU2-AFRINIC", "org": "MTN Uganda", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.mtn.co.ug"}, "pfx": 69, "reg": "2009-09-28", "rir": "afrinic", "s24": 101, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 82944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01498010900097}, {"a": 20326, "h": "TERASWITCH", "n": "Teraswitch Inc", "t": "Transit & backbone", "w": 255, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0671, "hi": 3.25, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "dshield": {"n": 2, "p": 0.3496, "hi": 5.64, "lo": 0.73, "ips": 255, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.351, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.954, "ts": null, "map": 0.173, "obs": 0, "own": 1.550, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.351, "se": 0.872, "ts": 1.000, "map": 1.322, "obs": 2, "own": 4.277, "comp": {"cins": -0.3633, "dshield": 7.4823, "crowdsec": -3.0036, "vulncheck": -0.5775, "blocklist_de": -1.8654}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.987, "det": {"shodan": {"compromised": 1}}, "oid": "TERAS-2-ARIN", "org": "TeraSwitch Networks Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.teraswitch.com"}, "pfx": 148, "reg": "2007-03-26", "rir": "arin", "s24": 216, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58624, "abuse": "noc@teraswitch.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02207567183538}, {"a": 20412, "h": "CLARITY-TELECOM", "n": "Bluepeak", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.0317, "hi": 2.73, "lo": 0.36, "ips": 2, "mean": 1.30, "above": false}, "dshield": {"n": 1, "p": 0.0925, "hi": 3.57, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}, "crowdsec": {"n": 2, "p": 0.0153, "hi": 2.40, "lo": 0.31, "ips": 2, "mean": 1.14, "above": false}, "blocklist_de": {"n": 2, "p": 0.1280, "hi": 3.81, "lo": 0.49, "ips": 2, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.438, 0.009, 0, false], ["2026-10-12", 0.634, 0.010, 0, false]], "sh": false, "uc": 157.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.876, "ts": null, "map": 0.147, "obs": 0, "own": 0.776, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.634, "se": 0.599, "ts": 0.400, "map": 1.440, "obs": 5, "own": 2.239, "comp": {"cins": -0.9562, "dshield": 1.2341, "crowdsec": -0.7238, "vulncheck": -0.8152, "blocklist_de": 3.0191}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "CTL-172-ARIN", "org": "Clarity Telecom LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://mybluepeak.com"}, "pfx": 257, "reg": "2001-05-04", "rir": "arin", "s24": 610, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 230400, "abuse": "abuse@mybluepeak.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00922944659022}, {"a": 20446, "h": "DUKELANA-20446", "n": "Dukelana", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.250, "det": {"shodan": {"compromised": 1}}, "oid": "DL-864-ARIN", "org": "Dukelana", "pdb": null, "pfx": 2, "reg": "2025-12-03", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@dukelana.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20454, "h": "SSASN2", "n": "SECURED SERVERS LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 14, "p": 0.9955, "hi": 9.65, "lo": 4.08, "ips": 14, "mean": 6.61, "above": true}, "crowdsec": {"n": 1, "p": 0.0038, "hi": 1.84, "lo": 0.14, "ips": 1, "mean": 0.78, "above": false}, "phishing_db": {"n": 1, "p": 0.1015, "hi": 3.68, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.148, 0.122, 0, false], ["2026-10-12", 0.052, 0.128, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.128, "se": 1.371, "ts": 1.000, "map": 0.843, "obs": 1, "own": 0.396, "comp": {"urlhaus": -0.3141, "threatfox": -0.284, "phishing_db": 2.0533}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.052, "se": 1.079, "ts": 1.000, "map": 0.289, "obs": 1, "own": 0.061, "comp": {"cins": -0.2261, "dshield": -0.5013, "crowdsec": 2.5019, "vulncheck": -0.4494, "blocklist_de": -1.1711}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.991, "det": {"shodan": {"c2": 1, "compromised": 13}}, "oid": "SSL-65-ARIN", "org": "SECURED SERVERS LLC", "pdb": null, "pfx": 156, "reg": "2010-10-18", "rir": "arin", "s24": 594, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 180992, "abuse": "abuse@phoenixnap.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0381169253993}, {"a": 20473, "h": "AS-VULTR", "n": "The Constant Company", "t": "Hosting & VPS", "w": 225, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 1.21, "waf": 2.68}, "cs": {"c": {"http_flood": 10, "data_centre": 19, "web_exploit": 17, "bad_crawling": 5, "proxy_or_vpn": 4, "first_seen_30d": 5, "ssh_bruteforce": 8, "web_bruteforce": 13, "home_connection": 2, "mail_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 3, "cve:CVE-2025-55182": 2, "cve:CVE-2026-63030": 1}, "n": 22}, "ev": {"cins": {"n": 7, "p": 0.1970, "hi": 3.84, "lo": 1.16, "ips": 7, "mean": 2.34, "above": false}, "shodan": {"n": 399, "p": 1.0000, "hi": 32.70, "lo": 27.74, "ips": 399, "mean": 30.18, "above": true}, "dshield": {"n": 7, "p": 0.0778, "hi": 3.21, "lo": 0.97, "ips": 7, "mean": 1.95, "above": false}, "urlhaus": {"n": 5, "p": 0.6872, "hi": 6.87, "lo": 1.71, "ips": 5, "mean": 3.92, "above": false}, "crowdsec": {"n": 22, "p": 0.0000, "hi": 1.93, "lo": 0.97, "ips": 22, "mean": 1.42, "above": false}, "threatfox": {"n": 28, "p": 1.0000, "hi": 20.42, "lo": 11.03, "ips": 28, "mean": 15.42, "above": true}, "vulncheck": {"n": 38, "p": 1.0000, "hi": 12.42, "lo": 7.32, "ips": 41, "mean": 9.73, "above": true}, "phishing_db": {"n": 109, "p": 1.0000, "hi": 33.61, "lo": 24.54, "ips": 112, "mean": 28.93, "above": true}, "blocklist_de": {"n": 13, "p": 0.0358, "hi": 2.89, "lo": 1.18, "ips": 13, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 1.261, 4.727, 0, false], ["2026-10-12", 1.250, 4.961, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 28, "phishing_db": 109}, "lo": 4.961, "se": 0.741, "ts": 0.768, "map": 9.797, "obs": 142, "own": 3.585, "comp": {"urlhaus": -1.2224, "threatfox": 0.6547, "phishing_db": 4.476}, "mass": 75.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 7, "crowdsec": 22, "vulncheck": 38, "blocklist_de": 13}, "lo": 1.250, "se": 0.380, "ts": 0.437, "map": 1.947, "obs": 87, "own": 0.382, "comp": {"cins": 4.7469, "dshield": -0.1045, "crowdsec": -2.9489, "vulncheck": 2.7942, "blocklist_de": -2.4279}, "mass": 61.9, "listed": false}}, "abq": false, "bot": 0.794, "det": {"shodan": {"c2": 98, "malware": 9, "compromised": 230, "doublepulsar": 62}, "threatfox": {"family:pupy": 5, "family:Sliver": 4, "family:VShell": 2, "family:AdaptixC2": 6, "family:Cobalt Strike": 5}, "vulncheck": {"c2_server": 18, "botnet_node": 12, "attack_tooling": 10, "other_infrastructure": 1}, "blocklist_de": {"ftp": 3, "ssh": 1, "bots": 1, "imap": 3, "mail": 7, "apache": 1, "bruteforcelogin": 1}}, "oid": "CHOOP-1-ARIN", "org": "The Constant Company, LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.vultr.com/"}, "pfx": 1743, "reg": "2001-05-11", "rir": "arin", "s24": 5736, "sib": 4, "tor": 3, "w24": 216, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 1479424, "abuse": "abuse@constant.com", "score": 1.0000, "groups": ["vulncheck", "abusech", "phishing", "shodan"], "sensors": [], "traffic": 0.176275}, {"a": 20485, "h": "TRANSTELECOM", "n": "TransTelecom", "t": "Broadband & mobile", "w": 9, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0392, "hi": 2.82, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "crowdsec": {"n": 2, "p": 0.0002, "hi": 1.45, "lo": 0.19, "ips": 2, "mean": 0.69, "above": false}, "vulncheck": {"n": 5, "p": 0.6192, "hi": 6.33, "lo": 1.57, "ips": 5, "mean": 3.61, "above": false}, "blocklist_de": {"n": 3, "p": 0.0793, "hi": 3.30, "lo": 0.58, "ips": 3, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.331, 0.008, 0, false], ["2026-10-12", 0.579, 0.009, 0, false]], "sh": false, "uc": 123.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.819, "ts": null, "map": 0.123, "obs": 0, "own": 0.595, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 5, "blocklist_de": 3}, "lo": 0.579, "se": 0.509, "ts": 0.455, "map": 1.112, "obs": 11, "own": 1.733, "comp": {"cins": -1.3521, "dshield": 0.2116, "crowdsec": -3.5338, "vulncheck": 2.6332, "blocklist_de": 3.5405}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.440, "det": {"vulncheck": {"botnet_node": 5}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-CJSC19-RIPE", "org": "Joint Stock Company TransTeleCom", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.ttk.ru"}, "pfx": 85, "reg": "2001-03-13", "rir": "ripencc", "s24": 1259, "sib": 33, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 346368, "abuse": "abuse@ttk.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0020476053213}, {"a": 20590, "h": "DEC-AS", "n": "Donbass Electronic Communications Ltd.", "t": "Other", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1447, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-12", 0.092, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 0.416, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.092, "se": 1.133, "ts": 1.000, "map": 0.566, "obs": 1, "own": 0.349, "comp": {"cins": -0.1942, "dshield": 4.1609, "crowdsec": -1.7248, "vulncheck": -0.4098, "blocklist_de": -1.0078}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-DECL1-RIPE", "org": "Donbass Electronic Communications Ltd.", "pdb": null, "pfx": 26, "reg": "2001-04-12", "rir": "ripencc", "s24": 259, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 193280, "abuse": "abuse@matrixb2b.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00089522072436}, {"a": 20597, "h": "ELTEL-AS", "n": "PJSC \"Vimpelcom\"", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2024-12847": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0258, "hi": 2.57, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "blocklist_de": {"n": 1, "p": 0.0900, "hi": 3.54, "lo": 0.27, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.077, 0.010, 0, false], ["2026-10-12", 0.273, 0.011, 0, false]], "sh": false, "uc": 223.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.390, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.273, "se": 0.864, "ts": 0.500, "map": 1.012, "obs": 2, "own": 0.590, "comp": {"cins": -0.4052, "dshield": -0.8361, "crowdsec": 0.6903, "vulncheck": -0.6071, "blocklist_de": 2.5634}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.547, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ES15-RIPE", "org": "PJSC \"Vimpelcom\"", "pdb": null, "pfx": 10, "reg": "2001-04-18", "rir": "ripencc", "s24": 318, "sib": 32, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 88064, "abuse": "abuse-b2b@beeline.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20598, "h": "CYBERSPACE-AS", "n": "Cyber Space", "t": "Broadband & mobile", "w": 3, "cc": "IL", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1592, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "dshield": {"n": 1, "p": 0.1495, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 1, "p": 0.0455, "hi": 2.93, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}}, "h2": [["2026-10-05", 0.095, 0.010, 0, false], ["2026-10-12", 0.702, 0.011, 0, false]], "sh": false, "uc": 85.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.065, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.702, "se": 0.737, "ts": 0.333, "map": 2.037, "obs": 3, "own": 3.200, "comp": {"cins": 3.9897, "dshield": 2.5033, "crowdsec": -0.7857, "vulncheck": -0.6976, "blocklist_de": -2.9045}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.664, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.cyberspace.net.ng"}, "pfx": 65, "reg": "2001-04-18", "rir": "ripencc", "s24": 233, "sib": 0, "tor": 0, "w24": 3, "drop": 11, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016565318356}, {"a": 20632, "h": "PETERSTAR-AS", "n": "North-West branch of PJSC Megafon", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0003, "hi": 1.51, "lo": 0.20, "ips": 2, "mean": 0.72, "above": false}, "vulncheck": {"n": 1, "p": 0.0447, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.0084, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.239, 0.008, 0, false], ["2026-10-12", 0.204, 0.009, 0, false]], "sh": false, "uc": 75.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.823, "ts": null, "map": 0.125, "obs": 0, "own": 0.607, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.204, "se": 0.658, "ts": 0.500, "map": 0.508, "obs": 4, "own": 0.802, "comp": {"cins": -0.7077, "dshield": -1.3075, "crowdsec": 1.4466, "vulncheck": 0.6294, "blocklist_de": 0.6565}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.507, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "http://spb.megafon.ru"}, "pfx": 63, "reg": "2001-04-20", "rir": "ripencc", "s24": 1194, "sib": 39, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 312832, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002882655083}, {"a": 20649, "h": "ASFIBERSUNUCU", "n": "FS Veri Merkezi Internet Teknolojileri", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 1.249, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.873, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TIEH1-RIPE", "org": "FS Veri Merkezi Internet Teknolojileri Limited Sirketi", "pdb": {"t": null, "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.fibersunucu.com.tr"}, "pfx": 15, "reg": "2001-04-25", "rir": "ripencc", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "abuse@fibersunucu.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20655, "h": "e-StyleISP-AS", "n": "e-Style ISP", "t": "Transit & backbone", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 2.434, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 1.693, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.437, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-SL23-RIPE", "org": "e-Style ISP LLC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.estt.ru/"}, "pfx": 3, "reg": "2001-04-27", "rir": "ripencc", "s24": 36, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "noc@estt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20661, "h": "TurkmenTelecom-AS", "n": "State Company of Electro Communications Turkmentelecom", "t": "Broadband & mobile", "w": 7, "cc": "TM", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 4, "router_or_botnet": 2}, "n": 4}, "ev": {"dshield": {"n": 1, "p": 0.1815, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 3, "p": 0.5139, "hi": 6.45, "lo": 1.14, "ips": 4, "mean": 3.33, "above": false}, "vulncheck": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 2, "mean": 1.92, "above": false}, "blocklist_de": {"n": 2, "p": 0.3707, "hi": 5.82, "lo": 0.76, "ips": 3, "mean": 2.77, "above": false}}, "h2": [["2026-10-05", 3.979, 0.011, 0, false], ["2026-10-12", 6.097, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 1.450, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 2}, "lo": 6.097, "se": 0.553, "ts": 0.429, "map": 12.757, "obs": 7, "own": 19.731, "comp": {"cins": -1.0327, "dshield": 1.017, "crowdsec": 1.3686, "vulncheck": 0.1266, "blocklist_de": 2.4603}, "mass": 5.4, "listed": false}}, "abq": true, "bot": 0.301, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-TIN2-RIPE", "org": "State Company of Electro Communications Turkmentelecom", "pdb": null, "pfx": 19, "reg": "2001-05-01", "rir": "ripencc", "s24": 76, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00386653659392}, {"a": 20686, "h": "BISPING", "n": "Bisping & Bisping GmbH & Co. KG", "t": "Transit & backbone", "w": 1, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0344, "hi": 2.74, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "blocklist_de": {"n": 1, "p": 0.0846, "hi": 3.47, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.081, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.920, "ts": null, "map": 0.163, "obs": 0, "own": 1.342, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.081, "se": 1.122, "ts": 1.000, "map": 0.489, "obs": 1, "own": 1.674, "comp": {"cins": -0.2203, "dshield": -0.4895, "crowdsec": -1.9343, "vulncheck": -0.4425, "blocklist_de": 3.7651}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.219, "det": {"shodan": {"c2": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BBCO1-RIPE", "org": "Bisping & Bisping GmbH & Co KG", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.bisping.de"}, "pfx": 14, "reg": "2001-05-08", "rir": "ripencc", "s24": 342, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 87552, "abuse": "abuse@bisping.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00091177128195}, {"a": 20738, "h": "GD-EMEA-DC-LD5", "n": "Heart Internet limited - AS20738", "t": "Other", "w": 4, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2004, "hi": 4.42, "lo": 0.57, "ips": 2, "mean": 2.10, "above": false}, "phishing_db": {"n": 2, "p": 0.3727, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 0.898, 0.947, 0, false], ["2026-10-12", 0.444, 0.970, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.970, "se": 1.141, "ts": 1.000, "map": 4.285, "obs": 2, "own": 4.470, "comp": {"urlhaus": -0.4152, "threatfox": -0.3306, "phishing_db": 3.8272}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.444, "se": 0.882, "ts": 1.000, "map": 1.706, "obs": 2, "own": 0.995, "comp": {"cins": -0.3485, "dshield": -0.7352, "crowdsec": 5.3689, "vulncheck": -0.5663, "blocklist_de": -1.7913}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-HIL23-RIPE", "org": "Heart Internet limited", "pdb": {"t": null, "sc": null, "tr": null, "pol": "Selective", "web": "https://www.heartinternet.uk/"}, "pfx": 76, "reg": "2001-05-15", "rir": "ripencc", "s24": 160, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45568, "abuse": "abuse@heartinternet.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082292171886}, {"a": 20764, "h": "RASCOM-AS", "n": "RASCOM", "t": "Transit & backbone", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 2.281, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 1.448, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.603, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CR2-RIPE", "org": "CJSC RASCOM", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://rascom.ru/en/"}, "pfx": 5, "reg": "2001-05-22", "rir": "ripencc", "s24": 49, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": "abuse@rascom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041641798877}, {"a": 20766, "h": "GITOYEN-MAIN-AS", "n": "Association Gitoyen", "t": "Enterprise, edu & gov", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-12031": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.315, 0.011, 0, false], ["2026-10-12", 0.335, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 2.992, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.335, "se": 1.309, "ts": 1.000, "map": 2.896, "obs": 1, "own": 18.880, "comp": {"cins": -0.1172, "dshield": -0.2721, "crowdsec": 3.7479, "vulncheck": -0.2906, "blocklist_de": -0.6111}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.705, "det": null, "oid": "ORG-GG4-RIPE", "org": "Association \"Gitoyen\"", "pdb": {"t": "Non-Profit", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.gitoyen.net/"}, "pfx": 6, "reg": "2001-05-22", "rir": "ripencc", "s24": 30, "sib": 2, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@gitoyen.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20773, "h": "GODADDY", "n": "Host Europe GmbH", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2271, "hi": 4.63, "lo": 0.60, "ips": 2, "mean": 2.21, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.736, "ts": null, "map": 0.130, "obs": 0, "own": 0.046, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.995, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-OG1-RIPE", "org": "Host Europe GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.hosteurope.de/"}, "pfx": 39, "reg": "2001-05-23", "rir": "ripencc", "s24": 168, "sib": 19, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 62208, "abuse": "abuse@hosteurope.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20799, "h": "DATANET-AS", "n": "Datanet", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1531, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 1.570, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.884, "ts": null, "map": 0.184, "obs": 0, "own": 0.677, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.683, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DI8-RIPE", "org": "Datanet.co.uk Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.datanet.co.uk"}, "pfx": 4, "reg": "2001-05-31", "rir": "ripencc", "s24": 54, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": "abuse@datanet.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 20811, "h": "BRENNERCOM-AS", "n": "Brennercom", "t": "Transit & backbone", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": 80.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.939, "ts": null, "map": 0.168, "obs": 0, "own": 1.454, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.675, "ts": null, "map": 0.108, "obs": 0, "own": 0.548, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.246, "det": null, "oid": "ORG-ES264-RIPE", "org": "Retelit Digital Services S.p.A.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.brennercom.it"}, "pfx": 14, "reg": "2001-06-06", "rir": "ripencc", "s24": 266, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 68352, "abuse": "abuse@retelit.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090371014375}, {"a": 20845, "h": "DIGICABLE", "n": "DIGI Ltd", "t": "Broadband & mobile", "w": 4, "cc": "HU", "cf": {"rb": "lo", "wb": null, "rep": 1.75, "waf": null}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0065, "hi": 2.00, "lo": 0.15, "ips": 1, "mean": 0.84, "above": false}, "vulncheck": {"n": 1, "p": 0.0072, "hi": 2.03, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}, "blocklist_de": {"n": 2, "p": 0.0010, "hi": 1.69, "lo": 0.22, "ips": 2, "mean": 0.80, "above": false}}, "h2": [["2026-10-05", 0.046, 0.051, 0, false], ["2026-10-12", 0.110, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.766, "ts": null, "map": 0.098, "obs": 0, "own": 0.452, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.110, "se": 0.655, "ts": 0.500, "map": 0.272, "obs": 4, "own": 0.430, "comp": {"cins": -0.7913, "dshield": 1.7402, "crowdsec": -5.5685, "vulncheck": 0.472, "blocklist_de": 4.2411}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.150, "det": {"threatfox": {"family:Mirai": 4}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-EMKL1-RIPE", "org": "DIGI Tavkozlesi es Szolgaltato Kft.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.digi.hu"}, "pfx": 115, "reg": "2001-06-15", "rir": "ripencc", "s24": 2548, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 652288, "abuse": "ipadmin@2connect.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02587705372651}, {"a": 20846, "h": "PARABOLE-AS", "n": "UAB \"Parabole\"", "t": "Broadband & mobile", "w": 5, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6360, "hi": 7.63, "lo": 1.34, "ips": 5, "mean": 3.93, "above": false}}, "h2": [["2026-10-12", 1.998, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 1.998, "se": 0.797, "ts": 1.000, "map": 6.269, "obs": 3, "own": 10.318, "comp": {"cins": -0.2616, "dshield": -0.5715, "crowdsec": -2.2567, "vulncheck": 7.6709, "blocklist_de": -1.3519}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.174, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-UA122-RIPE", "org": "UAB \"Parabole\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.parabole.lt"}, "pfx": 3, "reg": "2008-11-17", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001710887475}, {"a": 20847, "h": "PREVIDER-AS", "n": "Previder BV", "t": "Broadband & mobile", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0749, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.961, "ts": null, "map": 0.174, "obs": 0, "own": 1.124, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.716, "ts": null, "map": 0.123, "obs": 0, "own": 0.327, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.657, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IB5-RIPE", "org": "Previder B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.previder.com"}, "pfx": 15, "reg": "2001-06-18", "rir": "ripencc", "s24": 195, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49920, "abuse": "abuse@previder.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001235217065}, {"a": 20857, "h": "TRANSIP-AS", "n": "TransIP BV", "t": "Broadband & mobile", "w": 10, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 2, "web_exploit": 3, "proxy_or_vpn": 4, "first_seen_30d": 2, "web_bruteforce": 5, "home_connection": 4, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"shodan": {"n": 16, "p": 0.9983, "hi": 9.85, "lo": 4.39, "ips": 16, "mean": 6.89, "above": true}, "crowdsec": {"n": 6, "p": 0.2585, "hi": 4.19, "lo": 1.16, "ips": 6, "mean": 2.48, "above": false}, "vulncheck": {"n": 3, "p": 0.4178, "hi": 5.70, "lo": 1.00, "ips": 3, "mean": 2.94, "above": false}, "phishing_db": {"n": 1, "p": 0.0911, "hi": 3.55, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}}, "h2": [["2026-10-05", 1.657, 0.113, 0, false], ["2026-10-12", 0.788, 0.119, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.119, "se": 1.365, "ts": 1.000, "map": 0.767, "obs": 1, "own": 2.346, "comp": {"urlhaus": -0.3287, "threatfox": -0.2915, "phishing_db": 1.9806}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.788, "se": 0.520, "ts": 0.667, "map": 1.551, "obs": 9, "own": 2.413, "comp": {"cins": -1.1096, "dshield": -1.7997, "crowdsec": 8.3731, "vulncheck": 1.8121, "blocklist_de": -5.4432}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.970, "det": {"shodan": {"c2": 2, "malware": 1, "compromised": 12, "doublepulsar": 1}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}}, "oid": "ORG-SI6-RIPE", "org": "Signet B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.transip.nl/"}, "pfx": 48, "reg": "2001-06-20", "rir": "ripencc", "s24": 687, "sib": 8, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 177408, "abuse": "abuse@signet.nl", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00245789335}, {"a": 20860, "h": "IOMART-AS", "n": "iomart", "t": "Hosting & VPS", "w": 42, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 22, "data_centre": 18, "web_exploit": 9, "bad_crawling": 11, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 5, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-39290": 1, "cve:CVE-2024-34351": 1}, "n": 27}, "ev": {"shodan": {"n": 8, "p": 0.1254, "hi": 3.47, "lo": 1.13, "ips": 8, "mean": 2.16, "above": false}, "urlhaus": {"n": 1, "p": 0.1456, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 9, "p": 0.0763, "hi": 3.18, "lo": 1.10, "ips": 27, "mean": 2.03, "above": false}, "threatfox": {"n": 2, "p": 0.2885, "hi": 5.13, "lo": 0.67, "ips": 2, "mean": 2.44, "above": false}, "vulncheck": {"n": 8, "p": 0.9082, "hi": 8.12, "lo": 2.64, "ips": 9, "mean": 5.07, "above": true}, "phishing_db": {"n": 3, "p": 0.2418, "hi": 4.50, "lo": 0.79, "ips": 3, "mean": 2.32, "above": false}, "blocklist_de": {"n": 1, "p": 0.0037, "hi": 1.83, "lo": 0.14, "ips": 1, "mean": 0.77, "above": false}}, "h2": [["2026-10-05", 0.803, 0.914, 0, false], ["2026-10-12", 0.744, 0.943, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 3}, "lo": 0.943, "se": 0.931, "ts": 0.500, "map": 2.610, "obs": 6, "own": 1.051, "comp": {"urlhaus": 1.0426, "threatfox": 0.6215, "phishing_db": 0.9213}, "mass": 5.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 8, "blocklist_de": 1}, "lo": 0.744, "se": 0.454, "ts": 0.500, "map": 1.305, "obs": 18, "own": 0.258, "comp": {"cins": -1.6741, "dshield": -2.3177, "crowdsec": 7.3242, "vulncheck": 3.3142, "blocklist_de": -4.987}, "mass": 10.8, "listed": false}}, "abq": false, "bot": 0.872, "det": {"shodan": {"c2": 1, "compromised": 7}, "threatfox": {"family:Hook": 1, "family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 8, "attack_tooling": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-IA70-RIPE", "org": "IOMART CLOUD SERVICES LIMITED", "pdb": {"t": "Content", "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.iomart.com"}, "pfx": 192, "reg": "2001-06-20", "rir": "ripencc", "s24": 1481, "sib": 2, "tor": 1, "w24": 23, "drop": 1, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 416768, "abuse": "abuse@iomart.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00519249665818}, {"a": 20879, "h": "DIGI-PT", "n": "DIGI PT", "t": "Broadband & mobile", "w": 3, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "home_connection": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1726, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.0966, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "blocklist_de": {"n": 1, "p": 0.1496, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.145, 0.011, 0, false], ["2026-10-12", 1.251, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 1.298, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.251, "se": 0.748, "ts": 0.333, "map": 3.746, "obs": 3, "own": 5.873, "comp": {"cins": -0.5344, "dshield": 2.6512, "crowdsec": -0.4627, "vulncheck": -0.6799, "blocklist_de": 1.7401}, "mass": 2.5, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-RA18-RIPE", "org": "DIGI ROMANIA S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.digi.pt"}, "pfx": 8, "reg": "2001-06-26", "rir": "ripencc", "s24": 117, "sib": 9, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30464, "abuse": "abuse@rcs-rds.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0113113051904}, {"a": 20904, "h": "Netplaza-AS", "n": "Cinia Oy", "t": "Transit & backbone", "w": 1, "cc": "FI", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2020-11515": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1036, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.619, 0.011, 0, false], ["2026-10-12", 0.161, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.002, "ts": null, "map": 0.183, "obs": 0, "own": 1.895, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.161, "se": 1.199, "ts": 1.000, "map": 1.133, "obs": 1, "own": 3.955, "comp": {"cins": -0.1603, "dshield": -0.3654, "crowdsec": 3.2399, "vulncheck": -0.3621, "blocklist_de": -0.8338}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.245, "det": null, "oid": "ORG-CL69-RIPE", "org": "Cinia Oy", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.cinia.fi/"}, "pfx": 19, "reg": "2001-07-03", "rir": "ripencc", "s24": 106, "sib": 2, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28928, "abuse": "abuse@cinia.fi", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019417604668}, {"a": 20910, "h": "BALTKOM-AS", "n": "BALTCOM", "t": "Broadband & mobile", "w": 6, "cc": "LV", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 2.29}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2024-4577": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.0106, "hi": 2.38, "lo": 0.51, "ips": 4, "mean": 1.30, "above": false}, "blocklist_de": {"n": 3, "p": 0.1165, "hi": 3.62, "lo": 0.64, "ips": 3, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.385, 0.008, 0, false], ["2026-10-12", 0.594, 0.009, 0, false]], "sh": false, "uc": 70.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.832, "ts": null, "map": 0.128, "obs": 0, "own": 0.633, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.594, "se": 0.538, "ts": 0.571, "map": 1.212, "obs": 7, "own": 1.879, "comp": {"cins": -1.2793, "dshield": -1.9731, "crowdsec": 1.5627, "vulncheck": -0.8706, "blocklist_de": 4.1459}, "mass": 7.2, "listed": false}}, "abq": true, "bot": 0.585, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "bots": 1, "mail": 1}}, "oid": "ORG-SSN2-RIPE", "org": "SIA \"BITE Latvija\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://baltcom.lv/"}, "pfx": 20, "reg": "2001-07-04", "rir": "ripencc", "s24": 1068, "sib": 6, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 273920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00665602657505}, {"a": 20940, "h": "AKAMAI-ASN1", "n": "Akamai Technologies", "t": "CDN & platforms", "w": 11, "cc": "NL", "cf": {"rb": "hi", "wb": "hi", "rep": 1.29, "waf": 1.13}, "cs": null, "ev": {"dshield": {"n": 10, "p": 0.0000, "hi": 0.93, "lo": 0.34, "ips": 10, "mean": 0.60, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.28, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.030, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.012, "se": 1.346, "ts": 1.000, "map": 0.060, "obs": 1, "own": 0.668, "comp": {"urlhaus": -0.9485, "threatfox": -0.4635, "phishing_db": 0.229}, "mass": 4.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 10, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.030, "se": 0.491, "ts": 1.000, "map": 0.055, "obs": 10, "own": 0.113, "comp": {"cins": -1.5866, "dshield": 17.3026, "crowdsec": -8.7449, "vulncheck": -0.9059, "blocklist_de": -7.5665}, "mass": 10.0, "listed": false}}, "abq": false, "bot": 0.429, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AT1-RIPE", "org": "Akamai International B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "100+Tbps", "pol": "Open", "web": "https://www.akamai.com/"}, "pfx": 3938, "reg": "2001-07-10", "rir": "ripencc", "s24": 32104, "sib": 19, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15611136, "abuse": "abuse@akamai.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.056824}, {"a": 20960, "h": "TKTELEKOM-AS", "n": "TKTelekom", "t": "Broadband & mobile", "w": 1, "cc": "PL", "cf": null, "cs": {"c": {"bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0014, "hi": 1.61, "lo": 0.12, "ips": 1, "mean": 0.68, "above": false}, "crowdsec": {"n": 1, "p": 0.0004, "hi": 1.39, "lo": 0.10, "ips": 1, "mean": 0.58, "above": false}}, "h2": [["2026-10-05", 0.005, 0.008, 0, false], ["2026-10-12", 0.039, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.844, "ts": null, "map": 0.134, "obs": 0, "own": 0.672, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.039, "se": 1.053, "ts": 1.000, "map": 0.204, "obs": 1, "own": 0.338, "comp": {"cins": -0.2435, "dshield": -0.536, "crowdsec": 2.3133, "vulncheck": -0.4691, "blocklist_de": -1.26}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.162, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TKSZ1-RIPE", "org": "TK Telekom sp. z o.o.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.netia.pl/pl/transport/o-tk-telekom"}, "pfx": 8, "reg": "2002-05-27", "rir": "ripencc", "s24": 911, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 286720, "abuse": "abuse@tktelekom.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00079284394956}, {"a": 20978, "h": "TT_Mobil", "n": "TT Mobil Iletisim Hizmetleri A.S", "t": "Other", "w": 0, "cc": "TR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.67, "waf": 0.59}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.003, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.752, "ts": null, "map": 0.091, "obs": 0, "own": 0.167, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.374, "ts": null, "map": 0.026, "obs": 0, "own": 0.018, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.046, "det": null, "oid": "ORG-ITHA1-RIPE", "org": "TT Mobil Iletisim Hizmetleri A.S", "pdb": null, "pfx": 419, "reg": "2001-07-17", "rir": "ripencc", "s24": 3140, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1579264, "abuse": "abuse@turktelekom.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.108712}, {"a": 21021, "h": "MULTIMEDIA-AS", "n": "Multimedia Polska S.A.", "t": "Transit & backbone", "w": 6, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.06, "lo": 0.14, "ips": 2, "mean": 0.50, "above": false}, "dshield": {"n": 1, "p": 0.0090, "hi": 2.10, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "urlhaus": {"n": 2, "p": 0.2948, "hi": 5.18, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}, "blocklist_de": {"n": 1, "p": 0.0003, "hi": 1.36, "lo": 0.10, "ips": 3, "mean": 0.57, "above": false}}, "h2": [["2026-10-05", 0.052, 0.340, 0, false], ["2026-10-12", 0.053, 0.381, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.381, "se": 1.121, "ts": 1.000, "map": 1.602, "obs": 2, "own": 5.969, "comp": {"urlhaus": 3.6631, "threatfox": -0.5185, "phishing_db": -1.0473}, "mass": 5.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.053, "se": 0.809, "ts": 0.500, "map": 0.175, "obs": 2, "own": 0.566, "comp": {"cins": -0.5008, "dshield": 2.7832, "crowdsec": -3.9205, "vulncheck": -0.6632, "blocklist_de": 1.9529}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"c2": 1, "compromised": 1}, "blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-MP1-RIPE", "org": "Multimedia Polska Sp. z o.o.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.multimedia.pl"}, "pfx": 45, "reg": "2001-07-30", "rir": "ripencc", "s24": 2325, "sib": 5, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 634880, "abuse": "abuse.ip@multimedia.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01702725835122}, {"a": 21100, "h": "ITLDC-EU", "n": "ITL Company AS21100", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9441, "hi": 10.54, "lo": 2.92, "ips": 6, "mean": 6.23, "above": true}, "vulncheck": {"n": 1, "p": 0.1859, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "phishing_db": {"n": 1, "p": 0.1868, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.876, 0.365, 0, false], ["2026-10-12", 0.186, 0.381, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.381, "se": 1.502, "ts": 1.000, "map": 3.546, "obs": 1, "own": 4.172, "comp": {"urlhaus": -0.1369, "threatfox": -0.1623, "phishing_db": 3.1913}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.186, "se": 1.236, "ts": 1.000, "map": 1.350, "obs": 1, "own": 0.894, "comp": {"cins": -0.1058, "dshield": -0.247, "crowdsec": -0.9781, "vulncheck": 3.5769, "blocklist_de": -0.5524}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.824, "det": {"shodan": {"compromised": 6}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-RL646-RIPE", "org": "ROUTE 95 LLC", "pdb": null, "pfx": 36, "reg": "2001-08-27", "rir": "ripencc", "s24": 58, "sib": 5, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 14848, "abuse": "abuse@route95.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00092239067675}, {"a": 21107, "h": "BLICNET-AS", "n": "Blicnet", "t": "Other", "w": 3, "cc": "BA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0288, "hi": 2.63, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}, "blocklist_de": {"n": 1, "p": 0.0776, "hi": 3.38, "lo": 0.25, "ips": 3, "mean": 1.43, "above": false}}, "h2": [["2026-10-05", 0.073, 0.010, 0, false], ["2026-10-12", 0.076, 0.010, 0, false]], "sh": false, "uc": 72.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.913, "ts": null, "map": 0.160, "obs": 0, "own": 0.369, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.076, "se": 1.116, "ts": 1.000, "map": 0.454, "obs": 1, "own": 0.280, "comp": {"cins": -0.2242, "dshield": -0.4974, "crowdsec": -1.9655, "vulncheck": -0.4472, "blocklist_de": 3.7393}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.165, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-BAD1-RIPE", "org": "Blicnet d.o.o. Banja Luka", "pdb": null, "pfx": 74, "reg": "2001-08-29", "rir": "ripencc", "s24": 375, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 133376, "abuse": "abuse@blic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00248380059018}, {"a": 21127, "h": "ZSTTKAS", "n": "Joint Stock Company TransTeleCom", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 2, "p": 0.3732, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "crowdsec": {"n": 1, "p": 0.0007, "hi": 1.47, "lo": 0.11, "ips": 1, "mean": 0.62, "above": false}, "vulncheck": {"n": 1, "p": 0.0708, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "blocklist_de": {"n": 2, "p": 0.0771, "hi": 3.32, "lo": 0.43, "ips": 2, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.348, 0.710, 0, false], ["2026-10-12", 0.300, 0.782, 0, false]], "sh": false, "uc": 65, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.782, "se": 1.129, "ts": 1.000, "map": 3.497, "obs": 2, "own": 8.711, "comp": {"urlhaus": 4.386, "threatfox": -0.5011, "phishing_db": -1.007}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.300, "se": 0.664, "ts": 0.500, "map": 0.758, "obs": 4, "own": 1.195, "comp": {"cins": -0.735, "dshield": -1.3452, "crowdsec": -2.043, "vulncheck": 0.5753, "blocklist_de": 4.6643}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.448, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-CJSC19-RIPE", "org": "Joint Stock Company TransTeleCom", "pdb": null, "pfx": 48, "reg": "2001-09-03", "rir": "ripencc", "s24": 838, "sib": 33, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 248320, "abuse": "abuse@ttk.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0012570663413}, {"a": 21183, "h": "VODAFONE-FIX-AS", "n": "ABCOM", "t": "Broadband & mobile", "w": 3, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 3, "web_bruteforce": 3, "home_connection": 2, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5038, "hi": 6.37, "lo": 1.12, "ips": 3, "mean": 3.28, "above": false}}, "h2": [["2026-10-05", 3.378, 0.011, 0, false], ["2026-10-12", 1.586, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.423, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.586, "se": 0.752, "ts": 1.000, "map": 4.786, "obs": 3, "own": 7.496, "comp": {"cins": -0.4847, "dshield": -0.9703, "crowdsec": 7.5388, "vulncheck": -0.6546, "blocklist_de": -2.4699}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.258, "det": {"blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-VAS3-RIPE", "org": "Vodafone Albania Sh.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.abcom.al"}, "pfx": 37, "reg": "2001-09-18", "rir": "ripencc", "s24": 82, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00525743271516}, {"a": 21221, "h": "InfoPact-AS", "n": "Infopact Netwerk & Communicatie", "t": "Broadband & mobile", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0238, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.906, "ts": null, "map": 0.158, "obs": 0, "own": 0.889, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.619, "ts": null, "map": 0.088, "obs": 0, "own": 0.205, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-INB2-RIPE", "org": "Infopact Netwerkdiensten B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Restrictive", "web": "https://infopact.nl"}, "pfx": 24, "reg": "2001-10-02", "rir": "ripencc", "s24": 410, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 105984, "abuse": "abuse@infopact.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00124287331993}, {"a": 21246, "h": "IPKO-AS", "n": "Ipko Telecommunication", "t": "Broadband & mobile", "w": 3, "cc": "AL", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1360, "hi": 4.07, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 2, "p": 0.0911, "hi": 3.46, "lo": 0.45, "ips": 2, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.479, 0.010, 0, false], ["2026-10-12", 0.503, 0.011, 0, false]], "sh": false, "uc": 497.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.928, "ts": null, "map": 0.165, "obs": 0, "own": 0.976, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.503, "se": 0.729, "ts": 0.667, "map": 1.446, "obs": 3, "own": 2.268, "comp": {"cins": -0.5422, "dshield": 2.6211, "crowdsec": 3.1207, "vulncheck": -0.6836, "blocklist_de": -2.7533}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.173, "det": null, "oid": "ORG-IA73-RIPE", "org": "IPKO Telecommunications LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.ipko.com"}, "pfx": 13, "reg": "2001-10-04", "rir": "ripencc", "s24": 308, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 113408, "abuse": "abuse@ipko.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00572195963758}, {"a": 21249, "h": "RUTIL-BG-AS", "n": "Rutil Ltd.", "t": "Other", "w": 1, "cc": "BG", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.670, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 5.435, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RL56-RIPE", "org": "Rutil Ltd.", "pdb": null, "pfx": 1, "reg": "2001-10-05", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@rutil.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002791657258}, {"a": 21271, "h": "SOTELMABGP", "n": "SOTELMA", "t": "Broadband & mobile", "w": 2, "cc": "ML", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3817, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}}, "h2": [["2026-10-12", 1.975, 0.012, 0, false]], "sh": false, "uc": 4069, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.975, "se": 0.956, "ts": 1.000, "map": 8.756, "obs": 2, "own": 14.062, "comp": {"cins": -0.2733, "dshield": -0.5942, "crowdsec": 6.3421, "vulncheck": -0.5001, "blocklist_de": -1.4111}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SOMT1-AFRINIC", "org": "Society of Mali's Telecommunications (SOTELMA)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Open", "web": "https://moov-africa.ml"}, "pfx": 16, "reg": "2007-09-20", "rir": "afrinic", "s24": 24, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00329214235488}, {"a": 21277, "h": "Newroz-Telecom-ASN", "n": "Newroz Telecom", "t": "Broadband & mobile", "w": 8, "cc": "IQ", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1558, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 3, "p": 0.2604, "hi": 4.62, "lo": 0.81, "ips": 3, "mean": 2.38, "above": false}, "vulncheck": {"n": 2, "p": 0.3395, "hi": 5.55, "lo": 0.72, "ips": 4, "mean": 2.65, "above": false}}, "h2": [["2026-10-12", 1.327, 0.011, 0, false]], "sh": false, "uc": 514.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.036, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.327, "se": 0.591, "ts": 0.500, "map": 2.950, "obs": 6, "own": 4.621, "comp": {"cins": 3.3997, "dshield": -1.4902, "crowdsec": 3.2224, "vulncheck": 1.5549, "blocklist_de": -4.2114}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.149, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-NTL14-RIPE", "org": "Allay Nawroz Telecom Company for Communication/Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.newroztelecom.com"}, "pfx": 64, "reg": "2008-10-09", "rir": "ripencc", "s24": 255, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 94720, "abuse": "noc@newrozholdings.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00754114422048}, {"a": 21283, "h": "A1SI-AS", "n": "A1 Slovenija", "t": "Broadband & mobile", "w": 1, "cc": "SI", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 1.08, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}}, "h2": [["2026-10-05", 0.030, 0.008, 0, false], ["2026-10-12", 0.030, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.818, "ts": null, "map": 0.122, "obs": 0, "own": 0.593, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.030, "se": 1.035, "ts": 1.000, "map": 0.155, "obs": 1, "own": 0.256, "comp": {"cins": -0.2574, "dshield": -0.5634, "crowdsec": 2.1651, "vulncheck": -0.484, "blocklist_de": -1.3307}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SD2-RIPE", "org": "A1 Slovenija telekomunikacijske storitve,d.d.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.A1.si/"}, "pfx": 18, "reg": "2001-10-16", "rir": "ripencc", "s24": 1272, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 329728, "abuse": "abuse@a1.si", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00977920483862}, {"a": 21299, "h": "KAR-TEL-AS", "n": "Beeline Kazakhstan", "t": "Broadband & mobile", "w": 15, "cc": "KZ", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 4}, "ev": {"dshield": {"n": 6, "p": 0.7789, "hi": 7.27, "lo": 2.02, "ips": 6, "mean": 4.30, "above": false}, "crowdsec": {"n": 4, "p": 0.0062, "hi": 2.24, "lo": 0.48, "ips": 4, "mean": 1.22, "above": false}, "vulncheck": {"n": 1, "p": 0.0465, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "blocklist_de": {"n": 5, "p": 0.3349, "hi": 4.68, "lo": 1.16, "ips": 5, "mean": 2.67, "above": false}}, "h2": [["2026-10-05", 0.416, 0.008, 0, false], ["2026-10-12", 1.359, 0.009, 0, false]], "sh": false, "uc": 88.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.825, "ts": null, "map": 0.125, "obs": 0, "own": 0.613, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 5}, "lo": 1.359, "se": 0.445, "ts": 0.375, "map": 2.349, "obs": 16, "own": 3.622, "comp": {"cins": -2.0504, "dshield": 6.1785, "crowdsec": -4.3218, "vulncheck": -0.557, "blocklist_de": 2.9986}, "mass": 15.2, "listed": false}}, "abq": false, "bot": 0.181, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 4, "imap": 1, "mail": 1}}, "oid": "ORG-KL166-RIPE", "org": "Kar-Tel LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://beeline.kz"}, "pfx": 754, "reg": "2001-10-24", "rir": "ripencc", "s24": 1164, "sib": 5, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 544000, "abuse": "ripe-kartel-mobile@beeline.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01501237918432}, {"a": 21334, "h": "ASN-ONE-HU", "n": "2Connect Hungary", "t": "Other", "w": 8, "cc": "HU", "cf": null, "cs": {"c": {"web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 4, "mail_bruteforce": 1, "cve:CVE-2024-29973": 1}, "n": 4}, "ev": {"dshield": {"n": 2, "p": 0.0086, "hi": 2.20, "lo": 0.29, "ips": 2, "mean": 1.05, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.90, "lo": 0.19, "ips": 4, "mean": 0.49, "above": false}, "vulncheck": {"n": 1, "p": 0.0020, "hi": 1.68, "lo": 0.13, "ips": 1, "mean": 0.71, "above": false}, "blocklist_de": {"n": 2, "p": 0.0001, "hi": 1.34, "lo": 0.17, "ips": 2, "mean": 0.64, "above": false}}, "h2": [["2026-10-05", 0.357, 0.006, 0, false], ["2026-10-12", 0.225, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.745, "ts": null, "map": 0.088, "obs": 0, "own": 0.161, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.225, "se": 0.509, "ts": 0.444, "map": 0.434, "obs": 9, "own": 0.247, "comp": {"cins": -1.4209, "dshield": 2.2193, "crowdsec": 0.288, "vulncheck": -0.2283, "blocklist_de": -0.2983}, "mass": 8.4, "listed": false}}, "abq": false, "bot": 0.127, "det": {"vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TINS1-RIPE", "org": "2Connect Telecommunications Infrastructure & Network Services Ltd.", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://2connect.com/"}, "pfx": 64, "reg": "2001-11-02", "rir": "ripencc", "s24": 3462, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1702656, "abuse": "ipadmin@2connect.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03760571126414}, {"a": 21341, "h": "SINET-AS", "n": "Soroush Rasanheh Company Ltd", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3146, "hi": 5.34, "lo": 0.69, "ips": 3, "mean": 2.55, "above": false}}, "h2": [["2026-10-05", 0.847, 0.011, 0, false], ["2026-10-12", 0.895, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 0.602, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.895, "se": 0.913, "ts": 1.000, "map": 3.630, "obs": 2, "own": 2.123, "comp": {"cins": -0.3133, "dshield": -0.6702, "crowdsec": 5.8172, "vulncheck": -0.5372, "blocklist_de": -1.6136}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.531, "det": null, "oid": "ORG-SAVC1-RIPE", "org": "Soroush Rasanheh Company Ltd", "pdb": null, "pfx": 23, "reg": "2001-11-05", "rir": "ripencc", "s24": 67, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "ripencc@sinet.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001029621114}, {"a": 21409, "h": "IKOULA", "n": "Ikoula", "t": "Transit & backbone", "w": 5, "cc": "FR", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.5480, "hi": 6.22, "lo": 1.34, "ips": 4, "mean": 3.40, "above": false}, "crowdsec": {"n": 1, "p": 0.0492, "hi": 2.99, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "vulncheck": {"n": 3, "p": 0.5698, "hi": 6.95, "lo": 1.22, "ips": 3, "mean": 3.58, "above": false}, "phishing_db": {"n": 1, "p": 0.1557, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.330, 0.202, 0, false], ["2026-10-12", 0.627, 0.212, 0, false]], "sh": false, "uc": 107.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.212, "se": 1.415, "ts": 1.000, "map": 1.587, "obs": 1, "own": 6.645, "comp": {"urlhaus": -0.2267, "threatfox": -0.2322, "phishing_db": 2.5472}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.627, "se": 0.690, "ts": 0.750, "map": 1.633, "obs": 4, "own": 5.345, "comp": {"cins": -0.4496, "dshield": -0.9121, "crowdsec": 0.2809, "vulncheck": 5.2612, "blocklist_de": -2.2963}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.809, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 1, "botnet_node": 2}, "blocklist_de": {"apache": 1}}, "oid": "ORG-WH1-RIPE", "org": "Ikoula Net SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.ikoula.com"}, "pfx": 17, "reg": "2001-11-30", "rir": "ripencc", "s24": 221, "sib": 0, "tor": 1, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58368, "abuse": "abuse@ikoula.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00407951395176}, {"a": 21430, "h": "WIA-AS", "n": "WIA", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2335, "hi": 4.68, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.742, "ts": null, "map": 0.133, "obs": 0, "own": 0.367, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "ORG-WSS1-RIPE", "org": "WIA spol. s.r.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.wia.cz/"}, "pfx": 65, "reg": "2001-12-07", "rir": "ripencc", "s24": 161, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41472, "abuse": "abuse@wia.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0010642780726}, {"a": 21453, "h": "FLEX-AS", "n": "Flex", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0385, "hi": 2.84, "lo": 0.37, "ips": 2, "mean": 1.35, "above": false}, "vulncheck": {"n": 1, "p": 0.1143, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "blocklist_de": {"n": 1, "p": 0.0625, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.182, 0.009, 0, false], ["2026-10-12", 0.483, 0.010, 0, false]], "sh": false, "uc": 119.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 0.857, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.483, "se": 0.666, "ts": 0.500, "map": 1.230, "obs": 4, "own": 1.939, "comp": {"cins": -0.6644, "dshield": -1.2462, "crowdsec": 1.865, "vulncheck": 0.7214, "blocklist_de": 0.9251}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.463, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-FI3-RIPE", "org": "Flex Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://flex.ru"}, "pfx": 17, "reg": "2001-12-14", "rir": "ripencc", "s24": 458, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 179968, "abuse": "abuse@flex.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00112201072445}, {"a": 21491, "h": "Uganda-Telecom", "n": "Uganda Telecom", "t": "Broadband & mobile", "w": 36, "cc": "UG", "cf": null, "cs": {"c": {"ssh_bruteforce": 4, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 4}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "crowdsec": {"n": 5, "p": 0.6087, "hi": 6.26, "lo": 1.55, "ips": 5, "mean": 3.57, "above": false}, "blocklist_de": {"n": 20, "p": 1.0000, "hi": 22.81, "lo": 11.04, "ips": 35, "mean": 16.48, "above": true}}, "h2": [["2026-10-05", 11.266, 0.010, 1, false], ["2026-10-12", 14.019, 0.011, 1, false]], "sh": false, "uc": 1714.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.035, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 20}, "lo": 14.019, "se": 0.403, "ts": 0.800, "map": 22.433, "obs": 25, "own": 34.292, "comp": {"cins": -2.8622, "dshield": -3.0292, "crowdsec": -7.7402, "vulncheck": -0.9796, "blocklist_de": 19.1154}, "mass": 31.6, "listed": false}}, "abq": false, "bot": 0.234, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 1, "imap": 34, "mail": 34}}, "oid": "@aut-21491-RIPE", "org": "Uganda Telecom", "pdb": null, "pfx": 55, "reg": "2001-12-31", "rir": "ripencc", "s24": 256, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 79360, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00020679129789}, {"a": 21497, "h": "UMC-AS", "n": "Vodafone Ukraine", "t": "Broadband & mobile", "w": 6, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.85, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "dshield": {"n": 3, "p": 0.1135, "hi": 3.59, "lo": 0.63, "ips": 3, "mean": 1.85, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.94, "lo": 0.12, "ips": 2, "mean": 0.45, "above": false}, "blocklist_de": {"n": 1, "p": 0.0005, "hi": 1.44, "lo": 0.11, "ips": 1, "mean": 0.61, "above": false}}, "h2": [["2026-10-05", 0.218, 0.057, 0, false], ["2026-10-12", 0.231, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.779, "ts": null, "map": 0.104, "obs": 0, "own": 0.484, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.231, "se": 0.560, "ts": 0.500, "map": 0.488, "obs": 6, "own": 0.760, "comp": {"cins": -1.0962, "dshield": 6.1033, "crowdsec": -1.7975, "vulncheck": -0.8423, "blocklist_de": -1.6908}, "mass": 5.9, "listed": false}}, "abq": false, "bot": 0.120, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-UMC1-RIPE", "org": "PrJSC \"VF UKRAINE\"", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.vodafone.ua/"}, "pfx": 167, "reg": "2002-01-02", "rir": "ripencc", "s24": 2148, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1718016, "abuse": "noc@vodafone.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04163262989109}, {"a": 21499, "h": "GODADDY-SXB", "n": "Host Europe GmbH", "t": "Hosting & VPS", "w": 30, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 16, "web_exploit": 9, "bad_crawling": 4, "proxy_or_vpn": 5, "first_seen_30d": 2, "ssh_bruteforce": 12, "web_bruteforce": 9, "mail_bruteforce": 5, "cve:CVE-2011-3600": 1, "cve:CVE-2013-3827": 1, "cve:CVE-2014-2383": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2024-28000": 1}, "n": 20}, "ev": {"cins": {"n": 2, "p": 0.3456, "hi": 5.60, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}, "shodan": {"n": 20, "p": 1.0000, "hi": 17.90, "lo": 8.67, "ips": 20, "mean": 12.93, "above": true}, "crowdsec": {"n": 18, "p": 1.0000, "hi": 15.03, "lo": 7.01, "ips": 20, "mean": 10.70, "above": true}, "vulncheck": {"n": 3, "p": 0.5454, "hi": 6.72, "lo": 1.18, "ips": 3, "mean": 3.47, "above": false}, "phishing_db": {"n": 6, "p": 0.9401, "hi": 10.36, "lo": 2.88, "ips": 6, "mean": 6.13, "above": true}, "blocklist_de": {"n": 2, "p": 0.2472, "hi": 4.80, "lo": 0.62, "ips": 2, "mean": 2.29, "above": false}}, "h2": [["2026-10-05", 8.433, 2.968, 0, false], ["2026-10-12", 7.354, 2.997, 0, false]], "sh": false, "uc": 255.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 6}, "lo": 2.997, "se": 0.871, "ts": 1.000, "map": 7.702, "obs": 6, "own": 2.882, "comp": {"urlhaus": -1.0522, "threatfox": -0.4783, "phishing_db": 5.1981}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 18, "vulncheck": 3, "blocklist_de": 2}, "lo": 7.354, "se": 0.412, "ts": 0.720, "map": 12.153, "obs": 25, "own": 2.377, "comp": {"cins": 2.6448, "dshield": -2.7633, "crowdsec": 10.4239, "vulncheck": -0.0531, "blocklist_de": -6.3609}, "mass": 19.6, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"compromised": 20}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-OG1-RIPE", "org": "Host Europe GmbH", "pdb": null, "pfx": 46, "reg": "2002-01-03", "rir": "ripencc", "s24": 292, "sib": 19, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.8393]], "ipv4": 82432, "abuse": "abuse@hosteurope.de", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00215468881979}, {"a": 21508, "h": "COMCAST-21508", "n": "Comcast - Richmond", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.936, "ts": null, "map": 0.168, "obs": 0, "own": 1.012, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.671, "ts": null, "map": 0.106, "obs": 0, "own": 0.264, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.294, "det": null, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": null}, "pfx": 17, "reg": "2001-05-16", "rir": "arin", "s24": 275, "sib": 55, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 70400, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21668, "h": "ENET", "n": "ElbertonNet", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.479, 0.011, 0, false], ["2026-10-12", 0.482, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.482, "se": 1.395, "ts": 1.000, "map": 4.736, "obs": 1, "own": 3.377, "comp": {"cins": -0.0646, "dshield": -0.1536, "crowdsec": -0.6088, "vulncheck": 4.1141, "blocklist_de": -0.3383}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.158, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "CE-99-ARIN", "org": "ElbertonNet", "pdb": null, "pfx": 8, "reg": "2012-10-05", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse@zcorum.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21699, "h": "IO", "n": "IO INC", "t": "Other", "w": 9, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 8, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.729, 0.011, 0, false], ["2026-10-12", 0.874, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.874, "se": 0.939, "ts": 0.500, "map": 3.608, "obs": 2, "own": 2.192, "comp": {"cins": 4.662, "dshield": -0.5749, "crowdsec": -2.27, "vulncheck": 2.2204, "blocklist_de": -1.3607}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.497, "det": {"vulncheck": {"botnet_node": 8}}, "oid": "IOINC-ARIN", "org": "IO INC", "pdb": null, "pfx": 53, "reg": "2015-04-24", "rir": "arin", "s24": 56, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21743, "h": "ANL-36", "n": "Atlas Networks", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1332, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "threatfox": {"n": 1, "p": 0.1936, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.318, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.318, "se": 1.472, "ts": 1.000, "map": 2.728, "obs": 1, "own": 8.009, "comp": {"urlhaus": -0.1484, "threatfox": 3.0944, "phishing_db": -0.3164}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.166, "obs": 0, "own": 0.541, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.380, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Unknown malware": 1}}, "oid": "ANL-36-ARIN", "org": "Atlas Networks Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://atlasnet.com"}, "pfx": 24, "reg": "2011-01-20", "rir": "arin", "s24": 82, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": "abuse@atlasnet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21756, "h": "", "n": "SIDERCA S.A.I.C.", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.245, "det": {"shodan": {"malware": 1}}, "oid": "@aut-21756-LACNIC", "org": "SIDERCA S.A.I.C.", "pdb": null, "pfx": 5, "reg": "2001-06-15", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21769, "h": "AS-COLOAM", "n": "Colocation America AS21769", "t": "Hosting & VPS", "w": 11, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2017-3506": 1, "cve:CVE-2021-44228": 1, "cve:CVE-2022-22965": 1}, "n": 1}, "ev": {"dshield": {"n": 9, "p": 0.9960, "hi": 13.10, "lo": 4.52, "ips": 9, "mean": 8.34, "above": true}, "crowdsec": {"n": 1, "p": 0.0182, "hi": 2.39, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "phishing_db": {"n": 1, "p": 0.1316, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-12", 2.119, 0.164, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.164, "se": 1.390, "ts": 1.000, "map": 1.147, "obs": 1, "own": 0.529, "comp": {"urlhaus": -0.2695, "threatfox": -0.2592, "phishing_db": 2.2917}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 9, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.119, "se": 0.486, "ts": 0.900, "map": 3.959, "obs": 10, "own": 0.778, "comp": {"cins": -1.3929, "dshield": 17.7128, "crowdsec": -5.9462, "vulncheck": -0.8851, "blocklist_de": -6.7189}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.915, "det": null, "oid": "CAC-89-ARIN", "org": "Colocation America Corporation", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.colocationamerica.com"}, "pfx": 94, "reg": "2005-07-15", "rir": "arin", "s24": 369, "sib": 4, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 404736, "abuse": "Abuse@colocationamerica.com", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00476178982628}, {"a": 21788, "h": "HIPOINT-US", "n": "BurstNET Technologies, Inc.", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5762, "hi": 7.01, "lo": 1.24, "ips": 3, "mean": 3.62, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 2.790, 0.011, 0, false], ["2026-10-12", 5.204, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.259, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.204, "se": 0.674, "ts": 0.750, "map": 13.529, "obs": 4, "own": 2.679, "comp": {"cins": -0.6419, "dshield": -1.2135, "crowdsec": 5.5143, "vulncheck": -0.7256, "blocklist_de": 1.0653}, "mass": 3.0, "listed": false}}, "abq": true, "bot": 0.251, "det": {"blocklist_de": {"ssh": 1}}, "oid": "HTS-77-ARIN", "org": "HIPOINT TECHNOLOGY SERVICES, INC.", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.burst.net/"}, "pfx": 22, "reg": "2017-11-09", "rir": "arin", "s24": 40, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21804, "h": "ACCESS-SK", "n": "Access Communications Co-operative", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0218, "hi": 2.48, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}}, "h2": [["2026-10-05", 0.074, 0.010, 0, false], ["2026-10-12", 0.076, 0.011, 0, false]], "sh": false, "uc": 66.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.920, "ts": null, "map": 0.162, "obs": 0, "own": 0.943, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.076, "se": 1.114, "ts": 1.000, "map": 0.451, "obs": 1, "own": 0.756, "comp": {"cins": -0.2044, "dshield": -0.4572, "crowdsec": 2.7412, "vulncheck": -0.4229, "blocklist_de": -1.0599}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.130, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ACR-29-ARIN", "org": "Access Communications Co-operative Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.myaccess.ca"}, "pfx": 24, "reg": "2001-06-21", "rir": "arin", "s24": 343, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 96768, "abuse": "hostmaster@accesscomm.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00314590181997}, {"a": 21826, "h": "", "n": "Corporación Telemic Network", "t": "Transit & backbone", "w": 10, "cc": "VE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0527, "hi": 3.04, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "dshield": {"n": 3, "p": 0.2453, "hi": 4.52, "lo": 0.80, "ips": 3, "mean": 2.33, "above": false}, "crowdsec": {"n": 3, "p": 0.0007, "hi": 1.71, "lo": 0.30, "ips": 4, "mean": 0.88, "above": false}, "blocklist_de": {"n": 3, "p": 0.0692, "hi": 3.20, "lo": 0.56, "ips": 3, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.205, 0.008, 0, false], ["2026-10-12", 0.761, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.121, "obs": 0, "own": 0.830, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.761, "se": 0.490, "ts": 0.300, "map": 1.428, "obs": 10, "own": 4.486, "comp": {"cins": 1.6482, "dshield": 3.3344, "crowdsec": -3.4242, "vulncheck": -0.912, "blocklist_de": 1.1033}, "mass": 10.5, "listed": false}}, "abq": true, "bot": 0.224, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "@aut-21826-LACNIC", "org": "Corporación Telemic C.A.", "pdb": {"t": "NSP", "sc": "South America", "tr": "1-5Tbps", "pol": "Selective", "web": "https://inter.com.ve"}, "pfx": 804, "reg": "2001-06-26", "rir": "lacnic", "s24": 1325, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 658688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02372874904727}, {"a": 21852, "h": "DISNW1", "n": "State Of Arkansas, Division of Information Systems", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0003, "hi": 1.34, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.245, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.486, "ts": null, "map": 0.049, "obs": 0, "own": 0.037, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.284, "det": {"shodan": {"malware": 1}}, "oid": "SADI-ARIN", "org": "State Of Arkansas, Division of Information Systems", "pdb": null, "pfx": 11, "reg": "2001-06-29", "rir": "arin", "s24": 1190, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 370176, "abuse": "hostmaster@arkansas.gov", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 21859, "h": "ZEN-ECN", "n": "Zenlayer Edge Cloud Network - AS21859", "t": "Hosting & VPS", "w": 246, "cc": "US", "cf": {"rb": "hi", "wb": "", "rep": 0.93, "waf": 1.01}, "cs": {"c": {"http_flood": 89, "data_centre": 53, "web_exploit": 81, "bad_crawling": 47, "proxy_or_vpn": 12, "ssh_bruteforce": 7, "web_bruteforce": 101, "mail_bruteforce": 6, "router_or_botnet": 1, "cve:CVE-2017-9841": 71, "cve:CVE-2020-5902": 37, "cve:CVE-2018-13379": 25, "cve:CVE-2018-20062": 63, "cve:CVE-2021-41773": 5}, "n": 105}, "ev": {"cins": {"n": 7, "p": 0.7028, "hi": 6.27, "lo": 1.90, "ips": 127, "mean": 3.81, "above": false}, "shodan": {"n": 7, "p": 0.0010, "hi": 2.01, "lo": 0.61, "ips": 7, "mean": 1.22, "above": false}, "dshield": {"n": 2, "p": 0.0254, "hi": 2.62, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}, "crowdsec": {"n": 21, "p": 0.3346, "hi": 3.83, "lo": 1.88, "ips": 105, "mean": 2.78, "above": false}, "threatfox": {"n": 1, "p": 0.0782, "hi": 3.39, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "phishing_db": {"n": 5, "p": 0.3258, "hi": 4.63, "lo": 1.15, "ips": 7, "mean": 2.64, "above": false}, "blocklist_de": {"n": 7, "p": 0.1219, "hi": 3.47, "lo": 1.05, "ips": 9, "mean": 2.11, "above": false}}, "h2": [["2026-10-05", 1.937, 0.444, 0, false], ["2026-10-12", 1.787, 0.449, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 5}, "lo": 0.449, "se": 0.941, "ts": 0.833, "map": 1.201, "obs": 6, "own": 0.513, "comp": {"urlhaus": -1.2955, "threatfox": 0.1813, "phishing_db": 2.9233}, "mass": 4.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 2, "crowdsec": 21, "vulncheck": 0, "blocklist_de": 7}, "lo": 1.787, "se": 0.395, "ts": 0.568, "map": 2.821, "obs": 37, "own": 0.553, "comp": {"cins": 8.0984, "dshield": -1.8136, "crowdsec": 1.3926, "vulncheck": -0.9874, "blocklist_de": -4.2593}, "mass": 40.6, "listed": false}}, "abq": false, "bot": 0.588, "det": {"shodan": {"c2": 4, "compromised": 3}, "threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"ftp": 1, "ssh": 2, "imap": 3, "mail": 4, "apache": 2, "bruteforcelogin": 2}}, "oid": "ZENLA-7-ARIN", "org": "Zenlayer Inc", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.zenlayer.com"}, "pfx": 1683, "reg": "2013-04-02", "rir": "arin", "s24": 2598, "sib": 6, "tor": 0, "w24": 38, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 943872, "abuse": "abuse@zenlayer.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.078709}, {"a": 21928, "h": "T-MOBILE-AS21928", "n": "T-Mobile USA", "t": "Broadband & mobile", "w": 31, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.18, "waf": 0.19}, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.21, "lo": 0.02, "ips": 1, "mean": 0.09, "above": false}, "dshield": {"n": 8, "p": 0.0000, "hi": 0.50, "lo": 0.16, "ips": 8, "mean": 0.31, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.05, "lo": 0.01, "ips": 2, "mean": 0.02, "above": false}, "vulncheck": {"n": 12, "p": 0.0000, "hi": 0.70, "lo": 0.28, "ips": 14, "mean": 0.47, "above": false}, "blocklist_de": {"n": 6, "p": 0.0000, "hi": 0.21, "lo": 0.06, "ips": 6, "mean": 0.13, "above": false}}, "h2": [["2026-10-05", 0.048, 0.003, 0, false], ["2026-10-12", 0.048, 0.003, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.003, "se": 1.612, "ts": null, "map": 0.027, "obs": 0, "own": 0.129, "comp": null, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 8, "crowdsec": 2, "vulncheck": 12, "blocklist_de": 6}, "lo": 0.048, "se": 0.433, "ts": 0.414, "map": 0.081, "obs": 29, "own": 0.127, "comp": {"cins": -0.2385, "dshield": 5.6104, "crowdsec": -9.01, "vulncheck": 2.1381, "blocklist_de": 0.3857}, "mass": 23.4, "listed": false}}, "abq": false, "bot": 0.078, "det": {"vulncheck": {"c2_server": 5, "other_infrastructure": 9}, "blocklist_de": {"bots": 1, "imap": 5, "mail": 5}}, "oid": "TMOBI-ARIN", "org": "T-Mobile USA, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.t-mobile.com"}, "pfx": 285, "reg": "2002-06-12", "rir": "arin", "s24": 51254, "sib": 14, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13960704, "abuse": "abuse@t-mobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 1.382779}, {"a": 21949, "h": "BEANFIELD", "n": "Beanfield Technologies Inc.", "t": "Transit & backbone", "w": 2, "cc": "CA", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.2097, "hi": 4.49, "lo": 0.58, "ips": 2, "mean": 2.14, "above": false}}, "h2": [["2026-10-12", 0.127, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.860, "ts": null, "map": 0.140, "obs": 0, "own": 1.028, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.127, "se": 0.835, "ts": 1.000, "map": 0.446, "obs": 2, "own": 1.440, "comp": {"cins": -0.4164, "dshield": 7.1161, "crowdsec": -3.3693, "vulncheck": -0.6144, "blocklist_de": -2.1308}, "mass": 1.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "BNFD-ARIN", "org": "Beanfield Technologies Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.beanfield.com"}, "pfx": 71, "reg": "2001-07-17", "rir": "arin", "s24": 744, "sib": 10, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 192256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01040877076001}, {"a": 21976, "h": "NJEDGE-NET", "n": "NJEDge.Net", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0115, "hi": 2.20, "lo": 0.16, "ips": 1, "mean": 0.93, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.885, "ts": null, "map": 0.150, "obs": 0, "own": 1.363, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.583, "ts": null, "map": 0.076, "obs": 0, "own": 0.618, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.146, "det": {"shodan": {"malware": 1}}, "oid": "NJEDGE-ARIN", "org": "NJEDge.Net, Inc.", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.njedge.net"}, "pfx": 95, "reg": "2001-07-19", "rir": "arin", "s24": 543, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 167936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22047, "h": "", "n": "VTR Global COM S.A.", "t": "Broadband & mobile", "w": 18, "cc": "CL", "cf": {"rb": "hi", "wb": "hi", "rep": 1.50, "waf": 1.31}, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 2, "p": 0.0015, "hi": 1.76, "lo": 0.23, "ips": 2, "mean": 0.84, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.34, "lo": 0.03, "ips": 1, "mean": 0.14, "above": false}, "dshield": {"n": 4, "p": 0.0041, "hi": 2.13, "lo": 0.46, "ips": 4, "mean": 1.16, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.37, "lo": 0.05, "ips": 2, "mean": 0.17, "above": false}, "blocklist_de": {"n": 11, "p": 0.0054, "hi": 2.41, "lo": 0.92, "ips": 11, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.230, 0.006, 0, false], ["2026-10-12", 0.443, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.707, "ts": null, "map": 0.070, "obs": 0, "own": 0.315, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 11}, "lo": 0.443, "se": 0.431, "ts": 0.579, "map": 0.746, "obs": 19, "own": 1.153, "comp": {"cins": 1.7215, "dshield": 1.0338, "crowdsec": -9.3405, "vulncheck": -0.9704, "blocklist_de": 8.6567}, "mass": 25.3, "listed": false}}, "abq": true, "bot": 0.151, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 4, "bots": 6, "imap": 1, "mail": 1}}, "oid": "@aut-22047-LACNIC", "org": "VTR BANDA ANCHA S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "100-200Gbps", "pol": "Restrictive", "web": "http://www.vtr.com"}, "pfx": 326, "reg": "2001-07-30", "rir": "lacnic", "s24": 6109, "sib": 1, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2640640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.048954}, {"a": 22066, "h": "CITY-OF-EAU-CLAIRE", "n": "City of Eau Claire", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.114, "det": {"shodan": {"malware": 1}}, "oid": "CEC-143-ARIN", "org": "City of Eau Claire", "pdb": null, "pfx": 1, "reg": "2007-09-13", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22085, "h": "", "n": "Claro Brazil AS22085", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.39, "waf": 0.34}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 1.09, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}}, "h2": [["2026-10-05", 0.002, 0.006, 0, false], ["2026-10-12", 0.009, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.706, "ts": null, "map": 0.070, "obs": 0, "own": 0.314, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.009, "se": 0.958, "ts": 1.000, "map": 0.041, "obs": 1, "own": 0.067, "comp": {"cins": -0.3278, "dshield": 3.5193, "crowdsec": -2.7501, "vulncheck": -0.5496, "blocklist_de": -1.6869}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.032, "det": null, "oid": "@aut-27652-LACNIC", "org": "Claro S/A", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.claro.com.br"}, "pfx": 10, "reg": "2001-08-07", "rir": "lacnic", "s24": 6196, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1586688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.185732}, {"a": 22160, "h": "INISMART-01", "n": "INIsmart Technology Ltd.", "t": "Other", "w": 1, "cc": "VG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.707, 0, false], ["2026-10-12", 0.012, 0.729, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.729, "se": 1.683, "ts": 1.000, "map": 9.502, "obs": 1, "own": 12.668, "comp": {"urlhaus": -0.0456, "threatfox": 4.0382, "phishing_db": -0.1149}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.387, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Sliver": 1}}, "oid": "ITL-247-ARIN", "org": "INIsmart Technology Ltd.", "pdb": null, "pfx": 7, "reg": "2025-06-18", "rir": "arin", "s24": 7, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000000012741}, {"a": 22168, "h": "SHADOWSERVER-FOUNDATION", "n": "The Shadowserver Foundation", "t": "Hosting & VPS", "w": 54, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1926, "hi": 4.67, "lo": 0.35, "ips": 54, "mean": 1.97, "above": false}, "shodan": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1830, "hi": 4.57, "lo": 0.34, "ips": 3, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.305, 0.011, 0, false], ["2026-10-12", 3.882, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.882, "se": 0.776, "ts": 0.333, "map": 12.147, "obs": 3, "own": 2.430, "comp": {"cins": 4.1043, "dshield": -1.0279, "crowdsec": -0.3421, "vulncheck": -0.673, "blocklist_de": 1.8295}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.953, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 2, "bots": 1}}, "oid": "SF-1051-ARIN", "org": "The Shadowserver Foundation, Inc.", "pdb": null, "pfx": 27, "reg": "2023-03-17", "rir": "arin", "s24": 35, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@shadowserver.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22282, "h": null, "n": "AS22282", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.179, "obs": 0, "own": 0.494, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.756, "ts": null, "map": 0.138, "obs": 0, "own": 0.143, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.259, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 7, "reg": null, "rir": "arin", "s24": 144, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22295, "h": "ADVIN", "n": "Advin Servers - AS22295", "t": "Hosting & VPS", "w": 18, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 14, "data_centre": 1, "web_exploit": 14, "bad_crawling": 11, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 11, "cve:CVE-2017-9841": 3, "cve:CVE-2018-20062": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 4, "cve:CVE-2026-87902": 1}, "n": 15}, "ev": {"shodan": {"n": 6, "p": 0.9621, "hi": 11.52, "lo": 3.20, "ips": 6, "mean": 6.81, "above": true}, "dshield": {"n": 1, "p": 0.1960, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 10, "p": 0.9996, "hi": 16.40, "lo": 5.96, "ips": 15, "mean": 10.63, "above": true}, "threatfox": {"n": 1, "p": 0.1983, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 70.974, 0.596, 1, false], ["2026-10-12", 60.724, 0.616, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.616, "se": 1.623, "ts": 1.000, "map": 7.289, "obs": 1, "own": 3.509, "comp": {"urlhaus": -0.0646, "threatfox": 3.8345, "phishing_db": -0.1574}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 10, "vulncheck": 1, "blocklist_de": 0}, "lo": 60.724, "se": 0.466, "ts": 0.833, "map": 108.722, "obs": 12, "own": 21.184, "comp": {"cins": -1.3615, "dshield": 0.1903, "crowdsec": 14.0175, "vulncheck": -0.1846, "blocklist_de": -6.5793}, "mass": 7.8, "listed": false}}, "abq": false, "bot": 0.938, "det": {"shodan": {"c2": 4, "compromised": 2}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"attack_tooling": 1}}, "oid": "ASL-843-ARIN", "org": "Advin Services LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://advinservers.com"}, "pfx": 13, "reg": "2024-01-05", "rir": "arin", "s24": 13, "sib": 0, "tor": 1, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 3328, "abuse": "abuse@advinservers.com", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": null}, {"a": 22296, "h": "VORSK", "n": "Vorsk", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 14.129, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.762, "det": {"blocklist_de": {"bots": 1}}, "oid": "VL-441-ARIN", "org": "Vorsk LLC", "pdb": {"t": null, "sc": "North America", "tr": null, "pol": "Open", "web": "https://vorsk.com/"}, "pfx": 5, "reg": "2023-05-17", "rir": "arin", "s24": 8, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@vorsk.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22363, "h": "PHMGMT-AS1", "n": "Powerhouse Management, Inc.", "t": "Broadband & mobile", "w": 30, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 11, "data_centre": 6, "web_exploit": 12, "bad_crawling": 4, "ssh_bruteforce": 1, "web_bruteforce": 12, "mail_bruteforce": 5, "cve:CVE-2017-9841": 2, "cve:CVE-2025-4396": 2, "cve:CVE-2025-4427": 1, "cve:CVE-2025-4428": 1, "cve:CVE-2026-63030": 12}, "n": 12}, "ev": {"crowdsec": {"n": 7, "p": 0.9563, "hi": 10.19, "lo": 3.09, "ips": 12, "mean": 6.20, "above": true}, "threatfox": {"n": 7, "p": 0.9870, "hi": 12.93, "lo": 3.92, "ips": 15, "mean": 7.87, "above": true}, "phishing_db": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1526, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 51.511, 11.657, 1, false], ["2026-10-12", 5.394, 10.288, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 2}, "lo": 10.288, "se": 0.795, "ts": 0.778, "map": 23.862, "obs": 9, "own": 54.367, "comp": {"urlhaus": -1.1576, "threatfox": 5.112, "phishing_db": 0.844}, "mass": 3.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.394, "se": 0.518, "ts": 0.875, "map": 10.645, "obs": 8, "own": 16.398, "comp": {"cins": -1.1822, "dshield": -1.876, "crowdsec": 9.8689, "vulncheck": -0.8564, "blocklist_de": -2.1955}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.794, "det": {"threatfox": {"family:AsyncRAT": 15}, "blocklist_de": {"mail": 1}}, "oid": "POWER157-ARIN", "org": "Powerhouse Management, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.phmgmt.com"}, "pfx": 109, "reg": "2010-10-28", "rir": "arin", "s24": 109, "sib": 0, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.1060]], "ipv4": 27904, "abuse": "networkadvisory@phmgmt.com", "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00062241787656}, {"a": 22413, "h": "EMPOWER", "n": "empower, Delivered by Craighead Electric", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 905.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.215, "obs": 0, "own": 1.054, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.172, "det": null, "oid": "EBSL-5-ARIN", "org": "empower, Delivered by Craighead Electric", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://empowerbroadband.com/"}, "pfx": 24, "reg": "2018-08-08", "rir": "arin", "s24": 22, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "admin@empowerbroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22427, "h": "GNET-AS", "n": "GNET", "t": "Other", "w": 22, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "crowdsec": {"n": 1, "p": 0.1331, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "phishing_db": {"n": 5, "p": 0.9060, "hi": 10.18, "lo": 2.53, "ips": 21, "mean": 5.81, "above": true}}, "h2": [["2026-10-05", 0.223, 6.836, 0, false], ["2026-10-12", 0.214, 8.525, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 8.525, "se": 0.871, "ts": 1.000, "map": 23.015, "obs": 5, "own": 21.297, "comp": {"urlhaus": -0.7951, "threatfox": -0.4371, "phishing_db": 5.9945}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.214, "se": 1.238, "ts": 1.000, "map": 1.623, "obs": 1, "own": 1.035, "comp": {"cins": -0.1436, "dshield": -0.3296, "crowdsec": 3.4346, "vulncheck": -0.3359, "blocklist_de": -0.7476}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.719, "det": {"shodan": {"compromised": 1}}, "oid": "GNETI-ARIN", "org": "GNET INC.", "pdb": {"t": null, "sc": null, "tr": null, "pol": "Selective", "web": "http://www.gnet.cc"}, "pfx": 66, "reg": "2021-10-07", "rir": "arin", "s24": 66, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0810]], "ipv4": 16896, "abuse": "abuse@gnet.cc", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 22439, "h": "PERFECT-INTERNATIONAL", "n": "Perfect International, Inc", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.4918, "hi": 6.27, "lo": 1.10, "ips": 3, "mean": 3.23, "above": false}, "crowdsec": {"n": 2, "p": 0.2554, "hi": 4.86, "lo": 0.63, "ips": 2, "mean": 2.32, "above": false}, "phishing_db": {"n": 1, "p": 0.1761, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 1.636, 0.278, 0, false], ["2026-10-12", 0.595, 0.290, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.290, "se": 1.456, "ts": 1.000, "map": 2.425, "obs": 1, "own": 2.847, "comp": {"urlhaus": -0.1768, "threatfox": -0.1959, "phishing_db": 2.8846}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.595, "se": 0.895, "ts": 1.000, "map": 2.345, "obs": 2, "own": 1.369, "comp": {"cins": -0.3336, "dshield": -0.7079, "crowdsec": 5.5575, "vulncheck": -0.5543, "blocklist_de": -1.716}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.568, "det": {"shodan": {"malware": 1, "compromised": 2}}, "oid": "PI-ARIN", "org": "Perfect International, Inc", "pdb": null, "pfx": 111, "reg": "2006-10-11", "rir": "arin", "s24": 111, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28416, "abuse": "noc@perfectip.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020502035453}, {"a": 22611, "h": "INMOTION", "n": "InMotion Hosting", "t": "Hosting & VPS", "w": 22, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 6, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 3, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1628, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "shodan": {"n": 12, "p": 0.9994, "hi": 13.42, "lo": 5.31, "ips": 12, "mean": 8.97, "above": true}, "urlhaus": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 8, "p": 0.9511, "hi": 9.26, "lo": 3.01, "ips": 8, "mean": 5.78, "above": true}, "phishing_db": {"n": 10, "p": 0.9993, "hi": 15.38, "lo": 5.59, "ips": 13, "mean": 9.98, "above": true}, "blocklist_de": {"n": 1, "p": 0.1185, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}}, "h2": [["2026-10-05", 2.801, 9.347, 0, false], ["2026-10-12", 4.037, 9.490, 0, false]], "sh": false, "uc": 1388.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 10}, "lo": 9.490, "se": 0.793, "ts": 0.909, "map": 22.011, "obs": 11, "own": 7.774, "comp": {"urlhaus": 0.6936, "threatfox": -0.5317, "phishing_db": 4.5559}, "mass": 6.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.037, "se": 0.488, "ts": 0.800, "map": 7.480, "obs": 10, "own": 1.469, "comp": {"cins": 2.0572, "dshield": -2.1431, "crowdsec": 8.1963, "vulncheck": -0.8932, "blocklist_de": -3.8113}, "mass": 8.7, "listed": false}}, "abq": false, "bot": 0.970, "det": {"shodan": {"compromised": 12}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "INMOT-1-ARIN", "org": "InMotion Hosting, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.inmotionhosting.com/"}, "pfx": 81, "reg": "2012-11-02", "rir": "arin", "s24": 210, "sib": 2, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.8393]], "ipv4": 54784, "abuse": "abuse@inmotionhosting.com", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00039503457}, {"a": 22612, "h": "NAMECHEAP-NET", "n": "Namecheap", "t": "Hosting & VPS", "w": 105, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 22, "data_centre": 24, "web_exploit": 24, "bad_crawling": 3, "proxy_or_vpn": 13, "first_seen_30d": 5, "ssh_bruteforce": 17, "web_bruteforce": 26, "home_connection": 2, "mail_bruteforce": 4, "cve:CVE-2026-4020": 1, "cve:CVE-2026-8181": 12, "cve:CVE-2024-28000": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 35}, "ev": {"shodan": {"n": 66, "p": 1.0000, "hi": 47.87, "lo": 31.99, "ips": 66, "mean": 39.59, "above": true}, "urlhaus": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 26, "p": 1.0000, "hi": 19.38, "lo": 10.24, "ips": 35, "mean": 14.51, "above": true}, "threatfox": {"n": 10, "p": 0.9996, "hi": 16.16, "lo": 5.88, "ips": 10, "mean": 10.48, "above": true}, "vulncheck": {"n": 6, "p": 0.9339, "hi": 10.12, "lo": 2.81, "ips": 6, "mean": 5.98, "above": true}, "phishing_db": {"n": 40, "p": 1.0000, "hi": 44.95, "lo": 26.82, "ips": 52, "mean": 35.40, "above": true}, "blocklist_de": {"n": 4, "p": 0.6207, "hi": 6.79, "lo": 1.46, "ips": 4, "mean": 3.71, "above": false}}, "h2": [["2026-10-05", 7.658, 23.806, 1, false], ["2026-10-12", 8.908, 24.896, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 10, "phishing_db": 40}, "lo": 24.896, "se": 0.696, "ts": 0.784, "map": 48.971, "obs": 51, "own": 16.551, "comp": {"urlhaus": -1.4519, "threatfox": 0.9606, "phishing_db": 6.0087}, "mass": 19.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 26, "vulncheck": 6, "blocklist_de": 4}, "lo": 8.908, "se": 0.393, "ts": 0.722, "map": 14.182, "obs": 36, "own": 2.769, "comp": {"cins": -2.6261, "dshield": -2.9158, "crowdsec": 13.5582, "vulncheck": 0.4456, "blocklist_de": -4.4163}, "mass": 25.3, "listed": false}}, "abq": false, "bot": 0.957, "det": {"shodan": {"c2": 2, "malware": 2, "compromised": 62}, "threatfox": {"family:Mirai": 1, "family:Evilginx": 5, "family:AdaptixC2": 3, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 5, "attack_tooling": 1}, "blocklist_de": {"ssh": 4}}, "oid": "NAMEC-4-ARIN", "org": "Namecheap, Inc.", "pdb": {"t": "Content", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.namecheap.com/aboutus.aspx"}, "pfx": 331, "reg": "2011-06-21", "rir": "arin", "s24": 324, "sib": 0, "tor": 0, "w24": 76, "drop": 0, "hist": [["2026-10-05", 0.9970], ["2026-10-12", 1.0000]], "ipv4": 128256, "abuse": "abuse@namecheaphosting.com", "score": 1.0000, "groups": ["vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec"], "traffic": 0.01084237957919}, {"a": 22616, "h": "ZSCALER-SJC1", "n": "Zscaler AS22616", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.39, "waf": 0.34}, "cs": null, "ev": {"dshield": {"n": 5, "p": 0.4321, "hi": 5.18, "lo": 1.29, "ips": 5, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.023, 0.007, 0, false], ["2026-10-12", 0.199, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.788, "ts": null, "map": 0.108, "obs": 0, "own": 0.078, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.199, "se": 0.591, "ts": 1.000, "map": 0.438, "obs": 5, "own": 0.087, "comp": {"cins": -0.919, "dshield": 13.0464, "crowdsec": -6.1918, "vulncheck": -0.8069, "blocklist_de": -4.5601}, "mass": 4.7, "listed": false}}, "abq": true, "bot": 0.266, "det": null, "oid": "ZSCAL-ARIN", "org": "ZSCALER, INC.", "pdb": {"t": "Network Services", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.zscaler.com"}, "pfx": 566, "reg": "2014-05-28", "rir": "arin", "s24": 1906, "sib": 6, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 936448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.189175}, {"a": 22632, "h": "DAKPRO", "n": "DakotaPro.biz", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.230, "det": {"shodan": {"compromised": 2}}, "oid": "DIP-4-ARIN", "org": "DakotaPro.biz", "pdb": null, "pfx": 2, "reg": "2001-10-26", "rir": "arin", "s24": 32, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "support@DakotaPro.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22639, "h": "COOPTEL-AS-01", "n": "Cooptel Coop de Telecommunication", "t": "Broadband & mobile", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0921, "hi": 3.56, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.201, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.747, "ts": null, "map": 0.135, "obs": 0, "own": 0.375, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.146, "det": {"shodan": {"c2": 1}}, "oid": "COOPT-ARIN", "org": "Cooptel Coop de Telecommunication", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.cooptel.ca"}, "pfx": 155, "reg": "2001-10-26", "rir": "arin", "s24": 155, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 39680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00104157859078}, {"a": 22652, "h": "FIBRENOIRE-INTERNET", "n": "Fibrenoire / Vidéotron Affaires AS22652", "t": "Broadband & mobile", "w": 2, "cc": "CA", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0638, "hi": 3.20, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "phishing_db": {"n": 1, "p": 0.0713, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}}, "h2": [["2026-10-05", 0.005, 0.098, 0, false], ["2026-10-12", 0.039, 0.103, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.103, "se": 1.357, "ts": 1.000, "map": 0.645, "obs": 1, "own": 1.998, "comp": {"urlhaus": -0.3565, "threatfox": -0.305, "phishing_db": 1.8492}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.039, "se": 1.055, "ts": 1.000, "map": 0.208, "obs": 1, "own": 0.345, "comp": {"cins": -0.2436, "dshield": 3.9152, "crowdsec": -2.118, "vulncheck": -0.4692, "blocklist_de": -1.2605}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "VL-439-ARIN", "org": "Videotron Ltee", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Open", "web": "https://fibrenoire.ca/"}, "pfx": 156, "reg": "2007-09-27", "rir": "arin", "s24": 894, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 272640, "abuse": "abuse@fibrenoire.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00480939637815}, {"a": 22689, "h": "", "n": "Internet by Sercomtel", "t": "Transit & backbone", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0204, "hi": 2.52, "lo": 0.33, "ips": 2, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.408, 0.009, 0, false], ["2026-10-12", 0.160, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.882, "ts": null, "map": 0.149, "obs": 0, "own": 1.135, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.160, "se": 0.843, "ts": 1.000, "map": 0.566, "obs": 2, "own": 1.829, "comp": {"cins": -0.4016, "dshield": -0.8298, "crowdsec": 4.7177, "vulncheck": -0.6047, "blocklist_de": -2.0573}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-22689-LACNIC", "org": "SERCOMTEL S/A TELECOMUNICACOES", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.sercomtel.com.br"}, "pfx": 57, "reg": "2001-11-06", "rir": "lacnic", "s24": 563, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 253184, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00195996669057}, {"a": 22724, "h": "", "n": "PUNTONET", "t": "Broadband & mobile", "w": 8, "cc": "EC", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1407, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "shodan": {"n": 1, "p": 0.0314, "hi": 2.68, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}, "dshield": {"n": 2, "p": 0.3061, "hi": 5.27, "lo": 0.69, "ips": 2, "mean": 2.51, "above": false}, "crowdsec": {"n": 1, "p": 0.0195, "hi": 2.43, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}, "blocklist_de": {"n": 4, "p": 0.5988, "hi": 6.61, "lo": 1.42, "ips": 4, "mean": 3.61, "above": false}}, "h2": [["2026-10-05", 0.450, 0.010, 0, false], ["2026-10-12", 2.208, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.916, "ts": null, "map": 0.161, "obs": 0, "own": 0.929, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.208, "se": 0.519, "ts": 0.500, "map": 4.361, "obs": 8, "own": 6.729, "comp": {"cins": 2.0643, "dshield": 2.0829, "crowdsec": -6.2632, "vulncheck": -0.8928, "blocklist_de": 5.8751}, "mass": 8.7, "listed": false}}, "abq": true, "bot": 0.231, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 3}}, "oid": "@aut-22724-LACNIC", "org": "PUNTONET S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.puntonet.ec"}, "pfx": 354, "reg": "2001-11-12", "rir": "lacnic", "s24": 359, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 105984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01117525507007}, {"a": 22748, "h": "DCNORD-CANADIAN-DATA-CENTER-QUEBEC-CANADA", "n": "Resilience Data Group Inc", "t": "Transit & backbone", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 3.143, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 3.436, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.646, "det": {"shodan": {"compromised": 1}}, "oid": "RDG-58-ARIN", "org": "Resilience Data Group Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Open", "web": null}, "pfx": 7, "reg": "2011-10-25", "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "noc@sccdev.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22772, "h": "LOGIN", "n": "Login", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0974, "hi": 3.63, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.179, "obs": 0, "own": 1.744, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.756, "ts": null, "map": 0.138, "obs": 0, "own": 0.796, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.274, "det": {"shodan": {"compromised": 1}}, "oid": "LOGI-ARIN", "org": "Login, Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.loginbusiness.com"}, "pfx": 15, "reg": "2001-11-19", "rir": "arin", "s24": 144, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38144, "abuse": "abuse@loginbusiness.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22773, "h": "ASN-CXA-ALL-CCI-22773-RDC", "n": "Cox Communications", "t": "Hosting & VPS", "w": 779, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.83, "waf": 0.83}, "cs": {"c": {"http_flood": 42, "data_centre": 639, "web_exploit": 168, "bad_crawling": 12, "proxy_or_vpn": 19, "first_seen_30d": 4, "ssh_bruteforce": 628, "web_bruteforce": 562, "home_connection": 17, "mail_bruteforce": 712, "router_or_botnet": 2, "cve:CVE-2021-3129": 8, "cve:CVE-2026-8181": 8, "cve:CVE-2022-39290": 13, "cve:CVE-2025-22457": 19, "cve:CVE-2026-63030": 8}, "n": 730}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 0.41, "lo": 0.09, "ips": 4, "mean": 0.23, "above": false}, "shodan": {"n": 7, "p": 0.0000, "hi": 0.12, "lo": 0.04, "ips": 7, "mean": 0.07, "above": false}, "dshield": {"n": 9, "p": 0.0000, "hi": 0.56, "lo": 0.19, "ips": 9, "mean": 0.36, "above": false}, "urlhaus": {"n": 8, "p": 0.0135, "hi": 2.57, "lo": 0.83, "ips": 8, "mean": 1.60, "above": false}, "crowdsec": {"n": 230, "p": 0.0000, "hi": 1.92, "lo": 1.54, "ips": 730, "mean": 1.73, "above": false}, "vulncheck": {"n": 5, "p": 0.0000, "hi": 0.39, "lo": 0.10, "ips": 9, "mean": 0.22, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.30, "lo": 0.05, "ips": 4, "mean": 0.16, "above": false}, "blocklist_de": {"n": 158, "p": 0.3455, "hi": 3.30, "lo": 2.54, "ips": 440, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.922, 0.211, 0, false], ["2026-10-12", 1.074, 0.226, 0, false]], "sh": false, "uc": 407, "v2": {"band": 0, "host": {"n": {"urlhaus": 8, "threatfox": 0, "phishing_db": 3}, "lo": 0.226, "se": 0.928, "ts": 0.727, "map": 0.555, "obs": 11, "own": 0.252, "comp": {"urlhaus": 2.5067, "threatfox": -0.5832, "phishing_db": -0.8869}, "mass": 46.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 9, "crowdsec": 230, "vulncheck": 5, "blocklist_de": 158}, "lo": 1.074, "se": 0.359, "ts": 0.567, "map": 1.594, "obs": 406, "own": 0.313, "comp": {"cins": -3.4821, "dshield": -2.9231, "crowdsec": 1.6756, "vulncheck": -0.9428, "blocklist_de": 7.5325}, "mass": 441.7, "listed": false}}, "abq": false, "bot": 0.175, "det": {"shodan": {"c2": 2, "compromised": 5}, "vulncheck": {"botnet_node": 7, "attack_tooling": 2}, "blocklist_de": {"ssh": 2, "bots": 2, "imap": 357, "mail": 432, "apache": 4, "bruteforcelogin": 3}}, "oid": "CXA-ARIN", "org": "Cox Communications Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.cox.com/peering"}, "pfx": 4919, "reg": "2001-11-20", "rir": "arin", "s24": 49997, "sib": 10, "tor": 0, "w24": 267, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24404480, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.518932}, {"a": 22792, "h": "MNET", "n": "MOUNTAINET", "t": "Broadband & mobile", "w": 15, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 14, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1717, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.186, 0.011, 0, false], ["2026-10-12", 0.802, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 1.527, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.802, "se": 0.934, "ts": 0.500, "map": 3.314, "obs": 2, "own": 5.487, "comp": {"cins": -0.2635, "dshield": -0.5752, "crowdsec": -2.2711, "vulncheck": 2.2196, "blocklist_de": 3.4819}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.168, "det": {"vulncheck": {"botnet_node": 14}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "MTNT-ARIN", "org": "MOUNTAINET", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.mounet.com"}, "pfx": 23, "reg": "2001-11-21", "rir": "arin", "s24": 61, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 22884, "h": "", "n": "TOTAL PLAY TELECOMUNICACIONES AS22884", "t": "Broadband & mobile", "w": 17, "cc": "MX", "cf": {"rb": "lo", "wb": null, "rep": 1.73, "waf": null}, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "home_connection": 9, "mail_bruteforce": 3, "router_or_botnet": 2, "cve:CVE-2026-63030": 1}, "n": 9}, "ev": {"cins": {"n": 2, "p": 0.1764, "hi": 4.22, "lo": 0.55, "ips": 2, "mean": 2.01, "above": false}, "shodan": {"n": 3, "p": 0.0074, "hi": 2.22, "lo": 0.39, "ips": 3, "mean": 1.15, "above": false}, "dshield": {"n": 4, "p": 0.4611, "hi": 5.62, "lo": 1.21, "ips": 4, "mean": 3.07, "above": false}, "crowdsec": {"n": 8, "p": 0.1374, "hi": 3.53, "lo": 1.15, "ips": 9, "mean": 2.20, "above": false}, "vulncheck": {"n": 1, "p": 0.0465, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "blocklist_de": {"n": 4, "p": 0.1979, "hi": 4.07, "lo": 0.88, "ips": 4, "mean": 2.22, "above": false}}, "h2": [["2026-10-05", 1.539, 0.008, 0, false], ["2026-10-12", 1.685, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.825, "ts": null, "map": 0.125, "obs": 0, "own": 0.613, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 4}, "lo": 1.685, "se": 0.432, "ts": 0.421, "map": 2.863, "obs": 19, "own": 4.412, "comp": {"cins": 2.8787, "dshield": 2.324, "crowdsec": -0.6958, "vulncheck": -0.6345, "blocklist_de": -1.4268}, "mass": 18.5, "listed": false}}, "abq": true, "bot": 0.201, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 1, "ssh": 3}}, "oid": "@aut-28414-LACNIC", "org": "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.totalplay.com.mx"}, "pfx": 1099, "reg": "2001-12-10", "rir": "lacnic", "s24": 1164, "sib": 2, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 297984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0245101594624}, {"a": 22908, "h": "", "n": "Sixsigma Networks Mexico", "t": "Other", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1286, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.008, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 0.562, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.819, "ts": null, "map": 0.162, "obs": 0, "own": 0.189, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.591, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-22011-LACNIC", "org": "Sixsigma Networks Mexico, S.A. de C.V.", "pdb": {"t": null, "sc": "North America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.kio.tech"}, "pfx": 93, "reg": "2001-12-12", "rir": "lacnic", "s24": 89, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29952, "abuse": "abuse_ip@kio.tech", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000708078592}, {"a": 22927, "h": "", "n": "Telefonica de Argentina", "t": "Broadband & mobile", "w": 93, "cc": "AR", "cf": {"rb": "", "wb": "", "rep": 2.01, "waf": 0.91}, "cs": {"c": {"web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.23, "lo": 0.04, "ips": 3, "mean": 0.12, "above": false}, "dshield": {"n": 49, "p": 0.9999, "hi": 6.59, "lo": 4.13, "ips": 49, "mean": 5.30, "above": true}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.28, "lo": 0.08, "ips": 6, "mean": 0.16, "above": false}, "blocklist_de": {"n": 40, "p": 0.0358, "hi": 2.93, "lo": 1.75, "ips": 40, "mean": 2.31, "above": false}}, "h2": [["2026-10-05", 0.107, 0.004, 0, false], ["2026-10-12", 0.805, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.656, "ts": null, "map": 0.047, "obs": 0, "own": 0.212, "comp": null, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 49, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 40}, "lo": 0.805, "se": 0.372, "ts": 0.516, "map": 1.231, "obs": 95, "own": 1.898, "comp": {"cins": -3.829, "dshield": 9.967, "crowdsec": -11.5111, "vulncheck": -1.0053, "blocklist_de": 7.9804}, "mass": 106.8, "listed": false}}, "abq": true, "bot": 0.168, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 9, "bots": 30, "imap": 1, "mail": 1}}, "oid": "@family-70025", "org": "Telefonica de Argentina", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.movistar.com.ar/"}, "pfx": 208, "reg": "2001-12-14", "rir": "lacnic", "s24": 15634, "sib": 2, "tor": 0, "w24": 92, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5683968, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.092288}, {"a": 23005, "h": "SWITCH-LTD", "n": "Switch, Ltd.", "t": "Transit & backbone", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}, "phishing_db": {"n": 1, "p": 0.0483, "hi": 2.97, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.031, 0.082, 0, false], ["2026-10-12", 0.004, 0.087, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.087, "se": 1.348, "ts": 1.000, "map": 0.526, "obs": 1, "own": 2.352, "comp": {"urlhaus": -0.3914, "threatfox": -0.3207, "phishing_db": 1.6954}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.483, "ts": null, "map": 0.048, "obs": 0, "own": 0.199, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.296, "det": {"shodan": {"malware": 1}}, "oid": "SWITC-2-ARIN", "org": "SWITCH, LTD", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": null}, "pfx": 160, "reg": "2001-12-28", "rir": "arin", "s24": 1219, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 373504, "abuse": "abuse@switch.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23033, "h": "WOW", "n": "Wowrack.com", "t": "Hosting & VPS", "w": 35, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 30, "web_exploit": 33, "bad_crawling": 33, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2023-1389": 1, "cve:CVE-2025-4396": 4, "cve:CVE-2026-4020": 1, "cve:CVE-2018-20062": 10}, "n": 33}, "ev": {"crowdsec": {"n": 1, "p": 0.0966, "hi": 3.62, "lo": 0.27, "ips": 33, "mean": 1.53, "above": false}, "blocklist_de": {"n": 1, "p": 0.1496, "hi": 4.22, "lo": 0.32, "ips": 8, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 1.219, 0.011, 0, false], ["2026-10-12", 0.611, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 0.201, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.611, "se": 0.897, "ts": 0.500, "map": 2.419, "obs": 2, "own": 0.493, "comp": {"cins": -0.3604, "dshield": -0.7569, "crowdsec": 1.1182, "vulncheck": -0.5754, "blocklist_de": 2.8517}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.999, "det": {"blocklist_de": {"bots": 8}}, "oid": "WOWTEC-1-ARIN", "org": "Wowrack.com", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.wowrack.com"}, "pfx": 34, "reg": "2002-01-07", "rir": "arin", "s24": 117, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47616, "abuse": "abuse@wowrack.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0238561002722}, {"a": 23089, "h": "HOTWIRE-COMMUNICATIONS", "n": "Hotwire Communications", "t": "Transit & backbone", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2025-22457": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 1.10, "lo": 0.19, "ips": 3, "mean": 0.57, "above": false}}, "h2": [["2026-10-12", 0.085, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.775, "ts": null, "map": 0.102, "obs": 0, "own": 0.671, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.085, "se": 0.700, "ts": 1.000, "map": 0.232, "obs": 3, "own": 0.742, "comp": {"cins": -0.6299, "dshield": -1.1958, "crowdsec": 5.6612, "vulncheck": -0.721, "blocklist_de": -3.1811}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.132, "det": null, "oid": "HOTWI-ARIN", "org": "Hotwire Communications", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.gethotwired.com"}, "pfx": 608, "reg": "2007-10-04", "rir": "arin", "s24": 2280, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 714752, "abuse": "abuse@hotwirecommunication.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02619381889232}, {"a": 23106, "h": "", "n": "AMERICAN TOWER DO BRASIL", "t": "Transit & backbone", "w": 5, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.0872, "hi": 3.34, "lo": 0.72, "ips": 4, "mean": 1.82, "above": false}, "blocklist_de": {"n": 2, "p": 0.1158, "hi": 3.70, "lo": 0.48, "ips": 2, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.410, 0.009, 0, false], ["2026-10-12", 0.741, 0.010, 0, false]], "sh": false, "uc": 65.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.870, "ts": null, "map": 0.144, "obs": 0, "own": 1.075, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.741, "se": 0.564, "ts": 0.667, "map": 1.580, "obs": 6, "own": 4.980, "comp": {"cins": -1.0865, "dshield": -1.7746, "crowdsec": 3.4819, "vulncheck": -0.8406, "blocklist_de": 2.0706}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.177, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "@aut-23106-LACNIC", "org": "AMERICAN TOWER DO BRASIL-COMUNICAÇÂO MULTIMÍDIA LT", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "No", "web": "http://www.americantower.com.br/"}, "pfx": 28, "reg": "2002-02-14", "rir": "lacnic", "s24": 656, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 393216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00279752057298}, {"a": 23114, "h": "CRITICALHUBNET", "n": "Critical Hub Networks, Inc.", "t": "Transit & backbone", "w": 0, "cc": "PR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1199, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 1.909, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.800, "ts": null, "map": 0.155, "obs": 0, "own": 0.966, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"malware": 1}}, "oid": "CHN-9-ARIN", "org": "Critical Hub Networks", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.criticalhub.com/"}, "pfx": 13, "reg": "2002-01-24", "rir": "arin", "s24": 103, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33280, "abuse": "abuse@criticalhub.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00132386031432}, {"a": 23201, "h": "", "n": "TIGO PY", "t": "Broadband & mobile", "w": 9, "cc": "PY", "cf": {"rb": "lo", "wb": null, "rep": 1.56, "waf": null}, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 4, "router_or_botnet": 3, "cve:CVE-2021-41773": 1}, "n": 6}, "ev": {"shodan": {"n": 5, "p": 0.0000, "hi": 1.39, "lo": 0.34, "ips": 5, "mean": 0.79, "above": false}, "urlhaus": {"n": 1, "p": 0.1027, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 1.29, "lo": 0.36, "ips": 6, "mean": 0.76, "above": false}, "blocklist_de": {"n": 3, "p": 0.0011, "hi": 1.80, "lo": 0.32, "ips": 3, "mean": 0.93, "above": false}}, "h2": [["2026-10-05", 0.240, 0.007, 0, false], ["2026-10-12", 0.285, 0.091, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.091, "se": 1.346, "ts": 1.000, "map": 0.576, "obs": 1, "own": 1.711, "comp": {"urlhaus": 2.4311, "threatfox": -0.4546, "phishing_db": -0.9015}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.285, "se": 0.503, "ts": 0.667, "map": 0.545, "obs": 9, "own": 0.845, "comp": {"cins": -1.5305, "dshield": -2.2008, "crowdsec": 3.3383, "vulncheck": -0.9003, "blocklist_de": 2.0798}, "mass": 9.4, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 2, "bots": 1}}, "oid": "@aut-23201-LACNIC", "org": "Telecel S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.tigo.com.py"}, "pfx": 368, "reg": "2002-02-06", "rir": "lacnic", "s24": 3084, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1380864, "abuse": "abuse@tigo.com.py", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0226062991255}, {"a": 23273, "h": "HOSTP-LA", "n": "HostPapa", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 4, "p": 0.7765, "hi": 8.52, "lo": 1.83, "ips": 4, "mean": 4.65, "above": false}, "phishing_db": {"n": 1, "p": 0.1931, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 13.129, 0.479, 1, false], ["2026-10-12", 17.809, 0.499, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.499, "se": 1.561, "ts": 1.000, "map": 5.274, "obs": 1, "own": 2.426, "comp": {"urlhaus": -0.0995, "threatfox": -0.1263, "phishing_db": 3.5148}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 17.809, "se": 0.545, "ts": 0.571, "map": 36.514, "obs": 7, "own": 7.162, "comp": {"cins": 2.8993, "dshield": 0.9, "crowdsec": 3.5986, "vulncheck": -0.8386, "blocklist_de": -1.568}, "mass": 5.7, "listed": false}}, "abq": true, "bot": 0.859, "det": {"blocklist_de": {"ssh": 1}}, "oid": "HOSTP-7-ARIN", "org": "HostPapa", "pdb": null, "pfx": 10, "reg": "2002-02-20", "rir": "arin", "s24": 28, "sib": 11, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23299, "h": "LIBEO-NOCX-1", "n": "Libeo Inc.", "t": "Other", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.826, "det": {"shodan": {"compromised": 2}}, "oid": "LIBEO-ARIN", "org": "Libeo Inc.", "pdb": null, "pfx": 1, "reg": "2007-10-11", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23352, "h": "SERVERCENTRAL", "n": "Summit", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.10, "waf": 0.96}, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0134, "hi": 2.26, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}, "phishing_db": {"n": 1, "p": 0.1113, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.148, 0.131, 0, false], ["2026-10-12", 0.006, 0.138, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.138, "se": 1.376, "ts": 1.000, "map": 0.925, "obs": 1, "own": 0.432, "comp": {"urlhaus": -0.3002, "threatfox": -0.2766, "phishing_db": 2.1248}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.590, "ts": null, "map": 0.078, "obs": 0, "own": 0.022, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.514, "det": {"shodan": {"compromised": 1}}, "oid": "SL-2063-ARIN", "org": "DEFT.COM", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.summithq.com/"}, "pfx": 120, "reg": "2002-03-05", "rir": "arin", "s24": 515, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 277248, "abuse": "abuse@deft.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.066724}, {"a": 23367, "h": "AS-ADN", "n": "Adaptive Data Networks", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 2.735, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 2.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.583, "det": {"shodan": {"compromised": 1}}, "oid": "ADNL-3-ARIN", "org": "Adaptive Data Networks, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.adaptivedatanetworks.com"}, "pfx": 3, "reg": "2010-09-01", "rir": "arin", "s24": 19, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse-dl@adaptivedatanetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23470, "h": "RELIABLESITE", "n": "ReliableSite.Net", "t": "Hosting & VPS", "w": 50, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 1, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 14}, "ev": {"cins": {"n": 3, "p": 0.5946, "hi": 7.19, "lo": 1.27, "ips": 6, "mean": 3.71, "above": false}, "shodan": {"n": 17, "p": 1.0000, "hi": 18.25, "lo": 8.33, "ips": 17, "mean": 12.88, "above": true}, "dshield": {"n": 3, "p": 0.5801, "hi": 7.05, "lo": 1.24, "ips": 5, "mean": 3.64, "above": false}, "crowdsec": {"n": 6, "p": 0.8332, "hi": 7.92, "lo": 2.20, "ips": 14, "mean": 4.68, "above": true}, "threatfox": {"n": 3, "p": 0.6281, "hi": 7.54, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}, "vulncheck": {"n": 11, "p": 0.9998, "hi": 16.59, "lo": 6.31, "ips": 24, "mean": 10.93, "above": true}, "phishing_db": {"n": 1, "p": 0.1620, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 3, "p": 0.5157, "hi": 6.47, "lo": 1.14, "ips": 6, "mean": 3.34, "above": false}}, "h2": [["2026-10-05", 12.900, 0.807, 1, false], ["2026-10-12", 9.979, 2.414, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 1}, "lo": 2.414, "se": 0.942, "ts": 0.750, "map": 7.113, "obs": 4, "own": 2.707, "comp": {"urlhaus": -0.7153, "threatfox": 3.6213, "phishing_db": 0.682}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 3, "crowdsec": 6, "vulncheck": 11, "blocklist_de": 3}, "lo": 9.979, "se": 0.425, "ts": 0.423, "map": 16.736, "obs": 26, "own": 3.276, "comp": {"cins": 5.7983, "dshield": 1.3077, "crowdsec": -2.5935, "vulncheck": 2.8019, "blocklist_de": -3.1031}, "mass": 17.2, "listed": false}}, "abq": true, "bot": 0.869, "det": {"shodan": {"compromised": 17}, "threatfox": {"family:Remcos": 1, "family:PureRAT": 2}, "vulncheck": {"c2_server": 1, "botnet_node": 23}, "blocklist_de": {"ftp": 1, "sip": 4, "ssh": 1}}, "oid": "RL-323-ARIN", "org": "ReliableSite.Net LLC", "pdb": {"t": "Content", "sc": "North America", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.reliablesite.net"}, "pfx": 186, "reg": "2018-08-10", "rir": "arin", "s24": 186, "sib": 0, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 47616, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["crowdsec"], "traffic": 0.01585020188918}, {"a": 23497, "h": "NCWCOM", "n": "North Coast Wireless Communications, LLC", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.566, 0.011, 0, false], ["2026-10-12", 0.340, 0.012, 0, false]], "sh": false, "uc": 878.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.340, "se": 1.314, "ts": 1.000, "map": 2.963, "obs": 1, "own": 5.342, "comp": {"cins": -0.1276, "dshield": -0.2948, "crowdsec": -1.1671, "vulncheck": -0.3091, "blocklist_de": 4.3782}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.185, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "NCWC-2-ARIN", "org": "NORTH COAST WIRELESS COMMUNICATIONS LLC", "pdb": null, "pfx": 32, "reg": "2008-08-07", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@ncwcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23520, "h": "LIBERTY-NETWORKS", "n": "LIBERTY-NETWORKS", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0073, "hi": 2.03, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}, "crowdsec": {"n": 1, "p": 0.0031, "hi": 1.78, "lo": 0.13, "ips": 1, "mean": 0.75, "above": false}, "phishing_db": {"n": 1, "p": 0.0980, "hi": 3.64, "lo": 0.27, "ips": 2, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.049, 0.119, 0, false], ["2026-10-12", 0.050, 0.125, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.125, "se": 1.369, "ts": 1.000, "map": 0.816, "obs": 1, "own": 2.487, "comp": {"urlhaus": -0.319, "threatfox": -0.2865, "phishing_db": 2.0287}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.050, "se": 1.076, "ts": 1.000, "map": 0.278, "obs": 1, "own": 0.463, "comp": {"cins": -0.2281, "dshield": -0.5052, "crowdsec": 2.4802, "vulncheck": -0.4517, "blocklist_de": -1.1813}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.228, "det": {"shodan": {"malware": 1}}, "oid": "CNU-6-ARIN", "org": "Columbus Networks USA, Inc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "5-10Tbps", "pol": "Selective", "web": "https://libertynetworks.com/"}, "pfx": 113, "reg": "2002-04-02", "rir": "arin", "s24": 624, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 432128, "abuse": "abuse@cwc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0035445724307}, {"a": 23650, "h": "CHINANET-Jiangsu-Province-IDC", "n": "China Telecom Jiangsu Province IDC Network", "t": "Broadband & mobile", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.1215, "hi": 3.75, "lo": 0.49, "ips": 2, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 1.867, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.966, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.652, "ts": null, "map": 0.099, "obs": 0, "own": 0.241, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.733, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 93, "reg": "2003-02-14", "rir": "apnic", "s24": 318, "sib": 281, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 112384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037135097194}, {"a": 23655, "h": "TWODEGREES-NZ-AS", "n": "2degrees", "t": "Transit & backbone", "w": 1, "cc": "NZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0080, "hi": 2.06, "lo": 0.15, "ips": 1, "mean": 0.87, "above": false}, "dshield": {"n": 1, "p": 0.0927, "hi": 3.57, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 0.052, 0.009, 0, false], ["2026-10-12", 0.051, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.876, "ts": null, "map": 0.147, "obs": 0, "own": 1.105, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.051, "se": 1.077, "ts": 1.000, "map": 0.285, "obs": 1, "own": 0.964, "comp": {"cins": -0.2279, "dshield": 3.9925, "crowdsec": -1.9944, "vulncheck": -0.4514, "blocklist_de": -1.1801}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.364, "det": {"shodan": {"compromised": 1}}, "oid": "@family-38474", "org": "Two Degrees Mobile Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "No", "web": "https://www.2degrees.nz"}, "pfx": 57, "reg": "2003-02-24", "rir": "apnic", "s24": 608, "sib": 32, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 263680, "abuse": "abuse@2degrees.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00315002098125}, {"a": 23673, "h": "ONLINE-AS", "n": "Cogetel Ltd, Online ISP, Cambodia", "t": "Broadband & mobile", "w": 7, "cc": "KH", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 2, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 2, "router_or_botnet": 6, "cve:CVE-2019-9194": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2025-10353": 1}, "n": 6}, "ev": {"crowdsec": {"n": 6, "p": 0.8838, "hi": 8.77, "lo": 2.43, "ips": 6, "mean": 5.18, "above": true}, "blocklist_de": {"n": 1, "p": 0.1441, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 4.746, 0.373, 0, false], ["2026-10-12", 3.842, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 1.256, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.842, "se": 0.540, "ts": 0.857, "map": 7.809, "obs": 7, "own": 12.052, "comp": {"cins": -1.0822, "dshield": -1.7699, "crowdsec": 8.7486, "vulncheck": -0.8398, "blocklist_de": -1.6078}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.271, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-CCL7-AP-APNIC", "org": "COGETEL LTD.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.online.com.kh"}, "pfx": 141, "reg": "2003-03-18", "rir": "apnic", "s24": 132, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67584, "abuse": "network@cogetel.com.kh", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00249496591514}, {"a": 23674, "h": "NAYATEL-PK", "n": "Nayatel", "t": "Broadband & mobile", "w": 18, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 6, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 4, "cve:CVE-2024-6387": 1}, "n": 8}, "ev": {"crowdsec": {"n": 8, "p": 0.6602, "hi": 5.76, "lo": 1.87, "ips": 8, "mean": 3.59, "above": false}, "vulncheck": {"n": 1, "p": 0.0999, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "blocklist_de": {"n": 8, "p": 0.9431, "hi": 8.99, "lo": 2.92, "ips": 9, "mean": 5.60, "above": true}}, "h2": [["2026-10-05", 3.419, 0.009, 0, false], ["2026-10-12", 3.219, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.149, "obs": 0, "own": 0.797, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 8}, "lo": 3.219, "se": 0.438, "ts": 0.471, "map": 5.499, "obs": 17, "own": 8.453, "comp": {"cins": -2.1947, "dshield": -2.677, "crowdsec": 0.0027, "vulncheck": -0.6092, "blocklist_de": 8.5765}, "mass": 17.2, "listed": false}}, "abq": false, "bot": 0.107, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 6, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-NL14-AP-APNIC", "org": "Naya Tel (Pvt.) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.nayatel.com"}, "pfx": 491, "reg": "2003-03-18", "rir": "apnic", "s24": 566, "sib": 1, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 274688, "abuse": "abuse@nayatel.com", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.02784539921867}, {"a": 23679, "h": "NUSANET-AS-ID", "n": "Media Antar Nusa", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2022-46604": 2}, "n": 3}, "ev": {"shodan": {"n": 3, "p": 0.5174, "hi": 6.48, "lo": 1.14, "ips": 3, "mean": 3.34, "above": false}, "crowdsec": {"n": 2, "p": 0.2798, "hi": 5.06, "lo": 0.66, "ips": 3, "mean": 2.41, "above": false}}, "h2": [["2026-10-05", 1.453, 0.011, 0, false], ["2026-10-12", 0.696, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 1.382, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.696, "se": 0.901, "ts": 1.000, "map": 2.759, "obs": 2, "own": 4.406, "comp": {"cins": -0.326, "dshield": -0.6938, "crowdsec": 5.6542, "vulncheck": -0.5481, "blocklist_de": -1.6777}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.283, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-23679-APNIC", "org": "PT. Media Antar Nusa", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.nusa.net.id/"}, "pfx": 89, "reg": "2003-03-19", "rir": "apnic", "s24": 92, "sib": 1, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30720, "abuse": "abuse@nusa.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0026241515432}, {"a": 23688, "h": "LINK3-TECH-AS-BD-AP", "n": "Link3 Technologies Limited", "t": "Broadband & mobile", "w": 15, "cc": "BD", "cf": {"rb": "lo", "wb": null, "rep": 1.55, "waf": null}, "cs": {"c": {"http_flood": 6, "data_centre": 1, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 5, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 8, "home_connection": 10, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2024-28000": 5, "cve:CVE-2026-63030": 1, "cve:CVE-2026-75650": 1}, "n": 12}, "ev": {"shodan": {"n": 4, "p": 0.5616, "hi": 6.32, "lo": 1.36, "ips": 4, "mean": 3.45, "above": false}, "urlhaus": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 11, "p": 0.9968, "hi": 11.69, "lo": 4.44, "ips": 12, "mean": 7.70, "above": true}, "blocklist_de": {"n": 2, "p": 0.2897, "hi": 5.14, "lo": 0.67, "ips": 2, "mean": 2.45, "above": false}}, "h2": [["2026-10-05", 5.496, 4.630, 0, false], ["2026-10-12", 5.291, 0.336, 0, false]], "sh": false, "uc": 1231.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.336, "se": 1.488, "ts": 1.000, "map": 3.018, "obs": 1, "own": 8.786, "comp": {"urlhaus": 3.6587, "threatfox": -0.319, "phishing_db": -0.6089}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.291, "se": 0.457, "ts": 0.846, "map": 9.345, "obs": 13, "own": 14.362, "comp": {"cins": -1.6903, "dshield": -2.3304, "crowdsec": 10.7046, "vulncheck": -0.9154, "blocklist_de": -2.14}, "mass": 10.9, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-LTL6-AP-APNIC", "org": "Link3 Technologies Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.link3.net"}, "pfx": 261, "reg": "2003-03-27", "rir": "apnic", "s24": 210, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 191744, "abuse": "abuse@link3.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00999172803484}, {"a": 23693, "h": "TELKOMSEL-ASN-ID", "n": "Telekomunikasi Selular", "t": "Broadband & mobile", "w": 36, "cc": "ID", "cf": {"rb": "", "wb": "", "rep": 0.45, "waf": 0.34}, "cs": {"c": {"http_flood": 2, "web_exploit": 6, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 5, "home_connection": 6, "cve:CVE-2017-9841": 1, "cve:CVE-2022-46604": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 3}, "n": 7}, "ev": {"dshield": {"n": 15, "p": 0.7594, "hi": 5.31, "lo": 2.31, "ips": 15, "mean": 3.68, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.60, "lo": 0.15, "ips": 7, "mean": 0.34, "above": false}, "blocklist_de": {"n": 13, "p": 0.0178, "hi": 2.70, "lo": 1.11, "ips": 14, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.457, 0.006, 0, false], ["2026-10-12", 0.657, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.706, "ts": null, "map": 0.070, "obs": 0, "own": 0.313, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 15, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 13}, "lo": 0.657, "se": 0.401, "ts": 0.455, "map": 1.045, "obs": 33, "own": 1.612, "comp": {"cins": -2.9852, "dshield": 7.9333, "crowdsec": -8.339, "vulncheck": -0.9837, "blocklist_de": 5.8121}, "mass": 36.0, "listed": false}}, "abq": false, "bot": 0.118, "det": {"blocklist_de": {"ssh": 1, "bots": 8, "imap": 4, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-23693-APNIC", "org": "PT. Telekomunikasi Selular", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "10-20Tbps", "pol": "Open", "web": "http://www.telkomsel.com"}, "pfx": 419, "reg": "2003-03-28", "rir": "apnic", "s24": 6207, "sib": 0, "tor": 0, "w24": 31, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2453760, "abuse": "abuse@telkomsel.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.441298}, {"a": 23724, "h": "CHINANET-IDC-BJ-AP", "n": "IDC, China Telecommunications Corporation", "t": "Broadband & mobile", "w": 131, "cc": "CN", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.32}, "cs": {"c": {"http_flood": 23, "data_centre": 19, "web_exploit": 25, "bad_crawling": 5, "first_seen_30d": 5, "ssh_bruteforce": 76, "web_bruteforce": 14, "home_connection": 5, "mail_bruteforce": 7, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 4, "cve:CVE-2024-6387": 50, "cve:CVE-2018-20062": 4, "cve:CVE-2026-75650": 2}, "n": 83}, "ev": {"cins": {"n": 7, "p": 0.0298, "hi": 2.80, "lo": 0.85, "ips": 9, "mean": 1.70, "above": false}, "shodan": {"n": 35, "p": 0.0005, "hi": 2.35, "lo": 1.36, "ips": 35, "mean": 1.83, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 1.10, "lo": 0.14, "ips": 2, "mean": 0.52, "above": false}, "crowdsec": {"n": 68, "p": 0.3090, "hi": 3.43, "lo": 2.30, "ips": 83, "mean": 2.84, "above": false}, "threatfox": {"n": 4, "p": 0.1698, "hi": 3.90, "lo": 0.84, "ips": 4, "mean": 2.13, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 1.12, "lo": 0.15, "ips": 2, "mean": 0.54, "above": false}, "phishing_db": {"n": 4, "p": 0.0005, "hi": 1.73, "lo": 0.37, "ips": 4, "mean": 0.95, "above": false}, "blocklist_de": {"n": 39, "p": 0.9279, "hi": 4.90, "lo": 2.91, "ips": 61, "mean": 3.85, "above": true}}, "h2": [["2026-10-05", 2.002, 0.225, 0, false], ["2026-10-12", 1.730, 0.204, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 4}, "lo": 0.204, "se": 0.959, "ts": 0.500, "map": 0.527, "obs": 8, "own": 1.576, "comp": {"urlhaus": -1.6076, "threatfox": 1.4184, "phishing_db": 1.1756}, "mass": 7.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 2, "crowdsec": 68, "vulncheck": 2, "blocklist_de": 39}, "lo": 1.730, "se": 0.366, "ts": 0.576, "map": 2.621, "obs": 118, "own": 4.031, "comp": {"cins": 0.5936, "dshield": -2.9685, "crowdsec": 2.0065, "vulncheck": -0.9092, "blocklist_de": 3.6349}, "mass": 127.1, "listed": false}}, "abq": true, "bot": 0.895, "det": {"shodan": {"c2": 1, "compromised": 34}, "threatfox": {"family:DanaBot": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 2}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ftp": 3, "ssh": 32, "bots": 20, "imap": 5, "mail": 6}}, "oid": "@aut-23724-APNIC", "org": "IDC, China Telecommunications Corporation", "pdb": null, "pfx": 810, "reg": "2003-04-22", "rir": "apnic", "s24": 8764, "sib": 0, "tor": 0, "w24": 86, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 3210752, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.0178198794527}, {"a": 23750, "h": "GERRYS-AS-AP", "n": "Gerrys Information Technology", "t": "Broadband & mobile", "w": 3, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3189, "hi": 5.38, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 1.906, 0.011, 0, false], ["2026-10-12", 2.102, 0.012, 0, false]], "sh": false, "uc": 860.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.102, "se": 0.759, "ts": 0.667, "map": 6.439, "obs": 3, "own": 10.093, "comp": {"cins": -0.5061, "dshield": -1.0052, "crowdsec": 3.5139, "vulncheck": -0.6659, "blocklist_de": 1.9193}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.185, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-GITL1-AP-APNIC", "org": "Gerrys Information Technology (PVT) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.gerrys.net/"}, "pfx": 64, "reg": "2003-05-21", "rir": "apnic", "s24": 64, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "abuse@gerrys.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00147026540496}, {"a": 23752, "h": "NPTELECOM-NP-AS", "n": "Nepal Telecom", "t": "Broadband & mobile", "w": 4, "cc": "NP", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0438, "hi": 2.92, "lo": 0.38, "ips": 2, "mean": 1.39, "above": false}, "blocklist_de": {"n": 3, "p": 0.3592, "hi": 5.28, "lo": 0.93, "ips": 3, "mean": 2.73, "above": false}}, "h2": [["2026-10-05", 1.306, 0.009, 0, false], ["2026-10-12", 0.925, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.902, "ts": null, "map": 0.156, "obs": 0, "own": 0.871, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.925, "se": 0.602, "ts": 0.600, "map": 2.105, "obs": 5, "own": 3.269, "comp": {"cins": -0.9897, "dshield": -1.6658, "crowdsec": -0.9897, "vulncheck": -0.8222, "blocklist_de": 6.6054}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.113, "det": {"blocklist_de": {"ssh": 3}}, "oid": "ORG-NTC1-AP-APNIC", "org": "Nepal Telecommunications Corporation", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://ntc.net.np"}, "pfx": 101, "reg": "2003-05-27", "rir": "apnic", "s24": 436, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 212480, "abuse": "abuse_mail@ntc.net.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01322216460768}, {"a": 23860, "h": "ALLIANCE-GATEWAY-AS-AP", "n": "Alliance Broadband Services Pvt Ltd", "t": "Broadband & mobile", "w": 15, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1531, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "shodan": {"n": 1, "p": 0.0498, "hi": 3.00, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "dshield": {"n": 1, "p": 0.1422, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "crowdsec": {"n": 5, "p": 0.5850, "hi": 6.09, "lo": 1.51, "ips": 5, "mean": 3.48, "above": false}, "vulncheck": {"n": 5, "p": 0.8668, "hi": 9.20, "lo": 2.29, "ips": 5, "mean": 5.25, "above": true}, "blocklist_de": {"n": 3, "p": 0.4577, "hi": 6.00, "lo": 1.06, "ips": 3, "mean": 3.09, "above": false}}, "h2": [["2026-10-05", 3.526, 0.010, 0, false], ["2026-10-12", 4.061, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.014, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 5, "blocklist_de": 3}, "lo": 4.061, "se": 0.465, "ts": 0.333, "map": 7.221, "obs": 15, "own": 11.140, "comp": {"cins": 1.5544, "dshield": -0.5052, "crowdsec": -0.117, "vulncheck": 1.6797, "blocklist_de": 0.7588}, "mass": 10.9, "listed": false}}, "abq": false, "bot": 0.124, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 5}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-23860-APNIC", "org": "Alliance Broadband Services Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.alliancebroadband.co.in"}, "pfx": 264, "reg": "2005-08-31", "rir": "apnic", "s24": 273, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 146432, "abuse": "support@alliancekolkata.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.01832378572725}, {"a": 23865, "h": "NETINNOVATIONLLC-AS-AP", "n": "Net Innovation LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.878, "det": null, "oid": "ORG-NA115-AP-APNIC", "org": "net innovation llc", "pdb": null, "pfx": 6, "reg": "2020-12-04", "rir": "apnic", "s24": 6, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23884, "h": "PROENNET-AS", "n": "PROENNET", "t": "Other", "w": 2, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2025-55182": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.2381, "hi": 4.72, "lo": 0.61, "ips": 2, "mean": 2.25, "above": false}, "crowdsec": {"n": 1, "p": 0.0753, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "vulncheck": {"n": 1, "p": 0.1654, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.372, 0.010, 0, false], ["2026-10-12", 0.359, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 0.483, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.359, "se": 0.895, "ts": 0.500, "map": 1.382, "obs": 2, "own": 0.829, "comp": {"cins": -0.2799, "dshield": -0.6069, "crowdsec": 1.9293, "vulncheck": 2.1192, "blocklist_de": -1.4446}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.715, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-PEAC1-AP-APNIC", "org": "Proen Corp Public Company Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.proen.co.th"}, "pfx": 141, "reg": "2003-08-22", "rir": "apnic", "s24": 156, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 69632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068168765166}, {"a": 23888, "h": "NTC-AS-AP", "n": "National Telecommunication Corporation HQ", "t": "Broadband & mobile", "w": 7, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.3907, "hi": 6.00, "lo": 0.78, "ips": 3, "mean": 2.86, "above": false}, "crowdsec": {"n": 2, "p": 0.2798, "hi": 5.06, "lo": 0.66, "ips": 2, "mean": 2.41, "above": false}, "blocklist_de": {"n": 2, "p": 0.3603, "hi": 5.73, "lo": 0.74, "ips": 2, "mean": 2.73, "above": false}}, "h2": [["2026-10-05", 1.543, 0.011, 0, false], ["2026-10-12", 4.660, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 1.382, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.660, "se": 0.571, "ts": 0.333, "map": 10.104, "obs": 6, "own": 15.606, "comp": {"cins": -0.9996, "dshield": 3.8964, "crowdsec": -1.0672, "vulncheck": -0.8242, "blocklist_de": 2.7012}, "mass": 5.2, "listed": false}}, "abq": true, "bot": 0.204, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NTC3-AP-APNIC", "org": "National Telecommunication Corporation", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.ntc.net.pk"}, "pfx": 76, "reg": "2003-09-10", "rir": "apnic", "s24": 92, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00060406253072}, {"a": 23889, "h": "MauritiusTelecom", "n": "Mauritius Telecom Ltd", "t": "Broadband & mobile", "w": 33, "cc": "MU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.53, "lo": 0.04, "ips": 1, "mean": 0.22, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.85, "lo": 0.18, "ips": 4, "mean": 0.46, "above": false}, "threatfox": {"n": 16, "p": 1.0000, "hi": 15.50, "lo": 6.91, "ips": 27, "mean": 10.85, "above": true}, "blocklist_de": {"n": 4, "p": 0.0009, "hi": 1.84, "lo": 0.40, "ips": 4, "mean": 1.01, "above": false}}, "h2": [["2026-10-05", 0.136, 0.640, 0, false], ["2026-10-12", 0.224, 0.766, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 16, "phishing_db": 0}, "lo": 0.766, "se": 0.856, "ts": 1.000, "map": 1.755, "obs": 16, "own": 4.678, "comp": {"urlhaus": -1.8777, "threatfox": 5.1838, "phishing_db": -1.1175}, "mass": 9.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.224, "se": 0.518, "ts": 0.500, "map": 0.440, "obs": 8, "own": 0.684, "comp": {"cins": -1.4987, "dshield": -2.1737, "crowdsec": -0.3694, "vulncheck": -0.897, "blocklist_de": 5.5122}, "mass": 9.1, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"doublepulsar": 1}, "threatfox": {"family:Unknown malware": 27}, "blocklist_de": {"ssh": 2, "bots": 2}}, "oid": "ORG-MA21-AFRINIC", "org": "Mauritius Telecom Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.myt.mu/"}, "pfx": 240, "reg": "2004-09-10", "rir": "afrinic", "s24": 3697, "sib": 1, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 2153984, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.01079696047991}, {"a": 23923, "h": "AGNI-AS", "n": "Agni Systems Limited", "t": "Hosting & VPS", "w": 8, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1073, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "dshield": {"n": 1, "p": 0.1709, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 4, "p": 0.6295, "hi": 6.87, "lo": 1.48, "ips": 4, "mean": 3.75, "above": false}, "blocklist_de": {"n": 3, "p": 0.5580, "hi": 6.84, "lo": 1.20, "ips": 3, "mean": 3.53, "above": false}}, "h2": [["2026-10-05", 2.701, 0.381, 0, false], ["2026-10-12", 5.304, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.991, "ts": null, "map": 0.181, "obs": 0, "own": 0.197, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.304, "se": 0.520, "ts": 0.500, "map": 10.458, "obs": 8, "own": 2.053, "comp": {"cins": -1.2887, "dshield": 0.3597, "crowdsec": 1.4746, "vulncheck": -0.8719, "blocklist_de": 4.0673}, "mass": 7.2, "listed": false}}, "abq": true, "bot": 0.224, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ASL2-AP-APNIC", "org": "Agni Systems Limited", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.agni.com"}, "pfx": 130, "reg": "2003-10-30", "rir": "apnic", "s24": 125, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00327965769977}, {"a": 23949, "h": "COMNET-AS-ID", "n": "Comtronics Systems", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3683, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}, "urlhaus": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.269, 0.566, 0, false], ["2026-10-12", 0.301, 0.604, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.604, "se": 1.627, "ts": 1.000, "map": 7.036, "obs": 1, "own": 22.443, "comp": {"urlhaus": 4.1523, "threatfox": -0.2019, "phishing_db": -0.3732}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.301, "se": 1.293, "ts": 1.000, "map": 2.523, "obs": 1, "own": 4.505, "comp": {"cins": -0.1355, "dshield": -0.3122, "crowdsec": -1.2357, "vulncheck": -0.3227, "blocklist_de": 4.3252}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.259, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-23949-APNIC", "org": "PT Comtronics Systems", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.comnet.net.id"}, "pfx": 42, "reg": "2003-11-03", "rir": "apnic", "s24": 40, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 23951, "h": "CITRA-AS-ID", "n": "CITRANET", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 1, "p": 0.1471, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.238, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 1.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.238, "se": 1.255, "ts": 1.000, "map": 1.852, "obs": 1, "own": 3.261, "comp": {"cins": 4.9003, "dshield": -0.351, "crowdsec": -1.3887, "vulncheck": -0.3517, "blocklist_de": -0.799}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.173, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@family-43485", "org": "PT JEMBATAN CITRA NUSANTARA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.citra.net.id/"}, "pfx": 88, "reg": "2003-11-03", "rir": "apnic", "s24": 62, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58112, "abuse": "abuse@citra.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011743118706}, {"a": 23953, "h": "SCBDNET-AS-ID", "n": "ARTHA TELEKOMINDO", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1538, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 2, "p": 0.3354, "hi": 5.52, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}}, "h2": [["2026-10-05", 1.026, 0.011, 0, false], ["2026-10-12", 1.071, 0.012, 0, false]], "sh": false, "uc": 493.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 1.577, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.071, "se": 0.923, "ts": 1.000, "map": 4.443, "obs": 2, "own": 7.109, "comp": {"cins": -0.304, "dshield": -0.6528, "crowdsec": 5.9375, "vulncheck": -0.529, "blocklist_de": -1.5667}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.233, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-56060-APNIC", "org": "PT ARTHA TELEKOMINDO", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.arthatel.co.id"}, "pfx": 53, "reg": "2003-11-03", "rir": "apnic", "s24": 53, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004978494994}, {"a": 23956, "h": "AMBERIT-BD-AS", "n": "AMBERIT", "t": "Transit & backbone", "w": 11, "cc": "BD", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 3, "router_or_botnet": 4}, "n": 5}, "ev": {"cins": {"n": 2, "p": 0.3652, "hi": 5.77, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "shodan": {"n": 3, "p": 0.3644, "hi": 5.32, "lo": 0.94, "ips": 3, "mean": 2.75, "above": false}, "urlhaus": {"n": 2, "p": 0.4100, "hi": 6.17, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 5, "p": 0.6673, "hi": 6.70, "lo": 1.67, "ips": 5, "mean": 3.82, "above": false}, "blocklist_de": {"n": 4, "p": 0.6895, "hi": 7.45, "lo": 1.60, "ips": 4, "mean": 4.07, "above": false}}, "h2": [["2026-10-05", 4.273, 4.560, 0, false], ["2026-10-12", 5.347, 1.991, 0, false]], "sh": false, "uc": 728.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 1.991, "se": 1.156, "ts": 1.000, "map": 9.820, "obs": 2, "own": 33.165, "comp": {"urlhaus": 5.3224, "threatfox": -0.4718, "phishing_db": -0.9401}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 5.347, "se": 0.478, "ts": 0.455, "map": 9.809, "obs": 11, "own": 30.645, "comp": {"cins": 4.5809, "dshield": -2.3849, "crowdsec": -0.6774, "vulncheck": -0.9214, "blocklist_de": 3.0798}, "mass": 11.6, "listed": false}}, "abq": false, "bot": 0.194, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3, "bots": 1}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.amberit.com.bd"}, "pfx": 214, "reg": "2005-03-15", "rir": "apnic", "s24": 214, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110848, "abuse": "abuse@amberit.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00844706975508}, {"a": 23969, "h": "TOT-NET", "n": "NT Broadband ISP", "t": "Broadband & mobile", "w": 60, "cc": "TH", "cf": {"rb": "", "wb": "", "rep": 2.37, "waf": 1.00}, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 12, "web_bruteforce": 9, "home_connection": 11, "mail_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2024-28000": 2}, "n": 17}, "ev": {"cins": {"n": 2, "p": 0.0079, "hi": 2.17, "lo": 0.28, "ips": 2, "mean": 1.03, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.73, "lo": 0.13, "ips": 3, "mean": 0.38, "above": false}, "dshield": {"n": 28, "p": 1.0000, "hi": 11.20, "lo": 6.05, "ips": 29, "mean": 8.46, "above": true}, "urlhaus": {"n": 2, "p": 0.2039, "hi": 4.45, "lo": 0.58, "ips": 2, "mean": 2.12, "above": false}, "crowdsec": {"n": 17, "p": 0.0001, "hi": 1.97, "lo": 0.90, "ips": 17, "mean": 1.39, "above": false}, "vulncheck": {"n": 3, "p": 0.0097, "hi": 2.31, "lo": 0.41, "ips": 3, "mean": 1.19, "above": false}, "blocklist_de": {"n": 9, "p": 0.0205, "hi": 2.70, "lo": 0.93, "ips": 9, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.564, 0.414, 0, false], ["2026-10-12", 1.347, 0.237, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.237, "se": 1.122, "ts": 1.000, "map": 0.965, "obs": 2, "own": 2.633, "comp": {"urlhaus": 3.1885, "threatfox": -0.5281, "phishing_db": -1.0698}, "mass": 6.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 28, "crowdsec": 17, "vulncheck": 3, "blocklist_de": 9}, "lo": 1.347, "se": 0.381, "ts": 0.475, "map": 2.090, "obs": 59, "own": 3.216, "comp": {"cins": -0.6535, "dshield": 11.6049, "crowdsec": -3.6884, "vulncheck": -0.6395, "blocklist_de": -4.4928}, "mass": 52.1, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 2, "bots": 4, "imap": 1, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.ntplc.co.th/"}, "pfx": 1830, "reg": "2008-10-22", "rir": "apnic", "s24": 4500, "sib": 0, "tor": 0, "w24": 58, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5585664, "abuse": "abuse@totisp.net", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.076209}, {"a": 23974, "h": "MOE-AS-AP", "n": "Ministry of education", "t": "Other", "w": 4, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2025-22457": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.2175, "hi": 4.19, "lo": 0.90, "ips": 4, "mean": 2.29, "above": false}, "blocklist_de": {"n": 3, "p": 0.3536, "hi": 5.25, "lo": 0.92, "ips": 3, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 1.255, 0.009, 0, false], ["2026-10-12", 1.359, 0.010, 0, false]], "sh": false, "uc": 268.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.900, "ts": null, "map": 0.156, "obs": 0, "own": 0.348, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.359, "se": 0.539, "ts": 0.571, "map": 2.771, "obs": 7, "own": 1.569, "comp": {"cins": -1.2379, "dshield": -1.9324, "crowdsec": 1.9558, "vulncheck": -0.8648, "blocklist_de": 4.4922}, "mass": 6.9, "listed": false}}, "abq": true, "bot": 0.166, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-MOEE1-AP-APNIC", "org": "Ministry of Education - EMISC", "pdb": null, "pfx": 22, "reg": "2010-02-09", "rir": "apnic", "s24": 446, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 114176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00499797805926}, {"a": 23991, "h": "RANKS-AS-BD", "n": "Ranks ITT", "t": "Transit & backbone", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 8.284, 0.672, 0, false], ["2026-10-12", 2.105, 0.012, 0, false]], "sh": false, "uc": 905.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 2.668, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.105, "se": 0.960, "ts": 1.000, "map": 9.429, "obs": 2, "own": 30.778, "comp": {"cins": -0.27, "dshield": -0.5878, "crowdsec": 6.3863, "vulncheck": -0.4968, "blocklist_de": -1.3943}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.251, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RI1-AP-APNIC", "org": "Ranks ITT", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.ranksitt.net"}, "pfx": 23, "reg": "2004-01-13", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@ranksitt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00103979982044}, {"a": 24085, "h": "QTSC-AS-VN", "n": "Quang Trung Software City Development Company", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"data_centre": 1, "bad_crawling": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1046, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "crowdsec": {"n": 1, "p": 0.0889, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.136, 0.010, 0, false], ["2026-10-12", 0.142, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 0.509, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.142, "se": 1.183, "ts": 1.000, "map": 0.968, "obs": 1, "own": 0.606, "comp": {"cins": -0.1677, "dshield": -0.3811, "crowdsec": 3.1547, "vulncheck": -0.3731, "blocklist_de": -0.8719}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.323, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-24085-APNIC", "org": "Quang Trung Software City Development Company", "pdb": null, "pfx": 104, "reg": "2004-06-22", "rir": "apnic", "s24": 130, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58112, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042049304486}, {"a": 24086, "h": "VIETTEL-AS-VN", "n": "Viettel Corporation", "t": "Broadband & mobile", "w": 20, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 4, "ssh_bruteforce": 8, "web_bruteforce": 2, "home_connection": 3, "router_or_botnet": 1, "cve:CVE-2024-6387": 3, "cve:CVE-2024-28000": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0333, "hi": 2.72, "lo": 0.20, "ips": 1, "mean": 1.15, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 1.00, "lo": 0.07, "ips": 1, "mean": 0.42, "above": false}, "dshield": {"n": 5, "p": 0.4697, "hi": 5.39, "lo": 1.34, "ips": 5, "mean": 3.08, "above": false}, "crowdsec": {"n": 8, "p": 0.0122, "hi": 2.54, "lo": 0.83, "ips": 9, "mean": 1.58, "above": false}, "blocklist_de": {"n": 7, "p": 0.3646, "hi": 4.55, "lo": 1.38, "ips": 7, "mean": 2.77, "above": false}}, "h2": [["2026-10-05", 0.635, 0.008, 0, false], ["2026-10-12", 1.353, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.794, "ts": null, "map": 0.111, "obs": 0, "own": 0.523, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 7}, "lo": 1.353, "se": 0.423, "ts": 0.381, "map": 2.255, "obs": 21, "own": 3.473, "comp": {"cins": -0.1204, "dshield": 2.6738, "crowdsec": -2.3722, "vulncheck": -0.964, "blocklist_de": 2.9894}, "mass": 22.0, "listed": false}}, "abq": true, "bot": 0.371, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 5, "bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-24086-APNIC", "org": "Viettel Corporation", "pdb": null, "pfx": 288, "reg": "2004-06-22", "rir": "apnic", "s24": 1762, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 482048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01541333073084}, {"a": 24088, "h": "HTCHCMC-AS-VN", "n": "HITC", "t": "Broadband & mobile", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1332, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "crowdsec": {"n": 1, "p": 0.1205, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 1.572, 0.011, 0, false], ["2026-10-12", 0.189, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.423, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.189, "se": 1.220, "ts": 1.000, "map": 1.378, "obs": 1, "own": 2.385, "comp": {"cins": -0.1512, "dshield": -0.3459, "crowdsec": 3.3459, "vulncheck": -0.348, "blocklist_de": -0.7867}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.173, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-24088-APNIC", "org": "Hanoi Telecom Joint Stock Company - HCMC Branch", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://hitc.vn/"}, "pfx": 105, "reg": "2004-06-22", "rir": "apnic", "s24": 82, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 46080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00136254680156}, {"a": 24122, "h": "BDCOM-BD-AS-AP", "n": "BDCOM Online", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 2}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.5762, "hi": 7.01, "lo": 1.24, "ips": 4, "mean": 3.62, "above": false}}, "h2": [["2026-10-05", 2.790, 0.011, 0, false], ["2026-10-12", 2.965, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.965, "se": 0.766, "ts": 1.000, "map": 9.148, "obs": 3, "own": 14.322, "comp": {"cins": -0.4552, "dshield": -0.9215, "crowdsec": 7.946, "vulncheck": -0.6381, "blocklist_de": -2.324}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.461, "det": null, "oid": "ORG-BOL2-AP-APNIC", "org": "BDCOM Online Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.bdcom.com"}, "pfx": 41, "reg": "2004-08-09", "rir": "apnic", "s24": 40, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "abuse@bdcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045023882777}, {"a": 24139, "h": "WASUHZ", "n": "WASU Media & Network Co.Ltd", "t": "Other", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "dshield": {"n": 1, "p": 0.0132, "hi": 2.25, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.003, 0.007, 0, false], ["2026-10-12", 0.022, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.782, "ts": null, "map": 0.106, "obs": 0, "own": 0.199, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.022, "se": 1.010, "ts": 1.000, "map": 0.105, "obs": 1, "own": 0.063, "comp": {"cins": -0.2787, "dshield": 3.7471, "crowdsec": -2.3867, "vulncheck": -0.5054, "blocklist_de": -1.4386}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.663, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-24139-APNIC", "org": "Huashu media&Network Limited", "pdb": null, "pfx": 38, "reg": "2004-08-23", "rir": "apnic", "s24": 2048, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 770048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058308028714}, {"a": 24158, "h": "taiwanmobile-as", "n": "Taiwan Mobile Co., Ltd.", "t": "Broadband & mobile", "w": 39, "cc": "TW", "cf": {"rb": "hi", "wb": "hi", "rep": 1.23, "waf": 1.08}, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 16, "web_bruteforce": 21, "home_connection": 1, "mail_bruteforce": 25, "router_or_botnet": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 26}, "ev": {"dshield": {"n": 11, "p": 0.9686, "hi": 8.51, "lo": 3.23, "ips": 12, "mean": 5.61, "above": true}, "crowdsec": {"n": 9, "p": 0.0054, "hi": 2.37, "lo": 0.82, "ips": 26, "mean": 1.51, "above": false}, "blocklist_de": {"n": 6, "p": 0.1435, "hi": 3.63, "lo": 1.01, "ips": 21, "mean": 2.14, "above": false}}, "h2": [["2026-10-05", 0.719, 0.007, 0, false], ["2026-10-12", 1.274, 0.008, 0, false]], "sh": false, "uc": 580.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.780, "ts": null, "map": 0.105, "obs": 0, "own": 0.487, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 11, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 6}, "lo": 1.274, "se": 0.410, "ts": 0.423, "map": 2.087, "obs": 26, "own": 3.215, "comp": {"cins": -2.582, "dshield": 8.2472, "crowdsec": -2.3089, "vulncheck": -0.969, "blocklist_de": -0.2577}, "mass": 24.5, "listed": false}}, "abq": true, "bot": 0.096, "det": {"blocklist_de": {"imap": 16, "mail": 21}}, "oid": "@aut-24158-APNIC", "org": "Taiwan Mobile Co., Ltd.", "pdb": null, "pfx": 544, "reg": "2005-07-11", "rir": "apnic", "s24": 2114, "sib": 5, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 542720, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.059502}, {"a": 24164, "h": "UBBNET-AS-TW", "n": "TFN MEDIA", "t": "Other", "w": 5, "cc": "TW", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.3298, "hi": 5.08, "lo": 0.90, "ips": 3, "mean": 2.62, "above": false}, "crowdsec": {"n": 1, "p": 0.0003, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.0155, "hi": 2.32, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}}, "h2": [["2026-10-05", 0.005, 0.008, 0, false], ["2026-10-12", 0.389, 0.009, 0, false]], "sh": false, "uc": 154, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.839, "ts": null, "map": 0.132, "obs": 0, "own": 0.264, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.389, "se": 0.596, "ts": 0.600, "map": 0.874, "obs": 5, "own": 0.498, "comp": {"cins": -0.9324, "dshield": 7.1083, "crowdsec": -3.3926, "vulncheck": -0.81, "blocklist_de": -0.7142}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.227, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.twmbroadband.com/"}, "pfx": 235, "reg": "2005-07-11", "rir": "apnic", "s24": 973, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 954368, "abuse": "abuse@twmbroadband.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0091643556325}, {"a": 24165, "h": "UBBNET-AS-TW", "n": "TFN MEDIA, PHC", "t": "Other", "w": 1, "cc": "TW", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0404, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.090, 0.010, 0, false], ["2026-10-12", 0.094, 0.011, 0, false]], "sh": false, "uc": 235, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.170, "obs": 0, "own": 0.420, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.094, "se": 1.135, "ts": 1.000, "map": 0.578, "obs": 1, "own": 0.357, "comp": {"cins": -0.1923, "dshield": -0.4324, "crowdsec": 2.8757, "vulncheck": -0.4073, "blocklist_de": -0.9982}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.251, "det": null, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.twmbroadband.com/"}, "pfx": 54, "reg": "2005-07-11", "rir": "apnic", "s24": 251, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 64256, "abuse": "abuse@twmbroadband.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00411811527105}, {"a": 24173, "h": "NETNAM-AS-AP", "n": "NetNam", "t": "Broadband & mobile", "w": 5, "cc": "VN", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 5}, "ev": {"shodan": {"n": 2, "p": 0.1604, "hi": 4.09, "lo": 0.53, "ips": 2, "mean": 1.95, "above": false}, "crowdsec": {"n": 5, "p": 0.6129, "hi": 6.29, "lo": 1.56, "ips": 5, "mean": 3.59, "above": false}, "blocklist_de": {"n": 2, "p": 0.2668, "hi": 4.95, "lo": 0.64, "ips": 2, "mean": 2.36, "above": false}}, "h2": [["2026-10-05", 1.255, 0.010, 0, false], ["2026-10-12", 2.181, 0.011, 0, false]], "sh": false, "uc": 291.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.039, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.181, "se": 0.540, "ts": 0.714, "map": 4.469, "obs": 7, "own": 6.908, "comp": {"cins": -1.1599, "dshield": -1.8528, "crowdsec": 5.2141, "vulncheck": -0.8529, "blocklist_de": 1.5425}, "mass": 6.3, "listed": false}}, "abq": true, "bot": 0.203, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-24176-APNIC", "org": "Branch of Netnam Company in Ho Chi Minh City", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://netnam.vn"}, "pfx": 249, "reg": "2005-10-14", "rir": "apnic", "s24": 253, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00200590155878}, {"a": 24186, "h": "RAILTEL-AS-IN", "n": "Railtel Corporation Of India", "t": "Broadband & mobile", "w": 17, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 5, "web_bruteforce": 2, "home_connection": 5, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.0169, "hi": 2.36, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "crowdsec": {"n": 7, "p": 0.6327, "hi": 5.83, "lo": 1.76, "ips": 7, "mean": 3.54, "above": false}, "blocklist_de": {"n": 9, "p": 0.9824, "hi": 10.42, "lo": 3.60, "ips": 10, "mean": 6.64, "above": true}}, "h2": [["2026-10-05", 4.256, 0.009, 0, false], ["2026-10-12", 3.964, 0.010, 0, false]], "sh": false, "uc": 51.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.895, "ts": null, "map": 0.154, "obs": 0, "own": 0.847, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 9}, "lo": 3.964, "se": 0.439, "ts": 0.563, "map": 6.701, "obs": 16, "own": 10.292, "comp": {"cins": -2.2151, "dshield": -2.6894, "crowdsec": -1.4656, "vulncheck": -0.9515, "blocklist_de": 10.6176}, "mass": 17.5, "listed": false}}, "abq": false, "bot": 0.150, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 7, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-RCOI1-AP-APNIC", "org": "RailTel Corporation of India Ltd.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.railtelindia.com"}, "pfx": 510, "reg": "2005-10-28", "rir": "apnic", "s24": 473, "sib": 0, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 207360, "abuse": "abuse@railtelindia.com", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01936236123288}, {"a": 24203, "h": "NAPXLNET-AS-ID", "n": "XLSmart AS24203", "t": "Transit & backbone", "w": 5, "cc": "ID", "cf": {"rb": "hi", "wb": "hi", "rep": 0.43, "waf": 0.37}, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.4836, "hi": 6.20, "lo": 1.09, "ips": 3, "mean": 3.20, "above": false}, "blocklist_de": {"n": 2, "p": 0.1745, "hi": 4.21, "lo": 0.55, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.063, 0.009, 0, false], ["2026-10-12", 0.822, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.897, "ts": null, "map": 0.155, "obs": 0, "own": 1.213, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.822, "se": 0.600, "ts": 0.600, "map": 1.870, "obs": 5, "own": 5.901, "comp": {"cins": -0.947, "dshield": 7.0143, "crowdsec": -6.3215, "vulncheck": -0.8132, "blocklist_de": 3.0867}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.124, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-139994-APNIC", "org": "PT XL Axiata Tbk", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.xlsmart.co.id"}, "pfx": 325, "reg": "2004-08-26", "rir": "apnic", "s24": 464, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 227072, "abuse": "abuse@xlsmart.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.17148}, {"a": 24207, "h": "EXPRESSNET-AS-ID", "n": "NettoCyber Indonesia", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 224.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 1.398, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.821, "ts": null, "map": 0.162, "obs": 0, "own": 0.520, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.125, "det": null, "oid": "@aut-24207-APNIC", "org": "PT NettoCyber Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.velo.co.id"}, "pfx": 88, "reg": "2004-08-26", "rir": "apnic", "s24": 88, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": "abuse@velo.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007728224042}, {"a": 24282, "h": "KIR", "n": "KAGOYA JAPAN", "t": "Hosting & VPS", "w": 5, "cc": "JP", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "home_connection": 3, "cve:CVE-2025-55182": 1, "cve:CVE-2025-57819": 1, "cve:CVE-2026-87902": 1}, "n": 3}, "ev": {"shodan": {"n": 9, "p": 0.9590, "hi": 9.01, "lo": 3.11, "ips": 9, "mean": 5.74, "above": true}, "crowdsec": {"n": 3, "p": 0.1725, "hi": 4.03, "lo": 0.71, "ips": 3, "mean": 2.08, "above": false}, "vulncheck": {"n": 1, "p": 0.1309, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "blocklist_de": {"n": 1, "p": 0.0833, "hi": 3.46, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.197, 0.010, 0, false], ["2026-10-12", 0.874, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.919, "ts": null, "map": 0.162, "obs": 0, "own": 0.145, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.874, "se": 0.615, "ts": 0.600, "map": 2.010, "obs": 5, "own": 0.401, "comp": {"cins": -0.7964, "dshield": -1.4274, "crowdsec": 3.7412, "vulncheck": 0.4633, "blocklist_de": 0.1112}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.563, "det": {"shodan": {"compromised": 7, "doublepulsar": 2}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-24282-APNIC", "org": "KAGOYA JAPAN Inc.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.kagoya.jp/"}, "pfx": 7, "reg": "2004-10-19", "rir": "apnic", "s24": 348, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 89088, "abuse": "hostmaster@nic.ad.jp", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0025142429572}, {"a": 24309, "h": "CABLELITE-AS-AP", "n": "Atria Convergence Technologies Ltd.", "t": "Broadband & mobile", "w": 31, "cc": "IN", "cf": {"rb": "", "wb": "hi", "rep": 1.20, "waf": 0.90}, "cs": {"c": {"http_flood": 7, "web_exploit": 10, "bad_crawling": 3, "proxy_or_vpn": 8, "first_seen_30d": 1, "ssh_bruteforce": 10, "web_bruteforce": 16, "home_connection": 19, "mail_bruteforce": 8, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 3}, "n": 22}, "ev": {"cins": {"n": 1, "p": 0.0947, "hi": 3.60, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "shodan": {"n": 4, "p": 0.1088, "hi": 3.50, "lo": 0.75, "ips": 4, "mean": 1.91, "above": false}, "dshield": {"n": 5, "p": 0.7493, "hi": 7.47, "lo": 1.86, "ips": 5, "mean": 4.26, "above": false}, "urlhaus": {"n": 1, "p": 0.1699, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 22, "p": 0.9999, "hi": 10.44, "lo": 5.22, "ips": 22, "mean": 7.64, "above": true}, "vulncheck": {"n": 1, "p": 0.0786, "hi": 3.40, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "phishing_db": {"n": 1, "p": 0.0840, "hi": 3.46, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}, "blocklist_de": {"n": 3, "p": 0.2097, "hi": 4.28, "lo": 0.75, "ips": 3, "mean": 2.21, "above": false}}, "h2": [["2026-10-05", 4.040, 0.473, 0, false], ["2026-10-12", 3.985, 0.505, 0, false]], "sh": false, "uc": 430.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.505, "se": 1.157, "ts": 0.500, "map": 2.242, "obs": 2, "own": 6.043, "comp": {"urlhaus": 2.5046, "threatfox": -0.4495, "phishing_db": 0.3784}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 22, "vulncheck": 1, "blocklist_de": 3}, "lo": 3.985, "se": 0.397, "ts": 0.688, "map": 6.265, "obs": 32, "own": 9.619, "comp": {"cins": -0.5376, "dshield": 1.8487, "crowdsec": 9.1591, "vulncheck": -0.7428, "blocklist_de": -6.4988}, "mass": 26.2, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"compromised": 3, "doublepulsar": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "ORG-ACTP1-AP-APNIC", "org": "Atria Convergence Technologies Pvt. Ltd.,", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Restrictive", "web": "https://www.actcorp.in/"}, "pfx": 218, "reg": "2004-12-08", "rir": "apnic", "s24": 756, "sib": 4, "tor": 0, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 195328, "abuse": "abuse@actcorp.in", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.071107}, {"a": 24323, "h": "AAMRA-NETWORKS-AS-AP", "n": "Aamra Networks Limited", "t": "Broadband & mobile", "w": 7, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1829, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 4, "p": 0.7121, "hi": 7.69, "lo": 1.66, "ips": 4, "mean": 4.20, "above": false}, "dshield": {"n": 1, "p": 0.1786, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "urlhaus": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 4, "p": 0.6854, "hi": 7.40, "lo": 1.59, "ips": 4, "mean": 4.04, "above": false}, "vulncheck": {"n": 1, "p": 0.1792, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1603, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 9.549, 0.434, 0, false], ["2026-10-12", 6.435, 0.466, 0, false]], "sh": false, "uc": 2071.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.466, "se": 1.556, "ts": 1.000, "map": 4.788, "obs": 1, "own": 14.434, "comp": {"urlhaus": 3.9413, "threatfox": -0.2602, "phishing_db": -0.4888}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 6.435, "se": 0.530, "ts": 0.500, "map": 12.775, "obs": 8, "own": 19.734, "comp": {"cins": 2.7058, "dshield": 0.6658, "crowdsec": 2.6769, "vulncheck": -0.0148, "blocklist_de": -2.0926}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.377, "det": {"shodan": {"compromised": 4}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-ANL12-AP-APNIC", "org": "Aamra Networks Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.aamranetworks.com"}, "pfx": 98, "reg": "2004-12-29", "rir": "apnic", "s24": 89, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38144, "abuse": "abuse@aamra.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00174052236202}, {"a": 24326, "h": "TTT-AS-AP", "n": "TTT", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.599, "det": null, "oid": "ORG-TCL7-AP-APNIC", "org": "TT&T Co., Ltd.", "pdb": null, "pfx": 2, "reg": null, "rir": "apnic", "s24": 9, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002555326992}, {"a": 24337, "h": "SKYTelecom-AS-AP", "n": "Best Telecom", "t": "Broadband & mobile", "w": 3, "cc": "LA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 2, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.467, 0.011, 0, false], ["2026-10-12", 1.648, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 1.741, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.648, "se": 0.947, "ts": 0.500, "map": 7.193, "obs": 2, "own": 11.557, "comp": {"cins": -0.3062, "dshield": -0.657, "crowdsec": 1.6579, "vulncheck": -0.531, "blocklist_de": 3.2031}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.179, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-STSC3-AP-APNIC", "org": "Sky Telecom State Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.besttelecom.la"}, "pfx": 33, "reg": "2005-02-18", "rir": "apnic", "s24": 33, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039157470584}, {"a": 24342, "h": "BRAC-BDMAIL-AS-BD", "n": "BRACNet", "t": "Hosting & VPS", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1564, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "shodan": {"n": 1, "p": 0.0559, "hi": 3.09, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "urlhaus": {"n": 1, "p": 0.1890, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.0404, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.090, 0.286, 0, false], ["2026-10-12", 0.337, 0.312, 0, false]], "sh": false, "uc": 1060.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.312, "se": 1.475, "ts": 1.000, "map": 2.728, "obs": 1, "own": 1.221, "comp": {"urlhaus": 3.5928, "threatfox": -0.3304, "phishing_db": -0.6326}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.337, "se": 0.873, "ts": 0.500, "map": 1.263, "obs": 2, "own": 0.257, "comp": {"cins": 4.3657, "dshield": -0.8268, "crowdsec": 0.7406, "vulncheck": -0.6035, "blocklist_de": -2.0486}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.355, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BBNL1-AP-APNIC", "org": "BRACNet Limited", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://bracnet.net/"}, "pfx": 259, "reg": "2005-02-23", "rir": "apnic", "s24": 251, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 168704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00121303203623}, {"a": 24378, "h": "ENGTAC-AS-TH-AP", "n": "Total Access Communication PLC.", "t": "Other", "w": 1, "cc": "TH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.95, "waf": 0.83}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1217, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.069, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.159, "obs": 0, "own": 0.363, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.069, "se": 1.104, "ts": 1.000, "map": 0.403, "obs": 1, "own": 0.247, "comp": {"cins": -0.2107, "dshield": 4.0776, "crowdsec": -1.8582, "vulncheck": -0.4309, "blocklist_de": -1.0925}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.046, "det": null, "oid": "ORG-TACP1-AP-APNIC", "org": "Total Access Communication PLC.", "pdb": null, "pfx": 74, "reg": "2005-03-15", "rir": "apnic", "s24": 396, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 400384, "abuse": "abuse@trueinternet.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.077336}, {"a": 24389, "h": "GRAMEENPHONE-AS-AP", "n": "GrameenPhone", "t": "Other", "w": 0, "cc": "BD", "cf": {"rb": "hi", "wb": "hi", "rep": 1.01, "waf": 0.88}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.191, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.577, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.201, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.075, "det": null, "oid": "ORG-GL6-AP-APNIC", "org": "grameenphone limited", "pdb": null, "pfx": 80, "reg": "2005-03-29", "rir": "apnic", "s24": 80, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.072627}, {"a": 24400, "h": "CMNET-V4shanghai-AS-AP", "n": "Shanghai Mobile Communications Co.,Ltd.", "t": "Broadband & mobile", "w": 12, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0089, "hi": 2.10, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 1.05, "lo": 0.19, "ips": 3, "mean": 0.54, "above": false}, "dshield": {"n": 6, "p": 0.3362, "hi": 4.54, "lo": 1.26, "ips": 6, "mean": 2.69, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 1.18, "lo": 0.29, "ips": 5, "mean": 0.67, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 1.13, "lo": 0.08, "ips": 1, "mean": 0.48, "above": false}}, "h2": [["2026-10-05", 0.320, 0.007, 0, false], ["2026-10-12", 0.425, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.755, "ts": null, "map": 0.093, "obs": 0, "own": 0.424, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.425, "se": 0.463, "ts": 0.462, "map": 0.746, "obs": 13, "own": 1.155, "comp": {"cins": 1.2789, "dshield": 7.71, "crowdsec": -1.1667, "vulncheck": -0.9261, "blocklist_de": -5.7954}, "mass": 12.4, "listed": false}}, "abq": false, "bot": 0.423, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 538, "reg": "2005-04-19", "rir": "apnic", "s24": 2976, "sib": 28, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1134080, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01401082304414}, {"a": 24429, "h": "Taobao", "n": "Alibaba Cloud CDN", "t": "Hyperscale cloud", "w": 6, "cc": "US", "cf": {"rb": "lo", "wb": null, "rep": 1.97, "waf": null}, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0021, "hi": 1.70, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}, "threatfox": {"n": 5, "p": 0.8816, "hi": 9.53, "lo": 2.37, "ips": 5, "mean": 5.44, "above": true}, "blocklist_de": {"n": 1, "p": 0.0351, "hi": 2.75, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}}, "h2": [["2026-10-05", 0.132, 1.049, 0, false], ["2026-10-12", 0.148, 1.047, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 0}, "lo": 1.047, "se": 0.932, "ts": 1.000, "map": 2.897, "obs": 5, "own": 2.156, "comp": {"urlhaus": -0.9557, "threatfox": 4.5695, "phishing_db": -0.9239}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.148, "se": 0.841, "ts": 0.500, "map": 0.522, "obs": 2, "own": 0.222, "comp": {"cins": -0.44, "dshield": -0.8959, "crowdsec": 0.3682, "vulncheck": -0.6291, "blocklist_de": 2.3404}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.757, "det": {"threatfox": {"family:DeimosC2": 5}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-45102-APNIC", "org": "Alibaba (US) Technology Co., Ltd.", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Tbps", "pol": "Open", "web": "https://www.alibabacloud.com"}, "pfx": 628, "reg": "2005-04-22", "rir": "apnic", "s24": 675, "sib": 13, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 178944, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00216636183154}, {"a": 24432, "h": "AXIATA-ROBI-AS-AP", "n": "Robi Axiata Ltd.", "t": "Transit & backbone", "w": 0, "cc": "BD", "cf": {"rb": "hi", "wb": "hi", "rep": 0.93, "waf": 0.81}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.260, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 2.313, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.191, "obs": 0, "own": 1.496, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.075, "det": null, "oid": "ORG-AL4-AP-APNIC", "org": "Axiata (Bangladesh) Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Restrictive", "web": "http://www.robi.com.bd"}, "pfx": 55, "reg": "2005-04-26", "rir": "apnic", "s24": 46, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21504, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.078782}, {"a": 24435, "h": "SUPERNET-PAKISTAN-AS-AP", "n": "Supernet Transit ASN", "t": "Other", "w": 3, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1400, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "dshield": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1283, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.797, 0.011, 0, false], ["2026-10-12", 1.918, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 0.592, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.918, "se": 0.757, "ts": 0.333, "map": 5.809, "obs": 3, "own": 3.332, "comp": {"cins": -0.5128, "dshield": 2.7358, "crowdsec": -0.2777, "vulncheck": -0.6693, "blocklist_de": 1.877}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.164, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SPL10-AP-APNIC", "org": "Supernet, PDS Limited", "pdb": null, "pfx": 59, "reg": "2005-04-26", "rir": "apnic", "s24": 72, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": "abuse@super.net.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068005741366}, {"a": 24441, "h": "CITYLINK-AS-KH", "n": "CityLink Corporation, LTD", "t": "Transit & backbone", "w": 0, "cc": "KH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 3385.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 2.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 2.057, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.089, "det": null, "oid": "ORG-CCL5-AP-APNIC", "org": "CityLink Co., Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.citylink.com.kh"}, "pfx": 43, "reg": "2005-05-06", "rir": "apnic", "s24": 24, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 21504, "abuse": "noc@citylink.com.kh", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042076187916}, {"a": 24444, "h": "CMNET-V4shandong-AS-AP", "n": "CMNET-V4shandong-AS-AP", "t": "Other", "w": 29, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 16, "web_bruteforce": 6, "mail_bruteforce": 13, "cve:CVE-2024-6387": 1}, "n": 17}, "ev": {"cins": {"n": 3, "p": 0.0021, "hi": 1.92, "lo": 0.34, "ips": 3, "mean": 0.99, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.56, "lo": 0.12, "ips": 4, "mean": 0.30, "above": false}, "dshield": {"n": 8, "p": 0.0443, "hi": 2.95, "lo": 0.96, "ips": 8, "mean": 1.84, "above": false}, "urlhaus": {"n": 1, "p": 0.0404, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "crowdsec": {"n": 17, "p": 0.0000, "hi": 1.26, "lo": 0.58, "ips": 17, "mean": 0.89, "above": false}, "blocklist_de": {"n": 9, "p": 0.0001, "hi": 1.80, "lo": 0.62, "ips": 9, "mean": 1.15, "above": false}}, "h2": [["2026-10-05", 0.572, 0.049, 0, false], ["2026-10-12", 0.611, 0.056, 0, false]], "sh": false, "uc": 66.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.056, "se": 1.325, "ts": 1.000, "map": 0.328, "obs": 1, "own": 0.409, "comp": {"urlhaus": 1.9582, "threatfox": -0.4828, "phishing_db": -0.9651}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 8, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 9}, "lo": 0.611, "se": 0.398, "ts": 0.459, "map": 0.978, "obs": 37, "own": 0.552, "comp": {"cins": 1.8634, "dshield": 2.3462, "crowdsec": -0.7451, "vulncheck": -0.9863, "blocklist_de": -1.1069}, "mass": 39.2, "listed": false}}, "abq": false, "bot": 0.434, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"imap": 4, "mail": 9}}, "oid": null, "org": null, "pdb": null, "pfx": 1161, "reg": "2005-05-11", "rir": "apnic", "s24": 7211, "sib": 0, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4339712, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02735274255064}, {"a": 24445, "h": "CMNET-V4henan-AS-AP", "n": "Henan Mobile Communications Co.,Ltd", "t": "Broadband & mobile", "w": 29, "cc": "CN", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 13, "web_bruteforce": 4, "mail_bruteforce": 8, "cve:CVE-2024-6387": 3}, "n": 14}, "ev": {"cins": {"n": 4, "p": 0.0050, "hi": 2.18, "lo": 0.47, "ips": 4, "mean": 1.19, "above": false}, "shodan": {"n": 6, "p": 0.0000, "hi": 0.69, "lo": 0.19, "ips": 6, "mean": 0.41, "above": false}, "dshield": {"n": 10, "p": 0.1062, "hi": 3.33, "lo": 1.21, "ips": 10, "mean": 2.16, "above": false}, "crowdsec": {"n": 14, "p": 0.0000, "hi": 1.04, "lo": 0.44, "ips": 14, "mean": 0.71, "above": false}, "threatfox": {"n": 1, "p": 0.0114, "hi": 2.19, "lo": 0.16, "ips": 1, "mean": 0.92, "above": false}, "blocklist_de": {"n": 10, "p": 0.0001, "hi": 1.86, "lo": 0.68, "ips": 10, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.378, 0.027, 0, false], ["2026-10-12", 0.625, 0.028, 0, false]], "sh": false, "uc": 57.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.028, "se": 1.333, "ts": 1.000, "map": 0.147, "obs": 1, "own": 0.533, "comp": {"urlhaus": -0.6254, "threatfox": 1.1155, "phishing_db": -0.7787}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 10, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.625, "se": 0.397, "ts": 0.368, "map": 0.997, "obs": 38, "own": 1.538, "comp": {"cins": 3.1355, "dshield": 3.2872, "crowdsec": -3.3862, "vulncheck": -0.9882, "blocklist_de": -0.6576}, "mass": 41.9, "listed": false}}, "abq": false, "bot": 0.411, "det": {"shodan": {"compromised": 6}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 2, "imap": 2, "mail": 8}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 934, "reg": "2005-05-11", "rir": "apnic", "s24": 7576, "sib": 28, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4615680, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02553800752152}, {"a": 24446, "h": "INT-5GN-AS-AP", "n": "Netregistry", "t": "Other", "w": 5, "cc": "AU", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 2, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1132, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "phishing_db": {"n": 2, "p": 0.3937, "hi": 6.02, "lo": 0.78, "ips": 3, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 0.168, 1.396, 0, false], ["2026-10-12", 0.750, 1.431, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.431, "se": 1.148, "ts": 1.000, "map": 6.511, "obs": 2, "own": 6.634, "comp": {"urlhaus": -0.3688, "threatfox": -0.3107, "phishing_db": 4.1792}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.750, "se": 0.908, "ts": 0.500, "map": 3.023, "obs": 2, "own": 1.772, "comp": {"cins": 4.4639, "dshield": -0.7463, "crowdsec": 1.1751, "vulncheck": -0.571, "blocklist_de": -1.8219}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.953, "det": null, "oid": "ORG-NOPL2-AP-APNIC", "org": "5G NETWORK OPERATIONS PTY LTD", "pdb": {"t": null, "sc": "Australia", "tr": "1-5Gbps", "pol": "Selective", "web": "https://www.netregistry.com.au"}, "pfx": 16, "reg": "2005-05-12", "rir": "apnic", "s24": 92, "sib": 17, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23808, "abuse": "abuse@5gn.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 24492, "h": "IIT-WICAM-AS-AP", "n": "WiCAM Corporation, Ltd", "t": "Broadband & mobile", "w": 6, "cc": "KH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 4, "router_or_botnet": 4, "cve:CVE-2024-28000": 1, "cve:CVE-2026-87902": 1}, "n": 6}, "ev": {"crowdsec": {"n": 6, "p": 0.9358, "hi": 10.19, "lo": 2.83, "ips": 6, "mean": 6.02, "above": true}, "blocklist_de": {"n": 1, "p": 0.1717, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 9.049, 0.011, 0, false], ["2026-10-12", 7.897, 0.012, 0, false]], "sh": false, "uc": 4905.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 1.527, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.897, "se": 0.542, "ts": 0.857, "map": 16.225, "obs": 7, "own": 24.993, "comp": {"cins": -1.0491, "dshield": -1.7334, "crowdsec": 9.2085, "vulncheck": -0.8338, "blocklist_de": -1.4121}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.283, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-WC3-AP-APNIC", "org": "WiCAM Corporation Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.wicam.com.kh/"}, "pfx": 102, "reg": "2005-11-25", "rir": "apnic", "s24": 61, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 56832, "abuse": "noc@wicam.com.kh", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00175420770744}, {"a": 24499, "h": "TPP-AS-PK", "n": "Telenor Pakistan", "t": "Other", "w": 7, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "web_bruteforce": 5, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"dshield": {"n": 1, "p": 0.1806, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 4, "p": 0.6992, "hi": 7.55, "lo": 1.62, "ips": 6, "mean": 4.12, "above": false}, "blocklist_de": {"n": 1, "p": 0.1639, "hi": 4.37, "lo": 0.33, "ips": 3, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 6.353, 0.011, 0, false], ["2026-10-12", 5.062, 0.012, 0, false]], "sh": false, "uc": 293, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.577, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.062, "se": 0.570, "ts": 0.667, "map": 10.808, "obs": 6, "own": 6.107, "comp": {"cins": -0.9445, "dshield": 1.2682, "crowdsec": 5.0504, "vulncheck": -0.8126, "blocklist_de": -0.7874}, "mass": 4.8, "listed": false}}, "abq": true, "bot": 0.101, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-TPL5-AP-APNIC", "org": "Telenor Pakistan (Pvt) Ltd", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.telenor.com.pk"}, "pfx": 80, "reg": "2005-11-30", "rir": "apnic", "s24": 80, "sib": 0, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02798140347398}, {"a": 24514, "h": "MYREN-MY", "n": "Malaysian Research & Education Network (MYREN)", "t": "Enterprise, edu & gov", "w": 1, "cc": "MY", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.360, 0.011, 0, false], ["2026-10-12", 0.384, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 3.141, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 23.089, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-MOHE2-AP-APNIC", "org": "MINISTRY OF HIGHER EDUCATION MALAYSIA", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Selective", "web": "https://myren.net.my/"}, "pfx": 25, "reg": "2005-12-23", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "noc@myren.net.my", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00054667880585}, {"a": 24521, "h": "DATAUTAMA-NAP-ID", "n": "DataUtama Dinamika, PT", "t": "Transit & backbone", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 2.382, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 1.606, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.227, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-24521-APNIC", "org": "PT. DATA Utama Dinamika", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://datautama.net.id"}, "pfx": 59, "reg": "2006-01-12", "rir": "apnic", "s24": 40, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33536, "abuse": "abuse@datautama.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005278352904}, {"a": 24532, "h": "INET-AS-ID", "n": "Inet Global Indo", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-12", 0.247, 0.012, 0, false]], "sh": false, "uc": 545.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.247, "se": 1.259, "ts": 1.000, "map": 1.939, "obs": 1, "own": 3.405, "comp": {"cins": -0.1354, "dshield": -0.3119, "crowdsec": 3.5308, "vulncheck": -0.3225, "blocklist_de": -0.7054}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.445, "det": null, "oid": "@aut-24532-APNIC", "org": "PT. Inet Global Indo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.inet.net.id"}, "pfx": 50, "reg": "2006-01-12", "rir": "apnic", "s24": 52, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 24544, "h": "LAWSCLOUDINFRASTRUCTURELIMITED-AS-HK", "n": "Law's Cloud Infrastructure Limited", "t": "Hosting & VPS", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3992, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4111, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 38.161, 0.011, 1, false], ["2026-10-12", 9.868, 0.012, 0, false]], "sh": true, "uc": 2105, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 9.868, "se": 0.705, "ts": 0.500, "map": 27.081, "obs": 4, "own": 5.430, "comp": {"cins": -0.5581, "dshield": -1.0873, "crowdsec": -0.6612, "vulncheck": 0.9859, "blocklist_de": 6.0131}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.802, "det": {"shodan": {"compromised": 2}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ftp": 1, "imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 4, "reg": "2009-01-05", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@cloudie.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001684741268}, {"a": 24547, "h": "CMNET-V4HEBEI-AS-AP", "n": "Hebei Mobile Communication Company Limited", "t": "Broadband & mobile", "w": 100, "cc": "CN", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.83}, "cs": {"c": {"http_flood": 3, "web_exploit": 10, "bad_crawling": 7, "proxy_or_vpn": 25, "first_seen_30d": 3, "ssh_bruteforce": 8, "web_bruteforce": 5, "mail_bruteforce": 22, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2024-12847": 1}, "n": 83}, "ev": {"cins": {"n": 8, "p": 0.7829, "hi": 6.59, "lo": 2.14, "ips": 9, "mean": 4.11, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 1.10, "lo": 0.19, "ips": 3, "mean": 0.57, "above": false}, "dshield": {"n": 8, "p": 0.6533, "hi": 5.73, "lo": 1.86, "ips": 8, "mean": 3.57, "above": false}, "crowdsec": {"n": 23, "p": 0.3581, "hi": 3.84, "lo": 1.95, "ips": 83, "mean": 2.83, "above": false}, "blocklist_de": {"n": 10, "p": 0.3407, "hi": 4.22, "lo": 1.53, "ips": 19, "mean": 2.74, "above": false}}, "h2": [["2026-10-05", 1.574, 0.007, 0, false], ["2026-10-12", 2.173, 0.008, 0, false]], "sh": false, "uc": 286.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.759, "ts": null, "map": 0.095, "obs": 0, "own": 0.434, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 8, "crowdsec": 23, "vulncheck": 0, "blocklist_de": 10}, "lo": 2.173, "se": 0.384, "ts": 0.469, "map": 3.408, "obs": 49, "own": 5.239, "comp": {"cins": 7.1833, "dshield": 0.9244, "crowdsec": -0.8527, "vulncheck": -0.9942, "blocklist_de": -3.641}, "mass": 53.1, "listed": false}}, "abq": false, "bot": 0.655, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 4, "mail": 17}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://he.chinamobile.com"}, "pfx": 976, "reg": "2006-01-24", "rir": "apnic", "s24": 2819, "sib": 28, "tor": 0, "w24": 38, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1443584, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02743367531424}, {"a": 24550, "h": "WEBSURFERNP-AS-NP", "n": "Websurfer Nepal Communication System Pvt. Ltd.", "t": "Transit & backbone", "w": 8, "cc": "NP", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 2, "router_or_botnet": 2, "cve:CVE-2025-55182": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.4047, "hi": 6.13, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}, "shodan": {"n": 2, "p": 0.3353, "hi": 5.52, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "urlhaus": {"n": 1, "p": 0.1964, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 4, "p": 0.7205, "hi": 7.79, "lo": 1.68, "ips": 4, "mean": 4.25, "above": false}, "vulncheck": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 4.644, 3.952, 0, false], ["2026-10-12", 7.096, 0.518, 0, false]], "sh": false, "uc": 1541.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.518, "se": 1.581, "ts": 1.000, "map": 5.561, "obs": 1, "own": 24.271, "comp": {"urlhaus": 4.0261, "threatfox": -0.2386, "phishing_db": -0.4455}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 7.096, "se": 0.556, "ts": 0.571, "map": 14.954, "obs": 7, "own": 47.051, "comp": {"cins": 6.9695, "dshield": -1.7309, "crowdsec": 3.9048, "vulncheck": 0.1101, "blocklist_de": -5.1548}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.205, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-WNCS1-AP-APNIC", "org": "Websurfer Nepal Communication System Pvt. Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.websurfer.com.np"}, "pfx": 66, "reg": "2006-01-31", "rir": "apnic", "s24": 66, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44800, "abuse": "abuse@websurfer.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00370192883928}, {"a": 24556, "h": "BIJOY-BD-AS-AP", "n": "Bijoy Online", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "router_or_botnet": 4, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6133, "hi": 7.38, "lo": 1.30, "ips": 4, "mean": 3.81, "above": false}}, "h2": [["2026-10-05", 2.210, 0.011, 0, false], ["2026-10-12", 5.574, 0.012, 0, false]], "sh": false, "uc": 1377.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.574, "se": 0.782, "ts": 1.000, "map": 17.863, "obs": 3, "own": 27.961, "comp": {"cins": -0.4253, "dshield": -0.8709, "crowdsec": 8.3683, "vulncheck": -0.6201, "blocklist_de": -2.1756}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.146, "det": null, "oid": "ORG-BOL3-AP-APNIC", "org": "Bijoy Online Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Open", "web": "https://bijoy.net"}, "pfx": 21, "reg": "2006-02-07", "rir": "apnic", "s24": 19, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@bijoy.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00315039414219}, {"a": 24560, "h": "AIRTELBROADBAND-AS-AP", "n": "Bharti Airtel Ltd., Telemedia Services", "t": "Broadband & mobile", "w": 196, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 1.17, "waf": 0.73}, "cs": {"c": {"http_flood": 26, "web_exploit": 31, "bad_crawling": 5, "proxy_or_vpn": 21, "first_seen_30d": 5, "ssh_bruteforce": 83, "web_bruteforce": 61, "home_connection": 98, "mail_bruteforce": 49, "router_or_botnet": 4, "cve:CVE-2024-28000": 9, "cve:CVE-2025-22457": 3, "cve:CVE-2026-63030": 1}, "n": 110}, "ev": {"cins": {"n": 7, "p": 0.0357, "hi": 2.86, "lo": 0.87, "ips": 7, "mean": 1.74, "above": false}, "shodan": {"n": 11, "p": 0.0000, "hi": 0.95, "lo": 0.36, "ips": 11, "mean": 0.63, "above": false}, "dshield": {"n": 19, "p": 0.7553, "hi": 4.99, "lo": 2.37, "ips": 19, "mean": 3.58, "above": false}, "urlhaus": {"n": 6, "p": 0.7080, "hi": 6.63, "lo": 1.84, "ips": 6, "mean": 3.92, "above": false}, "crowdsec": {"n": 102, "p": 0.9998, "hi": 5.10, "lo": 3.68, "ips": 110, "mean": 4.36, "above": true}, "vulncheck": {"n": 5, "p": 0.0011, "hi": 1.93, "lo": 0.48, "ips": 5, "mean": 1.10, "above": false}, "blocklist_de": {"n": 94, "p": 1.0000, "hi": 11.03, "lo": 7.87, "ips": 101, "mean": 9.40, "above": true}}, "h2": [["2026-10-05", 3.027, 0.501, 0, false], ["2026-10-12", 3.538, 0.703, 0, false]], "sh": false, "uc": 208.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 6, "threatfox": 0, "phishing_db": 0}, "lo": 0.703, "se": 0.901, "ts": 1.000, "map": 1.792, "obs": 6, "own": 4.696, "comp": {"urlhaus": 3.9622, "threatfox": -0.5741, "phishing_db": -1.1787}, "mass": 22.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 19, "crowdsec": 102, "vulncheck": 5, "blocklist_de": 94}, "lo": 3.538, "se": 0.357, "ts": 0.449, "map": 5.318, "obs": 227, "own": 8.161, "comp": {"cins": -1.7319, "dshield": -1.2305, "crowdsec": -1.6479, "vulncheck": -0.8868, "blocklist_de": 8.5617}, "mass": 249.7, "listed": false}}, "abq": true, "bot": 0.115, "det": {"shodan": {"compromised": 11}, "vulncheck": {"botnet_node": 4, "other_infrastructure": 1}, "blocklist_de": {"ftp": 2, "ssh": 23, "bots": 23, "imap": 15, "mail": 37, "apache": 16, "bruteforcelogin": 16}}, "oid": "ORG-BAL1-AP-APNIC", "org": "Bharti Airtel Limited", "pdb": null, "pfx": 2392, "reg": "2006-02-13", "rir": "apnic", "s24": 8503, "sib": 5, "tor": 0, "w24": 174, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 2401280, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.508194}, {"a": 24586, "h": "NL-INTERMAX", "n": "Intermax Cloudsourcing B.V.", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.7622, "hi": 7.11, "lo": 1.97, "ips": 6, "mean": 4.20, "above": false}}, "h2": [["2026-10-05", 0.067, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.927, "ts": null, "map": 0.165, "obs": 0, "own": 0.150, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.654, "ts": null, "map": 0.100, "obs": 0, "own": 0.031, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.326, "det": {"shodan": {"c2": 6}}, "oid": "ORG-IB3-RIPE", "org": "Intermax Group B.V.", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.intermax.nl/"}, "pfx": 16, "reg": "2002-01-09", "rir": "ripencc", "s24": 312, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 81152, "abuse": "abuse@intermax.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 24589, "h": "TELENETSIA-AS", "n": "Telenet SIA", "t": "Broadband & mobile", "w": 4, "cc": "LV", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0608, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "vulncheck": {"n": 3, "p": 0.5650, "hi": 6.90, "lo": 1.22, "ips": 4, "mean": 3.56, "above": false}}, "h2": [["2026-10-05", 0.234, 0.010, 0, false], ["2026-10-12", 0.357, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.063, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.357, "se": 0.765, "ts": 1.000, "map": 1.056, "obs": 3, "own": 1.737, "comp": {"cins": -0.3193, "dshield": -0.6814, "crowdsec": -2.6882, "vulncheck": 6.7814, "blocklist_de": -1.644}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.533, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 4}}, "oid": "ORG-TS218-RIPE", "org": "Telenet SIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://telenet.lv/en"}, "pfx": 37, "reg": "2002-01-10", "rir": "ripencc", "s24": 235, "sib": 6, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65280, "abuse": "noc@telenet.lv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00109786108687}, {"a": 24631, "h": "FANAPTELECOM-FCP", "n": "Tose'h Fanavari Ertebabat Pasargad Arian Co. PJS", "t": "Broadband & mobile", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0206, "hi": 2.45, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.156, "obs": 0, "own": 0.870, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.611, "ts": null, "map": 0.085, "obs": 0, "own": 0.196, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.539, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PNEV1-RIPE", "org": "Tose'h Fanavari Ertebabat Pasargad Arian Co. PJS", "pdb": null, "pfx": 212, "reg": "2002-01-24", "rir": "ripencc", "s24": 437, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 134656, "abuse": "abuse@fanaptelecom.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005845724418}, {"a": 24651, "h": "LVBALTICOM-AS", "n": "Balticom", "t": "Hosting & VPS", "w": 18, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 17, "data_centre": 15, "web_exploit": 16, "bad_crawling": 7, "home_connection": 1}, "n": 17}, "ev": {"crowdsec": {"n": 1, "p": 0.0210, "hi": 2.46, "lo": 0.18, "ips": 17, "mean": 1.04, "above": false}, "vulncheck": {"n": 1, "p": 0.1309, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.197, 0.010, 0, false], ["2026-10-12", 0.188, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.919, "ts": null, "map": 0.162, "obs": 0, "own": 0.145, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.188, "se": 0.871, "ts": 0.500, "map": 0.689, "obs": 2, "own": 0.143, "comp": {"cins": -0.309, "dshield": -0.6622, "crowdsec": 1.63, "vulncheck": 1.9538, "blocklist_de": -1.592}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.447, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-JB1-RIPE", "org": "JSC BALTICOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.balticom.lv"}, "pfx": 37, "reg": "2002-02-07", "rir": "ripencc", "s24": 348, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 99584, "abuse": "abuse@balticom.info", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00874211763654}, {"a": 24691, "h": "TOGOTEL-AS", "n": "Togocom", "t": "Broadband & mobile", "w": 2, "cc": "TG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0006, "hi": 1.61, "lo": 0.21, "ips": 2, "mean": 0.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.0110, "hi": 2.18, "lo": 0.16, "ips": 1, "mean": 0.92, "above": false}}, "h2": [["2026-10-05", 0.159, 0.008, 0, false], ["2026-10-12", 0.175, 0.009, 0, false]], "sh": false, "uc": 71.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.127, "obs": 0, "own": 0.627, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.175, "se": 0.712, "ts": 0.667, "map": 0.488, "obs": 3, "own": 0.768, "comp": {"cins": -0.6364, "dshield": -1.2055, "crowdsec": 2.1429, "vulncheck": -0.7235, "blocklist_de": 1.0996}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.235, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-24691-RIPE", "org": "TogoTelecom, Togo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.yas.tg"}, "pfx": 55, "reg": "2002-02-21", "rir": "ripencc", "s24": 1097, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 470272, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0044234793779}, {"a": 24699, "h": "IVTELECOM-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1356, "hi": 4.06, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "blocklist_de": {"n": 1, "p": 0.1709, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.209, 0.011, 0, false], ["2026-10-12", 0.997, 0.012, 0, false]], "sh": false, "uc": 726.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 1.516, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.997, "se": 0.921, "ts": 0.500, "map": 4.131, "obs": 2, "own": 6.618, "comp": {"cins": -0.3336, "dshield": -0.7079, "crowdsec": 1.3826, "vulncheck": -0.5544, "blocklist_de": 3.0255}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.457, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 5, "reg": "2002-02-25", "rir": "ripencc", "s24": 63, "sib": 120, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 24722, "h": "Babilon-AS", "n": "Babilon-T", "t": "Other", "w": 7, "cc": "TJ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1379, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "dshield": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 1, "p": 0.1822, "hi": 4.56, "lo": 0.34, "ips": 6, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.647, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.586, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.647, "se": 0.920, "ts": 0.500, "map": 2.605, "obs": 2, "own": 1.568, "comp": {"cins": -0.2551, "dshield": 3.8595, "crowdsec": -2.2071, "vulncheck": 2.2728, "blocklist_de": -1.319}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.230, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 6}}, "oid": "ORG-BA76-RIPE", "org": "LLC Babilon-T", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.babilon-t.com"}, "pfx": 89, "reg": "2002-03-05", "rir": "ripencc", "s24": 75, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35584, "abuse": "abuse@babilon-t.tj", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00097657373859}, {"a": 24757, "h": "EthioNet-AS", "n": "Ethio Telecom", "t": "Broadband & mobile", "w": 85, "cc": "ET", "cf": {"rb": "lo", "wb": null, "rep": 2.61, "waf": null}, "cs": {"c": {"http_flood": 6, "web_exploit": 25, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 3, "ssh_bruteforce": 25, "web_bruteforce": 10, "mail_bruteforce": 18, "router_or_botnet": 17, "cve:CVE-2017-9841": 1, "cve:CVE-2019-8318": 9, "cve:CVE-2018-10562": 16, "cve:CVE-2018-20062": 1, "cve:CVE-2024-12847": 20}, "n": 56}, "ev": {"cins": {"n": 7, "p": 0.9159, "hi": 8.82, "lo": 2.67, "ips": 7, "mean": 5.37, "above": true}, "shodan": {"n": 3, "p": 0.0075, "hi": 2.23, "lo": 0.39, "ips": 3, "mean": 1.15, "above": false}, "dshield": {"n": 6, "p": 0.7798, "hi": 7.28, "lo": 2.02, "ips": 6, "mean": 4.31, "above": false}, "crowdsec": {"n": 45, "p": 1.0000, "hi": 14.13, "lo": 8.68, "ips": 56, "mean": 11.27, "above": true}, "threatfox": {"n": 1, "p": 0.1323, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 30, "p": 1.0000, "hi": 18.14, "lo": 10.01, "ips": 32, "mean": 13.82, "above": true}}, "h2": [["2026-10-05", 6.097, 1.028, 0, false], ["2026-10-12", 9.636, 0.084, 0, false]], "sh": false, "uc": 755, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.084, "se": 1.351, "ts": 1.000, "map": 0.510, "obs": 1, "own": 1.625, "comp": {"urlhaus": -0.3645, "threatfox": 1.9042, "phishing_db": -0.5876}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 6, "crowdsec": 45, "vulncheck": 0, "blocklist_de": 30}, "lo": 9.636, "se": 0.364, "ts": 0.511, "map": 14.706, "obs": 88, "own": 22.506, "comp": {"cins": 2.07, "dshield": -1.5429, "crowdsec": 0.3459, "vulncheck": -1.0039, "blocklist_de": 4.2128}, "mass": 94.0, "listed": false}}, "abq": false, "bot": 0.184, "det": {"shodan": {"c2": 2, "compromised": 1}, "threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 7, "bots": 12, "imap": 6, "mail": 12, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ETC2-AFRINIC", "org": "Ethio Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "No", "web": "http://www.ethiotelecom.et/"}, "pfx": 510, "reg": "2007-09-20", "rir": "afrinic", "s24": 1160, "sib": 0, "tor": 0, "w24": 73, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 1200896, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.0422317818489}, {"a": 24758, "h": "MICROEL-AS", "n": "Mikroel Ltd", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.093, 0.011, 0, false], ["2026-10-12", 3.200, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 3.200, "se": 1.010, "ts": 0.500, "map": 15.210, "obs": 2, "own": 9.346, "comp": {"cins": -0.2012, "dshield": -0.4507, "crowdsec": -1.7815, "vulncheck": 2.6582, "blocklist_de": 3.8907}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-ML180-RIPE", "org": "Mikroel Ltd", "pdb": null, "pfx": 4, "reg": "2002-03-15", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 24768, "h": "ALMOUROLTEC", "n": "ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET", "t": "Hosting & VPS", "w": 3, "cc": "PT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.2750, "hi": 5.02, "lo": 0.65, "ips": 2, "mean": 2.39, "above": false}, "crowdsec": {"n": 2, "p": 0.2457, "hi": 4.78, "lo": 0.62, "ips": 2, "mean": 2.28, "above": false}, "threatfox": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.541, 0.260, 0, false], ["2026-10-12", 0.564, 0.269, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.269, "se": 1.448, "ts": 1.000, "map": 2.182, "obs": 1, "own": 0.992, "comp": {"urlhaus": -0.171, "threatfox": 2.93, "phishing_db": -0.3526}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.564, "se": 0.892, "ts": 1.000, "map": 2.207, "obs": 2, "own": 0.449, "comp": {"cins": -0.3364, "dshield": -0.7131, "crowdsec": 5.5217, "vulncheck": -0.5566, "blocklist_de": -1.7302}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.867, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-ASDI1-RIPE", "org": "ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET LDA", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.ptisp.com"}, "pfx": 70, "reg": "2009-11-12", "rir": "ripencc", "s24": 119, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38656, "abuse": "abuse@ptisp.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003127231744}, {"a": 24806, "h": "INTERNET-CZ", "n": "INTERNET CZ", "t": "Hosting & VPS", "w": 10, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 7, "p": 0.9396, "hi": 9.51, "lo": 2.88, "ips": 7, "mean": 5.79, "above": true}, "crowdsec": {"n": 1, "p": 0.0648, "hi": 3.21, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}, "threatfox": {"n": 2, "p": 0.4050, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "vulncheck": {"n": 2, "p": 0.3631, "hi": 5.76, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "phishing_db": {"n": 4, "p": 0.7694, "hi": 8.42, "lo": 1.81, "ips": 4, "mean": 4.60, "above": false}, "blocklist_de": {"n": 1, "p": 0.1281, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.112, 4.362, 0, false], ["2026-10-12", 0.948, 4.362, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 4}, "lo": 4.362, "se": 0.861, "ts": 0.667, "map": 11.270, "obs": 6, "own": 4.136, "comp": {"urlhaus": -0.9767, "threatfox": 1.4974, "phishing_db": 3.5277}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.948, "se": 0.688, "ts": 0.500, "map": 2.488, "obs": 4, "own": 0.506, "comp": {"cins": -0.5421, "dshield": -1.0624, "crowdsec": -0.5276, "vulncheck": 2.7458, "blocklist_de": 1.6916}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.668, "det": {"shodan": {"c2": 4, "compromised": 3}, "threatfox": {"family:AdaptixC2": 1, "family:Unknown malware": 1}, "vulncheck": {"attack_tooling": 1, "other_infrastructure": 1}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-ICA1-RIPE", "org": "INTERNET CZ, a.s.", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.forpsi.com"}, "pfx": 11, "reg": "2002-04-04", "rir": "ripencc", "s24": 179, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 45824, "abuse": "abuse@forpsi.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0005475775781}, {"a": 24812, "h": "ASHOMENET", "n": "NPK Home-Net", "t": "Broadband & mobile", "w": 4, "cc": "UA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1291, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 2, "p": 0.3740, "hi": 5.85, "lo": 0.76, "ips": 3, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.204, 0.011, 0, false], ["2026-10-12", 3.312, 0.012, 0, false]], "sh": false, "uc": 401.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.187, "obs": 0, "own": 1.474, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.312, "se": 0.669, "ts": 0.500, "map": 8.585, "obs": 4, "own": 13.347, "comp": {"cins": -0.7101, "dshield": 2.0106, "crowdsec": -1.8593, "vulncheck": -0.7497, "blocklist_de": 4.8522}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.253, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-RHL23-RIPE", "org": "RPC HomeNet Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://homenet.ua"}, "pfx": 48, "reg": "2012-01-09", "rir": "ripencc", "s24": 71, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28160, "abuse": "abuse@homenet.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00576473018892}, {"a": 24835, "h": "RAYA-AS", "n": "Vodafone Egypt", "t": "Broadband & mobile", "w": 6, "cc": "EG", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 0.33, "lo": 0.04, "ips": 2, "mean": 0.16, "above": false}, "threatfox": {"n": 1, "p": 0.0159, "hi": 2.33, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.28, "lo": 0.32, "ips": 5, "mean": 0.73, "above": false}}, "h2": [["2026-10-05", 0.201, 0.136, 0, false], ["2026-10-12", 0.120, 0.030, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.030, "se": 1.333, "ts": 1.000, "map": 0.159, "obs": 1, "own": 0.570, "comp": {"urlhaus": -0.6055, "threatfox": 1.1616, "phishing_db": -0.7673}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.120, "se": 0.535, "ts": 0.714, "map": 0.238, "obs": 7, "own": 0.371, "comp": {"cins": -1.4846, "dshield": -2.1616, "crowdsec": -4.3349, "vulncheck": -0.8955, "blocklist_de": 8.8359}, "mass": 9.0, "listed": false}}, "abq": false, "bot": 0.134, "det": {"threatfox": {"family:DCRat": 1}, "blocklist_de": {"ssh": 2, "bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-RT2-AFRINIC", "org": "Vodafone Data", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://web.vodafone.com.eg/"}, "pfx": 1976, "reg": "2007-09-20", "rir": "afrinic", "s24": 6736, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5460480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0334027289765}, {"a": 24863, "h": "LINKdotNET-AS", "n": "LINKdotNET", "t": "Transit & backbone", "w": 15, "cc": "EG", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 7, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2025-55182": 1}, "n": 10}, "ev": {"cins": {"n": 2, "p": 0.0013, "hi": 1.73, "lo": 0.23, "ips": 2, "mean": 0.83, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.33, "lo": 0.02, "ips": 1, "mean": 0.14, "above": false}, "dshield": {"n": 2, "p": 0.0002, "hi": 1.44, "lo": 0.19, "ips": 2, "mean": 0.69, "above": false}, "crowdsec": {"n": 9, "p": 0.0000, "hi": 0.90, "lo": 0.31, "ips": 10, "mean": 0.57, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.37, "lo": 0.34, "ips": 6, "mean": 0.78, "above": false}}, "h2": [["2026-10-05", 0.183, 0.006, 0, false], ["2026-10-12", 0.342, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.706, "ts": null, "map": 0.070, "obs": 0, "own": 0.445, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.342, "se": 0.438, "ts": 0.500, "map": 0.580, "obs": 18, "own": 1.824, "comp": {"cins": 2.5798, "dshield": -0.4012, "crowdsec": -0.3238, "vulncheck": -0.959, "blocklist_de": -0.0465}, "mass": 20.1, "listed": false}}, "abq": false, "bot": 0.148, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 3, "imap": 1, "mail": 1}}, "oid": "ORG-LE1-AFRINIC", "org": "Link Egypt (Link.NET)", "pdb": {"t": "NSP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.orange.com/"}, "pfx": 1461, "reg": "2007-09-20", "rir": "afrinic", "s24": 6224, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2673920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01691686493075}, {"a": 24866, "h": "Cloud-Megafon", "n": "PJSC MegaFon", "t": "Hosting & VPS", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": 9440.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 2.163, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.927, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 6, "reg": "2002-04-26", "rir": "ripencc", "s24": 6, "sib": 39, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 24875, "h": "NOVOSERVE-AS", "n": "NovoServe B.V.", "t": "Hosting & VPS", "w": 13, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 2, "bad_crawling": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2025-4396": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7459, "hi": 8.10, "lo": 1.74, "ips": 4, "mean": 4.42, "above": false}, "vulncheck": {"n": 6, "p": 0.9625, "hi": 11.55, "lo": 3.20, "ips": 9, "mean": 6.82, "above": true}}, "h2": [["2026-10-05", 12.690, 0.011, 1, false], ["2026-10-12", 8.625, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.248, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 6, "blocklist_de": 0}, "lo": 8.625, "se": 0.521, "ts": 0.600, "map": 16.814, "obs": 10, "own": 3.338, "comp": {"cins": -0.9091, "dshield": -1.57, "crowdsec": 5.4656, "vulncheck": 5.7429, "blocklist_de": -4.5135}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.661, "det": {"vulncheck": {"botnet_node": 9}}, "oid": "ORG-NB80-RIPE", "org": "NovoServe B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.novoserve.com/"}, "pfx": 8, "reg": "2002-04-29", "rir": "ripencc", "s24": 49, "sib": 5, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 15616, "abuse": "abuse@novoserve.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.005422344635}, {"a": 24877, "h": "INIT", "n": "UAB INIT Kns", "t": "Other", "w": 0, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0450, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.070, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.400, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.663, "ts": null, "map": 0.103, "obs": 0, "own": 0.093, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.221, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IC1-RIPE", "org": "UAB INIT", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://init.lt"}, "pfx": 50, "reg": "2002-05-02", "rir": "ripencc", "s24": 292, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 101120, "abuse": "abuse@init.lt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011007872755}, {"a": 24940, "h": "HETZNER-AS", "n": "Hetzner Online", "t": "Hosting & VPS", "w": 1480, "cc": "DE", "cf": {"rb": "", "wb": "", "rep": 1.02, "waf": 1.76}, "cs": {"c": {"http_flood": 362, "data_centre": 795, "web_exploit": 514, "bad_crawling": 357, "proxy_or_vpn": 53, "first_seen_30d": 43, "ssh_bruteforce": 56, "web_bruteforce": 192, "home_connection": 102, "mail_bruteforce": 18, "router_or_botnet": 10, "cve:CVE-2017-9841": 31, "cve:CVE-2019-9082": 14, "cve:CVE-2025-4396": 370, "cve:CVE-2018-20062": 21, "cve:CVE-2024-28000": 13}, "n": 998}, "ev": {"shodan": {"n": 886, "p": 1.0000, "hi": 33.43, "lo": 29.93, "ips": 886, "mean": 31.66, "above": true}, "dshield": {"n": 16, "p": 0.0690, "hi": 3.11, "lo": 1.38, "ips": 16, "mean": 2.17, "above": false}, "crowdsec": {"n": 392, "p": 1.0000, "hi": 12.31, "lo": 10.43, "ips": 998, "mean": 11.36, "above": true}, "threatfox": {"n": 8, "p": 0.4794, "hi": 4.91, "lo": 1.60, "ips": 8, "mean": 3.06, "above": false}, "vulncheck": {"n": 350, "p": 1.0000, "hi": 50.09, "lo": 42.02, "ips": 377, "mean": 45.98, "above": true}, "phishing_db": {"n": 54, "p": 1.0000, "hi": 9.44, "lo": 6.04, "ips": 55, "mean": 7.66, "above": true}, "blocklist_de": {"n": 46, "p": 0.6743, "hi": 4.04, "lo": 2.50, "ips": 46, "mean": 3.23, "above": false}}, "h2": [["2026-10-05", 4.323, 0.981, 0, false], ["2026-10-12", 3.967, 0.967, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 8, "phishing_db": 54}, "lo": 0.967, "se": 0.814, "ts": 0.871, "map": 2.035, "obs": 62, "own": 0.828, "comp": {"urlhaus": -2.7264, "threatfox": 0.185, "phishing_db": 4.8779}, "mass": 38.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 16, "crowdsec": 392, "vulncheck": 350, "blocklist_de": 46}, "lo": 3.967, "se": 0.352, "ts": 0.488, "map": 5.750, "obs": 804, "own": 1.125, "comp": {"cins": -4.281, "dshield": -2.3344, "crowdsec": 14.9394, "vulncheck": 4.4378, "blocklist_de": -9.6189}, "mass": 401.5, "listed": false}}, "abq": false, "bot": 0.932, "det": {"shodan": {"c2": 128, "malware": 25, "compromised": 706, "doublepulsar": 27}, "threatfox": {"family:Chaos": 1, "family:Mirai": 1, "family:Evilginx": 1, "family:AdaptixC2": 2, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 110, "botnet_node": 223, "attack_tooling": 42, "other_infrastructure": 2}, "blocklist_de": {"ftp": 5, "ssh": 32, "bots": 1, "imap": 2, "mail": 3, "apache": 6, "bruteforcelogin": 3}}, "oid": "ORG-HOA1-RIPE", "org": "Hetzner Online GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.hetzner.com"}, "pfx": 91, "reg": "2002-06-03", "rir": "ripencc", "s24": 12645, "sib": 3, "tor": 1, "w24": 818, "drop": 0, "hist": [["2026-10-05", 0.9999], ["2026-10-12", 0.9974]], "ipv4": 3237120, "abuse": "abuse@hetzner.com", "score": 0.9974, "groups": ["vulncheck", "phishing", "shodan"], "sensors": ["crowdsec"], "traffic": 0.786626}, {"a": 24953, "h": "ASN-NETPLANET", "n": "NETPLANET GmbH", "t": "Transit & backbone", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 232.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 1.982, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.819, "ts": null, "map": 0.162, "obs": 0, "own": 1.049, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.224, "det": null, "oid": "ORG-NG47-RIPE", "org": "NETPLANET GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.netplanet.at"}, "pfx": 22, "reg": "2002-06-06", "rir": "ripencc", "s24": 89, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": "abuse@netplanet.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038629329076}, {"a": 24955, "h": "UBN-AS", "n": "JSC Ufanet", "t": "Broadband & mobile", "w": 21, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 3, "cve:CVE-2024-6387": 2}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0998, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "dshield": {"n": 3, "p": 0.4067, "hi": 5.62, "lo": 0.99, "ips": 3, "mean": 2.90, "above": false}, "urlhaus": {"n": 1, "p": 0.1718, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 5, "p": 0.1413, "hi": 3.66, "lo": 0.91, "ips": 5, "mean": 2.09, "above": false}, "vulncheck": {"n": 3, "p": 0.4127, "hi": 5.66, "lo": 1.00, "ips": 11, "mean": 2.92, "above": false}, "blocklist_de": {"n": 4, "p": 0.3956, "hi": 5.22, "lo": 1.12, "ips": 4, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 1.716, 0.177, 0, false], ["2026-10-12", 2.024, 0.196, 0, false]], "sh": false, "uc": 257.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.196, "se": 1.411, "ts": 1.000, "map": 1.478, "obs": 1, "own": 4.247, "comp": {"urlhaus": 3.1651, "threatfox": -0.3896, "phishing_db": -0.7585}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 4}, "lo": 2.024, "se": 0.452, "ts": 0.313, "map": 3.553, "obs": 16, "own": 5.478, "comp": {"cins": 0.9972, "dshield": 2.1493, "crowdsec": -2.172, "vulncheck": 0.3183, "blocklist_de": 1.3686}, "mass": 13.9, "listed": false}}, "abq": false, "bot": 0.409, "det": {"vulncheck": {"botnet_node": 11}, "blocklist_de": {"ssh": 1, "imap": 3, "mail": 3}}, "oid": "ORG-ZS2-RIPE", "org": "JSC \"Ufanet\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://ufanet.ru"}, "pfx": 340, "reg": "2002-06-06", "rir": "ripencc", "s24": 704, "sib": 11, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 411136, "abuse": "abuse@ufanet.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0087477200195}, {"a": 24961, "h": "MYLOC-AS", "n": "WIIT Group", "t": "Hosting & VPS", "w": 34, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 10, "data_centre": 8, "web_exploit": 11, "bad_crawling": 7, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 9, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2022-39290": 2, "cve:CVE-2023-50164": 1, "cve:CVE-2024-28000": 4, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 6}, "n": 14}, "ev": {"shodan": {"n": 3, "p": 0.1258, "hi": 3.69, "lo": 0.65, "ips": 3, "mean": 1.90, "above": false}, "dshield": {"n": 1, "p": 0.1044, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "urlhaus": {"n": 1, "p": 0.1788, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 11, "p": 0.9413, "hi": 7.68, "lo": 2.92, "ips": 14, "mean": 5.06, "above": true}, "vulncheck": {"n": 12, "p": 0.9998, "hi": 15.30, "lo": 6.05, "ips": 13, "mean": 10.23, "above": true}, "phishing_db": {"n": 3, "p": 0.4824, "hi": 6.19, "lo": 1.09, "ips": 3, "mean": 3.19, "above": false}, "blocklist_de": {"n": 4, "p": 0.5023, "hi": 5.89, "lo": 1.27, "ips": 4, "mean": 3.22, "above": false}}, "h2": [["2026-10-05", 2.986, 2.554, 0, false], ["2026-10-12", 3.567, 1.559, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 3}, "lo": 1.559, "se": 0.973, "ts": 0.750, "map": 4.864, "obs": 4, "own": 1.896, "comp": {"urlhaus": 1.8514, "threatfox": -0.4882, "phishing_db": 1.8448}, "mass": 3.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 11, "vulncheck": 12, "blocklist_de": 4}, "lo": 3.567, "se": 0.420, "ts": 0.429, "map": 5.942, "obs": 28, "own": 1.166, "comp": {"cins": -2.178, "dshield": -1.3234, "crowdsec": 4.0956, "vulncheck": 3.2023, "blocklist_de": -0.6208}, "mass": 17.0, "listed": false}}, "abq": false, "bot": 0.844, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"botnet_node": 13}, "blocklist_de": {"ftp": 1, "ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MMIA3-RIPE", "org": "WIIT AG", "pdb": {"t": "Content", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.wiit.cloud"}, "pfx": 47, "reg": "2002-06-10", "rir": "ripencc", "s24": 516, "sib": 8, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 132096, "abuse": "abuse@myloc.de", "score": 0.0833, "groups": ["vulncheck"], "sensors": ["crowdsec"], "traffic": 0.00750339641228}, {"a": 24971, "h": "MASTER-AS", "n": "MasterDC", "t": "Hosting & VPS", "w": 4, "cc": "CZ", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0634, "hi": 3.19, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "crowdsec": {"n": 3, "p": 0.2927, "hi": 4.84, "lo": 0.85, "ips": 3, "mean": 2.49, "above": false}, "vulncheck": {"n": 1, "p": 0.1518, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.662, 0.010, 0, false], ["2026-10-12", 0.863, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.950, "ts": null, "map": 0.172, "obs": 0, "own": 0.166, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.863, "se": 0.669, "ts": 0.750, "map": 2.193, "obs": 4, "own": 0.440, "comp": {"cins": -0.5973, "dshield": -1.1473, "crowdsec": 6.0647, "vulncheck": 0.8812, "blocklist_de": -3.0226}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.942, "det": {"shodan": {"malware": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-MIS2-RIPE", "org": "MasterDC s.r.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.master.cz"}, "pfx": 33, "reg": "2002-06-11", "rir": "ripencc", "s24": 227, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58880, "abuse": "abuse@master.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00078553872424}, {"a": 24997, "h": "GE-CDN-AS", "n": "Caucasus Digital Network LTD", "t": "Other", "w": 0, "cc": "GE", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6429, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.135, "det": {"shodan": {"c2": 3}}, "oid": "ORG-CDN1-RIPE", "org": "Caucasus Digital Network LTD", "pdb": null, "pfx": 4, "reg": "2002-06-19", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001050658128}, {"a": 25019, "h": "SAUDINETSTC-AS", "n": "Saudi Telecom Company (STC SAUDINET)", "t": "Broadband & mobile", "w": 36, "cc": "SA", "cf": {"rb": "", "wb": "", "rep": 0.99, "waf": 1.04}, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.76, "lo": 0.10, "ips": 2, "mean": 0.36, "above": false}, "shodan": {"n": 1938, "p": 1.0000, "hi": 53.46, "lo": 49.61, "ips": 1938, "mean": 51.52, "above": true}, "dshield": {"n": 15, "p": 0.0013, "hi": 2.25, "lo": 0.98, "ips": 15, "mean": 1.56, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.17, "lo": 0.03, "ips": 3, "mean": 0.09, "above": false}, "threatfox": {"n": 6, "p": 0.0830, "hi": 3.26, "lo": 0.90, "ips": 6, "mean": 1.93, "above": false}, "blocklist_de": {"n": 10, "p": 0.0000, "hi": 0.88, "lo": 0.32, "ips": 10, "mean": 0.57, "above": false}}, "h2": [["2026-10-05", 0.121, 0.044, 0, false], ["2026-10-12", 0.223, 0.084, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 6, "phishing_db": 0}, "lo": 0.084, "se": 1.032, "ts": 1.000, "map": 0.237, "obs": 6, "own": 0.781, "comp": {"urlhaus": -1.5049, "threatfox": 2.7527, "phishing_db": -1.0605}, "mass": 7.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 15, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.223, "se": 0.410, "ts": 0.500, "map": 0.363, "obs": 30, "own": 0.562, "comp": {"cins": 0.6293, "dshield": 8.3425, "crowdsec": -9.625, "vulncheck": -0.9824, "blocklist_de": 2.0162}, "mass": 34.7, "listed": false}}, "abq": true, "bot": 0.137, "det": {"shodan": {"malware": 1938}, "threatfox": {"family:Havoc": 5, "family:Xtreme RAT": 1}, "blocklist_de": {"ssh": 1, "bots": 6, "apache": 3, "bruteforcelogin": 2}}, "oid": "ORG-SSTC1-RIPE", "org": "Saudi Telecom Company JSC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.stc.com.sa"}, "pfx": 1931, "reg": "2002-06-25", "rir": "ripencc", "s24": 17148, "sib": 4, "tor": 0, "w24": 36, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 9073920, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.19841}, {"a": 25052, "h": "OMC-ASN", "n": "Kamatera IL 2", "t": "Hosting & VPS", "w": 0, "cc": "IL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.774, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OCCL1-RIPE", "org": "O.M.C. COMPUTERS & COMMUNICATIONS LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.kamatera.com"}, "pfx": 7, "reg": "2015-07-01", "rir": "ripencc", "s24": 7, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@cloudwm.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002564859479}, {"a": 25058, "h": "CMO-AS", "n": "CMO Internet Dienstleistungen", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.590, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CIDG1-RIPE", "org": "CMO Internet Dienstleistungen GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.cmo.de"}, "pfx": 2, "reg": "2002-07-15", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@cmo.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25082, "h": "AS-VINER-TELECOM", "n": "Viner Telecom LLC", "t": "Broadband & mobile", "w": 5, "cc": "UA", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 5, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 2.075, 0.011, 0, false], ["2026-10-12", 2.254, 0.012, 0, false]], "sh": false, "uc": 1882.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.254, "se": 0.965, "ts": 0.500, "map": 10.157, "obs": 2, "own": 16.359, "comp": {"cins": -0.2895, "dshield": -0.6252, "crowdsec": 1.8299, "vulncheck": -0.5157, "blocklist_de": 3.3123}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.226, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "ORG-VT72-RIPE", "org": "Viner Telecom LLC", "pdb": null, "pfx": 18, "reg": "2002-07-22", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "noc@vinertelecom.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00062322023679}, {"a": 25106, "h": "MTSBY-AS", "n": "Mobile TeleSystems", "t": "Broadband & mobile", "w": 1, "cc": "BY", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.0154, "hi": 2.32, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}}, "h2": [["2026-10-05", 0.492, 0.151, 0, false], ["2026-10-12", 0.039, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.839, "ts": null, "map": 0.131, "obs": 0, "own": 0.655, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.039, "se": 1.056, "ts": 1.000, "map": 0.209, "obs": 1, "own": 0.347, "comp": {"cins": -0.2664, "dshield": -0.5808, "crowdsec": -2.2931, "vulncheck": -0.4932, "blocklist_de": 3.4631}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-MTJ1-RIPE", "org": "Mobile TeleSystems JLLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.mts.by"}, "pfx": 195, "reg": "2002-07-26", "rir": "ripencc", "s24": 977, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 335872, "abuse": "abuse@mts.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00957562529184}, {"a": 25122, "h": "Gulfsat_Communications-AS", "n": "GULFSATCOMMUNICATIONS COMPANY K.S.C.", "t": "Other", "w": 7, "cc": "KW", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 4, "p": 0.8086, "hi": 9.04, "lo": 1.94, "ips": 7, "mean": 4.94, "above": true}}, "h2": [["2026-10-05", 2.830, 0.011, 0, false], ["2026-10-12", 3.767, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.740, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 3.767, "se": 0.713, "ts": 1.000, "map": 10.113, "obs": 4, "own": 6.017, "comp": {"cins": -0.3247, "dshield": -0.6916, "crowdsec": -2.7279, "vulncheck": 9.1231, "blocklist_de": -1.6715}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.364, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "ORG-GA16-RIPE", "org": "GULFSATCOMMUNICATIONS COMPANY K.S.C.", "pdb": null, "pfx": 31, "reg": "2002-07-31", "rir": "ripencc", "s24": 25, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 9728, "abuse": "abuse@gulfsat.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0000041002866}, {"a": 25124, "h": "DATAK", "n": "DATAK", "t": "Broadband & mobile", "w": 2, "cc": "IR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1847, "hi": 4.29, "lo": 0.56, "ips": 2, "mean": 2.04, "above": false}, "blocklist_de": {"n": 1, "p": 0.1291, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.394, 0.010, 0, false], ["2026-10-12", 0.885, 0.011, 0, false]], "sh": false, "uc": 297.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.176, "obs": 0, "own": 1.158, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.885, "se": 0.741, "ts": 0.667, "map": 2.580, "obs": 3, "own": 4.047, "comp": {"cins": -0.5513, "dshield": -1.0767, "crowdsec": 3.0234, "vulncheck": -0.6878, "blocklist_de": 1.6337}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.663, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-DIEI1-RIPE", "org": "Datak Company LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": null}, "pfx": 15, "reg": "2002-07-31", "rir": "ripencc", "s24": 176, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45312, "abuse": "ripe@datak.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00032647904415}, {"a": 25133, "h": "MCLAUT-AS", "n": "McLaut-Invest", "t": "Broadband & mobile", "w": 5, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2025-55182": 1}, "n": 1}, "ev": {"dshield": {"n": 4, "p": 0.6867, "hi": 7.42, "lo": 1.60, "ips": 4, "mean": 4.05, "above": false}, "crowdsec": {"n": 1, "p": 0.0117, "hi": 2.20, "lo": 0.17, "ips": 1, "mean": 0.93, "above": false}}, "h2": [["2026-10-05", 0.063, 0.009, 0, false], ["2026-10-12", 0.769, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.902, "ts": null, "map": 0.156, "obs": 0, "own": 0.872, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.769, "se": 0.598, "ts": 0.800, "map": 1.749, "obs": 5, "own": 2.716, "comp": {"cins": -0.8512, "dshield": 10.6948, "crowdsec": -2.8593, "vulncheck": -0.7906, "blocklist_de": -4.241}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.206, "det": null, "oid": "ORG-SLV3-RIPE", "org": "LLC \"McLaut-Invest\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://mclaut.com"}, "pfx": 44, "reg": "2002-08-01", "rir": "ripencc", "s24": 434, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 111104, "abuse": "abuse@mclaut.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0045802768242}, {"a": 25135, "h": "vodafone_uk_asn", "n": "Vodafone UK Packet Backbone", "t": "Broadband & mobile", "w": 1, "cc": "GB", "cf": {"rb": "hi", "wb": "hi", "rep": 0.84, "waf": 0.74}, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1441, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.150, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 1.256, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.150, "se": 1.191, "ts": 1.000, "map": 1.032, "obs": 1, "own": 1.773, "comp": {"cins": -0.181, "dshield": -0.4089, "crowdsec": -1.617, "vulncheck": -0.392, "blocklist_de": 4.0239}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.056, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-VI6-RIPE", "org": "Vodafone Limited", "pdb": null, "pfx": 25, "reg": "2002-08-02", "rir": "ripencc", "s24": 132, "sib": 5, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.087029}, {"a": 25139, "h": "TVCABO-AS", "n": "TVCabo Mozambique", "t": "Broadband & mobile", "w": 3, "cc": "MZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1509, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 2, "p": 0.1018, "hi": 3.57, "lo": 0.46, "ips": 2, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 1.190, 0.010, 0, false], ["2026-10-12", 0.577, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.933, "ts": null, "map": 0.167, "obs": 0, "own": 0.997, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.577, "se": 0.734, "ts": 0.667, "map": 1.675, "obs": 3, "own": 2.633, "comp": {"cins": 3.9719, "dshield": -1.123, "crowdsec": 2.7066, "vulncheck": -0.7012, "blocklist_de": -2.9447}, "mass": 2.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TCML1-RIPE", "org": "TVCABO - Comunicacoes Multimedia, Lda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Selective", "web": "https://tvcabo.mz"}, "pfx": 33, "reg": "2002-08-02", "rir": "ripencc", "s24": 288, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 158208, "abuse": "abuse@tvcabo.mz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00172665931746}, {"a": 25159, "h": "SONICDUO-AS", "n": "SONICDUO", "t": "Other", "w": 65, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 37, "web_bruteforce": 18, "home_connection": 1, "mail_bruteforce": 52}, "n": 52}, "ev": {"dshield": {"n": 6, "p": 0.9016, "hi": 9.16, "lo": 2.54, "ips": 7, "mean": 5.41, "above": true}, "urlhaus": {"n": 3, "p": 0.6135, "hi": 7.38, "lo": 1.30, "ips": 3, "mean": 3.81, "above": false}, "crowdsec": {"n": 20, "p": 1.0000, "hi": 11.89, "lo": 5.76, "ips": 52, "mean": 8.60, "above": true}, "vulncheck": {"n": 1, "p": 0.1028, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "blocklist_de": {"n": 16, "p": 1.0000, "hi": 15.36, "lo": 6.85, "ips": 40, "mean": 10.75, "above": true}}, "h2": [["2026-10-05", 8.036, 0.958, 0, false], ["2026-10-12", 8.937, 2.443, 0, false]], "sh": false, "uc": 4575.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 2.443, "se": 0.990, "ts": 1.000, "map": 8.386, "obs": 3, "own": 7.924, "comp": {"urlhaus": 5.3599, "threatfox": -0.5309, "phishing_db": -1.0762}, "mass": 6.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 20, "vulncheck": 1, "blocklist_de": 16}, "lo": 8.937, "se": 0.383, "ts": 0.465, "map": 14.006, "obs": 43, "own": 7.847, "comp": {"cins": -3.1387, "dshield": 0.6882, "crowdsec": 0.2848, "vulncheck": -0.8432, "blocklist_de": 7.0421}, "mass": 41.9, "listed": false}}, "abq": false, "bot": 0.376, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 24, "mail": 39}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 69, "reg": "2002-08-13", "rir": "ripencc", "s24": 543, "sib": 39, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 142336, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.00884690453955}, {"a": 25160, "h": "VORBOSS", "n": "Vorboss Limited", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0282, "hi": 2.62, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.912, "ts": null, "map": 0.160, "obs": 0, "own": 0.913, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.629, "ts": null, "map": 0.091, "obs": 0, "own": 0.215, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-VL110-RIPE", "org": "Vorboss Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://vorboss.com"}, "pfx": 33, "reg": "2010-04-23", "rir": "ripencc", "s24": 379, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 97024, "abuse": "abuse@vorboss.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00376904016199}, {"a": 25184, "h": "AFRANET", "n": "Afranet", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.1802, "hi": 4.25, "lo": 0.55, "ips": 2, "mean": 2.03, "above": false}, "crowdsec": {"n": 3, "p": 0.2951, "hi": 4.85, "lo": 0.86, "ips": 3, "mean": 2.50, "above": false}, "blocklist_de": {"n": 2, "p": 0.2815, "hi": 5.07, "lo": 0.66, "ips": 2, "mean": 2.42, "above": false}}, "h2": [["2026-10-05", 2.441, 0.010, 0, false], ["2026-10-12", 1.586, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.951, "ts": null, "map": 0.172, "obs": 0, "own": 0.434, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.586, "se": 0.605, "ts": 0.600, "map": 3.651, "obs": 5, "own": 2.073, "comp": {"cins": -0.9069, "dshield": -1.5674, "crowdsec": 2.5849, "vulncheck": -0.8041, "blocklist_de": 3.382}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.328, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-AA32-RIPE", "org": "Afranet", "pdb": null, "pfx": 229, "reg": "2002-08-26", "rir": "ripencc", "s24": 225, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 114432, "abuse": "abuse@afranet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009063442638}, {"a": 25190, "h": "KIS-AS", "n": "Kauno interneto sistemos", "t": "Broadband & mobile", "w": 51, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 46, "p": 1.0000, "hi": 56.14, "lo": 34.67, "ips": 51, "mean": 44.86, "above": true}}, "h2": [["2026-10-05", 20.650, 0.011, 1, false], ["2026-10-12", 12.403, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.011, "ts": null, "map": 0.185, "obs": 0, "own": 1.386, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 46, "blocklist_de": 0}, "lo": 12.403, "se": 0.402, "ts": 1.000, "map": 19.984, "obs": 46, "own": 30.829, "comp": {"cins": -1.6111, "dshield": -2.2675, "crowdsec": -8.8212, "vulncheck": 24.761, "blocklist_de": -7.6726}, "mass": 10.1, "listed": false}}, "abq": false, "bot": 0.197, "det": {"vulncheck": {"botnet_node": 51}}, "oid": "ORG-UIS4-RIPE", "org": "UAB \"Kauno interneto sistemos\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.k-sistemos.lt"}, "pfx": 5, "reg": "2002-08-28", "rir": "ripencc", "s24": 91, "sib": 0, "tor": 0, "w24": 46, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 23296, "abuse": "info@kis.lt", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0005705784425}, {"a": 25198, "h": "ZetServers", "n": "ZetServers", "t": "Hosting & VPS", "w": 24, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "web_bruteforce": 2, "cve:CVE-2023-28121": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1698, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 2, "p": 0.2328, "hi": 4.68, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}, "vulncheck": {"n": 15, "p": 1.0000, "hi": 21.62, "lo": 9.40, "ips": 21, "mean": 14.98, "above": true}}, "h2": [["2026-10-05", 3.171, 0.010, 0, false], ["2026-10-12", 4.902, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 0.195, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 15, "blocklist_de": 0}, "lo": 4.902, "se": 0.465, "ts": 0.833, "map": 8.636, "obs": 18, "own": 1.714, "comp": {"cins": -1.1537, "dshield": 0.6937, "crowdsec": -2.2116, "vulncheck": 11.8657, "blocklist_de": -5.6445}, "mass": 6.3, "listed": false}}, "abq": true, "bot": 0.436, "det": {"vulncheck": {"botnet_node": 21}}, "oid": "ORG-IHS20-RIPE", "org": "INTERKVM HOST SRL", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "https://zetservers.com"}, "pfx": 130, "reg": "2015-06-25", "rir": "ripencc", "s24": 130, "sib": 4, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 33280, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.01198077014836}, {"a": 25248, "h": "BlueTone-AS", "n": "Radiokomunikace", "t": "Transit & backbone", "w": 1, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0783, "hi": 3.33, "lo": 0.43, "ips": 2, "mean": 1.59, "above": false}, "crowdsec": {"n": 1, "p": 0.0131, "hi": 2.25, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.064, 0.009, 0, false], ["2026-10-12", 0.066, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.905, "ts": null, "map": 0.157, "obs": 0, "own": 1.257, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.066, "se": 1.101, "ts": 1.000, "map": 0.385, "obs": 1, "own": 1.309, "comp": {"cins": -0.212, "dshield": -0.4728, "crowdsec": 2.6564, "vulncheck": -0.4325, "blocklist_de": -1.0991}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.294, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-CRA1-RIPE", "org": "RADIOKOMUNIKACE a.s.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.cra.cz"}, "pfx": 5, "reg": "2002-09-11", "rir": "ripencc", "s24": 417, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 106752, "abuse": "abuse@bluetone.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00177372356965}, {"a": 25274, "h": "NARACOM-HU", "n": "Naracom", "t": "Broadband & mobile", "w": 1, "cc": "HU", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 3.159, 0.011, 0, false], ["2026-10-12", 0.215, 0.012, 0, false]], "sh": false, "uc": 374.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 1.469, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.215, "se": 1.240, "ts": 1.000, "map": 1.636, "obs": 1, "own": 2.859, "comp": {"cins": -0.1574, "dshield": -0.3591, "crowdsec": -1.4207, "vulncheck": -0.3576, "blocklist_de": 4.1804}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.165, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NK17-RIPE", "org": "Naracom Kft.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "http://naracom.hu"}, "pfx": 10, "reg": "2015-06-22", "rir": "ripencc", "s24": 72, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "abuse@naracom.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036585167186}, {"a": 25288, "h": "LIR-UKRAINE-AS", "n": "DEMENIN B.V.", "t": "Other", "w": 5, "cc": "NL", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.51}, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 5}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.6365, "hi": 7.63, "lo": 1.34, "ips": 5, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 5.153, 0.011, 0, false], ["2026-10-12", 14.800, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 14.800, "se": 0.810, "ts": 1.000, "map": 50.049, "obs": 3, "own": 28.680, "comp": {"cins": -0.3805, "dshield": -0.7927, "crowdsec": 9.0218, "vulncheck": -0.5901, "blocklist_de": -1.9518}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.936, "det": null, "oid": "ORG-DB230-RIPE", "org": "DEMENIN B.V.", "pdb": null, "pfx": 3, "reg": "2015-06-22", "rir": "ripencc", "s24": 6, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@demenin.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25335, "h": "NGS", "n": "NEXT GLOBAL SERVICES L.P.", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.403, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.613, "det": null, "oid": "ORG-NGSL3-RIPE", "org": "NEXT GLOBAL SERVICES L.P.", "pdb": null, "pfx": 11, "reg": "2015-06-19", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 0, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@nextglobalservices.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25341, "h": "LINIYA-AS", "n": "\"Nauchno proizvodstvennaya Firma \"Raspredelennaya Obrabotka Informacii\" LLC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 6884.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 14.129, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.456, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PFOI2-RIPE", "org": "\"Nauchno proizvodstvennaya Firma \"Raspredelennaya Obrabotka Informacii\" LLC", "pdb": null, "pfx": 3, "reg": "2007-05-07", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "admin@roitl.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25369, "h": "BANDWIDTH-AS", "n": "Hydra Communications Ltd (EU)", "t": "Broadband & mobile", "w": 2856, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 327, "data_centre": 18, "web_exploit": 671, "bad_crawling": 28, "proxy_or_vpn": 4, "ssh_bruteforce": 163, "web_bruteforce": 95, "home_connection": 752, "mail_bruteforce": 3, "cve:CVE-2017-9841": 7, "cve:CVE-2017-16894": 7, "cve:CVE-2019-17050": 7, "cve:CVE-2022-35914": 8, "cve:CVE-2024-28000": 6}, "n": 839}, "ev": {"cins": {"n": 28, "p": 1.0000, "hi": 31.60, "lo": 17.07, "ips": 2552, "mean": 23.87, "above": true}, "dshield": {"n": 1, "p": 0.1054, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "crowdsec": {"n": 30, "p": 1.0000, "hi": 17.29, "lo": 9.54, "ips": 839, "mean": 13.18, "above": true}, "phishing_db": {"n": 2, "p": 0.2777, "hi": 5.04, "lo": 0.65, "ips": 2, "mean": 2.40, "above": false}, "blocklist_de": {"n": 6, "p": 0.8132, "hi": 7.66, "lo": 2.13, "ips": 16, "mean": 4.53, "above": true}}, "h2": [["2026-10-05", 18.456, 0.399, 2, false], ["2026-10-12", 18.958, 0.431, 2, false]], "sh": false, "uc": 2829.5, "v2": {"band": 2, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.431, "se": 1.135, "ts": 1.000, "map": 1.784, "obs": 2, "own": 4.891, "comp": {"urlhaus": -0.5277, "threatfox": -0.3709, "phishing_db": 3.1036}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 28, "dshield": 1, "crowdsec": 30, "vulncheck": 0, "blocklist_de": 6}, "lo": 18.958, "se": 0.369, "ts": 0.462, "map": 29.092, "obs": 65, "own": 44.445, "comp": {"cins": 22.558, "dshield": -2.999, "crowdsec": -2.7302, "vulncheck": -1.0019, "blocklist_de": -11.0627}, "mass": 81.4, "listed": true}}, "abq": false, "bot": 0.709, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 3, "apache": 11, "bruteforcelogin": 11}}, "oid": "ORG-HCL11-RIPE", "org": "Hydra Communications Ltd", "pdb": {"t": "Content", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.bandwidth.co.uk"}, "pfx": 266, "reg": "2002-10-28", "rir": "ripencc", "s24": 509, "sib": 4, "tor": 0, "w24": 41, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 144384, "abuse": "abuse@zare.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.02638107857385}, {"a": 25400, "h": "TELIA-NORWAY-AS", "n": "Telia Norge", "t": "Transit & backbone", "w": 6, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 3, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"urlhaus": {"n": 1, "p": 0.0489, "hi": 2.98, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 0.66, "lo": 0.18, "ips": 6, "mean": 0.39, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.61, "lo": 0.05, "ips": 1, "mean": 0.26, "above": false}}, "h2": [["2026-10-05", 0.113, 0.054, 0, false], ["2026-10-12", 0.099, 0.060, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.060, "se": 1.327, "ts": 1.000, "map": 0.356, "obs": 1, "own": 1.555, "comp": {"urlhaus": 2.0282, "threatfox": -0.4791, "phishing_db": -0.9567}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.099, "se": 0.535, "ts": 0.857, "map": 0.198, "obs": 7, "own": 0.626, "comp": {"cins": -1.2563, "dshield": -1.9506, "crowdsec": 6.4741, "vulncheck": -0.8674, "blocklist_de": -2.6268}, "mass": 7.1, "listed": false}}, "abq": false, "bot": 0.094, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-TEN1-RIPE", "org": "Telia Norge AS", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "http://www.telia.no/"}, "pfx": 148, "reg": "2002-11-12", "rir": "ripencc", "s24": 6380, "sib": 7, "tor": 1, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2769664, "abuse": "abuse@telia-isp.no", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03237264706066}, {"a": 25417, "h": "Ljusnet-AS", "n": "Ljusnet", "t": "Other", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.261, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LA2073-RIPE", "org": "Ljusnet AB", "pdb": null, "pfx": 3, "reg": "2002-11-15", "rir": "ripencc", "s24": 49, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": "abuse@ljusnet.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030723998368}, {"a": 25472, "h": "WIND-AS", "n": "WIND HELLAS TELECOMMUNICATIONS", "t": "Broadband & mobile", "w": 4, "cc": "GR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0352, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}, "blocklist_de": {"n": 3, "p": 0.0675, "hi": 3.19, "lo": 0.56, "ips": 3, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.079, 0.008, 0, false], ["2026-10-12", 0.253, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.121, "obs": 0, "own": 0.582, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.253, "se": 0.642, "ts": 0.750, "map": 0.612, "obs": 4, "own": 0.956, "comp": {"cins": -0.9044, "dshield": 1.3874, "crowdsec": -6.1231, "vulncheck": -0.8036, "blocklist_de": 7.3466}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.104, "det": {"blocklist_de": {"bots": 2, "mail": 1}}, "oid": "ORG-FS5-RIPE", "org": "Nova Telecommunications & Media Single Member S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.nova.gr"}, "pfx": 345, "reg": "2002-12-04", "rir": "ripencc", "s24": 1337, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 934144, "abuse": "abuse@forthnet.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0340573373496}, {"a": 25490, "h": "STC-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 4, "web_bruteforce": 3, "mail_bruteforce": 3}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1267, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 4, "p": 0.2014, "hi": 4.09, "lo": 0.88, "ips": 4, "mean": 2.24, "above": false}, "threatfox": {"n": 1, "p": 0.1694, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "vulncheck": {"n": 1, "p": 0.1133, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "blocklist_de": {"n": 3, "p": 0.3432, "hi": 5.18, "lo": 0.91, "ips": 3, "mean": 2.67, "above": false}}, "h2": [["2026-10-05", 1.475, 0.133, 0, false], ["2026-10-12", 1.705, 0.138, 0, false]], "sh": false, "uc": 354.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.138, "se": 1.380, "ts": 1.000, "map": 0.926, "obs": 1, "own": 2.828, "comp": {"urlhaus": -0.2738, "threatfox": 2.3146, "phishing_db": -0.4918}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 3}, "lo": 1.705, "se": 0.511, "ts": 0.444, "map": 3.314, "obs": 9, "own": 5.125, "comp": {"cins": 2.0981, "dshield": -2.1265, "crowdsec": 0.0851, "vulncheck": -0.2449, "blocklist_de": 2.7799}, "mass": 8.6, "listed": false}}, "abq": false, "bot": 0.454, "det": {"threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 87, "reg": "2002-12-09", "rir": "ripencc", "s24": 465, "sib": 120, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 152576, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022248829064}, {"a": 25500, "h": "NTUU-KPI-AS", "n": "Igor Sikorsky Kyiv Polytechnic Institute", "t": "Enterprise, edu & gov", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1319, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.016, "ts": null, "map": 0.186, "obs": 0, "own": 2.386, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.165, "obs": 0, "own": 1.938, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-COEI1-RIPE", "org": "User Association of Ukrainian Research and Academic Network URAN", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://kpi.ua/"}, "pfx": 12, "reg": "2002-12-11", "rir": "ripencc", "s24": 84, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": "abuse@kpi.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25504, "h": "CRONON-AS", "n": "Vautron Rechenzentrum AG", "t": "Hosting & VPS", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1193, "hi": 3.88, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "crowdsec": {"n": 3, "p": 0.4675, "hi": 6.07, "lo": 1.07, "ips": 3, "mean": 3.13, "above": false}}, "h2": [["2026-10-05", 1.959, 0.011, 0, false], ["2026-10-12", 1.289, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.003, "ts": null, "map": 0.184, "obs": 0, "own": 0.207, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.289, "se": 0.747, "ts": 1.000, "map": 3.860, "obs": 3, "own": 0.771, "comp": {"cins": -0.4946, "dshield": -0.9864, "crowdsec": 7.4041, "vulncheck": -0.6599, "blocklist_de": -2.5188}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.995, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AIG9-RIPE", "org": "Vautron Rechenzentrum AG", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.vautron.de/"}, "pfx": 18, "reg": "2002-12-11", "rir": "ripencc", "s24": 104, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26624, "abuse": "abuse@vautron.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25513, "h": "ASN-MGTS-USPD", "n": "MGTS", "t": "Other", "w": 25, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 11, "web_bruteforce": 10, "home_connection": 8, "mail_bruteforce": 11, "router_or_botnet": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2024-12847": 1, "cve:CVE-2026-53787": 1, "cve:CVE-2026-75650": 1}, "n": 18}, "ev": {"dshield": {"n": 5, "p": 0.4541, "hi": 5.30, "lo": 1.32, "ips": 5, "mean": 3.03, "above": false}, "crowdsec": {"n": 18, "p": 0.6071, "hi": 4.57, "lo": 2.13, "ips": 18, "mean": 3.25, "above": false}, "vulncheck": {"n": 1, "p": 0.0195, "hi": 2.43, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}, "blocklist_de": {"n": 8, "p": 0.4750, "hi": 4.89, "lo": 1.59, "ips": 8, "mean": 3.05, "above": false}}, "h2": [["2026-10-05", 1.644, 0.007, 0, false], ["2026-10-12", 1.857, 0.008, 0, false]], "sh": false, "uc": 249.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.791, "ts": null, "map": 0.110, "obs": 0, "own": 0.208, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 18, "vulncheck": 1, "blocklist_de": 8}, "lo": 1.857, "se": 0.400, "ts": 0.563, "map": 2.922, "obs": 32, "own": 1.645, "comp": {"cins": -2.7827, "dshield": 1.3507, "crowdsec": 3.6614, "vulncheck": -0.7717, "blocklist_de": 1.0082}, "mass": 29.5, "listed": false}}, "abq": false, "bot": 0.402, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2, "imap": 4, "mail": 6}}, "oid": "ORG-OMCT1-RIPE", "org": "PJSC Moscow city telephone network", "pdb": null, "pfx": 53, "reg": "2002-12-17", "rir": "ripencc", "s24": 1821, "sib": 10, "tor": 0, "w24": 25, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 480256, "abuse": "abuse@spd-mgts.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01935758897765}, {"a": 25515, "h": "CTCNET-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 2, "p": 0.1791, "hi": 4.24, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}, "blocklist_de": {"n": 1, "p": 0.1272, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.859, 0.010, 0, false], ["2026-10-12", 1.452, 0.011, 0, false]], "sh": false, "uc": 74.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.147, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.452, "se": 0.661, "ts": 0.500, "map": 3.646, "obs": 4, "own": 5.684, "comp": {"cins": 3.5789, "dshield": -1.3822, "crowdsec": 0.937, "vulncheck": -0.7661, "blocklist_de": 0.3197}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.474, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 20, "reg": "2002-12-18", "rir": "ripencc", "s24": 182, "sib": 120, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 249856, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044800593915}, {"a": 25532, "h": "MASTERHOST-AS", "n": "Masterhost", "t": "Hosting & VPS", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.241, 0.011, 0, false], ["2026-10-12", 0.256, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.248, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.256, "se": 1.264, "ts": 1.000, "map": 2.026, "obs": 1, "own": 0.454, "comp": {"cins": -0.1334, "dshield": -0.3075, "crowdsec": 3.5546, "vulncheck": -0.3191, "blocklist_de": -0.695}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.994, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MA30-RIPE", "org": "LLC \"MASTERHOST\"", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://masterhost.ru"}, "pfx": 34, "reg": "2002-12-27", "rir": "ripencc", "s24": 49, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": "abuse@masterhost.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25543, "h": "FasoNet-AS", "n": "ONATEL (Office National des Telecommunications, PTT)", "t": "Broadband & mobile", "w": 1, "cc": "BF", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1134, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "dshield": {"n": 1, "p": 0.1732, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.154, 0.011, 0, false], ["2026-10-12", 0.155, 0.012, 0, false]], "sh": false, "uc": 637.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.997, "ts": null, "map": 0.183, "obs": 0, "own": 1.307, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.155, "se": 1.194, "ts": 1.000, "map": 1.075, "obs": 1, "own": 1.844, "comp": {"cins": -0.1635, "dshield": 4.3186, "crowdsec": -1.4721, "vulncheck": -0.3669, "blocklist_de": -0.8502}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.170, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ONDT1-AFRINIC", "org": "ONATEL (Office National des Telecommunications, PTT)", "pdb": null, "pfx": 96, "reg": "2007-09-20", "rir": "afrinic", "s24": 114, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 76032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00276158972854}, {"a": 25620, "h": "", "n": "COTAS LTDA.", "t": "Broadband & mobile", "w": 6, "cc": "BO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 3, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"urlhaus": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 4, "p": 0.1107, "hi": 3.51, "lo": 0.76, "ips": 4, "mean": 1.92, "above": false}, "vulncheck": {"n": 1, "p": 0.0953, "hi": 3.60, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.832, 0.192, 0, false], ["2026-10-12", 0.489, 0.210, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.210, "se": 1.419, "ts": 1.000, "map": 1.623, "obs": 1, "own": 4.662, "comp": {"urlhaus": 3.2335, "threatfox": -0.3816, "phishing_db": -0.7411}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.489, "se": 0.610, "ts": 0.800, "map": 1.126, "obs": 5, "own": 1.761, "comp": {"cins": -0.7779, "dshield": -1.403, "crowdsec": 7.0906, "vulncheck": 0.4957, "blocklist_de": -3.8933}, "mass": 3.8, "listed": false}}, "abq": true, "bot": 0.306, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "@aut-25620-LACNIC", "org": "COTAS LTDA.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.cotas.com"}, "pfx": 76, "reg": "2002-04-10", "rir": "lacnic", "s24": 604, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 314880, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00130404329328}, {"a": 25649, "h": "AYERA-AS", "n": "Ayera Technologies", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.6426, "hi": 6.99, "lo": 1.50, "ips": 4, "mean": 3.82, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 1.740, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.755, "ts": null, "map": 0.138, "obs": 0, "own": 0.792, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.216, "det": {"shodan": {"compromised": 4}}, "oid": "AYERA-1-ARIN", "org": "AYERA TECHNOLOGIES, INC.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.ayera.com"}, "pfx": 24, "reg": "2006-12-19", "rir": "arin", "s24": 145, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 37120, "abuse": "ipadmin@ayera.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25693, "h": "VIRMACH", "n": "VIRMACH", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": null, "cs": {"c": {}, "n": 4}, "ev": {"shodan": {"n": 4, "p": 0.7854, "hi": 8.65, "lo": 1.86, "ips": 4, "mean": 4.73, "above": false}, "crowdsec": {"n": 3, "p": 0.5991, "hi": 7.23, "lo": 1.27, "ips": 4, "mean": 3.73, "above": false}, "threatfox": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 3.943, 0.471, 0, false], ["2026-10-12", 4.144, 0.487, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.487, "se": 1.557, "ts": 1.000, "map": 5.082, "obs": 1, "own": 15.196, "comp": {"urlhaus": -0.0927, "threatfox": 3.5601, "phishing_db": -0.2155}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.144, "se": 0.774, "ts": 1.000, "map": 13.029, "obs": 3, "own": 20.395, "comp": {"cins": -0.4393, "dshield": -0.8947, "crowdsec": 8.169, "vulncheck": -0.6287, "blocklist_de": -2.2453}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.593, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 2}, "threatfox": {"family:AsyncRAT": 1}}, "oid": "VMSL-100-ARIN", "org": "Virtual Machine Solutions LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "http://virmach.com"}, "pfx": 24, "reg": "2025-03-20", "rir": "arin", "s24": 27, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25697, "h": "UPCLOUDUSA", "n": "UpCloud USA", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3185, "hi": 5.38, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}}, "h2": [["2026-10-05", 0.009, 0.309, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.221, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.070, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"compromised": 2}}, "oid": "UU-7-ARIN", "org": "UpCloud USA Inc", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.upcloud.com"}, "pfx": 23, "reg": "2014-05-06", "rir": "arin", "s24": 80, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "abuse@upcloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0061131063837}, {"a": 25715, "h": "SW-MN-BROADBAND", "n": "SOUTHWEST MINNESOTA BROADBAND SERVICES", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 4, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.221, 0.011, 0, false], ["2026-10-12", 0.215, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 1.634, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.215, "se": 1.256, "ts": 1.000, "map": 1.631, "obs": 1, "own": 2.976, "comp": {"cins": -0.0994, "dshield": -0.2325, "crowdsec": -0.921, "vulncheck": 3.6544, "blocklist_de": -0.5189}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.184, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "SMBS-11-ARIN", "org": "SOUTHWEST MINNESOTA BROADBAND SERVICES", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.mysmbs.com/"}, "pfx": 45, "reg": "2017-11-10", "rir": "arin", "s24": 45, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": "abuse@swnoc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25820, "h": "IT7NET", "n": "IT7 Networks", "t": "Hosting & VPS", "w": 12, "cc": "CA", "cf": null, "cs": {"c": {"data_centre": 1}, "n": 1}, "ev": {"shodan": {"n": 34, "p": 1.0000, "hi": 10.42, "lo": 5.95, "ips": 34, "mean": 8.05, "above": true}, "dshield": {"n": 1, "p": 0.0258, "hi": 2.57, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "urlhaus": {"n": 1, "p": 0.1430, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.92, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "threatfox": {"n": 2, "p": 0.2819, "hi": 5.08, "lo": 0.66, "ips": 2, "mean": 2.42, "above": false}, "vulncheck": {"n": 3, "p": 0.2058, "hi": 4.26, "lo": 0.75, "ips": 3, "mean": 2.20, "above": false}, "phishing_db": {"n": 2, "p": 0.1019, "hi": 3.57, "lo": 0.46, "ips": 2, "mean": 1.70, "above": false}, "blocklist_de": {"n": 2, "p": 0.0134, "hi": 2.35, "lo": 0.31, "ips": 2, "mean": 1.12, "above": false}}, "h2": [["2026-10-05", 0.407, 0.591, 0, false], ["2026-10-12", 0.284, 0.753, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 2}, "lo": 0.753, "se": 0.963, "ts": 0.400, "map": 2.206, "obs": 5, "own": 0.901, "comp": {"urlhaus": 1.2587, "threatfox": 0.7461, "phishing_db": 0.4125}, "mass": 5.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 2}, "lo": 0.284, "se": 0.567, "ts": 0.429, "map": 0.603, "obs": 7, "own": 0.121, "comp": {"cins": -1.0122, "dshield": 1.0741, "crowdsec": -3.8897, "vulncheck": 2.1066, "blocklist_de": 2.6094}, "mass": 5.3, "listed": false}}, "abq": false, "bot": 0.731, "det": {"shodan": {"c2": 9, "malware": 2, "compromised": 23}, "threatfox": {"family:Sliver": 1, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"ssh": 2}}, "oid": "IN-27-ARIN", "org": "IT7 Networks Inc", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Selective", "web": "https://www.it7.net"}, "pfx": 237, "reg": "2013-01-15", "rir": "arin", "s24": 1566, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 409600, "abuse": "abuse@sioru.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.02380004865856}, {"a": 25862, "h": "ISNX", "n": "ISNX LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.323, "det": null, "oid": "IL-875-ARIN", "org": "ISNX LLC", "pdb": null, "pfx": 16, "reg": "2023-03-09", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@isnx.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 25933, "h": "", "n": "Vogel Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1609, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 0.109, 0.011, 0, false]], "sh": false, "uc": 548.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.172, "obs": 0, "own": 1.081, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.109, "se": 1.154, "ts": 1.000, "map": 0.698, "obs": 1, "own": 1.188, "comp": {"cins": 4.789, "dshield": -0.4581, "crowdsec": -1.8108, "vulncheck": -0.4235, "blocklist_de": -1.0623}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.176, "det": null, "oid": "@family-58771", "org": "Vogel Soluções em Telecom e Informática S/A", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Selective", "web": "http://www.algar.com.br"}, "pfx": 98, "reg": "2002-06-05", "rir": "lacnic", "s24": 222, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 197888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26042, "h": "FIBERSTATE", "n": "FIBERSTATE", "t": "Broadband & mobile", "w": 16, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.2708, "hi": 4.99, "lo": 0.65, "ips": 2, "mean": 2.38, "above": false}, "urlhaus": {"n": 1, "p": 0.1941, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2409, "hi": 4.74, "lo": 0.62, "ips": 2, "mean": 2.26, "above": false}, "threatfox": {"n": 2, "p": 0.4106, "hi": 6.18, "lo": 0.80, "ips": 6, "mean": 2.94, "above": false}, "vulncheck": {"n": 6, "p": 0.9558, "hi": 11.12, "lo": 3.09, "ips": 7, "mean": 6.58, "above": true}}, "h2": [["2026-10-05", 2.412, 1.037, 0, false], ["2026-10-12", 2.452, 3.149, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 3.149, "se": 1.038, "ts": 0.667, "map": 11.495, "obs": 3, "own": 28.413, "comp": {"urlhaus": 2.7708, "threatfox": 2.141, "phishing_db": -0.8437}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 6, "blocklist_de": 0}, "lo": 2.452, "se": 0.560, "ts": 0.750, "map": 5.053, "obs": 8, "own": 7.975, "comp": {"cins": -0.7218, "dshield": -1.327, "crowdsec": 1.3133, "vulncheck": 7.3742, "blocklist_de": -3.625}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.605, "det": {"shodan": {"malware": 1, "compromised": 1}, "threatfox": {"family:vo1d": 6}, "vulncheck": {"c2_server": 1, "botnet_node": 6}}, "oid": "FL-751-ARIN", "org": "FiberState, LLC", "pdb": {"t": "Content", "sc": "North America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.fiberstate.com"}, "pfx": 123, "reg": "2022-12-13", "rir": "arin", "s24": 123, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 31488, "abuse": "abuse@fiberstate.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00922110421608}, {"a": 26068, "h": "ONSH-NET-CHGO-BLK01", "n": "OnShore, Inc.", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.244, 0.011, 0, false], ["2026-10-12", 0.258, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.258, "se": 1.266, "ts": 1.000, "map": 2.057, "obs": 1, "own": 3.623, "comp": {"cins": -0.1327, "dshield": -0.306, "crowdsec": 3.5629, "vulncheck": -0.3179, "blocklist_de": -0.6914}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.266, "det": null, "oid": "ONSH-ARIN", "org": "OnShore, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.onshore.com"}, "pfx": 8, "reg": "2002-06-27", "rir": "arin", "s24": 48, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26076, "h": "INFINITECOM", "n": "INFINITECOM", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.261, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.283, "det": {"shodan": {"malware": 1}}, "oid": "BLSL-ARIN", "org": "Block Line Systems, LLC", "pdb": null, "pfx": 17, "reg": "2007-10-24", "rir": "arin", "s24": 49, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": "IPAdmin@infinitecomllc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26156, "h": "VERUS", "n": "Verus Corporation, Inc.", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.462, "det": {"shodan": {"compromised": 1}}, "oid": "VERUS-3-ARIN", "org": "Verus, LLC", "pdb": {"t": "Enterprise", "sc": "North America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.veruscorp.com"}, "pfx": 1, "reg": "2007-10-29", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "noc@veruscorp.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26187, "h": "ADVENTURECK", "n": "ADVENTURECK", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.464, "det": {"shodan": {"compromised": 1}}, "oid": "AL-3126-ARIN", "org": "ADVENTURECK", "pdb": null, "pfx": 3, "reg": "2025-08-27", "rir": "arin", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26210, "h": "", "n": "AXS BOLIVIA", "t": "Broadband & mobile", "w": 16, "cc": "BO", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 6, "web_bruteforce": 2, "home_connection": 8, "mail_bruteforce": 1, "router_or_botnet": 5, "cve:CVE-2024-6387": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.1245, "hi": 3.94, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}, "shodan": {"n": 2, "p": 0.0578, "hi": 3.10, "lo": 0.40, "ips": 2, "mean": 1.48, "above": false}, "crowdsec": {"n": 9, "p": 0.8453, "hi": 6.88, "lo": 2.38, "ips": 9, "mean": 4.38, "above": true}, "vulncheck": {"n": 1, "p": 0.1108, "hi": 3.78, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "blocklist_de": {"n": 9, "p": 0.9817, "hi": 10.35, "lo": 3.58, "ips": 10, "mean": 6.59, "above": true}}, "h2": [["2026-10-05", 3.013, 0.009, 0, false], ["2026-10-12", 4.669, 0.010, 0, false]], "sh": false, "uc": 215.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.894, "ts": null, "map": 0.153, "obs": 0, "own": 0.841, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 9}, "lo": 4.669, "se": 0.425, "ts": 0.450, "map": 7.849, "obs": 20, "own": 12.048, "comp": {"cins": -0.0077, "dshield": -2.8044, "crowdsec": -0.8264, "vulncheck": -0.6782, "blocklist_de": 7.7707}, "mass": 20.9, "listed": false}}, "abq": true, "bot": 0.251, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 6, "bots": 3, "imap": 1, "mail": 1}}, "oid": "@aut-26210-LACNIC", "org": "AXS Bolivia S. A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.axsbolivia.com/"}, "pfx": 198, "reg": "2002-07-25", "rir": "lacnic", "s24": 483, "sib": 0, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 123648, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00401757165584}, {"a": 26223, "h": "SILVERSTAR-TELEPHONE", "n": "Silver Star Communications", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2227, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}}, "h2": [["2026-10-12", 0.498, 0.011, 0, false]], "sh": false, "uc": 295.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.984, "ts": null, "map": 0.180, "obs": 0, "own": 1.239, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.498, "se": 0.887, "ts": 1.000, "map": 1.928, "obs": 2, "own": 3.075, "comp": {"cins": -0.3427, "dshield": -0.7247, "crowdsec": 5.4415, "vulncheck": -0.5617, "blocklist_de": -1.7622}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.163, "det": null, "oid": "SILV-ARIN", "org": "Silver Star Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.silverstar.com"}, "pfx": 56, "reg": "2002-07-31", "rir": "arin", "s24": 139, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 35584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26247, "h": "HCCA", "n": "Hamilton-Clermont Cooperative Assn.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.146, "det": {"shodan": {"malware": 1}}, "oid": "HCA-24-ARIN", "org": "Hamilton-Clermont Cooperative Assn.", "pdb": null, "pfx": 18, "reg": "2002-08-06", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26277, "h": "SERVERPOINT", "n": "ServerPoint", "t": "Hosting & VPS", "w": 7, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "vulncheck": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "phishing_db": {"n": 2, "p": 0.4060, "hi": 6.14, "lo": 0.80, "ips": 4, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 0.010, 2.026, 0, false], ["2026-10-12", 2.026, 2.065, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 2.065, "se": 1.159, "ts": 1.000, "map": 9.865, "obs": 2, "own": 3.772, "comp": {"urlhaus": -0.3266, "threatfox": -0.2904, "phishing_db": 4.5322}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.026, "se": 0.782, "ts": 0.333, "map": 6.361, "obs": 3, "own": 1.299, "comp": {"cins": 4.3159, "dshield": -0.8665, "crowdsec": 0.5264, "vulncheck": 1.4312, "blocklist_de": -2.163}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.606, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "AHOSTI-ARIN", "org": "ServerPoint.com", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://ServerPoint.com"}, "pfx": 50, "reg": "2002-08-12", "rir": "arin", "s24": 53, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": "noc@serverpoint.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022310991287}, {"a": 26286, "h": "MYSTICDEVIO", "n": "MysticDev LLC", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 5, "first_seen_30d": 1, "web_bruteforce": 4, "cve:CVE-2018-13379": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2021-26086": 3, "cve:CVE-2021-44228": 1, "cve:CVE-2023-22515": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 5, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 21.086, 0.011, 1, false], ["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 13.105, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.806, "det": null, "oid": "ML-1477-ARIN", "org": "MysticDev LLC", "pdb": null, "pfx": 8, "reg": "2025-04-24", "rir": "arin", "s24": 8, "sib": 0, "tor": 5, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "nocadmin@mysticdev.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26337, "h": "OIS1", "n": "Oso Grande IP Services, LLC", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2026-8181": 3, "cve:CVE-2024-28000": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 4.980, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.980, "se": 1.016, "ts": 1.000, "map": 24.735, "obs": 2, "own": 14.667, "comp": {"cins": -0.2276, "dshield": -0.5042, "crowdsec": 6.9636, "vulncheck": -0.4511, "blocklist_de": -1.1787}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.907, "det": null, "oid": "OGISL-ARIN", "org": "Oso Grande IP Services, LLC", "pdb": null, "pfx": 7, "reg": "2013-10-09", "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26347, "h": "DREAMHOST-AS", "n": "DreamHost", "t": "Hosting & VPS", "w": 17, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 9, "web_exploit": 13, "bad_crawling": 9, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 13, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2026-8181": 3, "cve:CVE-2024-28000": 3, "cve:CVE-2025-55182": 4, "cve:CVE-2026-60137": 8, "cve:CVE-2026-63030": 8}, "n": 14}, "ev": {"shodan": {"n": 2, "p": 0.0253, "hi": 2.62, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}, "crowdsec": {"n": 13, "p": 0.9582, "hi": 7.53, "lo": 3.08, "ips": 14, "mean": 5.10, "above": true}, "phishing_db": {"n": 3, "p": 0.4407, "hi": 5.87, "lo": 1.03, "ips": 3, "mean": 3.03, "above": false}, "blocklist_de": {"n": 1, "p": 0.0368, "hi": 2.78, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}}, "h2": [["2026-10-05", 1.571, 0.619, 0, false], ["2026-10-12", 1.854, 0.634, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.634, "se": 1.026, "ts": 1.000, "map": 2.112, "obs": 3, "own": 0.872, "comp": {"urlhaus": -0.7421, "threatfox": -0.4264, "phishing_db": 3.542}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.854, "se": 0.451, "ts": 0.929, "map": 3.192, "obs": 14, "own": 0.627, "comp": {"cins": -1.7609, "dshield": -2.3842, "crowdsec": 13.0837, "vulncheck": -0.9213, "blocklist_de": -5.4629}, "mass": 11.6, "listed": false}}, "abq": true, "bot": 0.996, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1}}, "oid": "NDN-ARIN", "org": "New Dream Network, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.dreamhost.com/"}, "pfx": 20, "reg": "2002-08-28", "rir": "arin", "s24": 657, "sib": 0, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 168192, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 26383, "h": "ASNET", "n": "ASNET", "t": "Other", "w": 7, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 8, "p": 0.9268, "hi": 8.53, "lo": 2.77, "ips": 8, "mean": 5.32, "above": true}, "crowdsec": {"n": 1, "p": 0.0248, "hi": 2.55, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "threatfox": {"n": 2, "p": 0.3906, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "phishing_db": {"n": 1, "p": 0.1386, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "blocklist_de": {"n": 2, "p": 0.2321, "hi": 4.67, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 0.076, 0.557, 0, false], ["2026-10-12", 0.710, 1.034, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 1}, "lo": 1.034, "se": 1.019, "ts": 0.667, "map": 3.478, "obs": 3, "own": 3.638, "comp": {"urlhaus": -0.6301, "threatfox": 2.6096, "phishing_db": 0.8933}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.710, "se": 0.672, "ts": 0.500, "map": 1.818, "obs": 4, "own": 1.048, "comp": {"cins": -0.6899, "dshield": -1.2825, "crowdsec": -1.7077, "vulncheck": 0.6663, "blocklist_de": 5.0052}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.416, "det": {"shodan": {"c2": 1, "compromised": 7}, "threatfox": {"family:Cobalt Strike": 1, "family:Unknown malware": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2}}, "oid": "BG-556-ARIN", "org": "Baxet Group Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://baxetgroup.com"}, "pfx": 306, "reg": "2022-09-26", "rir": "arin", "s24": 324, "sib": 1, "tor": 0, "w24": 7, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 82944, "abuse": "abuse@baxetgroup.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00430135980677}, {"a": 26472, "h": "CHIBARDUN-TEL", "n": "Mosaic Telecom", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1242, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.810, "ts": null, "map": 0.158, "obs": 0, "own": 0.495, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"compromised": 1}}, "oid": "CTC-128-ARIN", "org": "Mosaic Telecom", "pdb": null, "pfx": 5, "reg": "2007-11-06", "rir": "arin", "s24": 96, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": "Abuse@mosaictelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26496, "h": "AS-26496-GO-DADDY-COM-LLC", "n": "GoDaddy", "t": "Hosting & VPS", "w": 62, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 19, "data_centre": 31, "web_exploit": 20, "bad_crawling": 4, "proxy_or_vpn": 5, "first_seen_30d": 3, "ssh_bruteforce": 22, "web_bruteforce": 22, "mail_bruteforce": 9, "cve:CVE-2017-9841": 2, "cve:CVE-2024-6387": 2, "cve:CVE-2026-8181": 4, "cve:CVE-2018-20062": 2, "cve:CVE-2026-63030": 3}, "n": 31}, "ev": {"cins": {"n": 4, "p": 0.3529, "hi": 4.97, "lo": 1.07, "ips": 4, "mean": 2.71, "above": false}, "shodan": {"n": 16, "p": 0.5865, "hi": 4.62, "lo": 2.06, "ips": 16, "mean": 3.23, "above": false}, "crowdsec": {"n": 24, "p": 0.8970, "hi": 5.35, "lo": 2.76, "ips": 31, "mean": 3.97, "above": true}, "vulncheck": {"n": 10, "p": 0.9513, "hi": 8.29, "lo": 3.01, "ips": 10, "mean": 5.37, "above": true}, "phishing_db": {"n": 15, "p": 0.9996, "hi": 11.69, "lo": 5.08, "ips": 15, "mean": 8.10, "above": true}, "blocklist_de": {"n": 8, "p": 0.4022, "hi": 4.60, "lo": 1.50, "ips": 8, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 1.885, 1.359, 0, false], ["2026-10-12", 2.216, 1.437, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 15}, "lo": 1.437, "se": 0.829, "ts": 1.000, "map": 3.205, "obs": 15, "own": 1.259, "comp": {"urlhaus": -1.8667, "threatfox": -0.5479, "phishing_db": 5.2054}, "mass": 9.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 0, "crowdsec": 24, "vulncheck": 10, "blocklist_de": 8}, "lo": 2.216, "se": 0.392, "ts": 0.522, "map": 3.507, "obs": 46, "own": 0.687, "comp": {"cins": 3.5475, "dshield": -3.1163, "crowdsec": 4.023, "vulncheck": 0.5879, "blocklist_de": -2.3937}, "mass": 38.7, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"c2": 1, "compromised": 15}, "vulncheck": {"c2_server": 8, "botnet_node": 1, "attack_tooling": 1}, "blocklist_de": {"ftp": 3, "ssh": 4}}, "oid": "GODAD-ARIN", "org": "GoDaddy.com, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.godaddy.com/"}, "pfx": 191, "reg": "2002-10-01", "rir": "arin", "s24": 1996, "sib": 42, "tor": 0, "w24": 52, "drop": 0, "hist": [["2026-10-05", 0.8443], ["2026-10-12", 0.8651]], "ipv4": 1188352, "abuse": "abuse@godaddy.com", "score": 0.8651, "groups": ["vulncheck", "phishing"], "sensors": ["crowdsec"], "traffic": 0.00167618715264}, {"a": 26548, "h": "PUREVOLTAGE-INC", "n": "Purevoltage Hosting", "t": "Hosting & VPS", "w": 390, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 112, "web_exploit": 314, "bad_crawling": 37, "proxy_or_vpn": 20, "ssh_bruteforce": 2, "web_bruteforce": 368, "home_connection": 60, "mail_bruteforce": 1, "cve:CVE-2017-9841": 12, "cve:CVE-2021-41773": 23, "cve:CVE-2022-39290": 11, "cve:CVE-2026-60137": 64, "cve:CVE-2026-63030": 159}, "n": 379}, "ev": {"shodan": {"n": 2, "p": 0.1715, "hi": 4.18, "lo": 0.54, "ips": 2, "mean": 1.99, "above": false}, "dshield": {"n": 3, "p": 0.5619, "hi": 6.87, "lo": 1.21, "ips": 3, "mean": 3.55, "above": false}, "crowdsec": {"n": 29, "p": 1.0000, "hi": 24.26, "lo": 13.25, "ips": 379, "mean": 18.41, "above": true}, "vulncheck": {"n": 3, "p": 0.5643, "hi": 6.90, "lo": 1.22, "ips": 5, "mean": 3.56, "above": false}, "blocklist_de": {"n": 4, "p": 0.6752, "hi": 7.30, "lo": 1.57, "ips": 4, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 18.626, 0.010, 1, false], ["2026-10-12", 14.128, 0.011, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.947, "ts": null, "map": 0.171, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 29, "vulncheck": 3, "blocklist_de": 4}, "lo": 14.128, "se": 0.386, "ts": 0.744, "map": 21.984, "obs": 39, "own": 4.286, "comp": {"cins": -2.7606, "dshield": -0.33, "crowdsec": 13.4423, "vulncheck": -0.3481, "blocklist_de": -5.5196}, "mass": 28.7, "listed": false}}, "abq": false, "bot": 0.883, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"botnet_node": 5}, "blocklist_de": {"bots": 1, "apache": 3}}, "oid": "PH-710-ARIN", "org": "PureVoltage Hosting Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Tbps", "pol": "Open", "web": "https://purevoltage.com"}, "pfx": 130, "reg": "2012-12-05", "rir": "arin", "s24": 237, "sib": 6, "tor": 0, "w24": 36, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 69376, "abuse": "abuse@purevoltage.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00834215255}, {"a": 26585, "h": "SIAC-SFTI", "n": "Securities Industry Automation Corporation", "t": "Other", "w": 0, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 2.30}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 0.388, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.651, "ts": null, "map": 0.099, "obs": 0, "own": 0.088, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.953, "det": null, "oid": "SIAC-ARIN", "org": "Securities Industry Automation Corporation", "pdb": null, "pfx": 107, "reg": "2002-10-22", "rir": "arin", "s24": 321, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 105472, "abuse": "abuse@theice.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26599, "h": "", "n": "TELEFÔNICA BRASIL AS26599", "t": "Broadband & mobile", "w": 40, "cc": "BR", "cf": {"rb": "", "wb": "", "rep": 0.38, "waf": 0.34}, "cs": {"c": {"web_exploit": 5, "first_seen_30d": 1, "ssh_bruteforce": 17, "web_bruteforce": 15, "home_connection": 16, "mail_bruteforce": 15, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 17}, "ev": {"cins": {"n": 5, "p": 0.0000, "hi": 0.56, "lo": 0.14, "ips": 5, "mean": 0.32, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 2, "mean": 0.03, "above": false}, "dshield": {"n": 5, "p": 0.0000, "hi": 0.44, "lo": 0.11, "ips": 5, "mean": 0.25, "above": false}, "crowdsec": {"n": 17, "p": 0.0000, "hi": 0.23, "lo": 0.10, "ips": 17, "mean": 0.16, "above": false}, "blocklist_de": {"n": 25, "p": 0.0000, "hi": 0.76, "lo": 0.39, "ips": 25, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.143, 0.003, 0, false], ["2026-10-12", 0.192, 0.003, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.003, "se": 1.617, "ts": null, "map": 0.029, "obs": 0, "own": 0.140, "comp": null, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 5, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 25}, "lo": 0.192, "se": 0.390, "ts": 0.481, "map": 0.297, "obs": 52, "own": 0.460, "comp": {"cins": 1.8125, "dshield": -1.2663, "crowdsec": -6.01, "vulncheck": -0.9993, "blocklist_de": 6.6427}, "mass": 69.7, "listed": false}}, "abq": false, "bot": 0.088, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2, "bots": 9, "imap": 11, "mail": 12, "apache": 2, "bruteforcelogin": 2}}, "oid": "@family-59211", "org": "TELEFÔNICA BRASIL S.A", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.telefonica.com.br"}, "pfx": 442, "reg": "2002-09-16", "rir": "lacnic", "s24": 42134, "sib": 11, "tor": 0, "w24": 40, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19450368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.288534}, {"a": 26611, "h": "", "n": "COMUNICACIÓN CELULAR S.A. COMCEL S.A.", "t": "Other", "w": 0, "cc": "CO", "cf": {"rb": "hi", "wb": "hi", "rep": 1.25, "waf": 1.09}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.001, 0.004, 0, false], ["2026-10-12", 0.001, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.650, "ts": null, "map": 0.045, "obs": 0, "own": 0.082, "comp": null, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.001, "se": 1.196, "ts": null, "map": 0.008, "obs": 0, "own": 0.005, "comp": null, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.039, "det": null, "oid": "@aut-26611-LACNIC", "org": "COMUNICACIÓN CELULAR S.A. COMCEL S.A.", "pdb": null, "pfx": 255, "reg": "2002-11-01", "rir": "lacnic", "s24": 17426, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4467456, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.058661}, {"a": 26615, "h": "", "n": "TIM Celular", "t": "Transit & backbone", "w": 10, "cc": "BR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.46, "waf": 0.40}, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.10, "lo": 0.02, "ips": 3, "mean": 0.05, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 0.31, "lo": 0.04, "ips": 2, "mean": 0.15, "above": false}, "urlhaus": {"n": 1, "p": 0.0000, "hi": 1.09, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.08, "lo": 0.01, "ips": 4, "mean": 0.04, "above": false}, "blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.20, "lo": 0.03, "ips": 3, "mean": 0.10, "above": false}}, "h2": [["2026-10-05", 0.022, 0.019, 0, false], ["2026-10-12", 0.029, 0.021, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.021, "se": 1.314, "ts": 1.000, "map": 0.110, "obs": 1, "own": 0.550, "comp": {"urlhaus": 0.9941, "threatfox": -0.5225, "phishing_db": -1.0566}, "mass": 8.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.029, "se": 0.505, "ts": 0.333, "map": 0.056, "obs": 9, "own": 0.177, "comp": {"cins": 1.4973, "dshield": 1.2443, "crowdsec": -3.8648, "vulncheck": -0.918, "blocklist_de": 0.5502}, "mass": 11.4, "listed": false}}, "abq": false, "bot": 0.049, "det": {"shodan": {"malware": 1, "compromised": 2}, "blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-26615-LACNIC", "org": "TIM S/A", "pdb": {"t": "NSP", "sc": "South America", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.tim.com.br"}, "pfx": 1042, "reg": "2007-05-29", "rir": "lacnic", "s24": 36167, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11470080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.159774}, {"a": 26658, "h": "HENGTONG-IDC-LLC", "n": "HT", "t": "Other", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2022-39290": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1116, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "dshield": {"n": 2, "p": 0.2440, "hi": 4.77, "lo": 0.62, "ips": 2, "mean": 2.27, "above": false}, "crowdsec": {"n": 5, "p": 0.2174, "hi": 4.08, "lo": 1.01, "ips": 6, "mean": 2.33, "above": false}, "blocklist_de": {"n": 2, "p": 0.1328, "hi": 3.85, "lo": 0.50, "ips": 2, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 1.090, 0.009, 0, false], ["2026-10-12", 1.563, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.878, "ts": null, "map": 0.147, "obs": 0, "own": 0.316, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.563, "se": 0.489, "ts": 0.500, "map": 2.924, "obs": 10, "own": 1.652, "comp": {"cins": 1.8425, "dshield": 1.7408, "crowdsec": 1.0592, "vulncheck": -0.9035, "blocklist_de": -1.2723}, "mass": 9.6, "listed": false}}, "abq": true, "bot": 0.903, "det": {"blocklist_de": {"ssh": 2}}, "oid": "HIL-48-ARIN", "org": "HT", "pdb": null, "pfx": 101, "reg": "2014-04-17", "rir": "arin", "s24": 593, "sib": 0, "tor": 0, "w24": 7, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 151808, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26666, "h": "INTERSERVER-LAX", "n": "Interserver, Inc", "t": "Hosting & VPS", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"shodan": {"n": 5, "p": 0.8266, "hi": 8.47, "lo": 2.10, "ips": 5, "mean": 4.83, "above": true}, "crowdsec": {"n": 3, "p": 0.4530, "hi": 5.96, "lo": 1.05, "ips": 3, "mean": 3.08, "above": false}, "threatfox": {"n": 3, "p": 0.6356, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}, "vulncheck": {"n": 3, "p": 0.6075, "hi": 7.32, "lo": 1.29, "ips": 3, "mean": 3.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1511, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 4.406, 2.300, 0, false], ["2026-10-12", 3.160, 2.292, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 2.292, "se": 1.009, "ts": 1.000, "map": 7.829, "obs": 3, "own": 2.994, "comp": {"urlhaus": -0.5164, "threatfox": 4.911, "phishing_db": -0.7106}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 1}, "lo": 3.160, "se": 0.570, "ts": 0.429, "map": 6.712, "obs": 7, "own": 1.337, "comp": {"cins": -0.8506, "dshield": -1.4974, "crowdsec": 3.1626, "vulncheck": 2.7028, "blocklist_de": -0.2198}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.752, "det": {"shodan": {"c2": 2, "compromised": 3}, "threatfox": {"family:PureRAT": 1, "family:AsyncRAT": 1, "family:Evilginx": 1}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "INTER-83-ARIN", "org": "Interserver, Inc", "pdb": null, "pfx": 51, "reg": "2023-02-06", "rir": "arin", "s24": 113, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 29952, "abuse": "abusencc@interserver.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 26667, "h": "RUBICONPROJECT", "n": "Magnite", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.30, "waf": 0.27}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.011, "ts": null, "map": 0.185, "obs": 0, "own": 0.214, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.817, "ts": null, "map": 0.161, "obs": 0, "own": 0.065, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.810, "det": null, "oid": "ADMON-ARIN", "org": "Magnite, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Restrictive", "web": "https://www.magnite.com/"}, "pfx": 11, "reg": "2007-11-08", "rir": "arin", "s24": 91, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.241653}, {"a": 26718, "h": "WOLVERINE-TRADING-TECHNOLOGIES-LLC", "n": "WOLVERINE TRADING TECHNOLOGIES, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.249, "det": {"shodan": {"compromised": 1}}, "oid": "WTTL-1-ARIN", "org": "WOLVERINE TRADING TECHNOLOGIES, LLC", "pdb": null, "pfx": 9, "reg": "2002-11-10", "rir": "arin", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26721, "h": "INYO", "n": "Inyo Networks", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1689, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.202, "obs": 0, "own": 0.857, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.220, "det": {"shodan": {"compromised": 1}}, "oid": "IN-85-ARIN", "org": "Inyo Networks", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://getonward.com"}, "pfx": 21, "reg": "2014-05-23", "rir": "arin", "s24": 34, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26753, "h": "IN2NET-NETWORK", "n": "In2net Network", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0826, "hi": 3.45, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "phishing_db": {"n": 1, "p": 0.1638, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.008, 0.225, 0, false], ["2026-10-12", 0.008, 0.236, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.236, "se": 1.428, "ts": 1.000, "map": 1.830, "obs": 1, "own": 5.360, "comp": {"urlhaus": -0.2093, "threatfox": -0.2202, "phishing_db": 2.6597}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.730, "ts": null, "map": 0.128, "obs": 0, "own": 0.347, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.631, "det": {"shodan": {"compromised": 1}}, "oid": "IN2N-ARIN", "org": "In2net Network Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Selective", "web": "http://www.in2net.com"}, "pfx": 16, "reg": "2002-11-15", "rir": "arin", "s24": 176, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 94720, "abuse": "abuse@in2net.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26785, "h": "NETWURX-AS", "n": "Netwurx", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.691, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.166, "det": {"shodan": {"compromised": 1}}, "oid": "NWRX-ARIN", "org": "Netwurx LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.netwurx.net"}, "pfx": 6, "reg": "2002-11-21", "rir": "arin", "s24": 52, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": "abuse@netwurx.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26801, "h": "ZITOMEDIA611", "n": "Zito Media", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0076, "hi": 2.05, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.0567, "hi": 3.10, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}}, "h2": [["2026-10-05", 0.180, 0.009, 0, false], ["2026-10-12", 0.191, 0.010, 0, false]], "sh": false, "uc": 177.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.892, "ts": null, "map": 0.153, "obs": 0, "own": 0.834, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.191, "se": 0.850, "ts": 0.500, "map": 0.686, "obs": 2, "own": 1.093, "comp": {"cins": -0.4256, "dshield": -0.8712, "crowdsec": 0.5009, "vulncheck": -0.6202, "blocklist_de": 2.4329}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.176, "det": {"blocklist_de": {"mail": 1}}, "oid": "ZITOM-ARIN", "org": "Zito Media, L.P.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.zitomedia.com/"}, "pfx": 59, "reg": "2006-12-22", "rir": "arin", "s24": 495, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 134400, "abuse": "abuse@zitomedia.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 26832, "h": "RICAWEBSERVICES", "n": "Rica Web Services", "t": "Other", "w": 11, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1859, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "shodan": {"n": 11, "p": 0.9997, "hi": 15.78, "lo": 6.00, "ips": 11, "mean": 10.40, "above": true}, "crowdsec": {"n": 5, "p": 0.8477, "hi": 8.82, "lo": 2.19, "ips": 5, "mean": 5.04, "above": true}, "threatfox": {"n": 3, "p": 0.6398, "hi": 7.67, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}, "vulncheck": {"n": 2, "p": 0.3983, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 11.010, 3.270, 1, false], ["2026-10-12", 6.684, 3.255, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 3.255, "se": 1.006, "ts": 1.000, "map": 11.259, "obs": 3, "own": 11.013, "comp": {"urlhaus": -0.4796, "threatfox": 5.2112, "phishing_db": -0.6842}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 0}, "lo": 6.684, "se": 0.537, "ts": 0.625, "map": 13.486, "obs": 8, "own": 7.645, "comp": {"cins": 2.9896, "dshield": -1.7163, "crowdsec": 6.7353, "vulncheck": 1.0813, "blocklist_de": -5.0946}, "mass": 5.4, "listed": false}}, "abq": true, "bot": 0.913, "det": {"shodan": {"c2": 7, "compromised": 4}, "threatfox": {"family:Havoc": 1, "family:Remcos": 1, "family:PureRAT": 1}, "vulncheck": {"c2_server": 2}}, "oid": "RWS-30-ARIN", "org": "Rica Web Services", "pdb": null, "pfx": 44, "reg": "2012-11-06", "rir": "arin", "s24": 72, "sib": 0, "tor": 1, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 24320, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00441586467777}, {"a": 27161, "h": "LITNICS-01", "n": "Litnics, LLC", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 6.424, 0.011, 0, false], ["2026-10-12", 0.820, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.820, "se": 1.527, "ts": 1.000, "map": 10.128, "obs": 1, "own": 7.925, "comp": {"cins": -0.0417, "dshield": -0.1001, "crowdsec": -0.3969, "vulncheck": 4.4661, "blocklist_de": -0.2185}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.952, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "LL-951-ARIN", "org": "Litnics, LLC", "pdb": null, "pfx": 3, "reg": "2024-12-03", "rir": "arin", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@litnics.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 27176, "h": "DATAWAGON", "n": "DataWagon", "t": "Other", "w": 38, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 21, "data_centre": 9, "web_exploit": 24, "bad_crawling": 12, "proxy_or_vpn": 13, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 21, "home_connection": 12, "mail_bruteforce": 6, "cve:CVE-2017-9841": 4, "cve:CVE-2020-5902": 2, "cve:CVE-2018-20062": 4, "cve:CVE-2021-26086": 4, "cve:CVE-2026-63030": 4}, "n": 27}, "ev": {"shodan": {"n": 2, "p": 0.2708, "hi": 4.99, "lo": 0.65, "ips": 2, "mean": 2.38, "above": false}, "urlhaus": {"n": 1, "p": 0.1941, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 17, "p": 1.0000, "hi": 19.22, "lo": 8.77, "ips": 27, "mean": 13.57, "above": true}, "threatfox": {"n": 5, "p": 0.9103, "hi": 10.32, "lo": 2.56, "ips": 6, "mean": 5.89, "above": true}, "phishing_db": {"n": 2, "p": 0.3840, "hi": 5.94, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "blocklist_de": {"n": 3, "p": 0.5594, "hi": 6.85, "lo": 1.21, "ips": 3, "mean": 3.53, "above": false}}, "h2": [["2026-10-05", 12.168, 7.023, 1, false], ["2026-10-12", 14.369, 10.380, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 5, "phishing_db": 2}, "lo": 10.380, "se": 0.827, "ts": 0.625, "map": 25.646, "obs": 8, "own": 23.692, "comp": {"urlhaus": 1.4313, "threatfox": 2.8972, "phishing_db": 0.5421}, "mass": 4.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 3}, "lo": 14.369, "se": 0.419, "ts": 0.850, "map": 23.812, "obs": 20, "own": 13.341, "comp": {"cins": -2.1269, "dshield": -2.6351, "crowdsec": 12.8626, "vulncheck": -0.9465, "blocklist_de": -2.5903}, "mass": 16.1, "listed": false}}, "abq": false, "bot": 0.844, "det": {"shodan": {"c2": 2}, "threatfox": {"family:Remcos": 1, "family:PureRAT": 4, "family:AsyncRAT": 1}, "blocklist_de": {"ftp": 2, "bots": 1}}, "oid": "DL-167-ARIN", "org": "DataWagon LLC", "pdb": null, "pfx": 109, "reg": "2014-03-21", "rir": "arin", "s24": 123, "sib": 0, "tor": 6, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 36096, "abuse": "abuse@datawagon.com", "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00114201313339}, {"a": 27257, "h": "WEBAIR-INTERNET", "n": "Webair", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 11, "p": 0.9905, "hi": 10.13, "lo": 3.85, "ips": 11, "mean": 6.68, "above": true}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.160, "obs": 0, "own": 1.305, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.631, "ts": null, "map": 0.092, "obs": 0, "own": 0.442, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"compromised": 11}}, "oid": "WAIR-ARIN", "org": "Webair Internet Development Company Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.webair.com"}, "pfx": 80, "reg": "2003-02-03", "rir": "arin", "s24": 373, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 133376, "abuse": "abuse@opti9tech.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.02864276916764}, {"a": 27284, "h": "FOURPLEX-ASN", "n": "Fourplex Telecom", "t": "Broadband & mobile", "w": 35, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 26, "data_centre": 2, "web_exploit": 29, "bad_crawling": 24, "proxy_or_vpn": 29, "first_seen_30d": 5, "ssh_bruteforce": 15, "web_bruteforce": 29, "mail_bruteforce": 6, "cve:CVE-2015-9406": 16, "cve:CVE-2017-9841": 23, "cve:CVE-2018-13379": 13, "cve:CVE-2018-20062": 13, "cve:CVE-2021-26086": 2}, "n": 35}, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 4, "p": 0.8072, "hi": 9.01, "lo": 1.94, "ips": 35, "mean": 4.92, "above": true}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 53.468, 0.011, 1, false], ["2026-10-12", 55.433, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 55.433, "se": 0.582, "ts": 0.667, "map": 123.627, "obs": 6, "own": 189.878, "comp": {"cins": -0.8354, "dshield": 1.5995, "crowdsec": 6.3604, "vulncheck": -0.7865, "blocklist_de": -0.1271}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.584, "det": {"blocklist_de": {"ssh": 5}}, "oid": "FTL-125-ARIN", "org": "Fourplex Telecom LLC", "pdb": null, "pfx": 4, "reg": "2025-02-07", "rir": "arin", "s24": 6, "sib": 0, "tor": 30, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@fourplex.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 27299, "h": "CIRA-REGISTRY", "n": "CIRA-REGISTRY", "t": "Hosting & VPS", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.292, "det": {"shodan": {"doublepulsar": 1}}, "oid": "CCIRAACPLEI-ARIN", "org": "CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet", "pdb": {"t": "Network Services", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.cira.ca"}, "pfx": 11, "reg": "2003-02-10", "rir": "arin", "s24": 11, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse@cira.ca", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 27323, "h": "SERVERSTADIUM", "n": "Worldlink", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1183, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "phishing_db": {"n": 4, "p": 0.7939, "hi": 8.79, "lo": 1.89, "ips": 4, "mean": 4.80, "above": true}}, "h2": [["2026-10-05", 1.277, 4.969, 0, false], ["2026-10-12", 0.184, 5.018, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 5.018, "se": 0.924, "ts": 1.000, "map": 14.807, "obs": 4, "own": 5.390, "comp": {"urlhaus": -0.6879, "threatfox": -0.4144, "phishing_db": 5.4236}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.184, "se": 1.217, "ts": 1.000, "map": 1.341, "obs": 1, "own": 0.295, "comp": {"cins": -0.1524, "dshield": -0.3486, "crowdsec": 3.3311, "vulncheck": -0.35, "blocklist_de": -0.7933}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.713, "det": null, "oid": "WOWTEC-1-ARIN", "org": "Wowrack.com", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.w-link.com"}, "pfx": 90, "reg": "2003-02-12", "rir": "arin", "s24": 85, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 34816, "abuse": "abuse@wowrack.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 27357, "h": "RACKSPACE", "n": "Rackspace Hosting", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.25, "waf": 0.21}, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0718, "hi": 3.31, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "shodan": {"n": 5, "p": 0.0843, "hi": 3.29, "lo": 0.82, "ips": 5, "mean": 1.88, "above": false}, "phishing_db": {"n": 1, "p": 0.0608, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}}, "h2": [["2026-10-05", 0.037, 0.090, 0, false], ["2026-10-12", 0.038, 0.096, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.096, "se": 1.353, "ts": 1.000, "map": 0.588, "obs": 1, "own": 0.284, "comp": {"urlhaus": -0.3719, "threatfox": -0.3121, "phishing_db": 1.7798}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.038, "se": 1.055, "ts": 1.000, "map": 0.204, "obs": 1, "own": 0.043, "comp": {"cins": 4.6422, "dshield": -0.5927, "crowdsec": -2.3398, "vulncheck": -0.4993, "blocklist_de": -1.4072}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.891, "det": {"shodan": {"malware": 1, "compromised": 4}}, "oid": "RACKS-8-ARIN", "org": "Rackspace Hosting", "pdb": null, "pfx": 38, "reg": "2003-02-20", "rir": "arin", "s24": 1028, "sib": 9, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 264448, "abuse": "abuse@rackspace.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.298627}, {"a": 27411, "h": "LEASEWEB-USA-CHI", "n": "LeaseWeb USA / CHI-11", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0716, "hi": 3.26, "lo": 0.42, "ips": 2, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.429, 0.010, 0, false], ["2026-10-12", 0.235, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.918, "ts": null, "map": 0.162, "obs": 0, "own": 0.145, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.235, "se": 0.857, "ts": 1.000, "map": 0.858, "obs": 2, "own": 0.174, "comp": {"cins": -0.3814, "dshield": -0.7943, "crowdsec": 4.9626, "vulncheck": -0.5907, "blocklist_de": -1.9561}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 96, "reg": "2017-10-27", "rir": "arin", "s24": 351, "sib": 9, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 90880, "abuse": "abuse@us.leaseweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00423700307616}, {"a": 27589, "h": "MOJOHOST", "n": "MojoHost", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.2475, "hi": 4.54, "lo": 0.80, "ips": 3, "mean": 2.34, "above": false}, "crowdsec": {"n": 1, "p": 0.0234, "hi": 2.52, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}}, "h2": [["2026-10-05", 0.075, 0.010, 0, false], ["2026-10-12", 0.077, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.922, "ts": null, "map": 0.163, "obs": 0, "own": 0.147, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.077, "se": 1.116, "ts": 1.000, "map": 0.463, "obs": 1, "own": 0.099, "comp": {"cins": -0.2031, "dshield": -0.4546, "crowdsec": 2.7553, "vulncheck": -0.4213, "blocklist_de": -1.0534}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.998, "det": {"shodan": {"compromised": 3}}, "oid": "EOS-17-ARIN", "org": "MOJOHOST", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.mojohost.com"}, "pfx": 22, "reg": "2003-04-04", "rir": "arin", "s24": 332, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 87296, "abuse": "ABUSE@mojohost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01186718170256}, {"a": 27640, "h": "GIGASNET-AS", "n": "GIGAS HOSTING USA", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.444, 0.011, 0, false], ["2026-10-12", 0.477, 0.012, 0, false]], "sh": false, "uc": 2916.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.309, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.477, "se": 1.379, "ts": 1.000, "map": 4.701, "obs": 1, "own": 1.115, "comp": {"cins": -0.0956, "dshield": -0.224, "crowdsec": 4.0096, "vulncheck": -0.2493, "blocklist_de": -0.4992}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.997, "det": {"blocklist_de": {"bots": 1}}, "oid": "GHUL-ARIN", "org": "GIGAS HOSTING USA, LLC", "pdb": {"t": "Enterprise", "sc": "North America", "tr": null, "pol": "Restrictive", "web": "http://www.gigas.com"}, "pfx": 5, "reg": "2013-01-09", "rir": "arin", "s24": 15, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 27651, "h": "", "n": "entel MPLS", "t": "Broadband & mobile", "w": 13, "cc": "CL", "cf": {"rb": "", "wb": "hi", "rep": 0.93, "waf": 0.77}, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 6, "home_connection": 1, "router_or_botnet": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.0218, "hi": 2.48, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "dshield": {"n": 3, "p": 0.1127, "hi": 3.59, "lo": 0.63, "ips": 3, "mean": 1.85, "above": false}, "crowdsec": {"n": 6, "p": 0.0002, "hi": 1.76, "lo": 0.49, "ips": 6, "mean": 1.04, "above": false}, "blocklist_de": {"n": 6, "p": 0.1348, "hi": 3.58, "lo": 0.99, "ips": 6, "mean": 2.12, "above": false}}, "h2": [["2026-10-05", 0.764, 0.007, 0, false], ["2026-10-12", 0.858, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.779, "ts": null, "map": 0.104, "obs": 0, "own": 0.483, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 6}, "lo": 0.858, "se": 0.444, "ts": 0.375, "map": 1.464, "obs": 16, "own": 2.260, "comp": {"cins": 0.4367, "dshield": 1.2586, "crowdsec": -2.7069, "vulncheck": -0.9512, "blocklist_de": 3.7377}, "mass": 17.5, "listed": false}}, "abq": true, "bot": 0.106, "det": {"blocklist_de": {"ssh": 3, "bots": 3}}, "oid": "@family-58992", "org": "ENTEL CHILE S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "http://www.entel.cl"}, "pfx": 859, "reg": "2002-12-04", "rir": "lacnic", "s24": 2155, "sib": 4, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 998656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.083585}, {"a": 27693, "h": "", "n": "NipCable - NipBr", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1306, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 1, "p": 0.1175, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "blocklist_de": {"n": 1, "p": 0.1615, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 1.526, 0.011, 0, false], ["2026-10-12", 0.780, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 1.406, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.780, "se": 0.909, "ts": 0.500, "map": 3.158, "obs": 2, "own": 5.054, "comp": {"cins": -0.347, "dshield": -0.7325, "crowdsec": 1.2497, "vulncheck": -0.5651, "blocklist_de": 2.9386}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.165, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-27693-LACNIC", "org": "NipBr - NipCable do Brasil Telecom LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.nipbr.com.br"}, "pfx": 18, "reg": "2003-06-16", "rir": "lacnic", "s24": 86, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 27699, "h": "", "n": "TELEFÔNICA BRASIL AS27699", "t": "Broadband & mobile", "w": 32, "cc": "BR", "cf": {"rb": "", "wb": "", "rep": 1.17, "waf": 0.81}, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 8, "home_connection": 9, "mail_bruteforce": 4, "router_or_botnet": 3, "cve:CVE-2022-39290": 1, "cve:CVE-2024-28000": 4}, "n": 12}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 1.06, "lo": 0.23, "ips": 4, "mean": 0.58, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.12, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "dshield": {"n": 1, "p": 0.0000, "hi": 0.44, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}, "crowdsec": {"n": 12, "p": 0.0000, "hi": 0.40, "lo": 0.16, "ips": 12, "mean": 0.26, "above": false}, "threatfox": {"n": 1, "p": 0.0001, "hi": 1.25, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}, "blocklist_de": {"n": 16, "p": 0.0000, "hi": 1.19, "lo": 0.53, "ips": 16, "mean": 0.83, "above": false}}, "h2": [["2026-10-05", 0.295, 0.015, 0, false], ["2026-10-12", 0.272, 0.016, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.016, "se": 1.342, "ts": 1.000, "map": 0.083, "obs": 1, "own": 0.324, "comp": {"urlhaus": -0.7907, "threatfox": 0.7899, "phishing_db": -0.8605}, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 1, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 16}, "lo": 0.272, "se": 0.404, "ts": 0.485, "map": 0.437, "obs": 33, "own": 0.676, "comp": {"cins": 2.878, "dshield": -2.5488, "crowdsec": -5.0242, "vulncheck": -0.9896, "blocklist_de": 6.2509}, "mass": 44.1, "listed": false}}, "abq": false, "bot": 0.187, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"ssh": 2, "bots": 12, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@family-59211", "org": "TELEFÔNICA BRASIL S.A", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.telefonica.com.br"}, "pfx": 136, "reg": "2003-08-25", "rir": "lacnic", "s24": 18140, "sib": 11, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6563328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.082948}, {"a": 27715, "h": "", "n": "Locaweb S.A.", "t": "Hosting & VPS", "w": 14, "cc": "BR", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 1, "ssh_bruteforce": 2, "home_connection": 1}, "n": 3}, "ev": {"shodan": {"n": 8, "p": 0.2419, "hi": 3.98, "lo": 1.29, "ips": 8, "mean": 2.48, "above": false}, "crowdsec": {"n": 3, "p": 0.0012, "hi": 1.82, "lo": 0.32, "ips": 3, "mean": 0.94, "above": false}, "threatfox": {"n": 1, "p": 0.1290, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "vulncheck": {"n": 1, "p": 0.0426, "hi": 2.88, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "phishing_db": {"n": 8, "p": 0.9439, "hi": 9.01, "lo": 2.93, "ips": 8, "mean": 5.62, "above": true}, "blocklist_de": {"n": 1, "p": 0.0076, "hi": 2.05, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}}, "h2": [["2026-10-05", 0.211, 1.295, 0, false], ["2026-10-12", 0.270, 1.304, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 8}, "lo": 1.304, "se": 0.862, "ts": 0.889, "map": 3.152, "obs": 9, "own": 1.243, "comp": {"urlhaus": -1.4672, "threatfox": 0.0481, "phishing_db": 4.1933}, "mass": 5.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.270, "se": 0.609, "ts": 0.600, "map": 0.619, "obs": 5, "own": 0.124, "comp": {"cins": -0.8533, "dshield": -1.5008, "crowdsec": 3.1341, "vulncheck": 0.3697, "blocklist_de": -0.2363}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.969, "det": {"shodan": {"compromised": 8}, "threatfox": {"family:Havoc": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 1}}, "oid": "@family-6727", "org": "Locaweb Serviços de Internet S/A", "pdb": {"t": "Content", "sc": "South America", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.locaweb.com.br"}, "pfx": 1109, "reg": "2003-08-12", "rir": "lacnic", "s24": 1231, "sib": 3, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 672512, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00129094861917}, {"a": 27725, "h": "", "n": "Empresa de Telecomunicaciones de Cuba S.A", "t": "Broadband & mobile", "w": 1, "cc": "CU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0037, "hi": 1.83, "lo": 0.14, "ips": 1, "mean": 0.77, "above": false}, "crowdsec": {"n": 1, "p": 0.0013, "hi": 1.59, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}}, "h2": [["2026-10-05", 0.123, 0.009, 0, false], ["2026-10-12", 0.045, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.860, "ts": null, "map": 0.140, "obs": 0, "own": 0.723, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.045, "se": 1.065, "ts": 1.000, "map": 0.241, "obs": 1, "own": 0.400, "comp": {"cins": -0.2352, "dshield": -0.5195, "crowdsec": 2.4028, "vulncheck": -0.4599, "blocklist_de": -1.2177}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.214, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-27725-LACNIC", "org": "Empresa de Telecomunicaciones de Cuba, S.A.", "pdb": {"t": null, "sc": "North America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.etecsa.cu"}, "pfx": 68, "reg": "2004-04-07", "rir": "lacnic", "s24": 744, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 300288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00613222082937}, {"a": 27738, "h": "", "n": "Ecuadortelecom", "t": "Broadband & mobile", "w": 6, "cc": "EC", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0849, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "dshield": {"n": 2, "p": 0.1853, "hi": 4.29, "lo": 0.56, "ips": 2, "mean": 2.05, "above": false}, "blocklist_de": {"n": 3, "p": 0.1722, "hi": 4.03, "lo": 0.71, "ips": 3, "mean": 2.08, "above": false}}, "h2": [["2026-10-12", 0.668, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.849, "ts": null, "map": 0.135, "obs": 0, "own": 0.685, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.668, "se": 0.565, "ts": 0.500, "map": 1.413, "obs": 6, "own": 2.192, "comp": {"cins": 2.5711, "dshield": 2.941, "crowdsec": -7.4964, "vulncheck": -0.8631, "blocklist_de": 4.5866}, "mass": 6.8, "listed": false}}, "abq": true, "bot": 0.223, "det": {"blocklist_de": {"bots": 3}}, "oid": "@aut-27738-LACNIC", "org": "Ecuadortelecom S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.claro.com.ec"}, "pfx": 354, "reg": "2004-05-25", "rir": "lacnic", "s24": 864, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 311296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01273846998762}, {"a": 27742, "h": "", "n": "Amnet Telecomunicaciones", "t": "Broadband & mobile", "w": 4, "cc": "NI", "cf": null, "cs": {"c": {"ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7220, "hi": 7.81, "lo": 1.68, "ips": 4, "mean": 4.26, "above": false}, "blocklist_de": {"n": 1, "p": 0.1700, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 3.182, 0.011, 0, false], ["2026-10-12", 4.676, 0.012, 0, false]], "sh": false, "uc": 1975.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 1.505, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.676, "se": 0.611, "ts": 0.800, "map": 10.903, "obs": 5, "own": 16.875, "comp": {"cins": -0.8048, "dshield": -1.4385, "crowdsec": 6.7449, "vulncheck": -0.7783, "blocklist_de": 0.0594}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.202, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-27742-LACNIC", "org": "Amnet Telecomunicaciones S.A.", "pdb": null, "pfx": 69, "reg": "2004-05-10", "rir": "lacnic", "s24": 65, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00092459363906}, {"a": 27747, "h": "", "n": "Telecentro", "t": "Broadband & mobile", "w": 21, "cc": "AR", "cf": {"rb": "", "wb": "hi", "rep": 1.71, "waf": 0.97}, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "bad_crawling": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 4, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2018-11511": 1, "cve:CVE-2020-13640": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"dshield": {"n": 7, "p": 0.6077, "hi": 5.68, "lo": 1.72, "ips": 7, "mean": 3.46, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.23, "lo": 0.26, "ips": 4, "mean": 0.67, "above": false}, "blocklist_de": {"n": 11, "p": 0.6002, "hi": 5.05, "lo": 1.92, "ips": 11, "mean": 3.33, "above": false}}, "h2": [["2026-10-05", 1.055, 0.007, 0, false], ["2026-10-12", 1.137, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.770, "ts": null, "map": 0.100, "obs": 0, "own": 0.460, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 7, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 11}, "lo": 1.137, "se": 0.420, "ts": 0.500, "map": 1.850, "obs": 22, "own": 2.850, "comp": {"cins": -2.6044, "dshield": 4.0682, "crowdsec": -7.3539, "vulncheck": -0.9699, "blocklist_de": 8.869}, "mass": 25.0, "listed": false}}, "abq": false, "bot": 0.174, "det": {"blocklist_de": {"ssh": 3, "bots": 7, "mail": 1}}, "oid": "@aut-27747-LACNIC", "org": "Telecentro S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.telecentro.com.ar"}, "pfx": 503, "reg": "2004-07-06", "rir": "lacnic", "s24": 2434, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1850112, "abuse": "ipadmin@telecentro.net.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.065693}, {"a": 27754, "h": "", "n": "Cooperativa Batan de Obras y Serv. Publicos", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6149, "hi": 7.40, "lo": 1.30, "ips": 3, "mean": 3.82, "above": false}}, "h2": [["2026-10-05", 2.955, 0.011, 0, false], ["2026-10-12", 3.303, 0.012, 0, false]], "sh": false, "uc": 737.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 1.634, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.303, "se": 0.771, "ts": 1.000, "map": 10.341, "obs": 3, "own": 16.200, "comp": {"cins": -0.5633, "dshield": -1.0954, "crowdsec": -4.3055, "vulncheck": -0.6933, "blocklist_de": 10.3873}, "mass": 2.6, "listed": false}}, "abq": true, "bot": 0.217, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-27754-LACNIC", "org": "Cooperativa Batan de Obras y Serv. Publicos Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://batan.coop"}, "pfx": 33, "reg": "2004-12-29", "rir": "lacnic", "s24": 45, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018750850608}, {"a": 27800, "h": "", "n": "Digicel Trinidad and Tobago", "t": "Broadband & mobile", "w": 6, "cc": "TT", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "blocklist_de": {"n": 3, "p": 0.6012, "hi": 7.26, "lo": 1.28, "ips": 3, "mean": 3.74, "above": false}}, "h2": [["2026-10-05", 0.921, 0.011, 0, false], ["2026-10-12", 6.956, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 6.956, "se": 0.573, "ts": 0.500, "map": 15.146, "obs": 6, "own": 23.366, "comp": {"cins": -1.0325, "dshield": 3.7497, "crowdsec": -4.0119, "vulncheck": -0.8306, "blocklist_de": 6.2367}, "mass": 5.4, "listed": false}}, "abq": true, "bot": 0.224, "det": {"blocklist_de": {"bots": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-27800-LACNIC", "org": "Digicel Trinidad and Tobago Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": null}, "pfx": 58, "reg": "2005-11-21", "rir": "lacnic", "s24": 64, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00847602982314}, {"a": 27813, "h": "", "n": "Teledifusora", "t": "Other", "w": 4, "cc": "AR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 3, "p": 0.5384, "hi": 6.66, "lo": 1.17, "ips": 3, "mean": 3.44, "above": false}}, "h2": [["2026-10-12", 1.790, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.978, "ts": null, "map": 0.178, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.790, "se": 0.662, "ts": 0.750, "map": 4.551, "obs": 4, "own": 2.591, "comp": {"cins": -0.7933, "dshield": 1.7337, "crowdsec": -5.5787, "vulncheck": -0.7751, "blocklist_de": 8.3226}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"bots": 3}}, "oid": "@aut-27813-LACNIC", "org": "Teledifusora S.A.", "pdb": null, "pfx": 158, "reg": "2006-03-16", "rir": "lacnic", "s24": 153, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 60160, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00540639388485}, {"a": 27823, "h": "", "n": "Dattatec.com", "t": "Other", "w": 5, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 2, "bad_crawling": 1, "web_bruteforce": 2, "cve:CVE-2010-2861": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2016-10924": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.6201, "hi": 6.79, "lo": 1.46, "ips": 4, "mean": 3.71, "above": false}, "crowdsec": {"n": 2, "p": 0.1974, "hi": 4.39, "lo": 0.57, "ips": 2, "mean": 2.09, "above": false}, "threatfox": {"n": 1, "p": 0.1882, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "phishing_db": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.119, 0.906, 0, false], ["2026-10-12", 0.717, 0.920, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.920, "se": 1.142, "ts": 0.500, "map": 4.037, "obs": 2, "own": 4.246, "comp": {"urlhaus": -0.4006, "threatfox": 1.7655, "phishing_db": 1.6569}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.717, "se": 0.756, "ts": 0.667, "map": 2.136, "obs": 3, "own": 1.246, "comp": {"cins": -0.4353, "dshield": -0.888, "crowdsec": 4.3183, "vulncheck": 1.3832, "blocklist_de": -2.2254}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.934, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 2}, "threatfox": {"family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "@aut-27823-LACNIC", "org": "Dattatec.com", "pdb": null, "pfx": 134, "reg": "2006-05-12", "rir": "lacnic", "s24": 163, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 81152, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090215836263}, {"a": 27843, "h": "", "n": "On Empresas", "t": "Transit & backbone", "w": 2, "cc": "PE", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0292, "hi": 2.69, "lo": 0.35, "ips": 2, "mean": 1.28, "above": false}, "blocklist_de": {"n": 2, "p": 0.1605, "hi": 4.09, "lo": 0.53, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.722, 0.009, 0, false], ["2026-10-12", 0.564, 0.010, 0, false]], "sh": false, "uc": 190.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.890, "ts": null, "map": 0.152, "obs": 0, "own": 1.179, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.564, "se": 0.650, "ts": 0.500, "map": 1.400, "obs": 4, "own": 4.436, "comp": {"cins": -0.8018, "dshield": -1.4346, "crowdsec": 0.5809, "vulncheck": -0.7774, "blocklist_de": 4.1628}, "mass": 4.0, "listed": false}}, "abq": true, "bot": 0.160, "det": {"blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-27843-LACNIC", "org": "ON EMPRESAS S.A.C.", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Selective", "web": "https://on.pe/empresas"}, "pfx": 431, "reg": "2006-08-01", "rir": "lacnic", "s24": 504, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 266496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00736842401532}, {"a": 27876, "h": "", "n": "American Data Networks", "t": "Other", "w": 0, "cc": "CR", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.8788, "hi": 9.46, "lo": 2.35, "ips": 5, "mean": 5.40, "above": true}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.253, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.225, "det": {"shodan": {"c2": 4, "compromised": 1}}, "oid": "@aut-27876-LACNIC", "org": "American Data Networks", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.data.cr"}, "pfx": 52, "reg": "2007-01-17", "rir": "lacnic", "s24": 52, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 13312, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00114865410842}, {"a": 27879, "h": "", "n": "Informática y Telecomunicaciones S.A.", "t": "Broadband & mobile", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 744.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.141, "det": null, "oid": "@aut-27879-LACNIC", "org": "Informática y Telecomunicaciones S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.itcsa.net"}, "pfx": 17, "reg": "2007-02-01", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00091374326505}, {"a": 27882, "h": "", "n": "Telefónica Celular de Bolivia", "t": "Broadband & mobile", "w": 13, "cc": "BO", "cf": null, "cs": {"c": {"data_centre": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 5, "home_connection": 4, "router_or_botnet": 2}, "n": 6}, "ev": {"dshield": {"n": 2, "p": 0.3166, "hi": 5.36, "lo": 0.70, "ips": 2, "mean": 2.55, "above": false}, "crowdsec": {"n": 6, "p": 0.6741, "hi": 6.37, "lo": 1.77, "ips": 6, "mean": 3.77, "above": false}, "blocklist_de": {"n": 9, "p": 0.9913, "hi": 11.67, "lo": 4.03, "ips": 9, "mean": 7.43, "above": true}}, "h2": [["2026-10-05", 1.897, 0.010, 0, false], ["2026-10-12", 5.931, 0.011, 0, false]], "sh": false, "uc": 84.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.924, "ts": null, "map": 0.164, "obs": 0, "own": 0.962, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 9}, "lo": 5.931, "se": 0.434, "ts": 0.529, "map": 10.142, "obs": 17, "own": 15.558, "comp": {"cins": -2.2519, "dshield": -0.1546, "crowdsec": -3.0179, "vulncheck": -0.9535, "blocklist_de": 10.0882}, "mass": 18.1, "listed": false}}, "abq": true, "bot": 0.187, "det": {"blocklist_de": {"ssh": 4, "bots": 4, "imap": 1, "mail": 1}}, "oid": "@aut-27882-LACNIC", "org": "Telefónica Celular de Bolivia S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.tigo.com.bo"}, "pfx": 351, "reg": "2007-02-15", "rir": "lacnic", "s24": 323, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 128256, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.02793108146592}, {"a": 27883, "h": "", "n": "Universidad Tecnologica Nacional", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.384, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-27883-LACNIC", "org": "Universidad Tecnologica Nacional", "pdb": null, "pfx": 3, "reg": "2007-03-02", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 27884, "h": "", "n": "CABLE COLOR", "t": "Hosting & VPS", "w": 2, "cc": "HN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2025-4396": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1653, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "shodan": {"n": 1, "p": 0.0753, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "crowdsec": {"n": 1, "p": 0.0588, "hi": 3.13, "lo": 0.23, "ips": 1, "mean": 1.32, "above": false}}, "h2": [["2026-10-05", 0.106, 0.010, 0, false], ["2026-10-12", 0.417, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 0.174, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.417, "se": 0.881, "ts": 0.500, "map": 1.582, "obs": 2, "own": 0.322, "comp": {"cins": 4.3913, "dshield": -0.8061, "crowdsec": 0.8522, "vulncheck": -0.5955, "blocklist_de": -1.9897}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.237, "det": {"shodan": {"compromised": 1}}, "oid": "@family-69201", "org": "CABLECOLOR S.A.", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.cablecolor.hn"}, "pfx": 201, "reg": "2007-03-08", "rir": "lacnic", "s24": 194, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 96000, "abuse": "network.manager@cablecolor.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00497328435586}, {"a": 27895, "h": "", "n": "Núcleo S.A., PY", "t": "Broadband & mobile", "w": 7, "cc": "PY", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 4, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1025, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}, "urlhaus": {"n": 1, "p": 0.1937, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 5, "p": 0.7743, "hi": 7.75, "lo": 1.93, "ips": 5, "mean": 4.42, "above": false}, "blocklist_de": {"n": 2, "p": 0.3338, "hi": 5.51, "lo": 0.72, "ips": 2, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 4.866, 0.371, 0, false], ["2026-10-12", 4.015, 0.402, 0, false]], "sh": false, "uc": 157.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.402, "se": 1.522, "ts": 1.000, "map": 3.864, "obs": 1, "own": 11.422, "comp": {"urlhaus": 3.8138, "threatfox": -0.289, "phishing_db": -0.5471}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.015, "se": 0.541, "ts": 0.714, "map": 8.161, "obs": 7, "own": 12.595, "comp": {"cins": -1.1313, "dshield": -1.8228, "crowdsec": 5.5482, "vulncheck": -0.8483, "blocklist_de": 1.7472}, "mass": 6.1, "listed": false}}, "abq": true, "bot": 0.195, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-27895-LACNIC", "org": "Núcleo S.A.", "pdb": {"t": "NSP", "sc": "South America", "tr": "100-200Gbps", "pol": "No", "web": "http://www.personal.com.py"}, "pfx": 83, "reg": "2009-06-22", "rir": "lacnic", "s24": 134, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.017685628649}, {"a": 27901, "h": "", "n": "Pacifico Cable S.A.", "t": "Broadband & mobile", "w": 9, "cc": "CL", "cf": {"rb": "lo", "wb": null, "rep": 1.96, "waf": null}, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 4, "p": 0.7574, "hi": 8.25, "lo": 1.78, "ips": 4, "mean": 4.51, "above": false}, "crowdsec": {"n": 1, "p": 0.0554, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "blocklist_de": {"n": 4, "p": 0.6964, "hi": 7.52, "lo": 1.62, "ips": 5, "mean": 4.11, "above": false}}, "h2": [["2026-10-12", 4.074, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.958, "ts": null, "map": 0.174, "obs": 0, "own": 1.111, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 4.074, "se": 0.502, "ts": 0.444, "map": 7.757, "obs": 9, "own": 11.946, "comp": {"cins": -1.4659, "dshield": 6.2712, "crowdsec": -6.29, "vulncheck": -0.8935, "blocklist_de": 5.8205}, "mass": 8.7, "listed": false}}, "abq": false, "bot": 0.188, "det": {"blocklist_de": {"bots": 4, "imap": 1, "mail": 1}}, "oid": "@aut-273025-LACNIC", "org": "Pacifico Cable SPA.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.tumundo.cl"}, "pfx": 45, "reg": "2007-05-04", "rir": "lacnic", "s24": 203, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 67328, "abuse": "abuse@mundotelecomunicaciones.cl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04537517124186}, {"a": 27926, "h": "", "n": "NETPATAGONIA", "t": "Broadband & mobile", "w": 2, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.606, 0.011, 0, false], ["2026-10-12", 0.670, 0.012, 0, false]], "sh": false, "uc": 3564.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 14.852, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.225, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-27926-LACNIC", "org": "NETPATAGONIA SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "5-10Gbps", "pol": "Open", "web": "https://www.netpatagonia.com.ar/"}, "pfx": 7, "reg": "2018-11-22", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 27947, "h": "", "n": "Telconet Ecuador", "t": "Broadband & mobile", "w": 17, "cc": "EC", "cf": {"rb": "lo", "wb": null, "rep": 3.14, "waf": null}, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 2, "home_connection": 5, "router_or_botnet": 4, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0240, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "dshield": {"n": 2, "p": 0.0483, "hi": 2.98, "lo": 0.39, "ips": 2, "mean": 1.42, "above": false}, "crowdsec": {"n": 9, "p": 0.0068, "hi": 2.42, "lo": 0.84, "ips": 9, "mean": 1.54, "above": false}, "blocklist_de": {"n": 7, "p": 0.2543, "hi": 4.09, "lo": 1.24, "ips": 7, "mean": 2.49, "above": false}}, "h2": [["2026-10-05", 0.439, 0.007, 0, false], ["2026-10-12", 1.064, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.782, "ts": null, "map": 0.105, "obs": 0, "own": 0.491, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 7}, "lo": 1.064, "se": 0.431, "ts": 0.474, "map": 1.791, "obs": 19, "own": 2.761, "comp": {"cins": 0.0509, "dshield": -0.4606, "crowdsec": -0.5766, "vulncheck": -0.9603, "blocklist_de": 3.9229}, "mass": 20.5, "listed": false}}, "abq": false, "bot": 0.209, "det": {"blocklist_de": {"ssh": 3, "bots": 4}}, "oid": "@aut-52257-LACNIC", "org": "Telconet S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.telconet.ec"}, "pfx": 380, "reg": "2007-12-21", "rir": "lacnic", "s24": 2066, "sib": 3, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1632000, "abuse": "cert@telconet.ec", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04687502115127}, {"a": 27951, "h": "", "n": "Media Commerce Partners", "t": "Broadband & mobile", "w": 6, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 4, "home_connection": 5, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.7099, "hi": 7.07, "lo": 1.76, "ips": 5, "mean": 4.04, "above": false}, "blocklist_de": {"n": 1, "p": 0.1268, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 3.241, 0.010, 0, false], ["2026-10-12", 2.317, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.145, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.317, "se": 0.567, "ts": 0.833, "map": 4.945, "obs": 6, "own": 7.651, "comp": {"cins": -0.9789, "dshield": -1.6533, "crowdsec": 7.4379, "vulncheck": -0.82, "blocklist_de": -0.9937}, "mass": 5.0, "listed": false}}, "abq": true, "bot": 0.246, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-27951-LACNIC", "org": "Media Commerce Partners S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.mc.net.co/"}, "pfx": 175, "reg": "2008-01-17", "rir": "lacnic", "s24": 183, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00906272948205}, {"a": 27953, "h": "", "n": "Nodosud S.A.", "t": "Broadband & mobile", "w": 7, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1057, "hi": 3.73, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "blocklist_de": {"n": 5, "p": 0.8691, "hi": 9.24, "lo": 2.30, "ips": 7, "mean": 5.28, "above": true}}, "h2": [["2026-10-05", 2.829, 0.010, 0, false], ["2026-10-12", 3.279, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.990, "ts": null, "map": 0.181, "obs": 0, "own": 1.267, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 5}, "lo": 3.279, "se": 0.608, "ts": 1.000, "map": 7.616, "obs": 5, "own": 11.769, "comp": {"cins": -1.0371, "dshield": -1.7199, "crowdsec": -6.7228, "vulncheck": -0.8315, "blocklist_de": 13.7352}, "mass": 5.4, "listed": false}}, "abq": true, "bot": 0.151, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 7, "mail": 7}}, "oid": "@aut-27953-LACNIC", "org": "NODOSUD S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.nodosud.com.ar"}, "pfx": 137, "reg": "2008-01-21", "rir": "lacnic", "s24": 128, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00062600201349}, {"a": 27983, "h": "", "n": "Red Intercable Digital S.A.", "t": "Broadband & mobile", "w": 8, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1342, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 5, "p": 0.4071, "hi": 5.05, "lo": 1.26, "ips": 6, "mean": 2.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.1963, "hi": 4.38, "lo": 0.57, "ips": 2, "mean": 2.09, "above": false}}, "h2": [["2026-10-05", 1.321, 0.009, 0, false], ["2026-10-12", 1.750, 0.010, 0, false]], "sh": false, "uc": 71, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.158, "obs": 0, "own": 0.891, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.750, "se": 0.520, "ts": 0.625, "map": 3.445, "obs": 8, "own": 5.325, "comp": {"cins": 2.2951, "dshield": -2.044, "crowdsec": 3.0904, "vulncheck": -0.8803, "blocklist_de": 0.1694}, "mass": 7.8, "listed": false}}, "abq": true, "bot": 0.169, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-61480-LACNIC", "org": "Red Intercable Digital S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.soon.com.ar"}, "pfx": 292, "reg": "2008-07-15", "rir": "lacnic", "s24": 407, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 125184, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00366429473382}, {"a": 28006, "h": "", "n": "CNT EP", "t": "Broadband & mobile", "w": 11, "cc": "EC", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 5, "cve:CVE-2024-28000": 1, "cve:CVE-2026-41940": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0611, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "dshield": {"n": 1, "p": 0.0433, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "crowdsec": {"n": 5, "p": 0.0154, "hi": 2.54, "lo": 0.63, "ips": 5, "mean": 1.45, "above": false}, "blocklist_de": {"n": 5, "p": 0.3261, "hi": 4.63, "lo": 1.15, "ips": 5, "mean": 2.64, "above": false}}, "h2": [["2026-10-05", 0.631, 0.556, 0, false], ["2026-10-12", 1.133, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.609, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.133, "se": 0.469, "ts": 0.417, "map": 2.010, "obs": 12, "own": 3.102, "comp": {"cins": 1.1151, "dshield": -0.8717, "crowdsec": -1.7593, "vulncheck": -0.9317, "blocklist_de": 4.5396}, "mass": 13.2, "listed": false}}, "abq": true, "bot": 0.211, "det": {"blocklist_de": {"ssh": 1, "bots": 4}}, "oid": "@family-59015", "org": "CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP", "pdb": {"t": null, "sc": "South America", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.cnt.gob.ec"}, "pfx": 658, "reg": "2008-10-06", "rir": "lacnic", "s24": 1184, "sib": 6, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 310272, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01169057459856}, {"a": 28033, "h": "", "n": "Banco Familiar SAECA", "t": "Other", "w": 0, "cc": "PY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.249, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-28033-LACNIC", "org": "Banco Familiar SAECA", "pdb": null, "pfx": 1, "reg": "2009-01-26", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000034070176}, {"a": 28048, "h": "", "n": "Internet Para Todos", "t": "Broadband & mobile", "w": 4, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1009, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}, "dshield": {"n": 3, "p": 0.5977, "hi": 7.22, "lo": 1.27, "ips": 3, "mean": 3.72, "above": false}, "blocklist_de": {"n": 1, "p": 0.1423, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-12", 1.722, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 1.244, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.722, "se": 0.661, "ts": 0.750, "map": 4.384, "obs": 4, "own": 6.822, "comp": {"cins": -0.7014, "dshield": 8.7191, "crowdsec": -5.095, "vulncheck": -0.7468, "blocklist_de": 0.6957}, "mass": 3.4, "listed": false}}, "abq": true, "bot": 0.235, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-28048-LACNIC", "org": "Internet Para Todos - Gobierno de La Rioja", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.internetparatodos.com.ar/"}, "pfx": 22, "reg": "2009-03-31", "rir": "lacnic", "s24": 137, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 51456, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0030484984677}, {"a": 28087, "h": "", "n": "COMNET,S.A.", "t": "Other", "w": 1, "cc": "GT", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 0.437, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.437, "se": 1.360, "ts": 1.000, "map": 4.149, "obs": 1, "own": 2.795, "comp": {"cins": -0.1011, "dshield": -0.2364, "crowdsec": 3.9422, "vulncheck": -0.2603, "blocklist_de": -0.5278}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.135, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-28087-LACNIC", "org": "COMNET,S.A.", "pdb": null, "pfx": 18, "reg": "2009-10-09", "rir": "lacnic", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020909449935}, {"a": 28118, "h": "", "n": "Altice Dominicana", "t": "Broadband & mobile", "w": 5, "cc": "DO", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0205, "hi": 2.45, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.83, "lo": 0.06, "ips": 1, "mean": 0.35, "above": false}, "blocklist_de": {"n": 4, "p": 0.0271, "hi": 2.71, "lo": 0.58, "ips": 4, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 0.021, 0.098, 0, false], ["2026-10-12", 0.240, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.777, "ts": null, "map": 0.103, "obs": 0, "own": 0.478, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.240, "se": 0.594, "ts": 0.800, "map": 0.538, "obs": 5, "own": 0.836, "comp": {"cins": 2.6193, "dshield": -1.8987, "crowdsec": -7.4105, "vulncheck": -0.8598, "blocklist_de": 8.3228}, "mass": 6.7, "listed": false}}, "abq": true, "bot": 0.113, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "imap": 1, "mail": 1}}, "oid": "@family-67201", "org": "ALTICE DOMINICANA S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Selective", "web": "https://altice.com.do/"}, "pfx": 860, "reg": "2010-02-11", "rir": "lacnic", "s24": 2214, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1389824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01641936303088}, {"a": 28126, "h": "", "n": "Brisanet Servicos de Telecomunicacoes", "t": "Broadband & mobile", "w": 9, "cc": "BR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.99, "waf": 0.86}, "cs": {"c": {"ssh_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0371, "hi": 2.79, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "dshield": {"n": 1, "p": 0.1327, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "crowdsec": {"n": 5, "p": 0.5093, "hi": 5.62, "lo": 1.40, "ips": 5, "mean": 3.21, "above": false}, "blocklist_de": {"n": 6, "p": 0.8836, "hi": 8.76, "lo": 2.43, "ips": 6, "mean": 5.18, "above": true}}, "h2": [["2026-10-05", 1.331, 0.010, 0, false], ["2026-10-12", 3.798, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.923, "ts": null, "map": 0.164, "obs": 0, "own": 0.957, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 6}, "lo": 3.798, "se": 0.467, "ts": 0.500, "map": 6.803, "obs": 12, "own": 10.462, "comp": {"cins": -1.8274, "dshield": -0.7491, "crowdsec": -1.2101, "vulncheck": -0.9265, "blocklist_de": 8.0241}, "mass": 12.3, "listed": false}}, "abq": false, "bot": 0.111, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 2, "imap": 2, "mail": 2}}, "oid": "@aut-28126-LACNIC", "org": "BRISANET SERVICOS DE TELECOMUNICACOES S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.brisanet.com.br"}, "pfx": 38, "reg": "2008-12-12", "rir": "lacnic", "s24": 328, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 217600, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.074209}, {"a": 28137, "h": "", "n": "Vialink Soluções", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.242, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-28137-LACNIC", "org": "Vialink Soluções de Tecnologia Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://vialink.com.br"}, "pfx": 10, "reg": "2009-03-09", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28146, "h": "", "n": "Mhnet Telecom", "t": "Broadband & mobile", "w": 9, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0608, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "dshield": {"n": 1, "p": 0.1491, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 1, "p": 0.0449, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "blocklist_de": {"n": 6, "p": 0.9132, "hi": 9.46, "lo": 2.62, "ips": 7, "mean": 5.59, "above": true}}, "h2": [["2026-10-05", 1.593, 0.010, 0, false], ["2026-10-12", 3.424, 0.011, 0, false]], "sh": false, "uc": 1017.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.063, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 6}, "lo": 3.424, "se": 0.518, "ts": 0.750, "map": 6.788, "obs": 8, "own": 10.451, "comp": {"cins": -1.4786, "dshield": -0.0685, "crowdsec": -6.3485, "vulncheck": -0.8949, "blocklist_de": 12.0992}, "mass": 8.8, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 3, "imap": 4, "mail": 4}}, "oid": "@aut-262688-LACNIC", "org": "MHNET TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.mhnet.com.br/"}, "pfx": 196, "reg": "2009-02-18", "rir": "lacnic", "s24": 235, "sib": 3, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 101376, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01257529747929}, {"a": 28160, "h": "", "n": "MEGALINK", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 6.431, 0.011, 0, false], ["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 8.338, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-28160-LACNIC", "org": "MEGALINK INTERNET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.megalinkinternet.com.br"}, "pfx": 22, "reg": "2009-05-21", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28166, "h": "", "n": "Telecom South America", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0733, "hi": 3.33, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 0.120, 0.010, 0, false], ["2026-10-12", 0.125, 0.011, 0, false]], "sh": false, "uc": 234.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.975, "ts": null, "map": 0.178, "obs": 0, "own": 1.190, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.125, "se": 1.167, "ts": 1.000, "map": 0.824, "obs": 1, "own": 1.402, "comp": {"cins": -0.1754, "dshield": -0.3971, "crowdsec": 3.0674, "vulncheck": -0.3841, "blocklist_de": -0.9112}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.158, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-28166-LACNIC", "org": "Telecom South America Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.tesatelecom.com"}, "pfx": 66, "reg": "2009-06-23", "rir": "lacnic", "s24": 160, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 66304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28171, "h": "", "n": "S.O. DO BRASIL", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1319, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1623, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.198, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.016, "ts": null, "map": 0.186, "obs": 0, "own": 1.414, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.198, "se": 1.227, "ts": 1.000, "map": 1.457, "obs": 1, "own": 2.534, "comp": {"cins": -0.1633, "dshield": -0.3716, "crowdsec": -1.4701, "vulncheck": -0.3665, "blocklist_de": 4.1412}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.178, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-28171-LACNIC", "org": "S. O. do Brasil Telecomunicações LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.zamix.com.br/"}, "pfx": 7, "reg": "2007-12-18", "rir": "lacnic", "s24": 84, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00467758948293}, {"a": 28178, "h": "", "n": "NWI Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"doublepulsar": 2}}, "oid": "@aut-28178-LACNIC", "org": "Networld Provedor e Servicos de Internet Ltda", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.nwi.com.br"}, "pfx": 6, "reg": "2008-01-10", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28186, "h": "", "n": "ITS Telecomunicações", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1111, "hi": 3.65, "lo": 0.47, "ips": 2, "mean": 1.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1012, "hi": 3.67, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 1.845, 0.010, 0, false], ["2026-10-12", 0.597, 0.011, 0, false]], "sh": false, "uc": 162.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.015, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.597, "se": 0.733, "ts": 0.667, "map": 1.738, "obs": 3, "own": 2.728, "comp": {"cins": -0.5711, "dshield": -1.1075, "crowdsec": 2.8131, "vulncheck": -0.6968, "blocklist_de": 1.5087}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.145, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-28186-LACNIC", "org": "ITS TELECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.itsbrasil.net"}, "pfx": 124, "reg": "2008-02-26", "rir": "lacnic", "s24": 272, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 204544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00465772943895}, {"a": 28189, "h": "", "n": "JR & JS ENGENHARIA E COMÉRCIO LTDA", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 433.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 2.346, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.912, "ts": null, "map": 0.194, "obs": 0, "own": 1.548, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.239, "det": null, "oid": "@aut-28189-LACNIC", "org": "JR & JS ENGENHARIA E COMÉRCIO LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.novvacore.com/"}, "pfx": 21, "reg": "2008-03-05", "rir": "lacnic", "s24": 43, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28195, "h": "", "n": "Com4 Data Center Eireli", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.113, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.185, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-28195-LACNIC", "org": "Com4 Data Center Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.com4.com.br"}, "pfx": 12, "reg": "2008-03-20", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28201, "h": "", "n": "VALENET", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 4, "p": 0.6559, "hi": 7.11, "lo": 1.53, "ips": 4, "mean": 3.88, "above": false}}, "h2": [["2026-10-12", 1.161, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.938, "ts": null, "map": 0.168, "obs": 0, "own": 1.020, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.161, "se": 0.657, "ts": 1.000, "map": 2.917, "obs": 4, "own": 4.535, "comp": {"cins": -0.8717, "dshield": -1.5239, "crowdsec": -5.9671, "vulncheck": -0.7957, "blocklist_de": 11.6227}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.189, "det": {"blocklist_de": {"ssh": 1, "bots": 3}}, "oid": "@aut-262669-LACNIC", "org": "Companhia Itabirana Telecomunicações Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.valenet.com.br"}, "pfx": 235, "reg": "2008-04-09", "rir": "lacnic", "s24": 268, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 227328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00951648462261}, {"a": 28202, "h": "", "n": "Rede Brasileira de Comunicacao", "t": "Broadband & mobile", "w": 205, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 2, "home_connection": 124, "mail_bruteforce": 136, "router_or_botnet": 2}, "n": 136}, "ev": {"dshield": {"n": 1, "p": 0.0692, "hi": 3.27, "lo": 0.25, "ips": 1, "mean": 1.38, "above": false}, "crowdsec": {"n": 10, "p": 0.6287, "hi": 5.28, "lo": 1.92, "ips": 136, "mean": 3.43, "above": false}, "blocklist_de": {"n": 28, "p": 1.0000, "hi": 20.30, "lo": 10.97, "ips": 101, "mean": 15.33, "above": true}}, "h2": [["2026-10-05", 6.332, 0.009, 0, false], ["2026-10-12", 6.885, 0.009, 0, false]], "sh": false, "uc": 2186.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.851, "ts": null, "map": 0.137, "obs": 0, "own": 0.694, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 28}, "lo": 6.885, "se": 0.385, "ts": 0.718, "map": 10.793, "obs": 39, "own": 16.529, "comp": {"cins": -3.2888, "dshield": -2.6573, "crowdsec": -7.0167, "vulncheck": -0.9926, "blocklist_de": 17.728}, "mass": 49.5, "listed": false}}, "abq": false, "bot": 0.168, "det": {"blocklist_de": {"imap": 101, "mail": 101}}, "oid": "@aut-28202-LACNIC", "org": "MASTER S/A", "pdb": {"t": "NSP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.soumaster.com.br/"}, "pfx": 1133, "reg": "2008-04-09", "rir": "lacnic", "s24": 832, "sib": 0, "tor": 0, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 697600, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00564766568646}, {"a": 28209, "h": "", "n": "Under", "t": "Hosting & VPS", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1845, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 1, "p": 0.1220, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "phishing_db": {"n": 1, "p": 0.1823, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.783, 0.322, 0, false], ["2026-10-12", 0.840, 0.335, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.335, "se": 1.478, "ts": 1.000, "map": 2.945, "obs": 1, "own": 1.324, "comp": {"urlhaus": -0.1559, "threatfox": -0.1789, "phishing_db": 3.0411}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.840, "se": 0.913, "ts": 0.500, "map": 3.411, "obs": 2, "own": 0.697, "comp": {"cins": 4.4773, "dshield": -0.7351, "crowdsec": 1.2356, "vulncheck": -0.5662, "blocklist_de": -1.7909}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.845, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-28209-LACNIC", "org": "Under Servicos de Internet Ltda", "pdb": {"t": "Content", "sc": "South America", "tr": null, "pol": "Open", "web": "https://www.under.com.br"}, "pfx": 36, "reg": "2008-05-08", "rir": "lacnic", "s24": 80, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28210, "h": "", "n": "Giga+ Fibra - DF/ES/RJ", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1519, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1155, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.791, 0.010, 0, false], ["2026-10-12", 0.369, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 1.084, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.369, "se": 0.876, "ts": 0.500, "map": 1.402, "obs": 2, "own": 2.236, "comp": {"cins": -0.3898, "dshield": 3.244, "crowdsec": -3.1886, "vulncheck": -0.5967, "blocklist_de": 2.6623}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@family-13621", "org": "GIGA MAIS FIBRA TELECOMUNICACOES S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://gigamaisempresas.com.br"}, "pfx": 48, "reg": "2008-05-12", "rir": "lacnic", "s24": 220, "sib": 10, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 63488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02283104249475}, {"a": 28219, "h": "", "n": "NetRosas Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.340, 0.012, 0, false]], "sh": false, "uc": 671.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.340, "se": 1.314, "ts": 1.000, "map": 2.963, "obs": 1, "own": 5.342, "comp": {"cins": -0.1276, "dshield": -0.2948, "crowdsec": -1.1671, "vulncheck": -0.3091, "blocklist_de": 4.3782}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.224, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-28219-LACNIC", "org": "Net Rosas Telecomunicações Ltda.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.net-rosas.com.br"}, "pfx": 34, "reg": "2008-06-06", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28220, "h": "", "n": "Alares Internet", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0001, "hi": 1.14, "lo": 0.09, "ips": 1, "mean": 0.48, "above": false}, "blocklist_de": {"n": 3, "p": 0.0919, "hi": 3.41, "lo": 0.60, "ips": 3, "mean": 1.76, "above": false}}, "h2": [["2026-10-12", 0.277, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.609, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.277, "se": 0.643, "ts": 0.750, "map": 0.682, "obs": 4, "own": 1.064, "comp": {"cins": -0.896, "dshield": -1.5541, "crowdsec": -3.1575, "vulncheck": -0.8016, "blocklist_de": 7.4195}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.144, "det": {"blocklist_de": {"bots": 3}}, "oid": "@aut-28220-LACNIC", "org": "Alares Cabo Servicos de Telecomunicacoes S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.alaresinternet.com.br"}, "pfx": 221, "reg": "2008-06-09", "rir": "lacnic", "s24": 1187, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 513792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02272295626461}, {"a": 28252, "h": "", "n": "WorldNet Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.304, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": 1391.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.253, "det": null, "oid": "@aut-28252-LACNIC", "org": "WorldNet Telecom Comercio e Serviços de Telecomuni", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.worldnet.psi.br"}, "pfx": 34, "reg": "2008-09-22", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28258, "h": "", "n": "Vero Internet", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": 167.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.984, "ts": null, "map": 0.180, "obs": 0, "own": 1.236, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.760, "ts": null, "map": 0.140, "obs": 0, "own": 0.398, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.176, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@family-10416", "org": "VERO S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.verointernet.com.br"}, "pfx": 55, "reg": "2008-10-07", "rir": "lacnic", "s24": 140, "sib": 35, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 107520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00679556707641}, {"a": 28267, "h": "", "n": "IMAXXTELECOM", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 3, "cve:CVE-2023-1389": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2025-57819": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3493, "hi": 5.64, "lo": 0.73, "ips": 3, "mean": 2.69, "above": false}, "blocklist_de": {"n": 1, "p": 0.1790, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 4.477, 0.011, 0, false], ["2026-10-12", 2.916, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.916, "se": 0.767, "ts": 0.667, "map": 9.025, "obs": 3, "own": 14.146, "comp": {"cins": -0.4898, "dshield": -0.9786, "crowdsec": 3.6961, "vulncheck": -0.6574, "blocklist_de": 2.0233}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.163, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-28267-LACNIC", "org": "SIM INTERNET PROVEDORES DE INTERNET EIRELI.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.imaxxtelecom.com.br"}, "pfx": 44, "reg": "2008-11-11", "rir": "lacnic", "s24": 44, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00138736592946}, {"a": 28270, "h": null, "n": "AS28270", "t": "Other", "w": 2, "cc": null, "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1917, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.0628, "hi": 3.19, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.110, 0.010, 0, false], ["2026-10-12", 0.114, 0.354, 0, false]], "sh": false, "uc": 152.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.354, "se": 1.498, "ts": 1.000, "map": 3.249, "obs": 1, "own": 3.828, "comp": {"urlhaus": 3.706, "threatfox": -0.3104, "phishing_db": -0.591}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.114, "se": 1.157, "ts": 1.000, "map": 0.738, "obs": 1, "own": 0.458, "comp": {"cins": -0.1806, "dshield": -0.408, "crowdsec": 3.0082, "vulncheck": -0.3914, "blocklist_de": -0.9379}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 13, "reg": null, "rir": "lacnic", "s24": 184, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 70912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28283, "h": "", "n": "Adylnet Telecom - AS28283", "t": "Broadband & mobile", "w": 5, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6064, "hi": 7.31, "lo": 1.29, "ips": 3, "mean": 3.77, "above": false}, "blocklist_de": {"n": 2, "p": 0.3450, "hi": 5.60, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}}, "h2": [["2026-10-12", 1.875, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 1.301, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 2}, "lo": 1.875, "se": 0.650, "ts": 0.600, "map": 4.519, "obs": 5, "own": 7.204, "comp": {"cins": -0.6246, "dshield": -1.1881, "crowdsec": -4.6659, "vulncheck": 3.8783, "blocklist_de": 5.5024}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.182, "det": {"vulncheck": {"botnet_node": 3}, "blocklist_de": {"bots": 2}}, "oid": "@aut-28283-LACNIC", "org": "Adylnet Telecom", "pdb": {"t": "NSP", "sc": "South America", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.adyl.com.br/"}, "pfx": 8, "reg": "2007-04-25", "rir": "lacnic", "s24": 116, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 29696, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00331246314189}, {"a": 28293, "h": "", "n": "InterCorp Provedor de Internet", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7808, "hi": 8.58, "lo": 1.85, "ips": 4, "mean": 4.69, "above": false}, "crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.309, 0.011, 0, false], ["2026-10-12", 0.329, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.329, "se": 1.306, "ts": 1.000, "map": 2.829, "obs": 1, "own": 5.069, "comp": {"cins": -0.1182, "dshield": -0.2744, "crowdsec": 3.7352, "vulncheck": -0.2925, "blocklist_de": -0.6166}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.137, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-28293-LACNIC", "org": "InterCorp Provedor de Internet LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.intercorp.com.br"}, "pfx": 7, "reg": "2007-05-17", "rir": "lacnic", "s24": 31, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 24576, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28300, "h": "", "n": "Speed Serviços de Internet Ltda", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1514, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.156, 0.011, 0, false], ["2026-10-12", 0.165, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.998, "ts": null, "map": 0.183, "obs": 0, "own": 1.313, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.165, "se": 1.204, "ts": 1.000, "map": 1.171, "obs": 1, "own": 2.019, "comp": {"cins": -0.1745, "dshield": -0.3953, "crowdsec": -1.5633, "vulncheck": -0.3828, "blocklist_de": 4.067}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-28300-LACNIC", "org": "Speed Serviços de Internet Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.mma.com.br"}, "pfx": 109, "reg": "2007-06-11", "rir": "lacnic", "s24": 112, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 139520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00253448939142}, {"a": 28318, "h": "", "n": "CYBERTAP", "t": "Broadband & mobile", "w": 1, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.513, 0.011, 0, false], ["2026-10-12", 3.796, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.796, "se": 0.999, "ts": 0.500, "map": 18.227, "obs": 2, "own": 29.503, "comp": {"cins": -0.2615, "dshield": -0.5712, "crowdsec": 2.1224, "vulncheck": -0.4882, "blocklist_de": 3.4951}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.245, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-28318-LACNIC", "org": "CYBERTAP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.cybertap.com.ar"}, "pfx": 5, "reg": "2014-03-21", "rir": "lacnic", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28329, "h": "", "n": "G8", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": 190.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 1.669, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.736, "ts": null, "map": 0.130, "obs": 0, "own": 0.726, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.308, "det": null, "oid": "@aut-268852-LACNIC", "org": "SAMM TECNOLOGIA E TELECOMUNICACOES S.A", "pdb": {"t": "NSP", "sc": "South America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.g8.net.br"}, "pfx": 26, "reg": "2007-08-01", "rir": "lacnic", "s24": 168, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 44544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28330, "h": null, "n": "AS28330", "t": "Other", "w": 3, "cc": null, "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 3, "mean": 2.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 2, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.218, 0.011, 0, false], ["2026-10-12", 3.448, 0.012, 0, false]], "sh": false, "uc": 846.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.448, "se": 0.771, "ts": 0.667, "map": 10.811, "obs": 3, "own": 6.201, "comp": {"cins": -0.4811, "dshield": -0.9644, "crowdsec": 3.7938, "vulncheck": -0.6527, "blocklist_de": 2.0786}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.312, "det": {"blocklist_de": {"ssh": 2}}, "oid": null, "org": null, "pdb": null, "pfx": 30, "reg": null, "rir": "lacnic", "s24": 36, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24576, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28343, "h": "", "n": "Unifique Telecomunicações", "t": "Broadband & mobile", "w": 20, "cc": "BR", "cf": {"rb": "hi", "wb": "hi", "rep": 1.46, "waf": 1.27}, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 3, "home_connection": 8, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 8}, "ev": {"crowdsec": {"n": 8, "p": 0.0715, "hi": 3.16, "lo": 1.03, "ips": 8, "mean": 1.97, "above": false}, "threatfox": {"n": 1, "p": 0.1239, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "phishing_db": {"n": 1, "p": 0.0415, "hi": 2.86, "lo": 0.21, "ips": 1, "mean": 1.21, "above": false}, "blocklist_de": {"n": 11, "p": 0.9310, "hi": 7.46, "lo": 2.84, "ips": 11, "mean": 4.92, "above": true}}, "h2": [["2026-10-05", 1.860, 0.200, 0, false], ["2026-10-12", 1.762, 0.205, 0, false]], "sh": false, "uc": 139.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.205, "se": 1.144, "ts": 0.500, "map": 0.822, "obs": 2, "own": 2.409, "comp": {"urlhaus": -0.6197, "threatfox": 1.1285, "phishing_db": 0.9213}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 11}, "lo": 1.762, "se": 0.428, "ts": 0.579, "map": 2.956, "obs": 19, "own": 4.548, "comp": {"cins": -2.4659, "dshield": -2.8323, "crowdsec": -2.3656, "vulncheck": -0.9639, "blocklist_de": 11.1052}, "mass": 22.0, "listed": false}}, "abq": false, "bot": 0.160, "det": {"threatfox": {"family:DanaBot": 1}, "blocklist_de": {"ssh": 2, "bots": 2, "imap": 7, "mail": 7}}, "oid": "@aut-28343-LACNIC", "org": "UNIFIQUE TELECOMUNICACOES S/A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.unifique.com.br/"}, "pfx": 476, "reg": "2007-09-14", "rir": "lacnic", "s24": 1343, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 550656, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.050333}, {"a": 28368, "h": "", "n": "SOBRAL TELECOMUNICACOES LTDA", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.4806, "hi": 6.18, "lo": 1.09, "ips": 3, "mean": 3.19, "above": false}, "blocklist_de": {"n": 1, "p": 0.1576, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.317, 0.011, 0, false], ["2026-10-12", 2.379, 0.012, 0, false]], "sh": false, "uc": 590, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.379, "se": 0.664, "ts": 0.750, "map": 6.036, "obs": 4, "own": 9.388, "comp": {"cins": -0.6804, "dshield": -1.2689, "crowdsec": 5.0542, "vulncheck": -0.7396, "blocklist_de": 0.826}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.200, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-28368-LACNIC", "org": "SOBRALNET SERVICOS E TELECOMUNICACOES LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.sobralnet.com.br"}, "pfx": 108, "reg": "2007-12-06", "rir": "lacnic", "s24": 96, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 93440, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28403, "h": "", "n": "RadioMovil Dipsa, S.A. de C.V.", "t": "Other", "w": 0, "cc": "MX", "cf": {"rb": "hi", "wb": "hi", "rep": 0.71, "waf": 0.62}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.187, "obs": 0, "own": 0.594, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.849, "ts": null, "map": 0.172, "obs": 0, "own": 0.214, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.039, "det": null, "oid": "@aut-28403-LACNIC", "org": "RadioMovil Dipsa, S.A. de C.V.", "pdb": null, "pfx": 68, "reg": "2013-11-26", "rir": "lacnic", "s24": 71, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.103342}, {"a": 28409, "h": "", "n": "ENI NETWORKS SAPI de CV", "t": "Other", "w": 9, "cc": "MX", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 5, "p": 0.9089, "hi": 10.28, "lo": 2.55, "ips": 9, "mean": 5.86, "above": true}}, "h2": [["2026-10-05", 3.603, 0.011, 0, false], ["2026-10-12", 3.035, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 5, "blocklist_de": 0}, "lo": 3.035, "se": 0.653, "ts": 1.000, "map": 7.279, "obs": 5, "own": 4.299, "comp": {"cins": -0.4035, "dshield": -0.8332, "crowdsec": -3.2824, "vulncheck": 9.9646, "blocklist_de": -2.0669}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.162, "det": {"vulncheck": {"botnet_node": 9}}, "oid": "@aut-28409-LACNIC", "org": "ENI NETWORKS SAPI de CV", "pdb": null, "pfx": 60, "reg": "2016-01-31", "rir": "lacnic", "s24": 44, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 19712, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0010625295616}, {"a": 28414, "h": "", "n": "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.", "t": "Broadband & mobile", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-28414-LACNIC", "org": "TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.", "pdb": null, "pfx": 7, "reg": "2015-08-12", "rir": "lacnic", "s24": 7, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28458, "h": "", "n": "IENTC Telecom Mexico", "t": "Broadband & mobile", "w": 21, "cc": "MX", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 5, "home_connection": 6, "mail_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2026-8181": 1}, "n": 7}, "ev": {"dshield": {"n": 1, "p": 0.1525, "hi": 4.25, "lo": 0.32, "ips": 2, "mean": 1.79, "above": false}, "crowdsec": {"n": 7, "p": 0.8932, "hi": 8.34, "lo": 2.52, "ips": 7, "mean": 5.07, "above": true}, "phishing_db": {"n": 1, "p": 0.1564, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "blocklist_de": {"n": 7, "p": 0.9649, "hi": 10.67, "lo": 3.23, "ips": 12, "mean": 6.49, "above": true}}, "h2": [["2026-10-05", 6.872, 0.221, 0, false], ["2026-10-12", 7.203, 0.213, 0, false]], "sh": false, "uc": 743.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.213, "se": 1.416, "ts": 1.000, "map": 1.606, "obs": 1, "own": 4.725, "comp": {"urlhaus": -0.2253, "threatfox": -0.2312, "phishing_db": 2.5562}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 7}, "lo": 7.203, "se": 0.444, "ts": 0.467, "map": 12.566, "obs": 15, "own": 19.279, "comp": {"cins": -2.0474, "dshield": -1.1206, "crowdsec": -0.0104, "vulncheck": -0.9417, "blocklist_de": 8.0447}, "mass": 15.1, "listed": false}}, "abq": true, "bot": 0.185, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "imap": 10, "mail": 10}}, "oid": "@aut-28458-LACNIC", "org": "IENTC S DE RL DE CV", "pdb": {"t": "NSP", "sc": "North America", "tr": "5-10Tbps", "pol": "Open", "web": "https://ientc.com"}, "pfx": 207, "reg": "2015-06-29", "rir": "lacnic", "s24": 217, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 58624, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0127103748992}, {"a": 28509, "h": "", "n": "izzi telecom", "t": "Broadband & mobile", "w": 4, "cc": "MX", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0464, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "blocklist_de": {"n": 3, "p": 0.1024, "hi": 3.50, "lo": 0.62, "ips": 3, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.035, 0.008, 0, false], ["2026-10-12", 0.290, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.126, "obs": 0, "own": 0.619, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.290, "se": 0.644, "ts": 0.750, "map": 0.714, "obs": 4, "own": 1.114, "comp": {"cins": -0.8957, "dshield": 1.4135, "crowdsec": -6.0821, "vulncheck": -0.8015, "blocklist_de": 7.4223}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.099, "det": {"blocklist_de": {"ssh": 2, "bots": 1}}, "oid": "@family-58593", "org": "Cablemas Telecomunicaciones SA de CV", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.izzi.mx"}, "pfx": 370, "reg": "2005-04-25", "rir": "lacnic", "s24": 1133, "sib": 11, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 332032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0213861743488}, {"a": 28548, "h": "", "n": "izzi telecom", "t": "Broadband & mobile", "w": 15, "cc": "MX", "cf": {"rb": "hi", "wb": "hi", "rep": 1.07, "waf": 0.93}, "cs": {"c": {"ssh_bruteforce": 2, "home_connection": 2}, "n": 2}, "ev": {"dshield": {"n": 10, "p": 0.9982, "hi": 13.47, "lo": 4.90, "ips": 10, "mean": 8.73, "above": true}, "crowdsec": {"n": 2, "p": 0.0335, "hi": 2.76, "lo": 0.36, "ips": 2, "mean": 1.32, "above": false}, "blocklist_de": {"n": 6, "p": 0.8251, "hi": 7.81, "lo": 2.17, "ips": 6, "mean": 4.62, "above": true}}, "h2": [["2026-10-05", 1.889, 0.009, 0, false], ["2026-10-12", 3.936, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.894, "ts": null, "map": 0.154, "obs": 0, "own": 0.843, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 10, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 6}, "lo": 3.936, "se": 0.430, "ts": 0.556, "map": 6.542, "obs": 18, "own": 10.051, "comp": {"cins": -2.207, "dshield": 10.4913, "crowdsec": -7.8318, "vulncheck": -0.951, "blocklist_de": 3.7705}, "mass": 17.4, "listed": false}}, "abq": false, "bot": 0.104, "det": {"blocklist_de": {"ssh": 2, "bots": 4}}, "oid": "@aut-28548-LACNIC", "org": "Cablevisión, S.A. de C.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.izzi.mx"}, "pfx": 177, "reg": "2008-09-08", "rir": "lacnic", "s24": 481, "sib": 0, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 123136, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["dshield", "blocklist_de"], "traffic": 0.068507}, {"a": 28573, "h": "", "n": "Claro S.A. (NET)", "t": "Broadband & mobile", "w": 74, "cc": "BR", "cf": {"rb": "", "wb": "", "rep": 0.71, "waf": 0.69}, "cs": {"c": {"http_flood": 7, "web_exploit": 7, "bad_crawling": 1, "proxy_or_vpn": 4, "first_seen_30d": 1, "ssh_bruteforce": 12, "web_bruteforce": 7, "home_connection": 16, "cve:CVE-2002-1131": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2014-8739": 1, "cve:CVE-2024-28000": 4}, "n": 19}, "ev": {"cins": {"n": 9, "p": 0.0000, "hi": 0.90, "lo": 0.31, "ips": 9, "mean": 0.57, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.07, "lo": 0.01, "ips": 2, "mean": 0.04, "above": false}, "dshield": {"n": 9, "p": 0.0000, "hi": 0.71, "lo": 0.25, "ips": 9, "mean": 0.45, "above": false}, "urlhaus": {"n": 2, "p": 0.0001, "hi": 1.37, "lo": 0.18, "ips": 2, "mean": 0.65, "above": false}, "crowdsec": {"n": 19, "p": 0.0000, "hi": 0.27, "lo": 0.13, "ips": 19, "mean": 0.19, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.24, "lo": 0.02, "ips": 1, "mean": 0.10, "above": false}, "blocklist_de": {"n": 40, "p": 0.0000, "hi": 1.22, "lo": 0.73, "ips": 40, "mean": 0.96, "above": false}}, "h2": [["2026-10-05", 0.423, 0.061, 0, false], ["2026-10-12", 0.329, 0.059, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 1}, "lo": 0.059, "se": 1.112, "ts": 0.667, "map": 0.203, "obs": 3, "own": 0.663, "comp": {"urlhaus": 1.3741, "threatfox": -0.5561, "phishing_db": -0.788}, "mass": 14.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 9, "dshield": 9, "crowdsec": 19, "vulncheck": 0, "blocklist_de": 40}, "lo": 0.329, "se": 0.379, "ts": 0.519, "map": 0.497, "obs": 77, "own": 0.769, "comp": {"cins": 2.9008, "dshield": -0.9588, "crowdsec": -8.0979, "vulncheck": -1.0054, "blocklist_de": 7.8564}, "mass": 107.6, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1, "ssh": 8, "bots": 28, "imap": 1, "mail": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "@aut-28351-LACNIC", "org": "Claro NXT Telecomunicacoes Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.claro.com.br/"}, "pfx": 1423, "reg": "2003-11-27", "rir": "lacnic", "s24": 38921, "sib": 1, "tor": 0, "w24": 74, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10098688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.448739}, {"a": 28598, "h": "", "n": "Giga+ Fibra - N/NE", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.1829, "hi": 4.27, "lo": 0.56, "ips": 3, "mean": 2.04, "above": false}, "blocklist_de": {"n": 1, "p": 0.1284, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.414, 0.010, 0, false], ["2026-10-12", 0.876, 0.011, 0, false]], "sh": false, "uc": 1653.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.176, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.876, "se": 0.740, "ts": 0.667, "map": 2.553, "obs": 3, "own": 4.005, "comp": {"cins": -0.5518, "dshield": -1.0775, "crowdsec": 3.018, "vulncheck": -0.6881, "blocklist_de": 1.6305}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.124, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@family-10088", "org": "DB3 SERVICOS DE TELECOMUNICACOES S.A", "pdb": {"t": "NSP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "https://gigamaisempresas.com.br"}, "pfx": 81, "reg": "2005-07-15", "rir": "lacnic", "s24": 178, "sib": 5, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 122880, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00948847921497}, {"a": 28618, "h": "", "n": "Linktel Telecomunicacoes", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1901, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-12", 0.271, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.271, "se": 1.276, "ts": 1.000, "map": 2.203, "obs": 1, "own": 3.912, "comp": {"cins": 4.9196, "dshield": -0.3319, "crowdsec": -1.3135, "vulncheck": -0.3377, "blocklist_de": -0.7531}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-28618-LACNIC", "org": "Linktel Telecom do Brasil Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Restrictive", "web": "http://www.linktelcorp.com"}, "pfx": 51, "reg": "2005-11-24", "rir": "lacnic", "s24": 49, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28624, "h": "", "n": "Oops Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1385, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-12", 0.139, 0.011, 0, false]], "sh": false, "uc": 316.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.980, "ts": null, "map": 0.179, "obs": 0, "own": 1.217, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.139, "se": 1.182, "ts": 1.000, "map": 0.945, "obs": 1, "own": 1.618, "comp": {"cins": -0.1856, "dshield": -0.4185, "crowdsec": -1.6546, "vulncheck": -0.3983, "blocklist_de": 3.9936}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.147, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-28624-LACNIC", "org": "PROVEDORA CMA INTERNET LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.oops.net.br"}, "pfx": 79, "reg": "2006-01-12", "rir": "lacnic", "s24": 148, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 90112, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28634, "h": "", "n": "Life Tecnologia", "t": "Broadband & mobile", "w": 6, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.3902, "hi": 5.99, "lo": 0.78, "ips": 5, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1576, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.902, 0.011, 0, false], ["2026-10-12", 0.982, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.982, "se": 0.781, "ts": 0.667, "map": 3.027, "obs": 3, "own": 4.933, "comp": {"cins": -0.3692, "dshield": -0.7726, "crowdsec": -3.0454, "vulncheck": 3.8934, "blocklist_de": 2.7951}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.207, "det": {"vulncheck": {"botnet_node": 5}, "blocklist_de": {"bots": 1}}, "oid": "@aut-28634-LACNIC", "org": "Life Tecnologia Ltda.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.life.com.br"}, "pfx": 7, "reg": "2006-03-08", "rir": "lacnic", "s24": 96, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24832, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00182529362736}, {"a": 28649, "h": "", "n": "Desktop Sigmanet Comunicação Multimídia Ltda", "t": "Broadband & mobile", "w": 7, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0095, "hi": 2.13, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "dshield": {"n": 1, "p": 0.0967, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "crowdsec": {"n": 2, "p": 0.0189, "hi": 2.49, "lo": 0.32, "ips": 2, "mean": 1.19, "above": false}, "blocklist_de": {"n": 6, "p": 0.7835, "hi": 7.32, "lo": 2.03, "ips": 6, "mean": 4.33, "above": false}}, "h2": [["2026-10-05", 0.885, 0.009, 0, false], ["2026-10-12", 1.651, 0.010, 0, false]], "sh": false, "uc": 202.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.880, "ts": null, "map": 0.148, "obs": 0, "own": 0.792, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 6}, "lo": 1.651, "se": 0.501, "ts": 0.667, "map": 3.169, "obs": 9, "own": 4.887, "comp": {"cins": -1.615, "dshield": -0.3494, "crowdsec": -5.0667, "vulncheck": -0.9086, "blocklist_de": 10.4867}, "mass": 10.1, "listed": false}}, "abq": false, "bot": 0.153, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 3, "imap": 1, "mail": 1}}, "oid": "@aut-28668-LACNIC", "org": "Desktop Sigmanet Comunicação Multimídia SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.desktop.com.br"}, "pfx": 266, "reg": "2006-06-07", "rir": "lacnic", "s24": 576, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 351232, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04303328326941}, {"a": 28656, "h": "", "n": "Brasil TecPar (Blink)", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6127, "hi": 7.37, "lo": 1.30, "ips": 3, "mean": 3.80, "above": false}}, "h2": [["2026-10-12", 3.144, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.144, "se": 0.770, "ts": 1.000, "map": 9.758, "obs": 3, "own": 15.286, "comp": {"cins": -0.5665, "dshield": -1.1004, "crowdsec": -4.3248, "vulncheck": -0.6947, "blocklist_de": 10.3581}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.210, "det": {"blocklist_de": {"bots": 3}}, "oid": "@family-13840", "org": "BTT TELECOMUNICACOES S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.brasiltecpar.com.br"}, "pfx": 42, "reg": "2006-07-07", "rir": "lacnic", "s24": 48, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 31488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00655807023711}, {"a": 28669, "h": "", "n": "Vero Internet AS28669", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1501, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1109, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-12", 0.273, 0.011, 0, false]], "sh": false, "uc": 435.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.061, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.273, "se": 0.889, "ts": 0.500, "map": 1.036, "obs": 2, "own": 1.703, "comp": {"cins": -0.3147, "dshield": -0.6729, "crowdsec": -2.6547, "vulncheck": 1.923, "blocklist_de": 3.148}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.171, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@family-10416", "org": "VERO S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://americanet.com.br/"}, "pfx": 166, "reg": "2006-11-08", "rir": "lacnic", "s24": 236, "sib": 35, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 190208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00508288996572}, {"a": 28725, "h": "CETIN-AS", "n": "CETIN", "t": "Transit & backbone", "w": 2, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0257, "hi": 2.63, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.163, 0.009, 0, false], ["2026-10-12", 0.168, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.887, "ts": null, "map": 0.151, "obs": 0, "own": 1.163, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.168, "se": 0.845, "ts": 1.000, "map": 0.602, "obs": 2, "own": 1.946, "comp": {"cins": -0.3986, "dshield": -0.8246, "crowdsec": 4.754, "vulncheck": -0.6027, "blocklist_de": -2.0422}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-EPSS1-RIPE", "org": "CETIN a.s.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.cetin.cz"}, "pfx": 9, "reg": "2003-02-10", "rir": "ripencc", "s24": 525, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 265472, "abuse": "abuse@cetin.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00233683097435}, {"a": 28753, "h": "LEASEWEB-DE-FRA-10", "n": "LeaseWeb Germany / FRA-01", "t": "Hosting & VPS", "w": 19, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 1, "web_exploit": 7, "bad_crawling": 5, "proxy_or_vpn": 5, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 7, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2017-16894": 1, "cve:CVE-2018-20062": 4, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 12}, "ev": {"shodan": {"n": 13, "p": 0.9973, "hi": 10.68, "lo": 4.37, "ips": 13, "mean": 7.23, "above": true}, "crowdsec": {"n": 9, "p": 0.8780, "hi": 7.26, "lo": 2.51, "ips": 12, "mean": 4.62, "above": true}, "threatfox": {"n": 1, "p": 0.1710, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "vulncheck": {"n": 6, "p": 0.9191, "hi": 9.63, "lo": 2.67, "ips": 6, "mean": 5.69, "above": true}}, "h2": [["2026-10-05", 2.076, 0.137, 0, false], ["2026-10-12", 1.997, 0.143, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.143, "se": 1.382, "ts": 1.000, "map": 0.962, "obs": 1, "own": 0.453, "comp": {"urlhaus": -0.2686, "threatfox": 2.3417, "phishing_db": -0.4855}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 6, "blocklist_de": 0}, "lo": 1.997, "se": 0.464, "ts": 0.600, "map": 3.569, "obs": 15, "own": 0.703, "comp": {"cins": -1.4586, "dshield": -2.1389, "crowdsec": 10.3357, "vulncheck": 2.936, "blocklist_de": -7.0085}, "mass": 8.7, "listed": false}}, "abq": false, "bot": 0.824, "det": {"shodan": {"malware": 1, "compromised": 12}, "threatfox": {"family:Hook": 1}, "vulncheck": {"c2_server": 3, "botnet_node": 3}}, "oid": "ORG-NA8-RIPE", "org": "Leaseweb Deutschland GmbH", "pdb": {"t": "Content", "sc": null, "tr": null, "pol": "Open", "web": "https://www.leaseweb.com/contact#germany"}, "pfx": 138, "reg": "2003-02-17", "rir": "ripencc", "s24": 438, "sib": 0, "tor": 5, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8435]], "ipv4": 113664, "abuse": "abuse@de.leaseweb.com", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["crowdsec"], "traffic": 0.0139003789161}, {"a": 28787, "h": "AS-AZTELEKOM", "n": "Aztelekom LLC", "t": "Broadband & mobile", "w": 8, "cc": "AZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0407, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "vulncheck": {"n": 1, "p": 0.1476, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "phishing_db": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "blocklist_de": {"n": 5, "p": 0.8150, "hi": 8.29, "lo": 2.06, "ips": 5, "mean": 4.73, "above": true}}, "h2": [["2026-10-12", 2.409, 0.200, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.200, "se": 1.409, "ts": 1.000, "map": 1.469, "obs": 1, "own": 4.337, "comp": {"urlhaus": -0.2366, "threatfox": -0.2387, "phishing_db": 2.486}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 5}, "lo": 2.409, "se": 0.552, "ts": 0.714, "map": 4.970, "obs": 7, "own": 7.690, "comp": {"cins": -1.2425, "dshield": -1.937, "crowdsec": -5.19, "vulncheck": -0.0871, "blocklist_de": 11.4537}, "mass": 6.9, "listed": false}}, "abq": false, "bot": 0.142, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 5}}, "oid": "ORG-AA137-RIPE", "org": "Aztelekom LLC", "pdb": null, "pfx": 26, "reg": "2003-02-24", "rir": "ripencc", "s24": 250, "sib": 2, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 68864, "abuse": "abuse@aztelekom.az", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01184311259208}, {"a": 28812, "h": "JSCBIS-AS", "n": "PJSC \"Bashinformsvyaz\"", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.1210, "hi": 3.74, "lo": 0.49, "ips": 2, "mean": 1.78, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.09, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}}, "h2": [["2026-10-05", 0.164, 0.008, 0, false], ["2026-10-12", 0.146, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.819, "ts": null, "map": 0.123, "obs": 0, "own": 0.240, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.146, "se": 0.708, "ts": 0.667, "map": 0.401, "obs": 3, "own": 0.231, "comp": {"cins": -0.6063, "dshield": 5.9198, "crowdsec": -1.0557, "vulncheck": -0.7116, "blocklist_de": -3.0664}, "mass": 2.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-BC2-RIPE", "org": "PJSC \"Bashinformsvyaz\"", "pdb": null, "pfx": 12, "reg": "2003-03-03", "rir": "ripencc", "s24": 1263, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 324608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0026756307347}, {"a": 28840, "h": "TATTELECOM-AS", "n": "PJSC \"TATTELECOM\"", "t": "Broadband & mobile", "w": 90, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"dshield": {"n": 4, "p": 0.4180, "hi": 5.35, "lo": 1.15, "ips": 4, "mean": 2.92, "above": false}, "urlhaus": {"n": 1, "p": 0.1508, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 2, "p": 0.0001, "hi": 1.40, "lo": 0.18, "ips": 2, "mean": 0.67, "above": false}, "vulncheck": {"n": 12, "p": 0.9977, "hi": 11.50, "lo": 4.55, "ips": 83, "mean": 7.69, "above": true}, "blocklist_de": {"n": 2, "p": 0.0249, "hi": 2.61, "lo": 0.34, "ips": 2, "mean": 1.24, "above": false}}, "h2": [["2026-10-05", 0.355, 0.129, 0, false], ["2026-10-12", 0.830, 0.142, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.142, "se": 1.379, "ts": 1.000, "map": 1.000, "obs": 1, "own": 2.894, "comp": {"urlhaus": 2.87, "threatfox": -0.4199, "phishing_db": -0.8244}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 2, "vulncheck": 12, "blocklist_de": 2}, "lo": 0.830, "se": 0.456, "ts": 0.600, "map": 1.449, "obs": 20, "own": 2.250, "comp": {"cins": -1.6603, "dshield": 5.167, "crowdsec": -5.3095, "vulncheck": 5.505, "blocklist_de": -1.9376}, "mass": 10.7, "listed": false}}, "abq": true, "bot": 0.407, "det": {"vulncheck": {"botnet_node": 81, "attack_tooling": 2}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-OT4-RIPE", "org": "PJSC \"TATTELECOM\"", "pdb": null, "pfx": 352, "reg": "2003-03-12", "rir": "ripencc", "s24": 1316, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 1288704, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00650873708485}, {"a": 28855, "h": "OCTOPUCE-AS", "n": "Octopuce-Paris", "t": "Hosting & VPS", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2021-0027": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.345, 0.011, 0, false], ["2026-10-12", 0.368, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.283, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.368, "se": 1.327, "ts": 1.000, "map": 3.298, "obs": 1, "own": 0.761, "comp": {"cins": -0.1113, "dshield": -0.2592, "crowdsec": 3.8181, "vulncheck": -0.2799, "blocklist_de": -0.5809}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.967, "det": null, "oid": "ORG-OS113-RIPE", "org": "Octopuce s.a.r.l.", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.octopuce.fr"}, "pfx": 7, "reg": "2003-03-18", "rir": "ripencc", "s24": 25, "sib": 2, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@octopuce.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 28878, "h": "SIGNET-AS", "n": "Signet B.V.", "t": "Transit & backbone", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0761, "hi": 3.36, "lo": 0.25, "ips": 1, "mean": 1.42, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 1.605, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.718, "ts": null, "map": 0.124, "obs": 0, "own": 0.670, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.191, "det": {"shodan": {"c2": 1}}, "oid": "ORG-SI6-RIPE", "org": "Signet B.V.", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "No", "web": "https://www.signetbreedband.nl"}, "pfx": 14, "reg": "2003-03-25", "rir": "ripencc", "s24": 192, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 55296, "abuse": "abuse@signet.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007634659348}, {"a": 28885, "h": "OMANTEL-NAP-AS", "n": "Oman Telecommunications Company (S.A.O.G)", "t": "Broadband & mobile", "w": 18, "cc": "OM", "cf": {"rb": "lo", "wb": null, "rep": 1.58, "waf": null}, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0287, "hi": 2.63, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}, "dshield": {"n": 3, "p": 0.1446, "hi": 3.83, "lo": 0.67, "ips": 3, "mean": 1.98, "above": false}, "blocklist_de": {"n": 14, "p": 0.9549, "hi": 7.21, "lo": 3.05, "ips": 14, "mean": 4.94, "above": true}}, "h2": [["2026-10-05", 0.914, 0.007, 0, false], ["2026-10-12", 1.400, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.788, "ts": null, "map": 0.108, "obs": 0, "own": 0.508, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 14}, "lo": 1.400, "se": 0.430, "ts": 0.778, "map": 2.345, "obs": 18, "own": 3.608, "comp": {"cins": -0.3941, "dshield": 0.1154, "crowdsec": -11.2157, "vulncheck": -0.9694, "blocklist_de": 14.7099}, "mass": 24.7, "listed": false}}, "abq": true, "bot": 0.208, "det": {"blocklist_de": {"ssh": 1, "bots": 11, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-GTO1-RIPE", "org": "Oman Telecommunications Company (S.A.O.G)", "pdb": null, "pfx": 224, "reg": "2003-03-26", "rir": "ripencc", "s24": 1900, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 926464, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.02655497279494}, {"a": 28890, "h": "INSYS-AS", "n": "INSYS LLC", "t": "Broadband & mobile", "w": 18, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 6, "ssh_bruteforce": 16, "web_bruteforce": 12, "mail_bruteforce": 14, "cve:CVE-2024-6387": 1}, "n": 16}, "ev": {"urlhaus": {"n": 1, "p": 0.1854, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 15, "p": 0.9997, "hi": 12.10, "lo": 5.26, "ips": 16, "mean": 8.38, "above": true}, "blocklist_de": {"n": 10, "p": 0.9966, "hi": 12.41, "lo": 4.51, "ips": 11, "mean": 8.05, "above": true}}, "h2": [["2026-10-05", 6.515, 1.318, 0, false], ["2026-10-12", 8.136, 0.272, 0, false]], "sh": false, "uc": 1632.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.272, "se": 1.454, "ts": 1.000, "map": 2.281, "obs": 1, "own": 6.574, "comp": {"urlhaus": 3.4727, "threatfox": -0.3494, "phishing_db": -0.6725}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 15, "vulncheck": 0, "blocklist_de": 10}, "lo": 8.136, "se": 0.407, "ts": 0.600, "map": 13.119, "obs": 25, "own": 20.100, "comp": {"cins": -2.6002, "dshield": -2.9027, "crowdsec": 3.3811, "vulncheck": -0.9697, "blocklist_de": 7.0592}, "mass": 24.7, "listed": false}}, "abq": false, "bot": 0.469, "det": {"blocklist_de": {"ssh": 2, "imap": 7, "mail": 9}}, "oid": "ORG-IJ1-RIPE", "org": "INSYS LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.profintel.ru"}, "pfx": 26, "reg": "2003-03-27", "rir": "ripencc", "s24": 342, "sib": 2, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 88320, "abuse": "abuse@profintel.ru", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00074194270535}, {"a": 28990, "h": "MoldData-AS", "n": "Information Technology and Cyber Security Service", "t": "Other", "w": 0, "cc": "MD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.674, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SETC1-RIPE", "org": "Information Technology and Cyber Security Service", "pdb": null, "pfx": 6, "reg": "2003-05-01", "rir": "ripencc", "s24": 16, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@itsec.md", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000608792205}, {"a": 29032, "h": "DATANET-UG", "n": "DATANET-UG", "t": "Broadband & mobile", "w": 1, "cc": "UG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.329, 0.011, 0, false], ["2026-10-12", 2.433, 0.012, 0, false]], "sh": false, "uc": 3597, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.433, "se": 0.970, "ts": 0.500, "map": 11.012, "obs": 2, "own": 17.746, "comp": {"cins": -0.2856, "dshield": -0.6178, "crowdsec": 1.8703, "vulncheck": -0.512, "blocklist_de": 3.3378}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.281, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-29032-RIPE", "org": "DATANET LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-1000Mbps", "pol": "Open", "web": "http://datanet.ug/"}, "pfx": 26, "reg": "2003-05-14", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011599429735}, {"a": 29049, "h": "Delta-Telecom-AS", "n": "Delta Telecom", "t": "Broadband & mobile", "w": 0, "cc": "AZ", "cf": {"rb": "hi", "wb": "hi", "rep": 0.95, "waf": 0.83}, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1020, "hi": 3.68, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 1.249, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.765, "ts": null, "map": 0.141, "obs": 0, "own": 0.407, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.452, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-AL1-RIPE", "org": "Delta Telecom Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.delta-telecom.net"}, "pfx": 135, "reg": "2003-05-20", "rir": "ripencc", "s24": 135, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34560, "abuse": "abuse@delta-telecom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.077385}, {"a": 29061, "h": "SAIMANET-AS", "n": "Saimanet Telecomunications", "t": "Broadband & mobile", "w": 1, "cc": "KG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1399, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "blocklist_de": {"n": 1, "p": 0.1730, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.991, 0.011, 0, false], ["2026-10-12", 1.067, 0.012, 0, false]], "sh": false, "uc": 1461.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 1.545, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.067, "se": 0.924, "ts": 0.500, "map": 4.436, "obs": 2, "own": 7.109, "comp": {"cins": -0.33, "dshield": -0.7014, "crowdsec": 1.4179, "vulncheck": -0.5515, "blocklist_de": 3.0485}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.259, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ST1-RIPE", "org": "CJSC SAIMA TELECOM", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.saimatelecom.kg"}, "pfx": 47, "reg": "2003-05-22", "rir": "ripencc", "s24": 58, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00306716457423}, {"a": 29066, "h": "VELIANET-AS", "n": "velia.net", "t": "Hosting & VPS", "w": 157, "cc": "DE", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.73}, "cs": {"c": {"http_flood": 135, "data_centre": 12, "web_exploit": 133, "bad_crawling": 100, "proxy_or_vpn": 59, "ssh_bruteforce": 3, "web_bruteforce": 128, "home_connection": 1, "mail_bruteforce": 18, "cve:CVE-2017-9841": 101, "cve:CVE-2021-3129": 16, "cve:CVE-2021-44228": 28, "cve:CVE-2022-46604": 27, "cve:CVE-2023-49103": 71}, "n": 143}, "ev": {"shodan": {"n": 10, "p": 0.7816, "hi": 6.11, "lo": 2.22, "ips": 10, "mean": 3.96, "above": false}, "urlhaus": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 18, "p": 0.9951, "hi": 8.31, "lo": 3.87, "ips": 143, "mean": 5.92, "above": true}, "vulncheck": {"n": 4, "p": 0.5686, "hi": 6.37, "lo": 1.37, "ips": 4, "mean": 3.48, "above": false}, "phishing_db": {"n": 6, "p": 0.8652, "hi": 8.42, "lo": 2.34, "ips": 7, "mean": 4.98, "above": true}, "blocklist_de": {"n": 2, "p": 0.0782, "hi": 3.33, "lo": 0.43, "ips": 2, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 3.121, 1.803, 0, false], ["2026-10-12", 2.308, 1.866, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 6}, "lo": 1.866, "se": 0.888, "ts": 0.857, "map": 4.831, "obs": 7, "own": 1.862, "comp": {"urlhaus": 0.9662, "threatfox": -0.5234, "phishing_db": 2.7585}, "mass": 5.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 18, "vulncheck": 4, "blocklist_de": 2}, "lo": 2.308, "se": 0.418, "ts": 0.750, "map": 3.785, "obs": 24, "own": 0.742, "comp": {"cins": -2.2079, "dshield": -2.685, "crowdsec": 12.7405, "vulncheck": 0.3986, "blocklist_de": -5.5213}, "mass": 17.4, "listed": false}}, "abq": false, "bot": 0.903, "det": {"shodan": {"compromised": 10}, "vulncheck": {"c2_server": 1, "botnet_node": 3}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-VIG33-RIPE", "org": "velia.net Internetdienste GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.velia.net"}, "pfx": 414, "reg": "2003-05-23", "rir": "ripencc", "s24": 832, "sib": 0, "tor": 0, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 281344, "abuse": "abuse-inquiries@server4you.com", "score": 0.0810, "groups": ["phishing"], "sensors": ["crowdsec"], "traffic": 0.0464045229205}, {"a": 29069, "h": "TLK-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.442, 0.011, 0, false], ["2026-10-12", 1.545, 0.012, 0, false]], "sh": false, "uc": 1779.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.545, "se": 0.943, "ts": 0.500, "map": 6.677, "obs": 2, "own": 10.724, "comp": {"cins": -0.3099, "dshield": -0.6638, "crowdsec": 1.6209, "vulncheck": -0.5343, "blocklist_de": 3.1795}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.436, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 6, "reg": "2003-05-26", "rir": "ripencc", "s24": 36, "sib": 120, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29075, "h": "IELO", "n": "IELO", "t": "Transit & backbone", "w": 3, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2012-0392": 1, "cve:CVE-2013-3827": 1, "cve:CVE-2014-2383": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.2567, "hi": 4.87, "lo": 0.63, "ips": 3, "mean": 2.32, "above": false}, "blocklist_de": {"n": 1, "p": 0.1522, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 1.231, 0.011, 0, false], ["2026-10-12", 1.316, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.999, "ts": null, "map": 0.183, "obs": 0, "own": 1.876, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.316, "se": 0.749, "ts": 0.667, "map": 3.948, "obs": 3, "own": 12.576, "comp": {"cins": -0.5301, "dshield": -1.0435, "crowdsec": 3.251, "vulncheck": -0.6778, "blocklist_de": 1.7673}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.299, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-LS56-RIPE", "org": "IELO-LIAZO SERVICES SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.ielo.net/"}, "pfx": 23, "reg": "2003-05-27", "rir": "ripencc", "s24": 110, "sib": 4, "tor": 2, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31232, "abuse": "abuse@ielo.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00074646284388}, {"a": 29084, "h": "COMNET-AS", "n": "Comnet Bulgaria", "t": "Broadband & mobile", "w": 4, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1674, "hi": 4.41, "lo": 0.33, "ips": 3, "mean": 1.86, "above": false}, "phishing_db": {"n": 1, "p": 0.1694, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-12", 0.105, 0.258, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.258, "se": 1.439, "ts": 1.000, "map": 2.053, "obs": 1, "own": 5.997, "comp": {"urlhaus": -0.1957, "threatfox": -0.2103, "phishing_db": 2.7514}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.105, "se": 1.167, "ts": 1.000, "map": 0.667, "obs": 1, "own": 1.180, "comp": {"cins": -0.1309, "dshield": -0.302, "crowdsec": -1.1955, "vulncheck": 3.2985, "blocklist_de": -0.6819}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.193, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-CBHL1-RIPE", "org": "Comnet Bulgaria Holding Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Selective", "web": "http://www.comnet.bg"}, "pfx": 154, "reg": "2003-05-28", "rir": "ripencc", "s24": 146, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 72704, "abuse": "abuse@comnet.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00177917708007}, {"a": 29091, "h": "IPNXng", "n": "ipNX Nigeria", "t": "Broadband & mobile", "w": 1, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0460, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "crowdsec": {"n": 1, "p": 0.0315, "hi": 2.69, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}}, "h2": [["2026-10-05", 0.082, 0.010, 0, false], ["2026-10-12", 0.085, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.933, "ts": null, "map": 0.167, "obs": 0, "own": 0.997, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.085, "se": 1.125, "ts": 1.000, "map": 0.518, "obs": 1, "own": 0.872, "comp": {"cins": -0.1976, "dshield": -0.4433, "crowdsec": 2.8166, "vulncheck": -0.4142, "blocklist_de": -1.0252}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.164, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-INL2-AFRINIC", "org": "ipNX Nigeria Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.ipnxnigeria.net/"}, "pfx": 87, "reg": "2007-09-20", "rir": "afrinic", "s24": 288, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 187648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00135323850306}, {"a": 29119, "h": "SERVIHOSTING-AS", "n": "Aire Networks del Mediterraneo", "t": "Hosting & VPS", "w": 17, "cc": "ES", "cf": null, "cs": {"c": {"web_exploit": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 4}, "n": 5}, "ev": {"shodan": {"n": 12, "p": 0.2753, "hi": 3.91, "lo": 1.55, "ips": 12, "mean": 2.62, "above": false}, "dshield": {"n": 3, "p": 0.1505, "hi": 3.87, "lo": 0.68, "ips": 3, "mean": 2.00, "above": false}, "urlhaus": {"n": 2, "p": 0.3180, "hi": 5.37, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "crowdsec": {"n": 4, "p": 0.0001, "hi": 1.54, "lo": 0.33, "ips": 5, "mean": 0.84, "above": false}, "vulncheck": {"n": 2, "p": 0.0654, "hi": 3.19, "lo": 0.41, "ips": 2, "mean": 1.52, "above": false}, "phishing_db": {"n": 1, "p": 0.0220, "hi": 2.49, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "blocklist_de": {"n": 1, "p": 0.0013, "hi": 1.59, "lo": 0.12, "ips": 4, "mean": 0.67, "above": false}}, "h2": [["2026-10-05", 0.372, 0.571, 0, false], ["2026-10-12", 0.412, 0.624, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 1}, "lo": 0.624, "se": 1.037, "ts": 0.667, "map": 2.201, "obs": 3, "own": 0.880, "comp": {"urlhaus": 3.3743, "threatfox": -0.5245, "phishing_db": -0.4345}, "mass": 6.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.412, "se": 0.500, "ts": 0.400, "map": 0.771, "obs": 10, "own": 0.153, "comp": {"cins": -1.3737, "dshield": 4.6123, "crowdsec": 0.7011, "vulncheck": 0.4951, "blocklist_de": -3.3017}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.716, "det": {"shodan": {"compromised": 12}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-ANDM1-RIPE", "org": "AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.airenetworks.es/"}, "pfx": 393, "reg": "2003-06-10", "rir": "ripencc", "s24": 1858, "sib": 3, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 690432, "abuse": "abuse@airenetworks.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0104135010006}, {"a": 29124, "h": "ISKRATELECOM-AS", "n": "Seven Sky", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2023-50164": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-54236": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0162, "hi": 2.42, "lo": 0.31, "ips": 2, "mean": 1.16, "above": false}, "vulncheck": {"n": 1, "p": 0.0956, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "blocklist_de": {"n": 1, "p": 0.0428, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}}, "h2": [["2026-10-12", 0.378, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.147, "obs": 0, "own": 0.780, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.378, "se": 0.664, "ts": 0.500, "map": 0.958, "obs": 4, "own": 1.510, "comp": {"cins": -0.6766, "dshield": -1.2635, "crowdsec": 1.7463, "vulncheck": 0.6948, "blocklist_de": 0.8496}, "mass": 3.3, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-JI4-RIPE", "org": "Iskratelecom JSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://seven-sky.net"}, "pfx": 47, "reg": "2003-06-11", "rir": "ripencc", "s24": 601, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 166912, "abuse": "abuse@seven-sky.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002275689878}, {"a": 29134, "h": "IGNUM-AS", "n": "Webglobe", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3150, "hi": 5.35, "lo": 0.69, "ips": 2, "mean": 2.55, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.419, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.829, "ts": null, "map": 0.165, "obs": 0, "own": 0.537, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.898, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-IS1-RIPE", "org": "Webglobe, s.r.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://webglobe.com"}, "pfx": 12, "reg": "2003-06-12", "rir": "ripencc", "s24": 83, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22784, "abuse": "abuse@webglobe.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001958572437}, {"a": 29140, "h": "HOSTSERVER-AS", "n": "Hostserver GmbH", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.997, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-HG5-RIPE", "org": "Hostserver GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.hostserver.de/"}, "pfx": 2, "reg": "2003-06-13", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@hostserver.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29164, "h": "IOMARTHOSTING-EU", "n": "Iomart Group Plc", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-ISTI1-RIPE", "org": "Iomart Group Plc", "pdb": null, "pfx": 4, "reg": "2003-06-19", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@iomart.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29169, "h": "GANDI-AS", "n": "Gandi", "t": "Transit & backbone", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1205, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 1.914, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.802, "ts": null, "map": 0.155, "obs": 0, "own": 0.972, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.968, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GA13-RIPE", "org": "GANDI SAS", "pdb": {"t": "NSP", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.gandi.net"}, "pfx": 8, "reg": "2003-06-20", "rir": "ripencc", "s24": 102, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32000, "abuse": "abuse@gandi.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027762048395}, {"a": 29170, "h": "KUJTESA-AS", "n": "KujtesaNET", "t": "Transit & backbone", "w": 4, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3293, "hi": 5.47, "lo": 0.71, "ips": 2, "mean": 2.61, "above": false}, "blocklist_de": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 2, "mean": 1.88, "above": false}}, "h2": [["2026-10-12", 2.343, 0.012, 0, false]], "sh": false, "uc": 541.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 2.206, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.343, "se": 0.762, "ts": 0.667, "map": 7.148, "obs": 3, "own": 22.762, "comp": {"cins": -0.5011, "dshield": -0.9969, "crowdsec": 3.5702, "vulncheck": -0.6633, "blocklist_de": 1.9516}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.239, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-KA21-RIPE", "org": "Kujtesa Net Sh.p.k.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.kujtesa.com"}, "pfx": 18, "reg": "2003-06-20", "rir": "ripencc", "s24": 57, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": "abuse@kujtesa.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00253071685153}, {"a": 29182, "h": "RU-JSCIOT", "n": "JSC IOT", "t": "Broadband & mobile", "w": 28, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "cve:CVE-2025-55182": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1234, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "shodan": {"n": 9, "p": 0.9051, "hi": 7.66, "lo": 2.65, "ips": 9, "mean": 4.88, "above": true}, "urlhaus": {"n": 1, "p": 0.1797, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 5, "p": 0.3106, "hi": 4.56, "lo": 1.13, "ips": 5, "mean": 2.60, "above": false}, "threatfox": {"n": 2, "p": 0.3744, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "vulncheck": {"n": 10, "p": 0.9982, "hi": 13.48, "lo": 4.90, "ips": 10, "mean": 8.74, "above": true}, "phishing_db": {"n": 7, "p": 0.9638, "hi": 10.60, "lo": 3.21, "ips": 7, "mean": 6.45, "above": true}, "blocklist_de": {"n": 2, "p": 0.1646, "hi": 4.12, "lo": 0.54, "ips": 2, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.428, 3.964, 0, false], ["2026-10-12", 2.110, 4.020, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 7}, "lo": 4.020, "se": 0.830, "ts": 0.700, "map": 9.569, "obs": 10, "own": 22.854, "comp": {"urlhaus": 0.6579, "threatfox": 0.4264, "phishing_db": 2.8004}, "mass": 6.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 10, "blocklist_de": 2}, "lo": 2.110, "se": 0.463, "ts": 0.556, "map": 3.763, "obs": 18, "own": 5.832, "comp": {"cins": 1.6965, "dshield": -2.2824, "crowdsec": 0.4528, "vulncheck": 4.5817, "blocklist_de": -1.7298}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.885, "det": {"shodan": {"compromised": 9}, "threatfox": {"family:PureRAT": 1, "family:Evilginx": 1}, "vulncheck": {"c2_server": 4, "botnet_node": 5, "attack_tooling": 1}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-JI50-RIPE", "org": "JSC IOT", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://aoiot.ru/"}, "pfx": 179, "reg": "2003-06-23", "rir": "ripencc", "s24": 492, "sib": 1, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.9974]], "ipv4": 134656, "abuse": "abuse@aoiot.ru", "score": 0.9974, "groups": ["vulncheck", "phishing", "shodan"], "sensors": [], "traffic": 0.00230598538451}, {"a": 29194, "h": "ASN-TVT", "n": "MTS PJSC", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.3781, "hi": 5.89, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "crowdsec": {"n": 1, "p": 0.0895, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.530, 0.010, 0, false], ["2026-10-12", 1.082, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 0.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.082, "se": 0.743, "ts": 0.667, "map": 3.196, "obs": 3, "own": 1.832, "comp": {"cins": -0.5064, "dshield": 6.5278, "crowdsec": -0.2224, "vulncheck": -0.666, "blocklist_de": -2.5772}, "mass": 2.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": null, "pfx": 53, "reg": "2003-06-25", "rir": "ripencc", "s24": 129, "sib": 95, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50432, "abuse": "abuse@mtu.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00172899155275}, {"a": 29208, "h": "QUANTCOM-AS", "n": "Quantcom", "t": "Transit & backbone", "w": 4, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 5, "p": 0.0811, "hi": 3.27, "lo": 0.81, "ips": 5, "mean": 1.86, "above": false}, "crowdsec": {"n": 3, "p": 0.0040, "hi": 2.06, "lo": 0.36, "ips": 3, "mean": 1.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.0129, "hi": 2.24, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.166, 0.008, 0, false], ["2026-10-12", 0.272, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.834, "ts": null, "map": 0.129, "obs": 0, "own": 0.910, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.272, "se": 0.643, "ts": 0.750, "map": 0.666, "obs": 4, "own": 2.115, "comp": {"cins": -0.7895, "dshield": -1.4184, "crowdsec": 3.8161, "vulncheck": -0.774, "blocklist_de": 0.1533}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.263, "det": {"shodan": {"malware": 1, "compromised": 3, "doublepulsar": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-IA8-RIPE", "org": "Quantcom, a.s.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.quantcom.cz"}, "pfx": 36, "reg": "2003-07-01", "rir": "ripencc", "s24": 1039, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 274432, "abuse": "abuse@dialtelecom.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0048409014076}, {"a": 29222, "h": "Infomaniak-AS", "n": "Infomaniak Network SA", "t": "Broadband & mobile", "w": 27, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 5, "home_connection": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-72898": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.0299, "hi": 2.66, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "crowdsec": {"n": 6, "p": 0.6169, "hi": 5.99, "lo": 1.66, "ips": 6, "mean": 3.54, "above": false}, "vulncheck": {"n": 7, "p": 0.9701, "hi": 11.02, "lo": 3.34, "ips": 20, "mean": 6.71, "above": true}, "blocklist_de": {"n": 2, "p": 0.2125, "hi": 4.52, "lo": 0.59, "ips": 2, "mean": 2.15, "above": false}}, "h2": [["2026-10-05", 1.479, 0.010, 0, false], ["2026-10-12", 2.445, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.161, "obs": 0, "own": 0.922, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 7, "blocklist_de": 2}, "lo": 2.445, "se": 0.472, "ts": 0.467, "map": 4.369, "obs": 15, "own": 6.765, "comp": {"cins": -1.4865, "dshield": -2.1632, "crowdsec": 3.8089, "vulncheck": 3.4614, "blocklist_de": -0.7522}, "mass": 9.0, "listed": false}}, "abq": false, "bot": 0.895, "det": {"shodan": {"c2": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 19}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-INS5-RIPE", "org": "Infomaniak Network SA", "pdb": {"t": "Content", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.infomaniak.com"}, "pfx": 30, "reg": "2003-07-02", "rir": "ripencc", "s24": 368, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 94208, "abuse": "abuse@infomaniak.ch", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00453660367864}, {"a": 29226, "h": "MASTERTEL-AS", "n": "Mastertel", "t": "Transit & backbone", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.5963, "hi": 6.59, "lo": 1.42, "ips": 4, "mean": 3.60, "above": false}}, "h2": [["2026-10-05", 0.116, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.631, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.725, "ts": null, "map": 0.126, "obs": 0, "own": 0.692, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.603, "det": {"shodan": {"c2": 4}}, "oid": "ORG-JM2-RIPE", "org": "JSC Mastertel", "pdb": {"t": "NSP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.mastertel.ru"}, "pfx": 39, "reg": "2003-07-03", "rir": "ripencc", "s24": 182, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 48896, "abuse": "noc@mastertel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038680947305}, {"a": 29238, "h": "Nisatel", "n": "Nisatel", "t": "Other", "w": 2, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-12", 1.761, 0.012, 0, false]], "sh": false, "uc": 725.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.761, "se": 0.949, "ts": 0.500, "map": 7.704, "obs": 2, "own": 4.523, "comp": {"cins": -0.2801, "dshield": 3.7405, "crowdsec": 1.9273, "vulncheck": -0.5068, "blocklist_de": -1.4456}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.184, "det": null, "oid": "ORG-NL143-RIPE", "org": "Nisatel LTD", "pdb": null, "pfx": 9, "reg": "2009-03-10", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011332683151}, {"a": 29244, "h": "TelenorBG-AS", "n": "CETIN Bulgaria AS29244", "t": "Transit & backbone", "w": 4, "cc": "BG", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1069, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 3, "p": 0.5749, "hi": 7.00, "lo": 1.23, "ips": 3, "mean": 3.61, "above": false}}, "h2": [["2026-10-05", 0.159, 0.415, 0, false], ["2026-10-12", 2.581, 0.446, 0, false]], "sh": false, "uc": 440.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.446, "se": 1.545, "ts": 1.000, "map": 4.486, "obs": 1, "own": 19.102, "comp": {"urlhaus": 3.9033, "threatfox": -0.2692, "phishing_db": -0.5069}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.581, "se": 0.667, "ts": 0.750, "map": 6.657, "obs": 4, "own": 21.025, "comp": {"cins": -0.7707, "dshield": -1.3935, "crowdsec": -2.301, "vulncheck": -0.7685, "blocklist_de": 8.5231}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.062, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-CBE2-RIPE", "org": "CETIN Bulgaria EAD", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.cetinbg.bg"}, "pfx": 19, "reg": "2003-07-08", "rir": "ripencc", "s24": 101, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "abuse-ripe@cetinbg.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01872533290836}, {"a": 29247, "h": "COSMOTE-GR", "n": "Cosmote Mobile Telecommunications S.A.", "t": "Broadband & mobile", "w": 1, "cc": "GR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0074, "hi": 2.15, "lo": 0.28, "ips": 2, "mean": 1.02, "above": false}, "crowdsec": {"n": 1, "p": 0.0004, "hi": 1.40, "lo": 0.10, "ips": 1, "mean": 0.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.0189, "hi": 2.41, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.110, 0.008, 0, false], ["2026-10-12", 0.117, 0.009, 0, false]], "sh": false, "uc": 51.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.845, "ts": null, "map": 0.134, "obs": 0, "own": 0.674, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.117, "se": 0.833, "ts": 0.500, "map": 0.404, "obs": 2, "own": 0.643, "comp": {"cins": -0.4537, "dshield": -0.919, "crowdsec": 0.2438, "vulncheck": -0.6373, "blocklist_de": 2.2529}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.067, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"mail": 1}}, "oid": "ORG-OSTO1-RIPE", "org": "Ote SA (Hellenic Telecommunications Organisation)", "pdb": null, "pfx": 12, "reg": "2003-07-09", "rir": "ripencc", "s24": 903, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 231168, "abuse": "abuse@ote.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0361376403615}, {"a": 29256, "h": "INT-PDN-STE-AS", "n": "Syrian Telecommunication", "t": "Broadband & mobile", "w": 13, "cc": "SY", "cf": {"rb": "lo", "wb": null, "rep": 1.85, "waf": null}, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 4, "web_bruteforce": 6, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2024-28000": 2}, "n": 8}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.80, "lo": 0.10, "ips": 2, "mean": 0.38, "above": false}, "dshield": {"n": 2, "p": 0.0115, "hi": 2.30, "lo": 0.30, "ips": 2, "mean": 1.09, "above": false}, "urlhaus": {"n": 1, "p": 0.0995, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "crowdsec": {"n": 8, "p": 0.0000, "hi": 1.51, "lo": 0.49, "ips": 8, "mean": 0.94, "above": false}, "blocklist_de": {"n": 4, "p": 0.0028, "hi": 2.05, "lo": 0.44, "ips": 4, "mean": 1.12, "above": false}}, "h2": [["2026-10-05", 0.452, 0.007, 0, false], ["2026-10-12", 0.446, 0.088, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.088, "se": 1.345, "ts": 1.000, "map": 0.559, "obs": 1, "own": 1.663, "comp": {"urlhaus": 2.4063, "threatfox": -0.4563, "phishing_db": -0.9052}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.446, "se": 0.456, "ts": 0.571, "map": 0.784, "obs": 14, "own": 1.213, "comp": {"cins": -1.9656, "dshield": 0.5558, "crowdsec": 2.2514, "vulncheck": -0.9364, "blocklist_de": 1.2455}, "mass": 14.1, "listed": false}}, "abq": true, "bot": 0.271, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2, "bots": 2}}, "oid": "ORG-STE1-RIPE", "org": "Syrian Telecommunication Private Closed Joint Stock Company", "pdb": null, "pfx": 294, "reg": "2003-07-10", "rir": "ripencc", "s24": 3229, "sib": 2, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 827648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01723037787599}, {"a": 29286, "h": "SKYLOGIC-AS", "n": "Eutelsat - Skylogic", "t": "Broadband & mobile", "w": 2, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0124, "hi": 2.32, "lo": 0.30, "ips": 2, "mean": 1.11, "above": false}}, "h2": [["2026-10-05", 0.398, 0.009, 0, false], ["2026-10-12", 0.143, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.871, "ts": null, "map": 0.145, "obs": 0, "own": 0.761, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.143, "se": 0.839, "ts": 1.000, "map": 0.503, "obs": 2, "own": 0.800, "comp": {"cins": -0.4074, "dshield": -0.84, "crowdsec": 4.648, "vulncheck": -0.6086, "blocklist_de": -2.0864}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.265, "det": null, "oid": "ORG-SIS5-RIPE", "org": "SKYLOGIC S.P.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.eutelsat.com/"}, "pfx": 258, "reg": "2003-07-22", "rir": "ripencc", "s24": 644, "sib": 0, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 223488, "abuse": "abuse@skylogic.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00071509677875}, {"a": 29314, "h": "VECTRANET-AS", "n": "VECTRA", "t": "Broadband & mobile", "w": 9, "cc": "PL", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.04, "lo": 0.13, "ips": 2, "mean": 0.49, "above": false}, "dshield": {"n": 1, "p": 0.0084, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "urlhaus": {"n": 1, "p": 0.1201, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.86, "lo": 0.11, "ips": 3, "mean": 0.41, "above": false}, "vulncheck": {"n": 1, "p": 0.0092, "hi": 2.11, "lo": 0.16, "ips": 1, "mean": 0.89, "above": false}, "blocklist_de": {"n": 3, "p": 0.0065, "hi": 2.19, "lo": 0.39, "ips": 4, "mean": 1.13, "above": false}}, "h2": [["2026-10-05", 0.233, 0.095, 0, false], ["2026-10-12", 0.258, 0.104, 0, false]], "sh": false, "uc": 53.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.104, "se": 1.355, "ts": 1.000, "map": 0.685, "obs": 1, "own": 2.013, "comp": {"urlhaus": 2.5709, "threatfox": -0.4446, "phishing_db": -0.8791}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.258, "se": 0.547, "ts": 0.429, "map": 0.525, "obs": 7, "own": 0.818, "comp": {"cins": -1.2437, "dshield": 0.4681, "crowdsec": -2.8308, "vulncheck": -0.0882, "blocklist_de": 4.4436}, "mass": 7.0, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-TKDS1-RIPE", "org": "VECTRA S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.vectra.pl/"}, "pfx": 112, "reg": "2003-07-29", "rir": "ripencc", "s24": 2370, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 674048, "abuse": "abuse@vectra.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02321522671806}, {"a": 29340, "h": "SP-ECHO-GHANA-LIMITED", "n": "Africa Online Ghana", "t": "Other", "w": 0, "cc": "GH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1013.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.216, "det": null, "oid": "ORG-SEGL1-AFRINIC", "org": "SP ECHO GHANA LIMITED", "pdb": null, "pfx": 32, "reg": "2009-01-14", "rir": "afrinic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003271733066}, {"a": 29357, "h": "WATANIYATELECOM-AS", "n": "Ooredoo Kuwait (Wataniya Telecom)", "t": "Broadband & mobile", "w": 5, "cc": "KW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0198, "hi": 2.51, "lo": 0.33, "ips": 2, "mean": 1.20, "above": false}, "blocklist_de": {"n": 4, "p": 0.4715, "hi": 5.69, "lo": 1.22, "ips": 4, "mean": 3.11, "above": false}}, "h2": [["2026-10-05", 0.433, 0.009, 0, false], ["2026-10-12", 0.959, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.149, "obs": 0, "own": 0.796, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.959, "se": 0.565, "ts": 0.667, "map": 2.055, "obs": 6, "own": 3.184, "comp": {"cins": -1.1875, "dshield": -1.8814, "crowdsec": -2.4478, "vulncheck": -0.8573, "blocklist_de": 8.4881}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.085, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-WT1-RIPE", "org": "NATIONAL MOBILE TELECOMMUNICATIONS COMPANY K.S.C.P.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.ooredoo.com.kw"}, "pfx": 214, "reg": "2003-08-15", "rir": "ripencc", "s24": 568, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 286720, "abuse": "ripe-ooredookuwait-abuse@ooredoo.com.kw", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02247135360912}, {"a": 29447, "h": "TIF-AS", "n": "Iliad Italia", "t": "Broadband & mobile", "w": 6, "cc": "FR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.83, "waf": 0.72}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 0.56, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}, "blocklist_de": {"n": 4, "p": 0.0007, "hi": 1.79, "lo": 0.39, "ips": 4, "mean": 0.98, "above": false}}, "h2": [["2026-10-05", 0.056, 0.006, 0, false], ["2026-10-12", 0.161, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.738, "ts": null, "map": 0.085, "obs": 0, "own": 0.382, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.161, "se": 0.560, "ts": 0.667, "map": 0.339, "obs": 6, "own": 0.528, "comp": {"cins": -1.2846, "dshield": -1.9783, "crowdsec": -3.1014, "vulncheck": -0.8713, "blocklist_de": 7.5473}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.079, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TT1-RIPE", "org": "Scaleway SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.iliad.it"}, "pfx": 20, "reg": "2003-09-11", "rir": "ripencc", "s24": 3840, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1900544, "abuse": "abuse@proxad.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.088787}, {"a": 29465, "h": "VCG-AS", "n": "MTN NIGERIA Communication", "t": "Broadband & mobile", "w": 25, "cc": "NG", "cf": {"rb": "", "wb": "", "rep": 0.32, "waf": 0.41}, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2024-28000": 1}, "n": 10}, "ev": {"cins": {"n": 1, "p": 0.0174, "hi": 2.37, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 1.04, "lo": 0.14, "ips": 2, "mean": 0.50, "above": false}, "dshield": {"n": 2, "p": 0.0338, "hi": 2.77, "lo": 0.36, "ips": 3, "mean": 1.32, "above": false}, "crowdsec": {"n": 8, "p": 0.0006, "hi": 1.98, "lo": 0.64, "ips": 10, "mean": 1.24, "above": false}, "blocklist_de": {"n": 14, "p": 0.8816, "hi": 6.19, "lo": 2.62, "ips": 16, "mean": 4.25, "above": true}}, "h2": [["2026-10-05", 0.482, 0.007, 0, false], ["2026-10-12", 1.449, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.772, "ts": null, "map": 0.101, "obs": 0, "own": 0.465, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 14}, "lo": 1.449, "se": 0.412, "ts": 0.560, "map": 2.323, "obs": 25, "own": 3.575, "comp": {"cins": -0.8782, "dshield": -1.3159, "crowdsec": -5.0349, "vulncheck": -0.978, "blocklist_de": 10.4435}, "mass": 30.4, "listed": false}}, "abq": false, "bot": 0.106, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 3, "bots": 12, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-VGC1-RIPE", "org": "MTN NIGERIA Communication limited", "pdb": {"t": "Enterprise", "sc": "Africa", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.mtnonline.com/"}, "pfx": 439, "reg": "2003-09-17", "rir": "ripencc", "s24": 2364, "sib": 0, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 717824, "abuse": "abuse@mtnnigeria.net", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.279237}, {"a": 29518, "h": "BREDBAND2", "n": "Bredband2", "t": "Broadband & mobile", "w": 56, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 25, "bad_crawling": 4, "proxy_or_vpn": 6, "first_seen_30d": 2, "ssh_bruteforce": 40, "web_bruteforce": 34, "home_connection": 42, "mail_bruteforce": 32, "router_or_botnet": 7, "cve:CVE-2017-9841": 1, "cve:CVE-2018-10562": 3, "cve:CVE-2021-24931": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2024-12847": 6}, "n": 44}, "ev": {"cins": {"n": 1, "p": 0.0059, "hi": 1.96, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 1.12, "lo": 0.24, "ips": 4, "mean": 0.61, "above": false}, "dshield": {"n": 2, "p": 0.0098, "hi": 2.24, "lo": 0.29, "ips": 2, "mean": 1.07, "above": false}, "urlhaus": {"n": 5, "p": 0.7960, "hi": 8.03, "lo": 1.99, "ips": 10, "mean": 4.58, "above": true}, "crowdsec": {"n": 37, "p": 0.9191, "hi": 4.91, "lo": 2.87, "ips": 44, "mean": 3.83, "above": true}, "threatfox": {"n": 2, "p": 0.1688, "hi": 4.16, "lo": 0.54, "ips": 2, "mean": 1.98, "above": false}, "vulncheck": {"n": 1, "p": 0.0024, "hi": 1.72, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}, "blocklist_de": {"n": 21, "p": 0.9752, "hi": 6.59, "lo": 3.24, "ips": 21, "mean": 4.79, "above": true}}, "h2": [["2026-10-05", 2.139, 1.248, 0, false], ["2026-10-12", 2.194, 1.361, 0, false]], "sh": false, "uc": 369.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 5, "threatfox": 2, "phishing_db": 0}, "lo": 1.361, "se": 0.881, "ts": 0.714, "map": 3.499, "obs": 7, "own": 8.730, "comp": {"urlhaus": 4.2007, "threatfox": -0.1576, "phishing_db": -1.1646}, "mass": 16.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 37, "vulncheck": 1, "blocklist_de": 21}, "lo": 2.194, "se": 0.377, "ts": 0.597, "map": 3.396, "obs": 62, "own": 5.219, "comp": {"cins": -2.3272, "dshield": -2.3918, "crowdsec": 3.3509, "vulncheck": -0.8997, "blocklist_de": 4.8842}, "mass": 63.0, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"malware": 1, "compromised": 3}, "threatfox": {"family:DeimosC2": 2}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1, "imap": 18, "mail": 20}}, "oid": "ORG-LA21-RIPE", "org": "Bredband2 AB", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.bredband2.com"}, "pfx": 120, "reg": "2003-10-02", "rir": "ripencc", "s24": 3352, "sib": 6, "tor": 0, "w24": 44, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.8803]], "ipv4": 887296, "abuse": "abuse@bredband2.se", "score": 0.8803, "groups": ["sensors", "abusech"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.02091902871388}, {"a": 29550, "h": "SIMPLYTRANSIT", "n": "Team Blue Carrier Ltd", "t": "Transit & backbone", "w": 7, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 2, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 3, "web_bruteforce": 3, "home_connection": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0358, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}, "dshield": {"n": 1, "p": 0.1315, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 4, "p": 0.3315, "hi": 4.84, "lo": 1.04, "ips": 4, "mean": 2.64, "above": false}, "blocklist_de": {"n": 2, "p": 0.2270, "hi": 4.63, "lo": 0.60, "ips": 2, "mean": 2.21, "above": false}}, "h2": [["2026-10-05", 0.970, 0.010, 0, false], ["2026-10-12", 1.676, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.922, "ts": null, "map": 0.163, "obs": 0, "own": 1.351, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.676, "se": 0.539, "ts": 0.571, "map": 3.433, "obs": 7, "own": 10.787, "comp": {"cins": -1.1744, "dshield": 0.6407, "crowdsec": 2.578, "vulncheck": -0.8552, "blocklist_de": 1.4381}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.976, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PIS3-RIPE", "org": "Team Blue Carrier Limited", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.simplytransit.net/"}, "pfx": 12, "reg": "2003-10-09", "rir": "ripencc", "s24": 335, "sib": 5, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 86016, "abuse": "abuse@as29550.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00148589812564}, {"a": 29551, "h": "HGCOMP-ASN", "n": "Aixit GmbH", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0935, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.978, "ts": null, "map": 0.179, "obs": 0, "own": 1.718, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.749, "ts": null, "map": 0.135, "obs": 0, "own": 0.771, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.880, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HC1-RIPE", "org": "Aixit GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.aixit.com"}, "pfx": 29, "reg": "2003-10-09", "rir": "ripencc", "s24": 152, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44032, "abuse": "abuse@aixit.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29571, "h": "ORANGE-COTE-IVOIRE", "n": "Orange Cote d'Ivoire", "t": "Broadband & mobile", "w": 12, "cc": "CI", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 5, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 3, "router_or_botnet": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1}, "n": 10}, "ev": {"dshield": {"n": 1, "p": 0.0469, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "urlhaus": {"n": 1, "p": 0.1571, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 9, "p": 0.2450, "hi": 3.94, "lo": 1.36, "ips": 10, "mean": 2.51, "above": false}, "blocklist_de": {"n": 2, "p": 0.0395, "hi": 2.85, "lo": 0.37, "ips": 2, "mean": 1.36, "above": false}}, "h2": [["2026-10-05", 1.049, 0.140, 0, false], ["2026-10-12", 0.963, 0.155, 0, false]], "sh": false, "uc": 75.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.155, "se": 1.387, "ts": 1.000, "map": 1.104, "obs": 1, "own": 3.187, "comp": {"urlhaus": 2.9463, "threatfox": -0.4127, "phishing_db": -0.8086}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.963, "se": 0.468, "ts": 0.750, "map": 1.739, "obs": 12, "own": 2.685, "comp": {"cins": -1.6869, "dshield": -0.4897, "crowdsec": 7.1555, "vulncheck": -0.9151, "blocklist_de": -2.1171}, "mass": 10.9, "listed": false}}, "abq": false, "bot": 0.134, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-OCD2-AFRINIC", "org": "Orange Côte d'Ivoire", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.orange.ci/"}, "pfx": 1086, "reg": "2017-12-29", "rir": "afrinic", "s24": 1125, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 560896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02498152693725}, {"a": 29580, "h": "A1BG_RSG", "n": "A1 Bulgaria AS29580", "t": "Other", "w": 10, "cc": "BG", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 2}, "n": 4}, "ev": {"dshield": {"n": 4, "p": 0.4992, "hi": 5.87, "lo": 1.26, "ips": 4, "mean": 3.21, "above": false}, "urlhaus": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 4, "p": 0.0127, "hi": 2.44, "lo": 0.53, "ips": 4, "mean": 1.33, "above": false}, "phishing_db": {"n": 1, "p": 0.0602, "hi": 3.15, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "blocklist_de": {"n": 1, "p": 0.0131, "hi": 2.25, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.558, 0.379, 0, false], ["2026-10-12", 0.735, 0.407, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.407, "se": 1.156, "ts": 0.500, "map": 1.778, "obs": 2, "own": 1.957, "comp": {"urlhaus": 2.3758, "threatfox": -0.4583, "phishing_db": 0.2842}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.735, "se": 0.501, "ts": 0.444, "map": 1.400, "obs": 9, "own": 0.793, "comp": {"cins": -1.3851, "dshield": 6.7657, "crowdsec": 0.6004, "vulncheck": -0.8842, "blocklist_de": -3.3667}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.213, "det": {"blocklist_de": {"ftp": 1}}, "oid": "ORG-MN1-RIPE", "org": "A1 Bulgaria EAD", "pdb": null, "pfx": 612, "reg": "2003-10-15", "rir": "ripencc", "s24": 1035, "sib": 7, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 264960, "abuse": "RIPE.Abuse@a1.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01648114330031}, {"a": 29582, "h": "SATCOM-AS", "n": "OPTISPRINT", "t": "Broadband & mobile", "w": 8, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.5994, "hi": 7.24, "lo": 1.28, "ips": 8, "mean": 3.73, "above": false}}, "h2": [["2026-10-05", 0.975, 0.010, 0, false], ["2026-10-12", 0.575, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 1.246, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.575, "se": 0.773, "ts": 1.000, "map": 1.724, "obs": 3, "own": 2.836, "comp": {"cins": -0.3028, "dshield": -0.6505, "crowdsec": -2.5668, "vulncheck": 7.0191, "blocklist_de": -1.5606}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.181, "det": {"vulncheck": {"botnet_node": 8}}, "oid": "ORG-OA212-RIPE", "org": "Optisprint OOD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://sprint-bg.net/"}, "pfx": 136, "reg": "2003-10-15", "rir": "ripencc", "s24": 136, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34816, "abuse": "abuse@optisprint.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00059875838438}, {"a": 29614, "h": "GHANATEL-AS", "n": "Telecel Ghana", "t": "Transit & backbone", "w": 11, "cc": "GH", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "mail_bruteforce": 3}, "n": 7}, "ev": {"dshield": {"n": 2, "p": 0.2329, "hi": 4.68, "lo": 0.61, "ips": 3, "mean": 2.23, "above": false}, "crowdsec": {"n": 5, "p": 0.1820, "hi": 3.89, "lo": 0.97, "ips": 7, "mean": 2.22, "above": false}, "blocklist_de": {"n": 3, "p": 0.2571, "hi": 4.60, "lo": 0.81, "ips": 3, "mean": 2.37, "above": false}}, "h2": [["2026-10-05", 1.023, 0.009, 0, false], ["2026-10-12", 1.459, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.872, "ts": null, "map": 0.145, "obs": 0, "own": 1.085, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.459, "se": 0.489, "ts": 0.500, "map": 2.682, "obs": 10, "own": 8.412, "comp": {"cins": -1.552, "dshield": 1.7745, "crowdsec": 1.1543, "vulncheck": -0.9025, "blocklist_de": 1.9058}, "mass": 9.5, "listed": false}}, "abq": false, "bot": 0.097, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-GTCL1-AFRINIC", "org": "Ghana Telecommunications Company Limited", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.telecel.com.gh"}, "pfx": 101, "reg": "2007-09-20", "rir": "afrinic", "s24": 640, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 325632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0148323856856}, {"a": 29624, "h": "KRICK-TECHNOLOGIC-AS", "n": "iWelt Eibelstadt", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 2.491, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 1.794, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.326, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-IAID1-RIPE", "org": "Krick Management GmbH trading as iWelt GmbH + Co. KG", "pdb": {"t": "NSP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.iwelt.de/"}, "pfx": 1, "reg": "2003-10-27", "rir": "ripencc", "s24": 32, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@iwelt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29648, "h": "COMLINE-AS", "n": "PJSC MegaFon", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1595, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 2, "p": 0.1801, "hi": 4.25, "lo": 0.55, "ips": 2, "mean": 2.03, "above": false}, "blocklist_de": {"n": 1, "p": 0.1275, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.408, 0.010, 0, false], ["2026-10-12", 1.330, 0.011, 0, false]], "sh": false, "uc": 170.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 0.463, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.330, "se": 0.658, "ts": 0.500, "map": 3.370, "obs": 4, "own": 1.920, "comp": {"cins": -0.7105, "dshield": 2.0093, "crowdsec": 1.4202, "vulncheck": -0.7498, "blocklist_de": 0.6393}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.484, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 125, "reg": "2003-10-31", "rir": "ripencc", "s24": 181, "sib": 39, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59904, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29684, "h": "NOURNET-ASN", "n": "Nour Internet Company for Communications and Information Technology Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "SA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1004, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 1.241, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.762, "ts": null, "map": 0.140, "obs": 0, "own": 0.402, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.360, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NICF1-RIPE", "org": "Nour Internet Company for Communications and Information Technology Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.nour.net.sa"}, "pfx": 136, "reg": "2003-11-11", "rir": "ripencc", "s24": 138, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 92672, "abuse": "abuse@nour.net.sa", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00054035912454}, {"a": 29691, "h": "NINE", "n": "Nine Internet Solutions AG", "t": "Hosting & VPS", "w": 2, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2019-12989": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2020-27866": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1134, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "crowdsec": {"n": 1, "p": 0.0985, "hi": 3.64, "lo": 0.27, "ips": 2, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.148, 0.011, 0, false], ["2026-10-12", 0.155, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.997, "ts": null, "map": 0.183, "obs": 0, "own": 0.202, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.155, "se": 1.193, "ts": 1.000, "map": 1.071, "obs": 1, "own": 0.234, "comp": {"cins": -0.1629, "dshield": -0.371, "crowdsec": 3.2096, "vulncheck": -0.366, "blocklist_de": -0.8474}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.911, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-NISA1-RIPE", "org": "Nine Internet Solutions AG", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.nine.ch"}, "pfx": 11, "reg": "2003-11-13", "rir": "ripencc", "s24": 114, "sib": 0, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29184, "abuse": "abuse@nine.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017966291254}, {"a": 29695, "h": "Altibox_AS", "n": "Lyse Tele AS", "t": "Broadband & mobile", "w": 6, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-21859": 1}, "n": 4}, "ev": {"dshield": {"n": 2, "p": 0.0032, "hi": 1.92, "lo": 0.25, "ips": 2, "mean": 0.92, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.75, "lo": 0.16, "ips": 4, "mean": 0.41, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.14, "lo": 0.15, "ips": 2, "mean": 0.54, "above": false}}, "h2": [["2026-10-05", 0.069, 0.006, 0, false], ["2026-10-12", 0.178, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.731, "ts": null, "map": 0.082, "obs": 0, "own": 0.368, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.178, "se": 0.517, "ts": 0.500, "map": 0.348, "obs": 8, "own": 0.542, "comp": {"cins": -1.3993, "dshield": 2.2958, "crowdsec": 0.4761, "vulncheck": -0.8859, "blocklist_de": -0.1478}, "mass": 8.2, "listed": false}}, "abq": false, "bot": 0.147, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "ORG-LEA1-RIPE", "org": "Lyse Tele AS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.lysekonsern.no/"}, "pfx": 66, "reg": "2003-11-14", "rir": "ripencc", "s24": 4222, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1170432, "abuse": "abuse@altibox.no", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04463940234362}, {"a": 29789, "h": "REFLECTED", "n": "Reflected Networks, Inc.", "t": "Other", "w": 18, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 14, "p": 1.0000, "hi": 20.26, "lo": 8.56, "ips": 18, "mean": 13.89, "above": true}}, "h2": [["2026-10-05", 2.993, 0.010, 0, false], ["2026-10-12", 2.684, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.978, "ts": null, "map": 0.178, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 14, "blocklist_de": 0}, "lo": 2.684, "se": 0.494, "ts": 1.000, "map": 4.972, "obs": 14, "own": 2.866, "comp": {"cins": -0.8527, "dshield": -1.5, "crowdsec": -5.8748, "vulncheck": 15.4731, "blocklist_de": -4.2481}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.991, "det": {"vulncheck": {"botnet_node": 18}}, "oid": "REFLE-2-ARIN", "org": "Reflected Networks, Inc.", "pdb": null, "pfx": 37, "reg": "2003-05-05", "rir": "arin", "s24": 153, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 45056, "abuse": "support@reflected.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00514106530798}, {"a": 29802, "h": "HVC-AS", "n": "Hivelocity LLC", "t": "Hosting & VPS", "w": 83, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 8, "web_exploit": 8, "bad_crawling": 3, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 6, "web_bruteforce": 9, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 3}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.0904, "hi": 3.45, "lo": 0.45, "ips": 2, "mean": 1.65, "above": false}, "shodan": {"n": 58, "p": 1.0000, "hi": 13.99, "lo": 9.10, "ips": 58, "mean": 11.43, "above": true}, "crowdsec": {"n": 14, "p": 0.1757, "hi": 3.54, "lo": 1.50, "ips": 14, "mean": 2.43, "above": false}, "threatfox": {"n": 13, "p": 0.9999, "hi": 15.91, "lo": 6.52, "ips": 25, "mean": 10.78, "above": true}, "vulncheck": {"n": 8, "p": 0.8406, "hi": 7.14, "lo": 2.32, "ips": 14, "mean": 4.45, "above": true}, "phishing_db": {"n": 13, "p": 0.9971, "hi": 10.59, "lo": 4.34, "ips": 25, "mean": 7.17, "above": true}, "blocklist_de": {"n": 5, "p": 0.1008, "hi": 3.41, "lo": 0.85, "ips": 5, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.156, 2.323, 0, false], ["2026-10-12", 1.294, 2.295, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 13, "phishing_db": 13}, "lo": 2.295, "se": 0.791, "ts": 0.500, "map": 4.866, "obs": 26, "own": 1.857, "comp": {"urlhaus": -2.1612, "threatfox": 2.7073, "phishing_db": 2.6623}, "mass": 13.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 14, "vulncheck": 8, "blocklist_de": 5}, "lo": 1.294, "se": 0.416, "ts": 0.483, "map": 2.139, "obs": 29, "own": 0.420, "comp": {"cins": 2.0519, "dshield": -2.8605, "crowdsec": 3.4118, "vulncheck": 1.1076, "blocklist_de": -1.5568}, "mass": 23.1, "listed": false}}, "abq": false, "bot": 0.908, "det": {"shodan": {"c2": 10, "malware": 1, "compromised": 46, "doublepulsar": 1}, "threatfox": {"family:Remcos": 2, "family:PureRAT": 3, "family:AdaptixC2": 13, "family:Cobalt Strike": 4, "family:Unknown malware": 2}, "vulncheck": {"c2_server": 4, "botnet_node": 9, "attack_tooling": 1}, "blocklist_de": {"sip": 2, "ssh": 3}}, "oid": "HVC-3-ARIN", "org": "HIVELOCITY, Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.hivelocity.net"}, "pfx": 1179, "reg": "2003-05-08", "rir": "arin", "s24": 1947, "sib": 2, "tor": 0, "w24": 48, "drop": 2, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 531968, "abuse": "abuse@hivelocity.net", "score": 1.0000, "groups": ["vulncheck", "abusech", "phishing", "shodan"], "sensors": [], "traffic": 0.01974385334062}, {"a": 29819, "h": "MIS124", "n": "Natural Networks, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3992, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.433, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.231, "det": {"shodan": {"c2": 2}}, "oid": "MIS-166-ARIN", "org": "Natural Networks, Inc.", "pdb": null, "pfx": 2, "reg": "2003-05-13", "rir": "arin", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "hostmaster@naturalnetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29838, "h": "AMC", "n": "Atlantic Metro", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0145, "hi": 2.29, "lo": 0.17, "ips": 1, "mean": 0.97, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.891, "ts": null, "map": 0.152, "obs": 0, "own": 1.181, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.593, "ts": null, "map": 0.079, "obs": 0, "own": 0.365, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.844, "det": {"shodan": {"compromised": 1}}, "oid": "AMCI-3-ARIN", "org": "Atlantic Metro Communications II, Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://365datacenters.com/"}, "pfx": 118, "reg": "2003-05-14", "rir": "arin", "s24": 501, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 207616, "abuse": "abuse@atlanticmetro.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 29894, "h": "SCRTC", "n": "SCRTC", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 6, "p": 0.9016, "hi": 9.16, "lo": 2.54, "ips": 6, "mean": 5.42, "above": true}, "crowdsec": {"n": 2, "p": 0.2249, "hi": 4.62, "lo": 0.60, "ips": 2, "mean": 2.20, "above": false}, "blocklist_de": {"n": 2, "p": 0.3320, "hi": 5.49, "lo": 0.71, "ips": 2, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 1.018, 0.010, 0, false], ["2026-10-12", 1.847, 0.011, 0, false]], "sh": false, "uc": 618.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 0.501, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.847, "se": 0.662, "ts": 0.500, "map": 4.667, "obs": 4, "own": 2.658, "comp": {"cins": -0.7392, "dshield": -1.3509, "crowdsec": 1.1506, "vulncheck": -0.759, "blocklist_de": 4.6327}, "mass": 3.6, "listed": false}}, "abq": true, "bot": 0.184, "det": {"shodan": {"compromised": 6}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "SCRT-1-ARIN", "org": "South Central Rural Telecommunications Cooperative Inc.", "pdb": null, "pfx": 89, "reg": "2017-10-31", "rir": "arin", "s24": 137, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 35072, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 29909, "h": "METROOPTIC", "n": "Metro Optic", "t": "Transit & backbone", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 2.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.189, "obs": 0, "own": 1.463, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.536, "det": {"shodan": {"c2": 1}}, "oid": "LESSE-ARIN", "org": "Metro Optic", "pdb": {"t": "NSP", "sc": "North America", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.metrooptic.com"}, "pfx": 33, "reg": "2010-02-26", "rir": "arin", "s24": 48, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": "abuse@metrooptic.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015489607126}, {"a": 29975, "h": "VODACOM-ZA", "n": "Vodacom", "t": "Broadband & mobile", "w": 7, "cc": "ZA", "cf": {"rb": "hi", "wb": "", "rep": 0.89, "waf": 0.90}, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.0001, "hi": 1.34, "lo": 0.17, "ips": 2, "mean": 0.64, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.26, "lo": 0.31, "ips": 5, "mean": 0.72, "above": false}}, "h2": [["2026-10-05", 0.021, 0.005, 0, false], ["2026-10-12", 0.119, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.701, "ts": null, "map": 0.067, "obs": 0, "own": 0.301, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.119, "se": 0.535, "ts": 0.714, "map": 0.236, "obs": 7, "own": 0.368, "comp": {"cins": -1.4894, "dshield": 1.9831, "crowdsec": -8.4325, "vulncheck": -0.896, "blocklist_de": 8.7858}, "mass": 9.0, "listed": false}}, "abq": false, "bot": 0.098, "det": {"blocklist_de": {"ssh": 1, "bots": 4}}, "oid": "ORG-VA67-AFRINIC", "org": "Vodacom", "pdb": null, "pfx": 127, "reg": "2003-06-18", "rir": "afrinic", "s24": 6824, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1786624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.082111}, {"a": 29990, "h": "ASN-APPNEXUS", "n": "AppNexus, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.69, "waf": 0.60}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.997, "ts": null, "map": 0.182, "obs": 0, "own": 0.201, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.786, "ts": null, "map": 0.149, "obs": 0, "own": 0.057, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.696, "det": null, "oid": "APPNE-ARIN", "org": "Xandr Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.appnexus.com"}, "pfx": 34, "reg": "2008-01-10", "rir": "arin", "s24": 115, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.10656}, {"a": 30036, "h": "MEDIACOM-ENTERPRISE-BUSINESS", "n": "Mediacom Communications", "t": "Broadband & mobile", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.0004, "hi": 1.39, "lo": 0.10, "ips": 1, "mean": 0.58, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.56, "lo": 0.12, "ips": 4, "mean": 0.31, "above": false}, "vulncheck": {"n": 1, "p": 0.0001, "hi": 1.18, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.88, "lo": 0.11, "ips": 2, "mean": 0.42, "above": false}}, "h2": [["2026-10-05", 0.108, 0.006, 0, false], ["2026-10-12", 0.130, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.711, "ts": null, "map": 0.072, "obs": 0, "own": 0.324, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.130, "se": 0.527, "ts": 0.500, "map": 0.259, "obs": 8, "own": 0.404, "comp": {"cins": 2.1759, "dshield": -2.0944, "crowdsec": 0.3937, "vulncheck": -0.2196, "blocklist_de": -0.2136}, "mass": 8.3, "listed": false}}, "abq": false, "bot": 0.142, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"mail": 2}}, "oid": "MEDIA-119-ARIN", "org": "Mediacom Communications Corp", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Open", "web": "https://mediacomcc.com"}, "pfx": 2528, "reg": "2009-02-17", "rir": "arin", "s24": 5738, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1635328, "abuse": "abuse@mediacombb.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.047474288393}, {"a": 30041, "h": "RACE", "n": "Race Telecommunications, LLC", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0445, "hi": 2.91, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "dshield": {"n": 1, "p": 0.1385, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.084, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.931, "ts": null, "map": 0.166, "obs": 0, "own": 0.991, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.084, "se": 1.124, "ts": 1.000, "map": 0.512, "obs": 1, "own": 0.861, "comp": {"cins": -0.1991, "dshield": 4.1362, "crowdsec": -1.7644, "vulncheck": -0.4162, "blocklist_de": -1.0329}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.185, "det": {"shodan": {"c2": 1}}, "oid": "RACE-ARIN", "org": "Race Tech, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Open", "web": "http://www.race.com"}, "pfx": 292, "reg": "2003-07-07", "rir": "arin", "s24": 294, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 75264, "abuse": "abuse@race.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00515867698672}, {"a": 30058, "h": "FDCSERVERS", "n": "FDCServers.Net", "t": "Hosting & VPS", "w": 66, "cc": "US", "cf": {"rb": "hi", "wb": "", "rep": 1.29, "waf": 1.21}, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 3, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2025-4396": 2, "cve:CVE-2021-24931": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2017-1000170": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0469, "hi": 2.95, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "dshield": {"n": 1, "p": 0.0308, "hi": 2.67, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}, "crowdsec": {"n": 2, "p": 0.0001, "hi": 1.31, "lo": 0.17, "ips": 3, "mean": 0.62, "above": false}, "vulncheck": {"n": 27, "p": 1.0000, "hi": 21.23, "lo": 11.35, "ips": 55, "mean": 15.97, "above": true}, "phishing_db": {"n": 1, "p": 0.0370, "hi": 2.79, "lo": 0.21, "ips": 4, "mean": 1.17, "above": false}, "blocklist_de": {"n": 2, "p": 0.0185, "hi": 2.48, "lo": 0.32, "ips": 2, "mean": 1.18, "above": false}}, "h2": [["2026-10-05", 1.312, 0.075, 0, false], ["2026-10-12", 0.956, 0.079, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.079, "se": 1.344, "ts": 1.000, "map": 0.472, "obs": 1, "own": 0.231, "comp": {"urlhaus": -0.411, "threatfox": -0.3289, "phishing_db": 1.6143}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 27, "blocklist_de": 2}, "lo": 0.956, "se": 0.433, "ts": 0.818, "map": 1.612, "obs": 33, "own": 0.319, "comp": {"cins": 1.1799, "dshield": -0.82, "crowdsec": -6.348, "vulncheck": 11.1795, "blocklist_de": -3.3206}, "mass": 12.9, "listed": false}}, "abq": false, "bot": 0.429, "det": {"vulncheck": {"botnet_node": 55}, "blocklist_de": {"imap": 1, "mail": 2, "apache": 1}}, "oid": "FDCSE-ARIN", "org": "FDCservers.net", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.fdcservers.net"}, "pfx": 836, "reg": "2003-07-10", "rir": "arin", "s24": 1437, "sib": 0, "tor": 0, "w24": 34, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 371456, "abuse": "abuse@fdcservers.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.056839}, {"a": 30060, "h": "VERISIGN-ILG1", "n": "Verisign Operations", "t": "Other", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 2, "home_connection": 3}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 4, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.230, 0.011, 0, false], ["2026-10-12", 0.244, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 0.636, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.244, "se": 1.257, "ts": 1.000, "map": 1.912, "obs": 1, "own": 1.228, "comp": {"cins": -0.136, "dshield": -0.3133, "crowdsec": 3.5232, "vulncheck": -0.3235, "blocklist_de": -0.7087}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.881, "det": null, "oid": "VIO-2-ARIN", "org": "VeriSign Infrastructure & Operations", "pdb": null, "pfx": 46, "reg": "2003-07-10", "rir": "arin", "s24": 53, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30083, "h": "AS-30083-US-VELIA-NET", "n": "velia.net", "t": "Other", "w": 9, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1599, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "shodan": {"n": 15, "p": 1.0000, "hi": 15.53, "lo": 6.75, "ips": 15, "mean": 10.76, "above": true}, "dshield": {"n": 1, "p": 0.1504, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 2, "p": 0.1408, "hi": 3.92, "lo": 0.51, "ips": 2, "mean": 1.87, "above": false}, "threatfox": {"n": 1, "p": 0.1840, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "vulncheck": {"n": 2, "p": 0.3478, "hi": 5.62, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "phishing_db": {"n": 3, "p": 0.5728, "hi": 6.98, "lo": 1.23, "ips": 3, "mean": 3.60, "above": false}}, "h2": [["2026-10-05", 1.682, 3.777, 0, false], ["2026-10-12", 1.489, 2.137, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 2.137, "se": 0.942, "ts": 0.750, "map": 6.344, "obs": 4, "own": 6.321, "comp": {"urlhaus": -0.7661, "threatfox": 0.8325, "phishing_db": 3.4072}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.489, "se": 0.591, "ts": 0.333, "map": 3.284, "obs": 6, "own": 1.882, "comp": {"cins": 3.4064, "dshield": 1.5794, "crowdsec": 0.2296, "vulncheck": 1.564, "blocklist_de": -4.1967}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.939, "det": {"shodan": {"compromised": 15}, "threatfox": {"family:Mirai": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "VIG-97-ARIN", "org": "velia.net", "pdb": null, "pfx": 118, "reg": "2003-07-16", "rir": "arin", "s24": 228, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 79616, "abuse": "abuse@velia.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.02503299297958}, {"a": 30277, "h": "DFW-DATACENTER", "n": "DFW Datacenter", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 1, "p": 0.1306, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.197, 0.012, 0, false]], "sh": false, "uc": 1326.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 0.217, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.197, "se": 1.227, "ts": 1.000, "map": 1.450, "obs": 1, "own": 0.322, "comp": {"cins": 4.8728, "dshield": -0.3779, "crowdsec": -1.4948, "vulncheck": -0.3709, "blocklist_de": -0.8643}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.557, "det": {"shodan": {"compromised": 1}}, "oid": "TMS-52-ARIN", "org": "DFW Datacenter", "pdb": null, "pfx": 19, "reg": "2003-08-25", "rir": "arin", "s24": 86, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30341, "h": "SCTA-ASN", "n": "South Central Telephone Association", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"compromised": 1}}, "oid": "SCTA-ARIN", "org": "South Central Telephone Association", "pdb": null, "pfx": 3, "reg": "2005-09-22", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "network-abuse@sctelcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30377, "h": "MACST-DUB", "n": "MacStadium, Inc.", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 3, "web_bruteforce": 5, "mail_bruteforce": 5}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.7821, "hi": 8.60, "lo": 1.85, "ips": 5, "mean": 4.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1879, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 14.332, 0.011, 1, false], ["2026-10-12", 11.663, 0.012, 1, false]], "sh": false, "uc": 2604.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 11.663, "se": 0.618, "ts": 0.800, "map": 27.629, "obs": 5, "own": 15.618, "comp": {"cins": -0.7619, "dshield": -1.3816, "crowdsec": 7.2993, "vulncheck": -0.7659, "blocklist_de": 0.3226}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.815, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "MACST-2-ARIN", "org": "MacStadium, Inc.", "pdb": null, "pfx": 7, "reg": "2017-11-07", "rir": "arin", "s24": 24, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@macstadium.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023922124227}, {"a": 30455, "h": "HOSTVENOM-LLC", "n": "HostVenom", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.664, "det": {"shodan": {"compromised": 2}}, "oid": "HL-52-ARIN", "org": "HostVenom LLC", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.hostvenom.com/"}, "pfx": 14, "reg": "2014-05-07", "rir": "arin", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@hostvenom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30475, "h": "WEHOSTWEBSITES-COM", "n": "Handy Networks, LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.5456, "hi": 6.20, "lo": 1.33, "ips": 4, "mean": 3.39, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.172, "obs": 0, "own": 0.167, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.699, "ts": null, "map": 0.116, "obs": 0, "own": 0.038, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.942, "det": {"shodan": {"compromised": 4}}, "oid": "WEHOST-1-ARIN", "org": "Handy Networks, LLC", "pdb": null, "pfx": 30, "reg": "2003-10-16", "rir": "arin", "s24": 223, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58880, "abuse": "abuse@wehostwebsites.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30600, "h": "AS-CMN", "n": "Cinergy Metronet", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.01, "waf": 0.88}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0525, "hi": 3.04, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.05, "lo": 0.08, "ips": 1, "mean": 0.44, "above": false}, "blocklist_de": {"n": 2, "p": 0.0241, "hi": 2.60, "lo": 0.34, "ips": 2, "mean": 1.24, "above": false}}, "h2": [["2026-10-05", 0.081, 0.008, 0, false], ["2026-10-12", 0.257, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.121, "obs": 0, "own": 0.583, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.257, "se": 0.644, "ts": 0.500, "map": 0.624, "obs": 4, "own": 0.976, "comp": {"cins": 3.2497, "dshield": -1.5761, "crowdsec": -3.2747, "vulncheck": -0.8058, "blocklist_de": 3.3293}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.146, "det": {"blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "CINER-3-ARIN", "org": "Metronet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.metronet.com"}, "pfx": 207, "reg": "2009-04-29", "rir": "arin", "s24": 1329, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 513280, "abuse": "abuse@metronetinc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.072447}, {"a": 30619, "h": "TMCEL-Mocambique", "n": "Telecomunicacoes de Mocambique", "t": "Broadband & mobile", "w": 1, "cc": "MZ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1737, "hi": 4.47, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.157, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.998, "ts": null, "map": 0.183, "obs": 0, "own": 1.313, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.157, "se": 1.195, "ts": 1.000, "map": 1.090, "obs": 1, "own": 1.870, "comp": {"cins": -0.1629, "dshield": 4.3219, "crowdsec": -1.4668, "vulncheck": -0.3659, "blocklist_de": -0.8469}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.271, "det": null, "oid": "ORG-TMTS1-AFRINIC", "org": "TMCEL - Moçambique Telecom, SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.tmcel.mz"}, "pfx": 33, "reg": "2024-11-14", "rir": "afrinic", "s24": 112, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00227973839079}, {"a": 30633, "h": "LEASEWEB-USA-WDC", "n": "LeaseWeb USA / WDC-02", "t": "Hosting & VPS", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 2, "web_exploit": 4, "bad_crawling": 4, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.0086, "hi": 2.09, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "crowdsec": {"n": 7, "p": 0.4903, "hi": 5.10, "lo": 1.54, "ips": 7, "mean": 3.10, "above": false}, "vulncheck": {"n": 2, "p": 0.2478, "hi": 4.80, "lo": 0.62, "ips": 2, "mean": 2.29, "above": false}, "phishing_db": {"n": 1, "p": 0.1015, "hi": 3.68, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 1.486, 0.122, 0, false], ["2026-10-12", 0.990, 0.128, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.128, "se": 1.371, "ts": 1.000, "map": 0.843, "obs": 1, "own": 0.396, "comp": {"urlhaus": -0.3141, "threatfox": -0.284, "phishing_db": 2.0533}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.990, "se": 0.513, "ts": 0.778, "map": 1.932, "obs": 9, "own": 0.382, "comp": {"cins": -1.1724, "dshield": -1.8659, "crowdsec": 10.0099, "vulncheck": 0.8101, "blocklist_de": -5.7297}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 87, "reg": "2010-09-29", "rir": "arin", "s24": 594, "sib": 9, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 152064, "abuse": "abuse@us.leaseweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04547582632124}, {"a": 30689, "h": "FLOW-NET", "n": "FLOW", "t": "Broadband & mobile", "w": 5, "cc": "JM", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0859, "hi": 3.49, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "crowdsec": {"n": 2, "p": 0.0107, "hi": 2.27, "lo": 0.29, "ips": 2, "mean": 1.08, "above": false}, "vulncheck": {"n": 1, "p": 0.0880, "hi": 3.51, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "blocklist_de": {"n": 1, "p": 0.0358, "hi": 2.77, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}}, "h2": [["2026-10-05", 0.330, 0.009, 0, false], ["2026-10-12", 0.475, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.869, "ts": null, "map": 0.144, "obs": 0, "own": 0.752, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.475, "se": 0.612, "ts": 0.400, "map": 1.099, "obs": 5, "own": 1.720, "comp": {"cins": -0.8273, "dshield": 1.6251, "crowdsec": 0.3562, "vulncheck": 0.4114, "blocklist_de": -0.0776}, "mass": 4.1, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1}}, "oid": "CCJL-ARIN", "org": "FLOW", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Selective", "web": "https://discoverflow.co/jamaica/"}, "pfx": 193, "reg": "2003-12-05", "rir": "arin", "s24": 667, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 192000, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.013831413442}, {"a": 30722, "h": "VODAFONE-IT-ASN", "n": "Vodafone Italy", "t": "Broadband & mobile", "w": 32, "cc": "IT", "cf": {"rb": "hi", "wb": "hi", "rep": 0.44, "waf": 0.38}, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 6, "web_bruteforce": 7, "home_connection": 11, "mail_bruteforce": 5}, "n": 13}, "ev": {"cins": {"n": 3, "p": 0.0000, "hi": 0.76, "lo": 0.13, "ips": 3, "mean": 0.39, "above": false}, "shodan": {"n": 6, "p": 0.0000, "hi": 0.25, "lo": 0.07, "ips": 6, "mean": 0.15, "above": false}, "dshield": {"n": 7, "p": 0.0000, "hi": 1.03, "lo": 0.31, "ips": 7, "mean": 0.63, "above": false}, "urlhaus": {"n": 1, "p": 0.0012, "hi": 1.57, "lo": 0.12, "ips": 1, "mean": 0.66, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 0.35, "lo": 0.14, "ips": 13, "mean": 0.24, "above": false}, "threatfox": {"n": 2, "p": 0.0002, "hi": 1.45, "lo": 0.19, "ips": 2, "mean": 0.69, "above": false}, "blocklist_de": {"n": 11, "p": 0.0000, "hi": 0.75, "lo": 0.28, "ips": 11, "mean": 0.49, "above": false}}, "h2": [["2026-10-05", 0.161, 0.055, 0, false], ["2026-10-12", 0.206, 0.059, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 0.059, "se": 1.133, "ts": 0.667, "map": 0.211, "obs": 3, "own": 0.697, "comp": {"urlhaus": 0.7021, "threatfox": 0.4473, "phishing_db": -1.0776}, "mass": 8.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 7, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 11}, "lo": 0.206, "se": 0.405, "ts": 0.382, "map": 0.329, "obs": 34, "own": 0.509, "comp": {"cins": 1.7976, "dshield": 1.5941, "crowdsec": -3.5411, "vulncheck": -0.9867, "blocklist_de": 1.4173}, "mass": 39.9, "listed": false}}, "abq": false, "bot": 0.106, "det": {"shodan": {"c2": 2, "compromised": 3, "doublepulsar": 1}, "threatfox": {"family:Brute Ratel C4": 2}, "blocklist_de": {"ssh": 2, "bots": 6, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-FA7-RIPE", "org": "Fastweb SpA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.vodafone.it"}, "pfx": 284, "reg": "2003-11-17", "rir": "ripencc", "s24": 21781, "sib": 3, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7095552, "abuse": "abuse@fastweb.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.167732}, {"a": 30764, "h": "PODA-AS", "n": "PODA", "t": "Broadband & mobile", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0096, "hi": 2.23, "lo": 0.29, "ips": 2, "mean": 1.06, "above": false}, "urlhaus": {"n": 1, "p": 0.1665, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.005, 0.161, 0, false], ["2026-10-12", 0.005, 0.177, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.177, "se": 1.400, "ts": 1.000, "map": 1.314, "obs": 1, "own": 3.779, "comp": {"urlhaus": 3.0778, "threatfox": -0.3993, "phishing_db": -0.7794}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.527, "ts": null, "map": 0.059, "obs": 0, "own": 0.126, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.172, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-PS2-RIPE", "org": "PODA a.s.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.poda.cz"}, "pfx": 16, "reg": "2003-11-27", "rir": "ripencc", "s24": 852, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 219392, "abuse": "abuse@poda.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0046437490608}, {"a": 30823, "h": "AUROLOGIC", "n": "aurologic GmbH", "t": "Transit & backbone", "w": 11, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.5914, "hi": 7.16, "lo": 1.26, "ips": 3, "mean": 3.69, "above": false}, "crowdsec": {"n": 2, "p": 0.3572, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "threatfox": {"n": 2, "p": 0.4192, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "phishing_db": {"n": 4, "p": 0.8056, "hi": 8.98, "lo": 1.93, "ips": 7, "mean": 4.91, "above": true}}, "h2": [["2026-10-05", 1.280, 19.906, 1, false], ["2026-10-12", 1.359, 16.393, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 4}, "lo": 16.393, "se": 0.829, "ts": 0.667, "map": 41.851, "obs": 6, "own": 132.810, "comp": {"urlhaus": -0.8389, "threatfox": 1.8671, "phishing_db": 4.3321}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.359, "se": 0.935, "ts": 1.000, "map": 5.783, "obs": 2, "own": 18.821, "comp": {"cins": -0.292, "dshield": -0.63, "crowdsec": 6.0945, "vulncheck": -0.5181, "blocklist_de": -1.5059}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.705, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:Havoc": 1, "family:Cobalt Strike": 1}}, "oid": "ORG-CISU3-RIPE", "org": "aurologic GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.aurologic.com"}, "pfx": 31, "reg": "2015-09-09", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 1, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.0810]], "ipv4": 11008, "abuse": "abuse@aurologic.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00107705530294}, {"a": 30844, "h": "LIQUID-AS", "n": "Liquid Intelligent Technologies", "t": "Transit & backbone", "w": 12, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 4, "proxy_or_vpn": 5, "ssh_bruteforce": 3, "web_bruteforce": 8, "home_connection": 3, "mail_bruteforce": 5, "router_or_botnet": 6, "cve:CVE-2025-4396": 1}, "n": 10}, "ev": {"shodan": {"n": 2, "p": 0.0028, "hi": 1.89, "lo": 0.25, "ips": 2, "mean": 0.90, "above": false}, "dshield": {"n": 2, "p": 0.1456, "hi": 3.96, "lo": 0.51, "ips": 2, "mean": 1.89, "above": false}, "crowdsec": {"n": 10, "p": 0.3787, "hi": 4.35, "lo": 1.58, "ips": 10, "mean": 2.82, "above": false}, "blocklist_de": {"n": 3, "p": 0.1111, "hi": 3.57, "lo": 0.63, "ips": 3, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 1.652, 0.008, 0, false], ["2026-10-12", 1.298, 0.009, 0, false]], "sh": false, "uc": 873.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.128, "obs": 0, "own": 0.893, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.298, "se": 0.447, "ts": 0.667, "map": 2.263, "obs": 15, "own": 7.089, "comp": {"cins": -1.9385, "dshield": 0.6281, "crowdsec": 5.605, "vulncheck": -0.9345, "blocklist_de": -1.1498}, "mass": 13.7, "listed": false}}, "abq": false, "bot": 0.150, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-ESSL1-RIPE", "org": "Liquid Telecommunications Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.liquid.tech"}, "pfx": 290, "reg": "2003-12-18", "rir": "ripencc", "s24": 1092, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 543744, "abuse": "abuse@liquidtelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00861028921848}, {"a": 30848, "h": "IT-TWT-AS", "n": "TWT SpA", "t": "Broadband & mobile", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0162, "hi": 2.34, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 0.175, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.894, "ts": null, "map": 0.154, "obs": 0, "own": 0.843, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.599, "ts": null, "map": 0.081, "obs": 0, "own": 0.185, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.214, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-TWTS1-RIPE", "org": "UNIDATA S.p.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.twt.it"}, "pfx": 65, "reg": "2003-12-19", "rir": "ripencc", "s24": 480, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 122880, "abuse": "abuse@twt.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00286210520275}, {"a": 30851, "h": "SILEMAN-RUDASL-AS", "n": "Sileman Sp. z o.o.", "t": "Transit & backbone", "w": 2, "cc": "PL", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1009, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}, "crowdsec": {"n": 2, "p": 0.2249, "hi": 4.62, "lo": 0.60, "ips": 2, "mean": 2.20, "above": false}}, "h2": [["2026-10-05", 0.480, 0.010, 0, false], ["2026-10-12", 0.504, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 1.768, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.504, "se": 0.887, "ts": 1.000, "map": 1.953, "obs": 2, "own": 6.327, "comp": {"cins": -0.3421, "dshield": -0.7236, "crowdsec": 5.449, "vulncheck": -0.5613, "blocklist_de": -1.7592}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.190, "det": {"shodan": {"malware": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-SGMI1-RIPE", "org": "Sileman Sp. z o.o.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Restrictive", "web": "http://sileman.pl/"}, "pfx": 29, "reg": "2003-12-19", "rir": "ripencc", "s24": 137, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 61696, "abuse": "abuse@sileman.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00052316401722}, {"a": 30855, "h": "Tele-plus-AS", "n": "Tele-plus LLC", "t": "Other", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "vulncheck": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 6, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1751, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-12", 2.005, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 0.636, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.005, "se": 0.781, "ts": 0.333, "map": 6.278, "obs": 3, "own": 3.673, "comp": {"cins": -0.4178, "dshield": -0.8579, "crowdsec": 0.5729, "vulncheck": 1.4508, "blocklist_de": 2.4827}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.454, "det": {"vulncheck": {"botnet_node": 6}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TL6-RIPE", "org": "Tele-plus LLC", "pdb": null, "pfx": 4, "reg": "2003-12-19", "rir": "ripencc", "s24": 53, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": "abuse@tele-plus.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30860, "h": "YURTEH-AS", "n": "Virtual Systems AS30860", "t": "Other", "w": 17, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "web_bruteforce": 4, "cve:CVE-2024-0204": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2024-34351": 1, "cve:CVE-2025-32355": 1}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.3515, "hi": 5.66, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}, "crowdsec": {"n": 4, "p": 0.7400, "hi": 8.02, "lo": 1.73, "ips": 4, "mean": 4.38, "above": false}, "threatfox": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}, "phishing_db": {"n": 6, "p": 0.9624, "hi": 11.54, "lo": 3.20, "ips": 10, "mean": 6.82, "above": true}, "blocklist_de": {"n": 1, "p": 0.1751, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 13.213, 15.642, 1, false], ["2026-10-12", 5.629, 15.608, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 6}, "lo": 15.608, "se": 0.808, "ts": 0.857, "map": 38.208, "obs": 7, "own": 34.392, "comp": {"urlhaus": -0.9793, "threatfox": 0.5115, "phishing_db": 5.737}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.629, "se": 0.612, "ts": 0.800, "map": 13.192, "obs": 5, "own": 7.468, "comp": {"cins": -0.796, "dshield": -1.4269, "crowdsec": 6.8582, "vulncheck": -0.7758, "blocklist_de": 0.1137}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.920, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Cobalt Strike": 3}, "blocklist_de": {"bots": 1}}, "oid": "ORG-VSL22-RIPE", "org": "Virtual Systems LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Tbps", "pol": "Open", "web": "https://vsys.host/"}, "pfx": 44, "reg": "2003-12-23", "rir": "ripencc", "s24": 53, "sib": 2, "tor": 2, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 13568, "abuse": "abuse@v-sys.org", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00137704711941}, {"a": 30881, "h": "TENSOR-AS", "n": "MTS PJSC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0808, "hi": 3.42, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}}, "h2": [["2026-10-05", 0.483, 0.010, 0, false], ["2026-10-12", 0.132, 0.011, 0, false]], "sh": false, "uc": 280.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 0.493, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.132, "se": 1.175, "ts": 1.000, "map": 0.889, "obs": 1, "own": 0.555, "comp": {"cins": -0.1717, "dshield": -0.3895, "crowdsec": 3.1089, "vulncheck": -0.3789, "blocklist_de": -0.8925}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.448, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": null, "pfx": 25, "reg": "2004-01-05", "rir": "ripencc", "s24": 145, "sib": 95, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 62720, "abuse": "abuse@mtu.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005422378731}, {"a": 30893, "h": "NOACKHOSTING-AS", "n": "no ack hosting network", "t": "Hosting & VPS", "w": 5, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 3, "web_exploit": 5, "bad_crawling": 4, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2021-3129": 1, "cve:CVE-2025-4396": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2024-38475": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 4, "p": 0.7948, "hi": 8.80, "lo": 1.89, "ips": 5, "mean": 4.81, "above": true}}, "h2": [["2026-10-05", 11.065, 0.011, 1, false], ["2026-10-12", 11.657, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.309, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.657, "se": 0.684, "ts": 1.000, "map": 31.173, "obs": 4, "own": 6.158, "comp": {"cins": -0.5657, "dshield": -1.0991, "crowdsec": 10.0607, "vulncheck": -0.6943, "blocklist_de": -2.8684}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.598, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-NAHA3-RIPE", "org": "No ACK Group Holding AB", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://noackhosting.com"}, "pfx": 12, "reg": "2004-01-07", "rir": "ripencc", "s24": 15, "sib": 1, "tor": 3, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "abuse@no-ack.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00145897281676}, {"a": 30922, "h": "MTS-FBN-Siberia-AS", "n": "MTS PJSC", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1575, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 1, "p": 0.0600, "hi": 3.15, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "blocklist_de": {"n": 2, "p": 0.3003, "hi": 5.23, "lo": 0.68, "ips": 2, "mean": 2.49, "above": false}}, "h2": [["2026-10-05", 0.389, 0.010, 0, false], ["2026-10-12", 1.360, 0.011, 0, false]], "sh": false, "uc": 287, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.963, "ts": null, "map": 0.175, "obs": 0, "own": 0.456, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.360, "se": 0.659, "ts": 0.500, "map": 3.444, "obs": 4, "own": 1.962, "comp": {"cins": -0.7569, "dshield": 1.8532, "crowdsec": -2.2015, "vulncheck": -0.7644, "blocklist_de": 4.4999}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.447, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": null, "pfx": 16, "reg": "2004-01-16", "rir": "ripencc", "s24": 191, "sib": 95, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50688, "abuse": "abuse@mtu.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00150535963655}, {"a": 30938, "h": "abstation", "n": "ahbr company limited", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.461, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ACL21-RIPE", "org": "ahbr company limited", "pdb": null, "pfx": 5, "reg": "2015-05-20", "rir": "ripencc", "s24": 11, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "info@abstation.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 30962, "h": "COMTRANCE-AS", "n": "comtrance GmbH", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 13, "p": 1.0000, "hi": 17.21, "lo": 7.05, "ips": 13, "mean": 11.66, "above": true}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 1.955, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.159, "obs": 0, "own": 1.018, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.907, "det": {"shodan": {"compromised": 13}}, "oid": "ORG-CSG21-RIPE", "org": "comtrance service GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.comtrance.net"}, "pfx": 20, "reg": "2006-05-02", "rir": "ripencc", "s24": 94, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 28672, "abuse": "abuse@comtrance.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 30982, "h": "CAFENET", "n": "CAFE Informatique et telecommunications", "t": "Broadband & mobile", "w": 4, "cc": "TG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2012-0392": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2014-8739": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 2, "mean": 1.84, "above": false}, "vulncheck": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 9.136, 0.011, 0, false], ["2026-10-12", 3.111, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 3.111, "se": 0.791, "ts": 0.333, "map": 9.853, "obs": 3, "own": 15.764, "comp": {"cins": -0.3978, "dshield": -0.8232, "crowdsec": 0.7599, "vulncheck": 1.5317, "blocklist_de": 2.6109}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.493, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CIET1-AFRINIC", "org": "CAFE Informatique et telecommunications", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.cafe.tg"}, "pfx": 32, "reg": "2014-01-24", "rir": "afrinic", "s24": 32, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003415447607}, {"a": 30983, "h": "MARWAN-AS", "n": "MARWAN - Moroccan Academic Network", "t": "Enterprise, edu & gov", "w": 1, "cc": "MA", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1307, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.199, 0.011, 0, false], ["2026-10-12", 0.209, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 2.503, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.209, "se": 1.234, "ts": 1.000, "map": 1.570, "obs": 1, "own": 9.920, "comp": {"cins": -0.1451, "dshield": -0.3329, "crowdsec": 3.4165, "vulncheck": -0.3384, "blocklist_de": -0.7556}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CNPL1-AFRINIC", "org": "CNRST (Centre National pour la Recherche Scientifique et Technique)", "pdb": {"t": "Educational/Research", "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "https://marwan.ma"}, "pfx": 7, "reg": "2004-05-21", "rir": "afrinic", "s24": 69, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00031849718901}, {"a": 30985, "h": "IKATELNET", "n": "Orange Mali", "t": "Broadband & mobile", "w": 1, "cc": "ML", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0519, "hi": 3.03, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}}, "h2": [["2026-10-12", 0.104, 0.011, 0, false]], "sh": false, "uc": 166.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.955, "ts": null, "map": 0.173, "obs": 0, "own": 1.095, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.104, "se": 1.146, "ts": 1.000, "map": 0.658, "obs": 1, "own": 1.113, "comp": {"cins": -0.1861, "dshield": -0.4195, "crowdsec": 2.9459, "vulncheck": -0.3989, "blocklist_de": -0.9662}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.165, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-IS28-AFRINIC", "org": "Orange Mali SA", "pdb": null, "pfx": 127, "reg": "2004-06-09", "rir": "afrinic", "s24": 213, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 88576, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00745888214712}, {"a": 30986, "h": "SCANCOM", "n": "Scancom", "t": "Broadband & mobile", "w": 5, "cc": "GH", "cf": {"rb": "hi", "wb": "hi", "rep": 1.21, "waf": 1.06}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0006, "hi": 1.46, "lo": 0.11, "ips": 1, "mean": 0.62, "above": false}, "blocklist_de": {"n": 3, "p": 0.0001, "hi": 1.42, "lo": 0.25, "ips": 4, "mean": 0.73, "above": false}}, "h2": [["2026-10-05", 0.013, 0.006, 0, false], ["2026-10-12", 0.089, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.732, "ts": null, "map": 0.082, "obs": 0, "own": 0.370, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.089, "se": 0.634, "ts": 0.750, "map": 0.213, "obs": 4, "own": 0.334, "comp": {"cins": -0.9646, "dshield": 1.2098, "crowdsec": -6.4018, "vulncheck": -0.817, "blocklist_de": 6.8227}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.066, "det": {"blocklist_de": {"bots": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SL39-AFRINIC", "org": "Scancom Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.mtn.com.gh"}, "pfx": 294, "reg": "2004-06-14", "rir": "afrinic", "s24": 4161, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1586432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.060421}, {"a": 30988, "h": "ISInternetSolutions", "n": "Dimension Data Nigeria", "t": "Transit & backbone", "w": 1, "cc": "NG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1421, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "crowdsec": {"n": 1, "p": 0.1307, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "blocklist_de": {"n": 1, "p": 0.1684, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 1.929, 0.011, 0, false], ["2026-10-12", 0.931, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 2.110, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.931, "se": 0.917, "ts": 0.500, "map": 3.820, "obs": 2, "own": 12.427, "comp": {"cins": -0.3375, "dshield": -0.7151, "crowdsec": 1.3438, "vulncheck": -0.5575, "blocklist_de": 3.0002}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.268, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AA74-AFRINIC", "org": "IS InternetSolutions Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.dimensiondata.com/"}, "pfx": 71, "reg": "2004-07-01", "rir": "afrinic", "s24": 69, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014614777422}, {"a": 30992, "h": "MTN-NS-CAMEROON", "n": "MTN Cameroon", "t": "Broadband & mobile", "w": 6, "cc": "CM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2022-26134": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.3152, "hi": 5.35, "lo": 0.69, "ips": 2, "mean": 2.55, "above": false}, "urlhaus": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 2, "p": 0.0815, "hi": 3.36, "lo": 0.44, "ips": 2, "mean": 1.60, "above": false}, "blocklist_de": {"n": 2, "p": 0.2302, "hi": 4.66, "lo": 0.61, "ips": 2, "mean": 2.22, "above": false}}, "h2": [["2026-10-12", 1.442, 0.277, 0, false]], "sh": false, "uc": 72.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.277, "se": 1.457, "ts": 1.000, "map": 2.337, "obs": 1, "own": 6.741, "comp": {"urlhaus": 3.4893, "threatfox": -0.3469, "phishing_db": -0.6672}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.442, "se": 0.566, "ts": 0.333, "map": 3.051, "obs": 6, "own": 4.725, "comp": {"cins": -1.0579, "dshield": 3.6384, "crowdsec": -1.5132, "vulncheck": -0.8354, "blocklist_de": 2.2772}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.096, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-GNC2-AFRINIC", "org": "MTN Network Solutions (Cameroon)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.mtn.cm"}, "pfx": 139, "reg": "2010-02-12", "rir": "afrinic", "s24": 328, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 128256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01189568399733}, {"a": 30998, "h": "NAL-AS", "n": "Netcom Africa", "t": "Broadband & mobile", "w": 4, "cc": "NG", "cf": null, "cs": {"c": {"data_centre": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1920, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.1847, "hi": 4.29, "lo": 0.56, "ips": 2, "mean": 2.04, "above": false}, "blocklist_de": {"n": 1, "p": 0.1291, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 1.274, 0.333, 0, false], ["2026-10-12", 0.885, 0.360, 0, false]], "sh": false, "uc": 736.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.360, "se": 1.501, "ts": 1.000, "map": 3.330, "obs": 1, "own": 9.747, "comp": {"urlhaus": 3.7216, "threatfox": -0.3074, "phishing_db": -0.5849}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.885, "se": 0.741, "ts": 0.667, "map": 2.580, "obs": 3, "own": 4.047, "comp": {"cins": -0.5513, "dshield": -1.0767, "crowdsec": 3.0234, "vulncheck": -0.6878, "blocklist_de": 1.6337}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.649, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NAL1-AFRINIC", "org": "Netcom Africa Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.netcomafrica.com"}, "pfx": 217, "reg": "2005-03-09", "rir": "afrinic", "s24": 176, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 130304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018156615044}, {"a": 31027, "h": "GlobalConnect-AS31027", "n": "GlobalConnect AS31027", "t": "Transit & backbone", "w": 2, "cc": "DK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.0051, "hi": 2.19, "lo": 0.47, "ips": 4, "mean": 1.19, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 1.27, "lo": 0.16, "ips": 2, "mean": 0.60, "above": false}}, "h2": [["2026-10-05", 0.069, 0.008, 0, false], ["2026-10-12", 0.071, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.806, "ts": null, "map": 0.117, "obs": 0, "own": 0.793, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.071, "se": 0.817, "ts": 1.000, "map": 0.239, "obs": 2, "own": 0.772, "comp": {"cins": -0.4444, "dshield": -0.9034, "crowdsec": 4.2124, "vulncheck": -0.6318, "blocklist_de": -2.2706}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"malware": 1, "doublepulsar": 3}}, "oid": "ORG-GA85-RIPE", "org": "GlobalConnect A/S", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "http://globalconnect.net/"}, "pfx": 126, "reg": "2004-02-10", "rir": "ripencc", "s24": 1491, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 384000, "abuse": "abuse@globalconnect.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00977797151773}, {"a": 31029, "h": "M-REAL", "n": "M-REAL NET", "t": "Transit & backbone", "w": 3, "cc": "BG", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3848, "hi": 5.95, "lo": 0.77, "ips": 3, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 1.093, 0.011, 0, false], ["2026-10-12", 1.196, 0.012, 0, false]], "sh": false, "uc": 688.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 2.224, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.196, "se": 0.931, "ts": 1.000, "map": 5.036, "obs": 2, "own": 16.414, "comp": {"cins": -0.3533, "dshield": -0.744, "crowdsec": -2.9333, "vulncheck": -0.57, "blocklist_de": 7.6109}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.169, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-MRN1-RIPE", "org": "M-REAL NET Ltd.", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.m-real.net"}, "pfx": 20, "reg": "2004-02-11", "rir": "ripencc", "s24": 55, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024423429108}, {"a": 31034, "h": "ARUBA-ASN", "n": "Aruba", "t": "Hosting & VPS", "w": 14, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 9, "web_exploit": 9, "proxy_or_vpn": 8, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 9, "cve:CVE-2024-28000": 1, "cve:CVE-2025-22457": 1}, "n": 9}, "ev": {"shodan": {"n": 12, "p": 0.7843, "hi": 5.79, "lo": 2.29, "ips": 12, "mean": 3.87, "above": false}, "crowdsec": {"n": 9, "p": 0.2600, "hi": 3.99, "lo": 1.38, "ips": 9, "mean": 2.54, "above": false}, "vulncheck": {"n": 1, "p": 0.0503, "hi": 3.00, "lo": 0.23, "ips": 1, "mean": 1.27, "above": false}, "phishing_db": {"n": 4, "p": 0.5098, "hi": 5.95, "lo": 1.28, "ips": 4, "mean": 3.25, "above": false}}, "h2": [["2026-10-05", 1.114, 0.587, 0, false], ["2026-10-12", 0.692, 0.598, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 0.598, "se": 0.977, "ts": 1.000, "map": 1.779, "obs": 4, "own": 0.739, "comp": {"urlhaus": -0.9585, "threatfox": -0.465, "phishing_db": 3.6256}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.692, "se": 0.493, "ts": 0.900, "map": 1.280, "obs": 10, "own": 0.253, "comp": {"cins": -1.3614, "dshield": -2.0511, "crowdsec": 11.8169, "vulncheck": -0.1846, "blocklist_de": -6.5791}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.961, "det": {"shodan": {"compromised": 11, "doublepulsar": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "ORG-TS9-RIPE", "org": "Aruba S.p.A.", "pdb": {"t": "Content", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.aruba.it/"}, "pfx": 98, "reg": "2004-02-12", "rir": "ripencc", "s24": 1104, "sib": 7, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 283648, "abuse": "abuse@staff.aruba.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0056778270035}, {"a": 31042, "h": "YETTEL-AS", "n": "Serbia BroadBand", "t": "Broadband & mobile", "w": 12, "cc": "RS", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.92, "lo": 0.07, "ips": 1, "mean": 0.39, "above": false}, "dshield": {"n": 2, "p": 0.0562, "hi": 3.08, "lo": 0.40, "ips": 2, "mean": 1.47, "above": false}, "urlhaus": {"n": 1, "p": 0.1320, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "crowdsec": {"n": 6, "p": 0.0008, "hi": 1.93, "lo": 0.53, "ips": 6, "mean": 1.14, "above": false}, "vulncheck": {"n": 1, "p": 0.0166, "hi": 2.35, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "blocklist_de": {"n": 3, "p": 0.0181, "hi": 2.52, "lo": 0.44, "ips": 3, "mean": 1.30, "above": false}}, "h2": [["2026-10-05", 0.574, 0.007, 0, false], ["2026-10-12", 0.567, 0.117, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.117, "se": 1.363, "ts": 1.000, "map": 0.780, "obs": 1, "own": 2.280, "comp": {"urlhaus": 2.6757, "threatfox": -0.4365, "phishing_db": -0.8611}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.567, "se": 0.474, "ts": 0.500, "map": 1.028, "obs": 12, "own": 1.592, "comp": {"cins": -1.7061, "dshield": 1.2903, "crowdsec": 1.5685, "vulncheck": -0.4025, "blocklist_de": 0.6714}, "mass": 11.1, "listed": false}}, "abq": false, "bot": 0.155, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SKMS1-RIPE", "org": "Yettel d.o.o.", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://yettel.rs"}, "pfx": 23, "reg": "2004-02-12", "rir": "ripencc", "s24": 1937, "sib": 2, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 562432, "abuse": "abuse@yettel.rs", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.030897340812}, {"a": 31103, "h": "KEYWEB-AS", "n": "Keyweb", "t": "Hosting & VPS", "w": 9, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 7, "web_exploit": 9, "bad_crawling": 5, "proxy_or_vpn": 9, "web_bruteforce": 9, "home_connection": 1, "cve:CVE-2018-20062": 6, "cve:CVE-2021-26086": 2, "cve:CVE-2021-41773": 4, "cve:CVE-2021-44228": 2, "cve:CVE-2024-28000": 2}, "n": 9}, "ev": {"shodan": {"n": 2, "p": 0.2467, "hi": 4.79, "lo": 0.62, "ips": 2, "mean": 2.28, "above": false}, "crowdsec": {"n": 6, "p": 0.8706, "hi": 8.52, "lo": 2.36, "ips": 9, "mean": 5.03, "above": true}}, "h2": [["2026-10-05", 1.984, 0.010, 0, false], ["2026-10-12", 2.655, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.655, "se": 0.566, "ts": 1.000, "map": 5.721, "obs": 6, "own": 1.127, "comp": {"cins": -0.924, "dshield": -1.5882, "crowdsec": 11.0416, "vulncheck": -0.8081, "blocklist_de": -4.5836}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.926, "det": {"shodan": {"c2": 2}}, "oid": "ORG-KA2-RIPE", "org": "Keyweb AG", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.keyweb.de"}, "pfx": 39, "reg": "2004-02-27", "rir": "ripencc", "s24": 147, "sib": 1, "tor": 7, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41728, "abuse": "abuse@keyweb.de", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 31115, "h": "INTRED-AS", "n": "Intred SpA", "t": "Broadband & mobile", "w": 1, "cc": "IT", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0897, "hi": 3.54, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}, "crowdsec": {"n": 1, "p": 0.0733, "hi": 3.33, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}}, "h2": [["2026-10-12", 0.125, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.975, "ts": null, "map": 0.178, "obs": 0, "own": 1.190, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.125, "se": 1.167, "ts": 1.000, "map": 0.824, "obs": 1, "own": 1.402, "comp": {"cins": -0.1754, "dshield": -0.3971, "crowdsec": 3.0674, "vulncheck": -0.3841, "blocklist_de": -0.9112}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.208, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-IS25-RIPE", "org": "INTRED S.p.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.intred.it"}, "pfx": 65, "reg": "2004-03-02", "rir": "ripencc", "s24": 160, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 87296, "abuse": "abuse@intred.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00285494642325}, {"a": 31126, "h": "SODETEL-AS", "n": "SODETEL S.A.L.", "t": "Broadband & mobile", "w": 1, "cc": "LB", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1399, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-12", 0.086, 0.011, 0, false]], "sh": false, "uc": 159.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.933, "ts": null, "map": 0.167, "obs": 0, "own": 1.000, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.086, "se": 1.126, "ts": 1.000, "map": 0.523, "obs": 1, "own": 0.880, "comp": {"cins": -0.198, "dshield": 4.1416, "crowdsec": -1.7558, "vulncheck": -0.4148, "blocklist_de": -1.0274}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "ORG-SS58-RIPE", "org": "SODETEL S.A.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Selective", "web": "https://www.sodetel.net.lb/"}, "pfx": 240, "reg": "2004-03-04", "rir": "ripencc", "s24": 286, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 116992, "abuse": "noc@sodetel.net.lb", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006613960122}, {"a": 31133, "h": "MF-MGSM-AS", "n": "MegaFon", "t": "Transit & backbone", "w": 19, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 13, "p": 0.9987, "hi": 11.61, "lo": 4.75, "ips": 15, "mean": 7.86, "above": true}, "urlhaus": {"n": 1, "p": 0.1467, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 2, "p": 0.0001, "hi": 1.30, "lo": 0.17, "ips": 2, "mean": 0.62, "above": false}, "blocklist_de": {"n": 2, "p": 0.0180, "hi": 2.47, "lo": 0.32, "ips": 2, "mean": 1.18, "above": false}}, "h2": [["2026-10-05", 0.266, 0.123, 0, false], ["2026-10-12", 1.112, 0.135, 0, false]], "sh": false, "uc": 910.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.135, "se": 1.375, "ts": 1.000, "map": 0.941, "obs": 1, "own": 3.881, "comp": {"urlhaus": 2.8231, "threatfox": -0.4241, "phishing_db": -0.8337}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 13, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.112, "se": 0.437, "ts": 0.765, "map": 1.869, "obs": 17, "own": 5.856, "comp": {"cins": -2.0384, "dshield": 16.5603, "crowdsec": -7.1254, "vulncheck": -0.9411, "blocklist_de": -4.436}, "mass": 15.0, "listed": false}}, "abq": false, "bot": 0.358, "det": {"blocklist_de": {"bots": 1, "mail": 1}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "http://www.megafon.ru"}, "pfx": 484, "reg": "2004-03-05", "rir": "ripencc", "s24": 1447, "sib": 39, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 973824, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.013937077231}, {"a": 31163, "h": "MF-KAVKAZ-AS", "n": "PJSC MegaFon", "t": "Other", "w": 6, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.5454, "hi": 6.72, "lo": 1.18, "ips": 3, "mean": 3.47, "above": false}, "urlhaus": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.0324, "hi": 2.70, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 0.083, 0.271, 0, false], ["2026-10-12", 0.836, 0.295, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.295, "se": 1.467, "ts": 1.000, "map": 2.541, "obs": 1, "own": 2.962, "comp": {"urlhaus": 3.5457, "threatfox": -0.3381, "phishing_db": -0.6488}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.836, "se": 0.652, "ts": 0.750, "map": 2.085, "obs": 4, "own": 1.188, "comp": {"cins": -0.693, "dshield": 8.7826, "crowdsec": -1.7308, "vulncheck": -0.7439, "blocklist_de": -3.4864}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.476, "det": null, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 246, "reg": "2004-03-11", "rir": "ripencc", "s24": 284, "sib": 39, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 74496, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00312433972235}, {"a": 31195, "h": "MF-DV-AS", "n": "PJSC MegaFon", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1619, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.182, 0.011, 0, false], ["2026-10-12", 0.196, 0.012, 0, false]], "sh": false, "uc": 910.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.015, "ts": null, "map": 0.186, "obs": 0, "own": 0.568, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.196, "se": 1.226, "ts": 1.000, "map": 1.444, "obs": 1, "own": 0.919, "comp": {"cins": -0.1637, "dshield": -0.3726, "crowdsec": -1.4739, "vulncheck": -0.3672, "blocklist_de": 4.1382}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.536, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 80, "reg": "2004-03-19", "rir": "ripencc", "s24": 85, "sib": 39, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 31200, "h": "NTK", "n": "Novotelecom (NTK)", "t": "Broadband & mobile", "w": 11, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "ssh_bruteforce": 5, "home_connection": 6, "router_or_botnet": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 3, "cve:CVE-2024-12847": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.0205, "hi": 2.45, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}, "dshield": {"n": 1, "p": 0.0105, "hi": 2.16, "lo": 0.16, "ips": 1, "mean": 0.91, "above": false}, "urlhaus": {"n": 1, "p": 0.1243, "hi": 3.94, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}, "crowdsec": {"n": 7, "p": 0.0005, "hi": 1.91, "lo": 0.58, "ips": 7, "mean": 1.16, "above": false}, "vulncheck": {"n": 1, "p": 0.0115, "hi": 2.20, "lo": 0.16, "ips": 1, "mean": 0.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.0025, "hi": 1.87, "lo": 0.24, "ips": 2, "mean": 0.89, "above": false}}, "h2": [["2026-10-05", 0.418, 0.098, 0, false], ["2026-10-12", 0.506, 0.108, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.108, "se": 1.358, "ts": 1.000, "map": 0.716, "obs": 1, "own": 2.101, "comp": {"urlhaus": 2.607, "threatfox": -0.4419, "phishing_db": -0.8731}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.506, "se": 0.475, "ts": 0.583, "map": 0.916, "obs": 12, "own": 1.419, "comp": {"cins": 1.4912, "dshield": -0.5603, "crowdsec": 3.1544, "vulncheck": -0.4119, "blocklist_de": -2.3673}, "mass": 11.3, "listed": false}}, "abq": false, "bot": 0.459, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-NL9-RIPE", "org": "Novotelecom Ltd", "pdb": null, "pfx": 58, "reg": "2004-03-22", "rir": "ripencc", "s24": 2212, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 908288, "abuse": "noc@novotelecom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00410199896645}, {"a": 31204, "h": "SunCommunications-AS", "n": "ORANGE MOLDOVA S.A.", "t": "Broadband & mobile", "w": 1, "cc": "MD", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1459, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.094, 0.010, 0, false], ["2026-10-12", 0.094, 0.011, 0, false]], "sh": false, "uc": 77.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.169, "obs": 0, "own": 1.040, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.094, "se": 1.135, "ts": 1.000, "map": 0.578, "obs": 1, "own": 0.975, "comp": {"cins": -0.1931, "dshield": 4.1663, "crowdsec": -1.7162, "vulncheck": -0.4084, "blocklist_de": -1.0024}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.196, "det": null, "oid": "ORG-OMS3-RIPE", "org": "ORANGE MOLDOVA S.A.", "pdb": null, "pfx": 4, "reg": "2004-03-22", "rir": "ripencc", "s24": 252, "sib": 5, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "abuse@orange.md", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00210883444065}, {"a": 31205, "h": "MF-SIB-AS", "n": "PJSC MegaFon", "t": "Other", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 4}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.1813, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 5, "p": 0.8422, "hi": 8.73, "lo": 2.17, "ips": 5, "mean": 4.98, "above": true}, "blocklist_de": {"n": 4, "p": 0.7721, "hi": 8.46, "lo": 1.82, "ips": 4, "mean": 4.62, "above": false}}, "h2": [["2026-10-05", 3.966, 0.011, 0, false], ["2026-10-12", 11.387, 0.012, 1, false]], "sh": false, "uc": 1704.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.021, "ts": null, "map": 0.187, "obs": 0, "own": 0.583, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 11.387, "se": 0.488, "ts": 0.500, "map": 21.337, "obs": 10, "own": 11.988, "comp": {"cins": -1.508, "dshield": -0.1307, "crowdsec": 1.5658, "vulncheck": -0.898, "blocklist_de": 5.4249}, "mass": 9.1, "listed": false}}, "abq": false, "bot": 0.367, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 2}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 42, "reg": "2004-03-22", "rir": "ripencc", "s24": 77, "sib": 39, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0017601678479}, {"a": 31213, "h": "MF-NWGSM-AS", "n": "PJSC MegaFon", "t": "Other", "w": 8, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 2, "router_or_botnet": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 2}, "n": 2}, "ev": {"dshield": {"n": 4, "p": 0.7291, "hi": 7.89, "lo": 1.70, "ips": 5, "mean": 4.31, "above": false}, "urlhaus": {"n": 1, "p": 0.1872, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 2, "p": 0.0969, "hi": 3.52, "lo": 0.46, "ips": 2, "mean": 1.68, "above": false}, "vulncheck": {"n": 1, "p": 0.1394, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-12", 1.527, 0.289, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.289, "se": 1.464, "ts": 1.000, "map": 2.476, "obs": 1, "own": 2.884, "comp": {"urlhaus": 3.5284, "threatfox": -0.3409, "phishing_db": -0.6546}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.527, "se": 0.547, "ts": 0.571, "map": 3.147, "obs": 7, "own": 1.785, "comp": {"cins": -1.0038, "dshield": 9.4374, "crowdsec": -1.0996, "vulncheck": 0.1613, "blocklist_de": -4.9553}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.393, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 37, "reg": "2004-03-23", "rir": "ripencc", "s24": 297, "sib": 39, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 76544, "abuse": "abuse-mailbox@megafon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0046395264146}, {"a": 31224, "h": "MF-UGSM-AS", "n": "PJSC MegaFon", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4011, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-12", 0.951, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.613, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 0.917, "ts": 1.000, "map": 3.908, "obs": 2, "own": 2.286, "comp": {"cins": -0.3122, "dshield": 7.8496, "crowdsec": -2.6362, "vulncheck": -0.5363, "blocklist_de": -1.6082}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-OM1-RIPE", "org": "PJSC MegaFon", "pdb": null, "pfx": 34, "reg": "2004-03-26", "rir": "ripencc", "s24": 62, "sib": 39, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0017247029569}, {"a": 31242, "h": "TKPSA-AS", "n": "3S S.A.", "t": "Transit & backbone", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0198, "hi": 2.43, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}, "dshield": {"n": 1, "p": 0.1145, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "crowdsec": {"n": 1, "p": 0.0109, "hi": 2.18, "lo": 0.16, "ips": 1, "mean": 0.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.0648, "hi": 3.21, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}}, "h2": [["2026-10-05", 0.198, 0.009, 0, false], ["2026-10-12", 0.392, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.900, "ts": null, "map": 0.156, "obs": 0, "own": 1.231, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.392, "se": 0.725, "ts": 0.333, "map": 1.117, "obs": 3, "own": 3.563, "comp": {"cins": -0.5955, "dshield": 2.4195, "crowdsec": -0.9685, "vulncheck": -0.7072, "blocklist_de": 1.3559}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.236, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PSZO7-RIPE", "org": "P4 Sp. z o.o.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.3s.pl"}, "pfx": 57, "reg": "2004-03-29", "rir": "ripencc", "s24": 444, "sib": 10, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 113664, "abuse": "abuse@play.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00306732443706}, {"a": 31245, "h": "ATI-ISP", "n": "ATI - Agence Tunisienne Internet", "t": "Other", "w": 4, "cc": "TN", "cf": null, "cs": {"c": {"ssh_bruteforce": 4}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1220, "hi": 3.91, "lo": 0.29, "ips": 4, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 1.421, 0.011, 0, false], ["2026-10-12", 0.192, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.577, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.192, "se": 1.222, "ts": 1.000, "map": 1.404, "obs": 1, "own": 0.890, "comp": {"cins": -0.1503, "dshield": -0.344, "crowdsec": 3.356, "vulncheck": -0.3467, "blocklist_de": -0.7822}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.270, "det": null, "oid": "ORG-ATIA2-AFRINIC", "org": "ATI - Agence Tunisienne Internet", "pdb": null, "pfx": 56, "reg": "2007-09-20", "rir": "afrinic", "s24": 80, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012177684288}, {"a": 31252, "h": "STARNET-AS", "n": "StarNet Moldova", "t": "Broadband & mobile", "w": 10, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1045, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "urlhaus": {"n": 1, "p": 0.1735, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.0024, "hi": 1.73, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}, "vulncheck": {"n": 1, "p": 0.0890, "hi": 3.53, "lo": 0.26, "ips": 6, "mean": 1.49, "above": false}, "blocklist_de": {"n": 1, "p": 0.0367, "hi": 2.78, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}}, "h2": [["2026-10-05", 0.333, 0.183, 0, false], ["2026-10-12", 0.378, 0.202, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.202, "se": 1.414, "ts": 1.000, "map": 1.541, "obs": 1, "own": 4.425, "comp": {"urlhaus": 3.1955, "threatfox": -0.3861, "phishing_db": -0.7509}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.378, "se": 0.667, "ts": 0.250, "map": 0.962, "obs": 4, "own": 1.518, "comp": {"cins": 3.643, "dshield": -1.3422, "crowdsec": -2.027, "vulncheck": 0.5795, "blocklist_de": 0.5014}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.161, "det": {"vulncheck": {"botnet_node": 6}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SSS72-RIPE", "org": "StarNet Solutii SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.starnet.md"}, "pfx": 23, "reg": "2004-03-31", "rir": "ripencc", "s24": 658, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 171776, "abuse": "abuse@starnet.md", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.007099561014}, {"a": 31257, "h": "ORIONNET-KRK", "n": "Orion Telecom", "t": "Broadband & mobile", "w": 14, "cc": "RU", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1674, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "dshield": {"n": 2, "p": 0.3608, "hi": 5.74, "lo": 0.74, "ips": 2, "mean": 2.73, "above": false}, "vulncheck": {"n": 1, "p": 0.1605, "hi": 4.33, "lo": 0.32, "ips": 11, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 1.148, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.149, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.148, "se": 0.676, "ts": 0.500, "map": 2.950, "obs": 4, "own": 4.649, "comp": {"cins": 3.8564, "dshield": 5.7556, "crowdsec": -4.7227, "vulncheck": 0.7898, "blocklist_de": -3.2037}, "mass": 3.0, "listed": false}}, "abq": true, "bot": 0.430, "det": {"vulncheck": {"botnet_node": 11}}, "oid": "ORG-MNL1-RIPE", "org": "Orion Telecom LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://orionnet.ru/"}, "pfx": 64, "reg": "2004-03-31", "rir": "ripencc", "s24": 181, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 83712, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00136207835225}, {"a": 31263, "h": "MYNET-AS", "n": "Mynet Italia", "t": "Broadband & mobile", "w": 1, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0254, "hi": 2.56, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "phishing_db": {"n": 1, "p": 0.1273, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.070, 0.151, 0, false], ["2026-10-12", 0.006, 0.158, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.158, "se": 1.387, "ts": 1.000, "map": 1.092, "obs": 1, "own": 3.271, "comp": {"urlhaus": -0.2763, "threatfox": -0.2631, "phishing_db": 2.2538}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.623, "ts": null, "map": 0.089, "obs": 0, "own": 0.209, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MS17-RIPE", "org": "MYNET S.R.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": null, "pol": "Selective", "web": "https://www.mynet.it"}, "pfx": 40, "reg": "2006-07-31", "rir": "ripencc", "s24": 398, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 102912, "abuse": "abuse@mynet.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00264530625425}, {"a": 31357, "h": "TOMICA-AS", "n": "Limited Company Information and Consulting Agency", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1283, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.841, 0.011, 0, false], ["2026-10-12", 0.904, 0.012, 0, false]], "sh": false, "uc": 342.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 0.592, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.904, "se": 0.915, "ts": 0.500, "map": 3.682, "obs": 2, "own": 2.157, "comp": {"cins": -0.3393, "dshield": -0.7185, "crowdsec": 1.3256, "vulncheck": -0.559, "blocklist_de": 2.9884}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.594, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LCIA1-RIPE", "org": "Limited Company Information and Consulting Agency", "pdb": null, "pfx": 4, "reg": "2004-04-23", "rir": "ripencc", "s24": 72, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22784, "abuse": "noc@tomica.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 31359, "h": "FORATEC-AS", "n": "PJSC \"Vimpelcom\"", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.011, 0, false], ["2026-10-12", 0.008, 0.012, 0, false]], "sh": false, "uc": 295, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 0.523, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.784, "ts": null, "map": 0.149, "obs": 0, "own": 0.162, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.504, "det": null, "oid": "ORG-ES15-RIPE", "org": "PJSC \"Vimpelcom\"", "pdb": null, "pfx": 4, "reg": "2004-04-26", "rir": "ripencc", "s24": 117, "sib": 32, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "abuse-b2b@beeline.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 31363, "h": "MOSCOW-AS", "n": "JSC \"ER-Telecom Holding\" Moscow branch", "t": "Broadband & mobile", "w": 6, "cc": "RU", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 4, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2024-6387": 3}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1097, "hi": 3.77, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "crowdsec": {"n": 5, "p": 0.2040, "hi": 4.01, "lo": 1.00, "ips": 5, "mean": 2.29, "above": false}, "blocklist_de": {"n": 2, "p": 0.1280, "hi": 3.81, "lo": 0.49, "ips": 2, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.246, 0.009, 0, false], ["2026-10-12", 1.193, 0.010, 0, false]], "sh": false, "uc": 126.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.876, "ts": null, "map": 0.147, "obs": 0, "own": 0.776, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.193, "se": 0.519, "ts": 0.625, "map": 2.344, "obs": 8, "own": 3.628, "comp": {"cins": 2.2543, "dshield": -2.0615, "crowdsec": 2.8974, "vulncheck": -0.8827, "blocklist_de": 0.0381}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.449, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 103, "reg": "2004-04-26", "rir": "ripencc", "s24": 610, "sib": 121, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 203264, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014889473599}, {"a": 31370, "h": "MOSLINE-AS", "n": "Gruppa MosLine", "t": "Transit & backbone", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "blocklist_de": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 1.294, 0.011, 0, false], ["2026-10-12", 1.401, 0.012, 0, false]], "sh": false, "uc": 1381.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 2.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.401, "se": 0.938, "ts": 0.500, "map": 5.974, "obs": 2, "own": 19.480, "comp": {"cins": -0.3153, "dshield": -0.6741, "crowdsec": 1.5656, "vulncheck": -0.539, "blocklist_de": 3.144}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.473, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OMTS1-RIPE", "org": "OOO \"Gruppa MosLine\"", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://mosline.ru"}, "pfx": 5, "reg": "2004-04-27", "rir": "ripencc", "s24": 41, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040147975175}, {"a": 31430, "h": "TEL-NET-AS", "n": "TC TEL CENTER AS31430", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 4}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.2140, "hi": 4.53, "lo": 0.59, "ips": 4, "mean": 2.16, "above": false}}, "h2": [["2026-10-05", 0.958, 0.010, 0, false], ["2026-10-12", 0.475, 0.011, 0, false]], "sh": false, "uc": 287, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 1.219, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.475, "se": 0.885, "ts": 1.000, "map": 1.836, "obs": 2, "own": 2.929, "comp": {"cins": -0.345, "dshield": -0.7289, "crowdsec": 5.4127, "vulncheck": -0.5635, "blocklist_de": -1.7737}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.523, "det": null, "oid": "ORG-OS214-RIPE", "org": "OOO Suntel", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.tel.ru/"}, "pfx": 32, "reg": "2004-05-14", "rir": "ripencc", "s24": 147, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38400, "abuse": "abuse@tel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003176529356}, {"a": 31463, "h": "FourD-AS", "n": "4D Data Centres Ltd", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1025, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.180, "obs": 0, "own": 0.193, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.766, "ts": null, "map": 0.142, "obs": 0, "own": 0.052, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.418, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RSL38-RIPE", "org": "Redcentric Solutions Ltd", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.4d-dc.com"}, "pfx": 33, "reg": "2004-05-24", "rir": "ripencc", "s24": 134, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35328, "abuse": "abuse@redcentricplc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039688849574}, {"a": 31477, "h": "DUOCAST-AS", "n": "Duocast", "t": "Hosting & VPS", "w": 4, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 3, "home_connection": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.4419, "hi": 5.88, "lo": 1.04, "ips": 4, "mean": 3.03, "above": false}}, "h2": [["2026-10-05", 1.718, 0.010, 0, false], ["2026-10-12", 1.150, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 0.199, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.150, "se": 0.745, "ts": 1.000, "map": 3.391, "obs": 3, "own": 0.677, "comp": {"cins": -0.5006, "dshield": -0.9961, "crowdsec": 7.323, "vulncheck": -0.663, "blocklist_de": -2.5484}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.833, "det": null, "oid": "ORG-DA16-RIPE", "org": "Duocast B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.duocast.nl"}, "pfx": 43, "reg": "2004-05-26", "rir": "ripencc", "s24": 120, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40960, "abuse": "abuse@duocast.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005701824875}, {"a": 31492, "h": "UZSCI-AS", "n": "UZSCINET", "t": "Other", "w": 0, "cc": "UZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.733, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-UA28-RIPE", "org": "UZSCINET", "pdb": null, "pfx": 1, "reg": "2004-05-27", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000027320604}, {"a": 31531, "h": "JUPITER-AS", "n": "TOV Point", "t": "Other", "w": 3, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4210, "hi": 6.28, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 5.566, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.566, "se": 1.025, "ts": 1.000, "map": 28.309, "obs": 2, "own": 16.809, "comp": {"cins": -0.2235, "dshield": 8.5242, "crowdsec": -1.9598, "vulncheck": -0.4463, "blocklist_de": -1.1577}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.560, "det": null, "oid": "ORG-PL7-RIPE", "org": "TOV Point", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://point.zp.ua"}, "pfx": 5, "reg": "2004-06-07", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "admin@jupiter.ru.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 31543, "h": "MYNET-AS", "n": "myNET", "t": "Broadband & mobile", "w": 3, "cc": "AT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.2227, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}}, "h2": [["2026-10-05", 0.474, 0.010, 0, false], ["2026-10-12", 0.498, 0.396, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.396, "se": 1.519, "ts": 1.000, "map": 3.788, "obs": 1, "own": 11.182, "comp": {"urlhaus": 3.8018, "threatfox": -0.2915, "phishing_db": -0.5522}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.498, "se": 0.887, "ts": 1.000, "map": 1.928, "obs": 2, "own": 3.075, "comp": {"cins": -0.3427, "dshield": -0.7247, "crowdsec": 5.4415, "vulncheck": -0.5617, "blocklist_de": -1.7622}, "mass": 1.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MIS1-RIPE", "org": "myNet GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.mynet.at"}, "pfx": 26, "reg": "2004-06-09", "rir": "ripencc", "s24": 139, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": "abuse@mynet.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00171183687778}, {"a": 31549, "h": "RASANA", "n": "RASANA", "t": "Other", "w": 7, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2021-41773": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0007, "hi": 1.47, "lo": 0.11, "ips": 1, "mean": 0.62, "above": false}, "dshield": {"n": 1, "p": 0.0525, "hi": 3.04, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "crowdsec": {"n": 4, "p": 0.0123, "hi": 2.43, "lo": 0.52, "ips": 4, "mean": 1.33, "above": false}, "phishing_db": {"n": 1, "p": 0.0598, "hi": 3.14, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}, "blocklist_de": {"n": 1, "p": 0.0129, "hi": 2.24, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.446, 0.090, 0, false], ["2026-10-12", 0.453, 0.095, 0, false]], "sh": false, "uc": 185.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.095, "se": 1.353, "ts": 1.000, "map": 0.584, "obs": 1, "own": 0.734, "comp": {"urlhaus": -0.3733, "threatfox": -0.3127, "phishing_db": 1.7736}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.453, "se": 0.562, "ts": 0.667, "map": 0.962, "obs": 6, "own": 0.547, "comp": {"cins": -1.0589, "dshield": 0.9449, "crowdsec": 3.7751, "vulncheck": -0.8356, "blocklist_de": -1.4702}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.499, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-ART1-RIPE", "org": "Aria Shatel PJSC", "pdb": null, "pfx": 174, "reg": "2004-06-10", "rir": "ripencc", "s24": 1041, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 495104, "abuse": "abuse@rasana.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00811978770135}, {"a": 31655, "h": "ASN-GammaTelecom", "n": "Gamma", "t": "Broadband & mobile", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "dshield": {"n": 1, "p": 0.0083, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.86, "lo": 0.11, "ips": 2, "mean": 0.41, "above": false}, "blocklist_de": {"n": 2, "p": 0.0016, "hi": 1.77, "lo": 0.23, "ips": 2, "mean": 0.84, "above": false}}, "h2": [["2026-10-05", 0.277, 0.007, 0, false], ["2026-10-12", 0.180, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.771, "ts": null, "map": 0.100, "obs": 0, "own": 0.464, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.180, "se": 0.593, "ts": 0.400, "map": 0.402, "obs": 5, "own": 0.627, "comp": {"cins": -1.0226, "dshield": 1.045, "crowdsec": -1.245, "vulncheck": -0.8287, "blocklist_de": 2.5337}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"malware": 1}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "ORG-GTHL1-RIPE", "org": "Gamma Telecom Holdings Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.gamma.co.uk/"}, "pfx": 36, "reg": "2004-07-02", "rir": "ripencc", "s24": 2381, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 614400, "abuse": "abuse@gamma.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02028236266421}, {"a": 31727, "h": "NODE4-AS", "n": "Node4 Ltd", "t": "Broadband & mobile", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1529, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-12", 0.007, 0.205, 0, false]], "sh": false, "uc": 84.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.205, "se": 1.411, "ts": 1.000, "map": 1.519, "obs": 1, "own": 4.480, "comp": {"urlhaus": -0.2323, "threatfox": -0.2359, "phishing_db": 2.5125}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.691, "ts": null, "map": 0.113, "obs": 0, "own": 0.290, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.580, "det": null, "oid": "ORG-NL21-RIPE", "org": "Node4 Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.node4.co.uk"}, "pfx": 143, "reg": "2004-07-26", "rir": "ripencc", "s24": 237, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 78848, "abuse": "abuse@node4.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00142692451867}, {"a": 31863, "h": "DACEN-2", "n": "Dacentec", "t": "Transit & backbone", "w": 9, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.2062, "hi": 4.46, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}, "crowdsec": {"n": 1, "p": 0.0596, "hi": 3.14, "lo": 0.24, "ips": 1, "mean": 1.32, "above": false}, "threatfox": {"n": 2, "p": 0.4037, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "phishing_db": {"n": 5, "p": 0.8851, "hi": 9.61, "lo": 2.39, "ips": 5, "mean": 5.49, "above": true}, "blocklist_de": {"n": 1, "p": 0.1240, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 1.513, 5.012, 0, false], ["2026-10-12", 0.415, 5.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 5}, "lo": 5.008, "se": 0.839, "ts": 0.714, "map": 12.295, "obs": 7, "own": 41.228, "comp": {"urlhaus": -1.0868, "threatfox": 1.2505, "phishing_db": 3.9717}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.415, "se": 0.880, "ts": 0.500, "map": 1.573, "obs": 2, "own": 5.100, "comp": {"cins": -0.3824, "dshield": -0.7961, "crowdsec": 0.9063, "vulncheck": -0.5915, "blocklist_de": 2.7101}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.924, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:PureRAT": 2}, "blocklist_de": {"bots": 1}}, "oid": "CENTR-60-ARIN", "org": "Centrilogic, Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.dacentec.com"}, "pfx": 51, "reg": "2010-03-03", "rir": "arin", "s24": 192, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 49664, "abuse": "abuse@dacentec.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 31898, "h": "ORACLE-BMC-31898", "n": "Oracle Cloud Infrastructure", "t": "Hyperscale cloud", "w": 1110, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 1.29, "waf": 1.98}, "cs": {"c": {"http_flood": 509, "data_centre": 120, "web_exploit": 565, "bad_crawling": 381, "proxy_or_vpn": 158, "first_seen_30d": 176, "ssh_bruteforce": 425, "web_bruteforce": 371, "home_connection": 101, "mail_bruteforce": 56, "router_or_botnet": 4, "cve:CVE-2017-9841": 29, "cve:CVE-2026-8181": 103, "cve:CVE-2024-28000": 148, "cve:CVE-2026-27771": 46, "cve:CVE-2026-63030": 63}, "n": 738}, "ev": {"cins": {"n": 98, "p": 1.0000, "hi": 11.18, "lo": 8.03, "ips": 108, "mean": 9.55, "above": true}, "shodan": {"n": 536, "p": 1.0000, "hi": 11.90, "lo": 10.33, "ips": 536, "mean": 11.10, "above": true}, "dshield": {"n": 33, "p": 0.1954, "hi": 3.40, "lo": 1.93, "ips": 34, "mean": 2.62, "above": false}, "urlhaus": {"n": 10, "p": 0.6878, "hi": 5.56, "lo": 2.02, "ips": 11, "mean": 3.61, "above": false}, "crowdsec": {"n": 556, "p": 1.0000, "hi": 9.95, "lo": 8.66, "ips": 738, "mean": 9.29, "above": true}, "threatfox": {"n": 18, "p": 0.9215, "hi": 6.06, "lo": 2.83, "ips": 19, "mean": 4.32, "above": true}, "vulncheck": {"n": 67, "p": 1.0000, "hi": 6.50, "lo": 4.36, "ips": 67, "mean": 5.38, "above": true}, "phishing_db": {"n": 65, "p": 1.0000, "hi": 6.75, "lo": 4.50, "ips": 65, "mean": 5.58, "above": true}, "blocklist_de": {"n": 214, "p": 1.0000, "hi": 9.68, "lo": 7.73, "ips": 255, "mean": 8.68, "above": true}}, "h2": [["2026-10-05", 4.549, 1.297, 0, false], ["2026-10-12", 5.299, 1.260, 0, false]], "sh": false, "uc": 51.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 10, "threatfox": 18, "phishing_db": 65}, "lo": 1.260, "se": 0.803, "ts": 0.699, "map": 2.644, "obs": 93, "own": 1.953, "comp": {"urlhaus": 0.3828, "threatfox": 0.1773, "phishing_db": 2.0386}, "mass": 86.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 98, "dshield": 33, "crowdsec": 556, "vulncheck": 67, "blocklist_de": 214}, "lo": 5.299, "se": 0.350, "ts": 0.574, "map": 7.788, "obs": 968, "own": 3.193, "comp": {"cins": 5.0231, "dshield": -2.5134, "crowdsec": 3.4699, "vulncheck": -0.5752, "blocklist_de": -1.9582}, "mass": 952.8, "listed": false}}, "abq": false, "bot": 0.896, "det": {"shodan": {"c2": 95, "malware": 20, "compromised": 407, "doublepulsar": 14}, "threatfox": {"family:Hook": 3, "family:Chaos": 1, "family:Havoc": 2, "family:DanaBot": 4, "family:Unknown malware": 6}, "vulncheck": {"c2_server": 24, "botnet_node": 5, "attack_tooling": 32, "other_infrastructure": 6}, "blocklist_de": {"ftp": 16, "sip": 1, "ssh": 164, "bots": 33, "imap": 6, "mail": 9, "apache": 32, "bruteforcelogin": 25}}, "oid": "ORACLE-4-ARIN", "org": "Oracle Corporation", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://cloud.oracle.com"}, "pfx": 2831, "reg": "2011-03-21", "rir": "arin", "s24": 22174, "sib": 42, "tor": 0, "w24": 859, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 5920512, "abuse": "abuse@oracleemaildelivery.com", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.312032}, {"a": 31950, "h": "AS-DANS", "n": "Data Network Solutions", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.161, "det": {"shodan": {"compromised": 1}}, "oid": "DANS-ARIN", "org": "Data Network Solutions", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.dnetworksolution.com"}, "pfx": 4, "reg": "2004-01-30", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 31960, "h": "EMUNET", "n": "Eduardo Mondlane University", "t": "Enterprise, edu & gov", "w": 0, "cc": "MZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 8593.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 5.847, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.381, "det": null, "oid": "ORG-EMU1-AFRINIC", "org": "Eduardo Mondlane University", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ciuem.mz"}, "pfx": 9, "reg": "2004-01-30", "rir": "afrinic", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006218351349}, {"a": 31996, "h": "ZOOMTC", "n": "Zoom Telcom, LLC", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1913, "hi": 4.66, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.259, 0.011, 0, false], ["2026-10-12", 0.255, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 0.698, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.255, "se": 1.280, "ts": 1.000, "map": 2.004, "obs": 1, "own": 1.351, "comp": {"cins": -0.0924, "dshield": -0.2169, "crowdsec": -0.8593, "vulncheck": 3.7402, "blocklist_de": -0.4828}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.239, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ZTL-17-ARIN", "org": "Zoom Telcom, LLC", "pdb": null, "pfx": 33, "reg": "2018-10-03", "rir": "arin", "s24": 34, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "noc@zoomtelcom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32002, "h": "RACKGENIUS", "n": "RackGenius", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.513, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.934, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 2.787, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.926, "det": {"shodan": {"compromised": 1}}, "oid": "SHL-1147-ARIN", "org": "RackGenius", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://rackgenius.com"}, "pfx": 8, "reg": "2024-02-26", "rir": "arin", "s24": 12, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@rackgenius.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32097, "h": "WII", "n": "Wholesale Internet, Inc.", "t": "Transit & backbone", "w": 19, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"shodan": {"n": 18, "p": 1.0000, "hi": 14.33, "lo": 6.68, "ips": 18, "mean": 10.20, "above": true}, "dshield": {"n": 1, "p": 0.1205, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "crowdsec": {"n": 4, "p": 0.2565, "hi": 4.41, "lo": 0.95, "ips": 4, "mean": 2.41, "above": false}, "vulncheck": {"n": 11, "p": 0.9996, "hi": 15.02, "lo": 5.71, "ips": 13, "mean": 9.90, "above": true}, "phishing_db": {"n": 1, "p": 0.1265, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 1.975, 1.258, 0, false], ["2026-10-12", 1.725, 0.157, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.157, "se": 1.386, "ts": 1.000, "map": 1.082, "obs": 1, "own": 4.609, "comp": {"urlhaus": -0.2776, "threatfox": -0.2639, "phishing_db": 2.2463}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 11, "blocklist_de": 0}, "lo": 1.725, "se": 0.473, "ts": 0.688, "map": 3.110, "obs": 16, "own": 9.831, "comp": {"cins": -1.2527, "dshield": 0.4463, "crowdsec": 1.8145, "vulncheck": 7.6128, "blocklist_de": -6.0926}, "mass": 7.0, "listed": false}}, "abq": false, "bot": 0.856, "det": {"shodan": {"c2": 1, "compromised": 17}, "vulncheck": {"c2_server": 2, "botnet_node": 9, "attack_tooling": 2}}, "oid": "WHOLE-125-ARIN", "org": "WholeSale Internet, Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "1-5Tbps", "pol": "Open", "web": "http://wholesaleinternet.net"}, "pfx": 41, "reg": "2004-02-26", "rir": "arin", "s24": 404, "sib": 0, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 109824, "abuse": "abuse@nocix.net", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.00711295537322}, {"a": 32098, "h": "TRANSTELCO-INC", "n": "Flō Networks", "t": "Transit & backbone", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 2, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0652, "hi": 3.22, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}, "shodan": {"n": 1, "p": 0.0004, "hi": 1.40, "lo": 0.10, "ips": 1, "mean": 0.59, "above": false}, "crowdsec": {"n": 3, "p": 0.0024, "hi": 1.95, "lo": 0.34, "ips": 3, "mean": 1.01, "above": false}}, "h2": [["2026-10-05", 0.246, 0.008, 0, false], ["2026-10-12", 0.259, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.828, "ts": null, "map": 0.127, "obs": 0, "own": 0.884, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.259, "se": 0.643, "ts": 0.750, "map": 0.630, "obs": 4, "own": 2.004, "comp": {"cins": 3.4906, "dshield": -1.4362, "crowdsec": 3.6687, "vulncheck": -0.7778, "blocklist_de": -4.0129}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.162, "det": {"shodan": {"malware": 1}}, "oid": "TRANS-351-ARIN", "org": "Transtelco Inc", "pdb": {"t": "NSP", "sc": "North America", "tr": "5-10Tbps", "pol": "Open", "web": "https://flo.net"}, "pfx": 452, "reg": "2004-02-26", "rir": "arin", "s24": 1121, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 541696, "abuse": "abuse@flo.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01059578943048}, {"a": 32119, "h": "WESLEYAN-SCHOOL", "n": "Wesleyan School, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.226, "det": {"shodan": {"malware": 1}}, "oid": "WS-842-ARIN", "org": "Wesleyan School, Inc.", "pdb": null, "pfx": 1, "reg": "2024-02-26", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32181, "h": "ASN-GIGENET", "n": "GigeNET", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0726, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.959, "ts": null, "map": 0.174, "obs": 0, "own": 0.449, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.712, "ts": null, "map": 0.122, "obs": 0, "own": 0.117, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.853, "det": {"shodan": {"compromised": 1}}, "oid": "DMPL-ARIN", "org": "GigeNET", "pdb": {"t": null, "sc": "North America", "tr": null, "pol": "Open", "web": "https://www.gigenet.com"}, "pfx": 39, "reg": "2004-03-16", "rir": "arin", "s24": 201, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51456, "abuse": "abuse@gigenet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32244, "h": "LIQUIDWEB", "n": "Liquid Web", "t": "Hosting & VPS", "w": 28, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2025-3605": 1, "cve:CVE-2023-28121": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-27007": 2}, "n": 3}, "ev": {"cins": {"n": 14, "p": 1.0000, "hi": 15.49, "lo": 6.54, "ips": 14, "mean": 10.61, "above": true}, "shodan": {"n": 4, "p": 0.0466, "hi": 2.96, "lo": 0.64, "ips": 4, "mean": 1.62, "above": false}, "crowdsec": {"n": 3, "p": 0.0057, "hi": 2.15, "lo": 0.38, "ips": 3, "mean": 1.11, "above": false}, "phishing_db": {"n": 11, "p": 0.9979, "hi": 12.32, "lo": 4.69, "ips": 11, "mean": 8.12, "above": true}}, "h2": [["2026-10-05", 0.438, 2.131, 0, false], ["2026-10-12", 2.797, 1.988, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 11}, "lo": 1.988, "se": 0.832, "ts": 1.000, "map": 4.602, "obs": 11, "own": 1.766, "comp": {"urlhaus": -1.5862, "threatfox": -0.5302, "phishing_db": 5.2692}, "mass": 6.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 14, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.797, "se": 0.435, "ts": 0.824, "map": 4.790, "obs": 17, "own": 0.938, "comp": {"cins": 27.2457, "dshield": -2.9263, "crowdsec": -8.498, "vulncheck": -0.9716, "blocklist_de": -11.8896}, "mass": 25.9, "listed": false}}, "abq": false, "bot": 0.990, "det": {"shodan": {"compromised": 2, "doublepulsar": 2}}, "oid": "LQWB-ARIN", "org": "Liquid Web, L.L.C", "pdb": {"t": "Content", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.liquidweb.com"}, "pfx": 48, "reg": "2004-03-26", "rir": "arin", "s24": 978, "sib": 8, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 256256, "abuse": "abuse@liquidweb.com", "score": 0.0810, "groups": ["phishing"], "sensors": ["cins"], "traffic": null}, {"a": 32274, "h": "LENAWEE-MONROE-TECHNOLOGY-CONSORTIUM", "n": "Lenawee-Monroe Technology Consortium", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.328, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.268, "det": {"shodan": {"malware": 1}}, "oid": "LTC-51-ARIN", "org": "Lenawee-Monroe Technology Consortium", "pdb": null, "pfx": 27, "reg": "2004-04-02", "rir": "arin", "s24": 31, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32298, "h": "CNSQ-AS32298", "n": "Centersquare-AS32298", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1508, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 2.206, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.182, "obs": 0, "own": 1.338, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.783, "det": {"shodan": {"c2": 1}}, "oid": "PIL-188-ARIN", "org": "Centersquare", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Open", "web": "https://centersquaredc.com/"}, "pfx": 55, "reg": "2020-04-08", "rir": "arin", "s24": 57, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22272, "abuse": "networkabuse@csquare.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32374, "h": "NUCLEARFALLOUT-LAX", "n": "Nuclearfallout Enterprises, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.272, "det": {"shodan": {"compromised": 1}}, "oid": "NUCLE-3-ARIN", "org": "Nuclearfallout Enterprises, Inc.", "pdb": null, "pfx": 3, "reg": "2004-04-22", "rir": "arin", "s24": 3, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "noc@nfoe.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32444, "h": "ANTHEMBB", "n": "Safelink Internet [AS32444]", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2496, "hi": 4.81, "lo": 0.63, "ips": 2, "mean": 2.29, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.179, "obs": 0, "own": 1.226, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.756, "ts": null, "map": 0.138, "obs": 0, "own": 0.392, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"compromised": 2}}, "oid": "SAFEL-ARIN", "org": "Anthem Broadband", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://anthembroadband.com"}, "pfx": 40, "reg": "2006-12-27", "rir": "arin", "s24": 144, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 73984, "abuse": "abuse-team@safelinkinternet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32475, "h": "SINGLEHOP-LLC", "n": "Internap Holding LLC", "t": "Hosting & VPS", "w": 47, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 35, "web_exploit": 34, "bad_crawling": 22, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 20, "mail_bruteforce": 1, "cve:CVE-2024-2473": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 1}, "n": 41}, "ev": {"cins": {"n": 4, "p": 0.5077, "hi": 5.93, "lo": 1.28, "ips": 6, "mean": 3.24, "above": false}, "shodan": {"n": 23, "p": 0.9994, "hi": 8.70, "lo": 4.42, "ips": 23, "mean": 6.40, "above": true}, "dshield": {"n": 2, "p": 0.1179, "hi": 3.72, "lo": 0.48, "ips": 2, "mean": 1.77, "above": false}, "crowdsec": {"n": 9, "p": 0.1497, "hi": 3.55, "lo": 1.23, "ips": 41, "mean": 2.26, "above": false}, "phishing_db": {"n": 2, "p": 0.1347, "hi": 3.87, "lo": 0.50, "ips": 2, "mean": 1.84, "above": false}, "blocklist_de": {"n": 2, "p": 0.0268, "hi": 2.65, "lo": 0.34, "ips": 2, "mean": 1.26, "above": false}}, "h2": [["2026-10-05", 1.381, 0.213, 0, false], ["2026-10-12", 1.484, 0.220, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.220, "se": 1.140, "ts": 1.000, "map": 0.886, "obs": 2, "own": 0.397, "comp": {"urlhaus": -0.6356, "threatfox": -0.4016, "phishing_db": 2.5421}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 2, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.484, "se": 0.440, "ts": 0.529, "map": 2.514, "obs": 17, "own": 0.494, "comp": {"cins": 8.2223, "dshield": -0.1204, "crowdsec": 0.8729, "vulncheck": -0.9527, "blocklist_de": -5.7067}, "mass": 17.9, "listed": false}}, "abq": false, "bot": 0.942, "det": {"shodan": {"compromised": 23}, "blocklist_de": {"sip": 1, "mail": 1}}, "oid": "IC-1425-ARIN", "org": "Internap Holding LLC", "pdb": null, "pfx": 219, "reg": "2005-07-21", "rir": "arin", "s24": 1286, "sib": 6, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 433664, "abuse": "abuse@horizoniq.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 32489, "h": "AMANAHA-NEW", "n": "Amanah Tech", "t": "Hosting & VPS", "w": 9, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 4, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2025-29927": 1, "cve:CVE-2025-55182": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "dshield": {"n": 1, "p": 0.1869, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 5, "p": 0.8687, "hi": 9.24, "lo": 2.30, "ips": 6, "mean": 5.27, "above": true}, "threatfox": {"n": 2, "p": 0.4178, "hi": 6.25, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 6.120, 1.922, 0, false], ["2026-10-12", 7.030, 1.932, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.932, "se": 1.160, "ts": 1.000, "map": 9.119, "obs": 2, "own": 3.529, "comp": {"urlhaus": -0.2991, "threatfox": 4.6562, "phishing_db": -0.5206}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.030, "se": 0.570, "ts": 0.833, "map": 15.265, "obs": 6, "own": 3.000, "comp": {"cins": -0.8824, "dshield": 1.4538, "crowdsec": 8.7346, "vulncheck": -0.7983, "blocklist_de": -4.3884}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.884, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 2, "family:AsyncRAT": 1}}, "oid": "AT-2-ARIN", "org": "Amanah Tech Inc.", "pdb": {"t": "Network Services", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://amanah.com"}, "pfx": 52, "reg": "2004-05-14", "rir": "arin", "s24": 52, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": "abuse@amanah.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00184311450274}, {"a": 32613, "h": "IWEB-AS", "n": "Leaseweb Canada", "t": "Hosting & VPS", "w": 35, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 27, "data_centre": 11, "web_exploit": 28, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2019-8318": 27, "cve:CVE-2025-22457": 27}, "n": 29}, "ev": {"cins": {"n": 2, "p": 0.1914, "hi": 4.34, "lo": 0.56, "ips": 2, "mean": 2.07, "above": false}, "shodan": {"n": 13, "p": 0.8773, "hi": 6.31, "lo": 2.59, "ips": 13, "mean": 4.28, "above": true}, "crowdsec": {"n": 3, "p": 0.0034, "hi": 2.03, "lo": 0.36, "ips": 29, "mean": 1.04, "above": false}, "vulncheck": {"n": 4, "p": 0.4993, "hi": 5.87, "lo": 1.26, "ips": 4, "mean": 3.21, "above": false}}, "h2": [["2026-10-05", 0.499, 0.084, 0, false], ["2026-10-12", 0.546, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.832, "ts": null, "map": 0.128, "obs": 0, "own": 0.098, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 3, "vulncheck": 4, "blocklist_de": 0}, "lo": 0.546, "se": 0.535, "ts": 0.444, "map": 1.083, "obs": 9, "own": 0.216, "comp": {"cins": 6.5366, "dshield": -1.87, "crowdsec": 0.0935, "vulncheck": 2.4616, "blocklist_de": -5.7479}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.935, "det": {"shodan": {"c2": 1, "compromised": 12}, "vulncheck": {"botnet_node": 4}}, "oid": "LC-1193-ARIN", "org": "Leaseweb Canada Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.leaseweb.ca"}, "pfx": 63, "reg": "2004-06-15", "rir": "arin", "s24": 1064, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.0690]], "ipv4": 276992, "abuse": "abuse@ca.leaseweb.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00368852048642}, {"a": 32806, "h": "MTNSAT-ASN-02", "n": "MTNSAT AS32806", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 1.626, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.724, "ts": null, "map": 0.126, "obs": 0, "own": 0.687, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.224, "det": null, "oid": "MHL-217-ARIN", "org": "MTNSAT Holdings LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.mtnsat.com"}, "pfx": 51, "reg": "2004-07-29", "rir": "arin", "s24": 184, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53248, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000291429376}, {"a": 32860, "h": "CATS-NET-NETWORK", "n": "Cats-Net", "t": "Other", "w": 0, "cc": "TZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1063.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.318, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.154, "det": null, "oid": "ORG-CL5-AFRINIC", "org": "Cats-Net Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://cats-net.co.tz/"}, "pfx": 35, "reg": "2004-08-10", "rir": "afrinic", "s24": 33, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 25344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000561138729}, {"a": 32899, "h": "BRESCOBROADBAND", "n": "Bresco Broadband", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1848, "hi": 4.59, "lo": 0.34, "ips": 5, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.176, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 1.516, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.176, "se": 1.229, "ts": 1.000, "map": 1.268, "obs": 1, "own": 2.292, "comp": {"cins": -0.108, "dshield": -0.2518, "crowdsec": -0.997, "vulncheck": 3.5517, "blocklist_de": -0.5636}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.199, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "BRESC-1-ARIN", "org": "Bresco Broadband", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.brescobroadband.com"}, "pfx": 32, "reg": "2008-01-24", "rir": "arin", "s24": 63, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 19200, "abuse": "abuse@brescosolutions.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 32934, "h": "FACEBOOK", "n": "Meta", "t": "CDN & platforms", "w": 7, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 1.76, "waf": 2.47}, "cs": null, "ev": {"dshield": {"n": 6, "p": 0.6321, "hi": 6.08, "lo": 1.69, "ips": 7, "mean": 3.60, "above": false}}, "h2": [["2026-10-05", 0.454, 0.008, 0, false], ["2026-10-12", 0.266, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.794, "ts": null, "map": 0.111, "obs": 0, "own": 1.424, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.266, "se": 0.559, "ts": 1.000, "map": 0.560, "obs": 6, "own": 1.135, "comp": {"cins": -1.0425, "dshield": 14.569, "crowdsec": -6.7463, "vulncheck": -0.8325, "blocklist_de": -5.1345}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.929, "det": null, "oid": "THEFA-3-ARIN", "org": "Facebook, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "100+Tbps", "pol": "Selective", "web": "https://www.meta.com/"}, "pfx": 193, "reg": "2004-08-24", "rir": "arin", "s24": 1754, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 531968, "abuse": "noc@fb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.457421}, {"a": 32987, "h": "AS080780", "n": "Clnetworks Inc", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.928, "det": null, "oid": "CLNET-ARIN", "org": "Clnetworks Inc", "pdb": null, "pfx": 3, "reg": "2009-06-05", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@clnetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33070, "h": "RMH-14", "n": "Rackspace Hosting", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.82, "lo": 0.11, "ips": 2, "mean": 0.39, "above": false}, "phishing_db": {"n": 1, "p": 0.0044, "hi": 1.88, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.003, 0.047, 0, false], ["2026-10-12", 0.003, 0.050, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.050, "se": 1.332, "ts": 1.000, "map": 0.282, "obs": 1, "own": 0.145, "comp": {"urlhaus": -0.5135, "threatfox": -0.3664, "phishing_db": 1.239}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.375, "ts": null, "map": 0.026, "obs": 0, "own": 0.006, "comp": null, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"compromised": 2}}, "oid": "RACKS-8-ARIN", "org": "Rackspace Hosting", "pdb": null, "pfx": 103, "reg": "2004-09-24", "rir": "arin", "s24": 3120, "sib": 9, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 805632, "abuse": "abuse@rackspace.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33083, "h": "AXCELX-NET", "n": "Axcelx Technologies LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 1, "cve:CVE-2022-26134": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3817, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}}, "h2": [["2026-10-05", 1.869, 0.011, 0, false], ["2026-10-12", 1.975, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.975, "se": 0.956, "ts": 1.000, "map": 8.756, "obs": 2, "own": 1.792, "comp": {"cins": -0.2733, "dshield": -0.5942, "crowdsec": 6.3421, "vulncheck": -0.5001, "blocklist_de": -1.4111}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.876, "det": null, "oid": "AXCEL-16-ARIN", "org": "AxcelX Technologies LLC", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.axcelx.com"}, "pfx": 10, "reg": "2009-11-20", "rir": "arin", "s24": 24, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "noc@axcelx.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33139, "h": "CANACA-210", "n": "Canaca", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3034, "hi": 5.25, "lo": 0.68, "ips": 2, "mean": 2.50, "above": false}, "vulncheck": {"n": 1, "p": 0.1783, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.139, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 1.378, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.139, "se": 1.199, "ts": 1.000, "map": 0.944, "obs": 1, "own": 1.688, "comp": {"cins": -0.1184, "dshield": -0.2747, "crowdsec": -1.0875, "vulncheck": 3.4337, "blocklist_de": -0.6172}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.142, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}}, "oid": "CANAC-ARIN", "org": "Canaca-com Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.canaca.com"}, "pfx": 35, "reg": "2004-10-08", "rir": "arin", "s24": 93, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013023250009}, {"a": 33178, "h": "CSINET", "n": "Cable Services, Inc.", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 1.184, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.157, "det": {"shodan": {"compromised": 1}}, "oid": "CS-3-ARIN", "org": "Cable Services, Inc.", "pdb": null, "pfx": 3, "reg": "2011-03-16", "rir": "arin", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse2@csicable.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33182, "h": "DIMENOC", "n": "HostDime.com Inc", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2017-12149": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2017-17762": 1, "cve:CVE-2019-17050": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0284, "hi": 2.62, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}, "urlhaus": {"n": 1, "p": 0.1840, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 2, "p": 0.0613, "hi": 3.14, "lo": 0.41, "ips": 2, "mean": 1.50, "above": false}, "phishing_db": {"n": 3, "p": 0.5250, "hi": 6.54, "lo": 1.15, "ips": 3, "mean": 3.38, "above": false}}, "h2": [["2026-10-05", 0.212, 1.942, 0, false], ["2026-10-12", 0.221, 2.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 3}, "lo": 2.008, "se": 0.967, "ts": 0.750, "map": 6.263, "obs": 4, "own": 2.408, "comp": {"urlhaus": 1.9543, "threatfox": -0.483, "phishing_db": 1.9897}, "mass": 3.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.221, "se": 0.854, "ts": 1.000, "map": 0.804, "obs": 2, "own": 0.163, "comp": {"cins": -0.3845, "dshield": -0.7998, "crowdsec": 4.9242, "vulncheck": -0.593, "blocklist_de": -1.9719}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"compromised": 1}}, "oid": "DIMEN-6-ARIN", "org": "HostDime.com, Inc.", "pdb": {"t": "Content", "sc": "North America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.hostdime.com"}, "pfx": 84, "reg": "2004-10-20", "rir": "arin", "s24": 378, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 102144, "abuse": "abuse@hostdime.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015300446739}, {"a": 33363, "h": "BHN-33363", "n": "Charter Communications (33363)", "t": "Broadband & mobile", "w": 21, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.52, "waf": 0.33}, "cs": {"c": {"http_flood": 2, "data_centre": 5, "web_exploit": 5, "proxy_or_vpn": 2, "ssh_bruteforce": 5, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2025-22457": 1}, "n": 10}, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.45, "lo": 0.03, "ips": 1, "mean": 0.19, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.16, "lo": 0.03, "ips": 3, "mean": 0.08, "above": false}, "dshield": {"n": 4, "p": 0.0000, "hi": 0.69, "lo": 0.15, "ips": 4, "mean": 0.38, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.28, "lo": 0.10, "ips": 10, "mean": 0.18, "above": false}, "vulncheck": {"n": 4, "p": 0.0000, "hi": 0.71, "lo": 0.15, "ips": 4, "mean": 0.39, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 0.57, "lo": 0.19, "ips": 8, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.128, 0.004, 0, false], ["2026-10-12", 0.130, 0.004, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.639, "ts": null, "map": 0.039, "obs": 0, "own": 0.181, "comp": null, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 10, "vulncheck": 4, "blocklist_de": 8}, "lo": 0.130, "se": 0.422, "ts": 0.370, "map": 0.216, "obs": 27, "own": 0.334, "comp": {"cins": -0.6138, "dshield": 0.774, "crowdsec": -2.3359, "vulncheck": -0.0844, "blocklist_de": 2.1194}, "mass": 27.3, "listed": false}}, "abq": false, "bot": 0.137, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 3, "attack_tooling": 1}, "blocklist_de": {"ssh": 2, "imap": 4, "mail": 5, "apache": 1, "bruteforcelogin": 1}}, "oid": "CC-3518-ARIN", "org": "Charter Communications, Inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.spectrum.com/"}, "pfx": 443, "reg": "2004-12-03", "rir": "arin", "s24": 22700, "sib": 6, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6352384, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.233184}, {"a": 33387, "h": "NOCIX", "n": "NOCIX", "t": "Transit & backbone", "w": 15, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 3}, "ev": {"shodan": {"n": 8, "p": 0.9654, "hi": 9.91, "lo": 3.22, "ips": 8, "mean": 6.18, "above": true}, "crowdsec": {"n": 3, "p": 0.3087, "hi": 4.94, "lo": 0.87, "ips": 3, "mean": 2.55, "above": false}, "vulncheck": {"n": 11, "p": 0.9998, "hi": 16.37, "lo": 6.23, "ips": 11, "mean": 10.79, "above": true}, "phishing_db": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 3.841, 0.205, 0, false], ["2026-10-12", 2.500, 0.215, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.215, "se": 1.417, "ts": 1.000, "map": 1.620, "obs": 1, "own": 6.775, "comp": {"urlhaus": -0.2242, "threatfox": -0.2305, "phishing_db": 2.5631}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 11, "blocklist_de": 0}, "lo": 2.500, "se": 0.490, "ts": 0.786, "map": 4.597, "obs": 14, "own": 14.597, "comp": {"cins": -1.0443, "dshield": -1.728, "crowdsec": 1.2613, "vulncheck": 9.5727, "blocklist_de": -5.1427}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.867, "det": {"shodan": {"compromised": 7, "doublepulsar": 1}, "vulncheck": {"botnet_node": 11}}, "oid": "DL-9-ARIN", "org": "Nocix, LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.nocix.net"}, "pfx": 23, "reg": "2011-03-18", "rir": "arin", "s24": 214, "sib": 1, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 55040, "abuse": "security@datashack.net", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.00528103180744}, {"a": 33425, "h": "COREWEAVE", "n": "CoreWeave", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1271, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-12", 0.057, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.160, "obs": 0, "own": 0.370, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.057, "se": 1.107, "ts": 1.000, "map": 0.319, "obs": 1, "own": 0.203, "comp": {"cins": -0.1585, "dshield": -0.3615, "crowdsec": -1.4299, "vulncheck": 3.0248, "blocklist_de": -0.8243}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"other_infrastructure": 1}}, "oid": "COREW-1-ARIN", "org": "CoreWeave, Inc", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Selective", "web": "https://coreweave.com"}, "pfx": 6, "reg": "2020-08-05", "rir": "arin", "s24": 372, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 95232, "abuse": "abuse@coreweave.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00913026515998}, {"a": 33490, "h": "COMCAST-33490", "n": "Comcast - Portland/Spokane", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1531, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 1.570, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.884, "ts": null, "map": 0.184, "obs": 0, "own": 0.677, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.307, "det": {"shodan": {"compromised": 1}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": null}, "pfx": 35, "reg": "2004-12-30", "rir": "arin", "s24": 54, "sib": 55, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33491, "h": "COMCAST-33491", "n": "Comcast - Chicago", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2138, "hi": 4.53, "lo": 0.59, "ips": 2, "mean": 2.16, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.145, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.725, "ts": null, "map": 0.126, "obs": 0, "own": 0.339, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"compromised": 2}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": null}, "pfx": 81, "reg": "2004-12-30", "rir": "arin", "s24": 183, "sib": 55, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 46848, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33515, "h": "MONROE-GA", "n": "City of Monroe, GA", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1936, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.312, 0.011, 0, false], ["2026-10-12", 0.308, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.308, "se": 1.311, "ts": 1.000, "map": 2.578, "obs": 1, "own": 4.813, "comp": {"cins": -0.0841, "dshield": -0.1981, "crowdsec": -0.7848, "vulncheck": 3.8471, "blocklist_de": -0.4395}, "mass": 0.4, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "CITYO-385-ARIN", "org": "City of Monroe", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.monroega.com"}, "pfx": 11, "reg": "2010-10-04", "rir": "arin", "s24": 24, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33541, "h": "CCROUTE", "n": "Cable Cable", "t": "Broadband & mobile", "w": 9, "cc": "CA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "blocklist_de": {"n": 7, "p": 0.9843, "hi": 12.49, "lo": 3.78, "ips": 9, "mean": 7.60, "above": true}}, "h2": [["2026-10-05", 7.669, 0.011, 0, false], ["2026-10-12", 15.966, 0.012, 1, false]], "sh": false, "uc": 4424.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 7}, "lo": 15.966, "se": 0.519, "ts": 0.875, "map": 31.837, "obs": 8, "own": 48.801, "comp": {"cins": -1.4567, "dshield": -2.1372, "crowdsec": -6.2473, "vulncheck": -0.8925, "blocklist_de": 15.588}, "mass": 8.6, "listed": false}}, "abq": false, "bot": 0.258, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 9, "mail": 9}}, "oid": "CC-3056-ARIN", "org": "Cable Cable Inc", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.cablecable.net/"}, "pfx": 8, "reg": "2005-01-19", "rir": "arin", "s24": 49, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": "abuse-mail@i-zoom.net", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 33549, "h": "WHIPCORD", "n": "Whipcord", "t": "Hosting & VPS", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 0.252, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.192, "obs": 0, "own": 0.095, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.657, "det": {"shodan": {"compromised": 1}}, "oid": "WEDC-3-ARIN", "org": "Whipcord Edge Data Centers Inc.", "pdb": {"t": "Network Services", "sc": "North America", "tr": null, "pol": "Open", "web": "https://www.whipcord.com"}, "pfx": 50, "reg": "2011-03-22", "rir": "arin", "s24": 45, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16896, "abuse": "noc@whipcord.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33588, "h": "BRESNAN-33588", "n": "Charter Communications LLC", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.59, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}, "dshield": {"n": 1, "p": 0.0023, "hi": 1.71, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "vulncheck": {"n": 1, "p": 0.0026, "hi": 1.74, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}, "blocklist_de": {"n": 2, "p": 0.0001, "hi": 1.39, "lo": 0.18, "ips": 2, "mean": 0.66, "above": false}}, "h2": [["2026-10-05", 0.204, 0.007, 0, false], ["2026-10-12", 0.118, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.748, "ts": null, "map": 0.090, "obs": 0, "own": 0.407, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.118, "se": 0.606, "ts": 0.400, "map": 0.265, "obs": 5, "own": 0.417, "comp": {"cins": -0.9513, "dshield": 1.2482, "crowdsec": -3.5132, "vulncheck": 0.2284, "blocklist_de": 3.0546}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.154, "det": {"shodan": {"compromised": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 1, "mail": 2}}, "oid": "CC04-ARIN", "org": "Charter Communications LLC", "pdb": null, "pfx": 39, "reg": "2005-01-27", "rir": "arin", "s24": 3289, "sib": 128, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 841984, "abuse": "abuse@charter.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02651360990102}, {"a": 33638, "h": "SCOTTS-AS", "n": "CITY OF SCOTTSBURG", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.446, 0.011, 0, false], ["2026-10-12", 0.484, 0.012, 0, false]], "sh": false, "uc": 2490.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.484, "se": 1.383, "ts": 1.000, "map": 4.801, "obs": 1, "own": 3.286, "comp": {"cins": -0.1039, "dshield": -0.2427, "crowdsec": -0.961, "vulncheck": -0.2657, "blocklist_de": 4.5357}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.274, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "CITYO-19-ARIN", "org": "CITY OF SCOTTSBURG", "pdb": null, "pfx": 2, "reg": "2005-02-09", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "hostmaster@c3bb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33651, "h": "CMCS", "n": "Comcast - SFBA", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2005, "hi": 4.42, "lo": 0.57, "ips": 2, "mean": 2.11, "above": false}}, "h2": [["2026-10-05", 0.107, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.174, "obs": 0, "own": 1.117, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.714, "ts": null, "map": 0.122, "obs": 0, "own": 0.323, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.457, "det": {"shodan": {"compromised": 2}}, "oid": "CCCS-ARIN", "org": "Comcast Cable Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "https://corporate.comcast.com/"}, "pfx": 86, "reg": "2005-02-16", "rir": "arin", "s24": 199, "sib": 55, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51968, "abuse": "abuse@comcast.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000000177827}, {"a": 33724, "h": "BIZNESSHOSTING-DBA-VOLICO", "n": "Biznesshosting Inc DBA VOLICO", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0757, "hi": 3.36, "lo": 0.25, "ips": 1, "mean": 1.42, "above": false}, "blocklist_de": {"n": 1, "p": 0.1361, "hi": 4.07, "lo": 0.30, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.458, 0.010, 0, false], ["2026-10-12", 0.489, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 0.186, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.489, "se": 0.887, "ts": 0.500, "map": 1.895, "obs": 2, "own": 0.386, "comp": {"cins": -0.3729, "dshield": -0.7791, "crowdsec": 0.9979, "vulncheck": -0.5846, "blocklist_de": 2.7716}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "BIZNE-ARIN", "org": "VOLICO", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.volico.com/"}, "pfx": 71, "reg": "2005-03-04", "rir": "arin", "s24": 155, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 79872, "abuse": "abuse@biznesshosting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33749, "h": "FOCUS-BROADBAND", "n": "ATMC", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.5822, "hi": 7.07, "lo": 1.25, "ips": 3, "mean": 3.65, "above": false}}, "h2": [["2026-10-12", 0.808, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.967, "ts": null, "map": 0.176, "obs": 0, "own": 1.151, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.808, "se": 0.738, "ts": 1.000, "map": 2.371, "obs": 3, "own": 3.714, "comp": {"cins": -0.522, "dshield": 10.16, "crowdsec": -4.0531, "vulncheck": -0.6739, "blocklist_de": -2.6541}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.157, "det": null, "oid": "ATMC-2-ARIN", "org": "Focus Broadband", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.atmc.com/"}, "pfx": 54, "reg": "2005-03-18", "rir": "arin", "s24": 180, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 83456, "abuse": "noc@focusbroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00493775856042}, {"a": 33763, "h": "Paratus", "n": "Paratus Africa", "t": "Transit & backbone", "w": 11, "cc": "MU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 7, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 10, "mail_bruteforce": 10, "cve:CVE-2026-8181": 1}, "n": 11}, "ev": {"crowdsec": {"n": 10, "p": 0.9746, "hi": 9.25, "lo": 3.36, "ips": 11, "mean": 6.00, "above": true}}, "h2": [["2026-10-05", 4.074, 0.010, 0, false], ["2026-10-12", 2.464, 0.011, 0, false]], "sh": false, "uc": 75.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.927, "ts": null, "map": 0.165, "obs": 0, "own": 1.380, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.464, "se": 0.486, "ts": 1.000, "map": 4.549, "obs": 10, "own": 14.243, "comp": {"cins": -1.3715, "dshield": -2.0605, "crowdsec": 13.847, "vulncheck": -0.8825, "blocklist_de": -6.6239}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.260, "det": null, "oid": "ORG-PTL5-AFRINIC", "org": "Paratus Telecommunications Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.paratus.africa"}, "pfx": 129, "reg": "2004-10-29", "rir": "afrinic", "s24": 314, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 121088, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00402877675262}, {"a": 33765, "h": "TTCLDATA", "n": "TTCL Corporation", "t": "Transit & backbone", "w": 15, "cc": "TZ", "cf": null, "cs": {"c": {"proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 5, "router_or_botnet": 4, "cve:CVE-2024-6387": 1}, "n": 11}, "ev": {"shodan": {"n": 4, "p": 0.4541, "hi": 5.58, "lo": 1.20, "ips": 4, "mean": 3.05, "above": false}, "crowdsec": {"n": 11, "p": 0.9905, "hi": 10.13, "lo": 3.85, "ips": 11, "mean": 6.68, "above": true}, "blocklist_de": {"n": 6, "p": 0.8930, "hi": 8.96, "lo": 2.49, "ips": 7, "mean": 5.30, "above": true}}, "h2": [["2026-10-05", 3.874, 0.010, 0, false], ["2026-10-12", 5.692, 0.011, 0, false]], "sh": false, "uc": 755.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.930, "ts": null, "map": 0.166, "obs": 0, "own": 1.400, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 6}, "lo": 5.692, "se": 0.434, "ts": 0.647, "map": 9.759, "obs": 17, "own": 30.434, "comp": {"cins": -2.1264, "dshield": -2.6348, "crowdsec": 4.7216, "vulncheck": -0.9465, "blocklist_de": 4.658}, "mass": 16.2, "listed": false}}, "abq": false, "bot": 0.157, "det": {"shodan": {"compromised": 2, "doublepulsar": 2}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 2, "mail": 4}}, "oid": "ORG-TTCL1-AFRINIC", "org": "TANZANIA TELECOMMUNICATIONS CO. LTD", "pdb": {"t": "NSP", "sc": "Africa", "tr": null, "pol": "Open", "web": "https://www.ttcl.co.tz"}, "pfx": 222, "reg": "2009-01-29", "rir": "afrinic", "s24": 300, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 171776, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00323430897514}, {"a": 33771, "h": "SAFARICOM-LIMITED", "n": "Safaricom AS33771", "t": "Transit & backbone", "w": 16, "cc": "KE", "cf": {"rb": "hi", "wb": "hi", "rep": 1.18, "waf": 1.03}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 1.01, "lo": 0.08, "ips": 1, "mean": 0.43, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.09, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}, "blocklist_de": {"n": 12, "p": 0.0031, "hi": 2.33, "lo": 0.92, "ips": 14, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.051, 0.029, 0, false], ["2026-10-12", 0.281, 0.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.031, "se": 1.328, "ts": 1.000, "map": 0.167, "obs": 1, "own": 0.837, "comp": {"urlhaus": -0.6371, "threatfox": -0.402, "phishing_db": 0.8749}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 12}, "lo": 0.281, "se": 0.459, "ts": 0.923, "map": 0.499, "obs": 13, "own": 1.567, "comp": {"cins": -2.2988, "dshield": -1.5006, "crowdsec": -10.6111, "vulncheck": -0.9559, "blocklist_de": 16.0648}, "mass": 19.0, "listed": false}}, "abq": false, "bot": 0.118, "det": {"blocklist_de": {"bots": 14}}, "oid": "ORG-SL70-AFRINIC", "org": "Safaricom Limited", "pdb": {"t": "NSP", "sc": "Africa", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.safaricom.co.ke"}, "pfx": 106, "reg": "2005-04-11", "rir": "afrinic", "s24": 6846, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2317824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.061883}, {"a": 33786, "h": "KNet", "n": "K-Net Ghana", "t": "Transit & backbone", "w": 1, "cc": "GH", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.263, 0.012, 0, false]], "sh": false, "uc": 2539.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 2.491, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.263, "se": 1.285, "ts": 1.000, "map": 2.095, "obs": 1, "own": 7.857, "comp": {"cins": -0.0909, "dshield": -0.2136, "crowdsec": -0.8461, "vulncheck": 3.7588, "blocklist_de": -0.4751}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.319, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-KA10-AFRINIC", "org": "K-Net", "pdb": {"t": "NSP", "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.knetgh.com"}, "pfx": 29, "reg": "2005-07-25", "rir": "afrinic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001898245188}, {"a": 33876, "h": "Flesk-AS", "n": "Dominios", "t": "Transit & backbone", "w": 2, "cc": "PT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.5957, "hi": 7.20, "lo": 1.27, "ips": 3, "mean": 3.71, "above": false}, "crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.285, 0.011, 0, false], ["2026-10-12", 3.448, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 2.434, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.448, "se": 0.771, "ts": 0.667, "map": 10.811, "obs": 3, "own": 34.424, "comp": {"cins": -0.4811, "dshield": -0.9644, "crowdsec": 3.7938, "vulncheck": -0.6527, "blocklist_de": 2.0786}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.872, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-DDS19-RIPE", "org": "DMNS - DOMINIOS, S.A.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "http://dominios.pt"}, "pfx": 10, "reg": "2004-09-01", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "abuse@dominios.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000215505792}, {"a": 33885, "h": "OWNIT", "n": "Ownit Broadband AB", "t": "Broadband & mobile", "w": 2, "cc": "SE", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0181, "hi": 2.39, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "crowdsec": {"n": 2, "p": 0.0380, "hi": 2.83, "lo": 0.37, "ips": 2, "mean": 1.35, "above": false}}, "h2": [["2026-10-05", 0.565, 0.009, 0, false], ["2026-10-12", 0.189, 0.010, 0, false]], "sh": false, "uc": 82.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 0.855, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.189, "se": 0.849, "ts": 1.000, "map": 0.676, "obs": 2, "own": 1.076, "comp": {"cins": -0.3929, "dshield": -0.8146, "crowdsec": 4.8225, "vulncheck": -0.5988, "blocklist_de": -2.0138}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.135, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TBSA1-RIPE", "org": "Telenor Sverige AB", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Restrictive", "web": "http://www.ownit.se"}, "pfx": 12, "reg": "2004-08-31", "rir": "ripencc", "s24": 460, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 117760, "abuse": "abuse@telenor.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00342482716976}, {"a": 33915, "h": "TNF-AS", "n": "Vodafone Libertel B.V.", "t": "Broadband & mobile", "w": 84, "cc": "NL", "cf": {"rb": "hi", "wb": "hi", "rep": 0.41, "waf": 0.36}, "cs": {"c": {"http_flood": 1, "web_exploit": 31, "bad_crawling": 1, "proxy_or_vpn": 6, "ssh_bruteforce": 39, "web_bruteforce": 73, "home_connection": 68, "mail_bruteforce": 70, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 2}, "n": 74}, "ev": {"dshield": {"n": 4, "p": 0.0000, "hi": 0.61, "lo": 0.13, "ips": 4, "mean": 0.34, "above": false}, "crowdsec": {"n": 64, "p": 0.0000, "hi": 1.14, "lo": 0.75, "ips": 74, "mean": 0.94, "above": false}, "vulncheck": {"n": 2, "p": 0.0000, "hi": 0.43, "lo": 0.06, "ips": 2, "mean": 0.21, "above": false}, "blocklist_de": {"n": 30, "p": 0.0000, "hi": 1.42, "lo": 0.79, "ips": 30, "mean": 1.08, "above": false}}, "h2": [["2026-10-05", 0.464, 0.012, 0, false], ["2026-10-12", 0.458, 0.004, 0, false]], "sh": false, "uc": 50.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.004, "se": 1.634, "ts": null, "map": 0.037, "obs": 0, "own": 0.172, "comp": null, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 64, "vulncheck": 2, "blocklist_de": 30}, "lo": 0.458, "se": 0.374, "ts": 0.640, "map": 0.704, "obs": 100, "own": 1.087, "comp": {"cins": -3.7949, "dshield": -2.2338, "crowdsec": 4.8927, "vulncheck": -0.8807, "blocklist_de": 3.0592}, "mass": 100.7, "listed": false}}, "abq": true, "bot": 0.116, "det": {"vulncheck": {"c2_server": 2}, "blocklist_de": {"ftp": 1, "imap": 23, "mail": 29}}, "oid": "ORG-TNFB1-RIPE", "org": "Vodafone Libertel B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Restrictive", "web": "http://www.vodafone.nl/zakelijk/"}, "pfx": 343, "reg": "2004-09-06", "rir": "ripencc", "s24": 25739, "sib": 2, "tor": 0, "w24": 74, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.178144}, {"a": 33934, "h": "VolgogradEC-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1668, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 2, "p": 0.1764, "hi": 4.22, "lo": 0.55, "ips": 3, "mean": 2.01, "above": false}, "blocklist_de": {"n": 1, "p": 0.1262, "hi": 3.96, "lo": 0.30, "ips": 2, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.328, 0.010, 0, false], ["2026-10-12", 1.426, 0.011, 0, false]], "sh": false, "uc": 262.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 1.141, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.426, "se": 0.661, "ts": 0.500, "map": 3.591, "obs": 4, "own": 5.599, "comp": {"cins": 3.5772, "dshield": -1.3833, "crowdsec": 0.9298, "vulncheck": -0.7663, "blocklist_de": 0.3149}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.488, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 62, "reg": "2004-09-09", "rir": "ripencc", "s24": 185, "sib": 120, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 148480, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33983, "h": "ARTMOTION-AS", "n": "ARTMOTION SH.P.K.", "t": "Transit & backbone", "w": 4, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3493, "hi": 5.64, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}, "vulncheck": {"n": 2, "p": 0.4079, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 2.699, 0.011, 0, false], ["2026-10-12", 3.162, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 2.335, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 3.162, "se": 0.698, "ts": 0.500, "map": 8.414, "obs": 4, "own": 27.185, "comp": {"cins": -0.46, "dshield": -0.9295, "crowdsec": 4.0331, "vulncheck": 3.2277, "blocklist_de": -2.3478}, "mass": 2.1, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-AN5-RIPE", "org": "ARTMOTION SH.P.K.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.artmotion.net"}, "pfx": 47, "reg": "2004-09-23", "rir": "ripencc", "s24": 44, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00350781657522}, {"a": 33984, "h": "SURFPLANET-AS", "n": "Surfplanet GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 390.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.586, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.842, "ts": null, "map": 0.170, "obs": 0, "own": 0.208, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.835, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SG15-RIPE", "org": "Surfplanet GmbH", "pdb": null, "pfx": 14, "reg": "2004-09-23", "rir": "ripencc", "s24": 75, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 19200, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 33993, "h": "UFO-AS", "n": "UFO Hosting LLC", "t": "Hosting & VPS", "w": 8, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "vulncheck": {"n": 5, "p": 0.9103, "hi": 10.32, "lo": 2.56, "ips": 6, "mean": 5.89, "above": true}, "phishing_db": {"n": 1, "p": 0.1914, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 4.169, 0.439, 0, false], ["2026-10-12", 5.151, 0.457, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.457, "se": 1.539, "ts": 1.000, "map": 4.618, "obs": 1, "own": 2.104, "comp": {"urlhaus": -0.1116, "threatfox": -0.1385, "phishing_db": 3.4062}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 5, "blocklist_de": 0}, "lo": 5.151, "se": 0.614, "ts": 0.833, "map": 11.625, "obs": 6, "own": 2.362, "comp": {"cins": -0.5131, "dshield": -1.0164, "crowdsec": -0.2803, "vulncheck": 8.267, "blocklist_de": -2.6103}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.634, "det": {"threatfox": {"family:Sliver": 1}, "vulncheck": {"c2_server": 4, "botnet_node": 2}}, "oid": "ORG-UHL6-RIPE", "org": "UFO Hosting LLC", "pdb": null, "pfx": 36, "reg": "2004-09-24", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 9216, "abuse": "abuse@ufo.hosting", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00064840600825}, {"a": 34001, "h": "LIVAS-NET-AS", "n": "SIA LIVAS NET", "t": "Other", "w": 5, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1283, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "vulncheck": {"n": 1, "p": 0.1829, "hi": 4.57, "lo": 0.34, "ips": 4, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.692, 0.011, 0, false], ["2026-10-12", 0.669, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 0.592, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.669, "se": 0.921, "ts": 0.500, "map": 2.689, "obs": 2, "own": 1.619, "comp": {"cins": -0.253, "dshield": -0.5547, "crowdsec": 2.2121, "vulncheck": 2.2867, "blocklist_de": -1.3082}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.367, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-LN1-RIPE", "org": "SIA LIVAS NET", "pdb": null, "pfx": 4, "reg": "2004-09-28", "rir": "ripencc", "s24": 72, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "abuse@livas.lv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026171388594}, {"a": 34137, "h": "RUAMUR-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1730, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.008, 0.262, 0, false], ["2026-10-12", 0.008, 0.274, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.274, "se": 1.447, "ts": 1.000, "map": 2.235, "obs": 1, "own": 6.518, "comp": {"urlhaus": -0.186, "threatfox": -0.203, "phishing_db": 2.8194}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.773, "ts": null, "map": 0.145, "obs": 0, "own": 0.422, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 4, "reg": "2004-11-03", "rir": "ripencc", "s24": 127, "sib": 120, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 122880, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34139, "h": "DIVO-AS", "n": "JSC DIVO", "t": "Other", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1857, "hi": 4.60, "lo": 0.34, "ips": 6, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.184, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 0.620, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.184, "se": 1.234, "ts": 1.000, "map": 1.332, "obs": 1, "own": 0.883, "comp": {"cins": -0.1063, "dshield": -0.248, "crowdsec": -0.982, "vulncheck": 3.5717, "blocklist_de": -0.5547}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.430, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-CD37-RIPE", "org": "JSC DIVO", "pdb": null, "pfx": 17, "reg": "2004-11-03", "rir": "ripencc", "s24": 59, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "abuse@divomail.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34170, "h": "AS-AZTELEKOM", "n": "Aztelekom", "t": "Broadband & mobile", "w": 5, "cc": "AZ", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1904, "hi": 4.65, "lo": 0.35, "ips": 5, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.238, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 1.693, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.238, "se": 1.270, "ts": 1.000, "map": 1.847, "obs": 1, "own": 3.390, "comp": {"cins": -0.0952, "dshield": -0.2231, "crowdsec": -0.8836, "vulncheck": 3.7061, "blocklist_de": -0.497}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.143, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-AA137-RIPE", "org": "Aztelekom LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Tbps", "pol": "Selective", "web": "https://aztelekom.az/en/"}, "pfx": 38, "reg": "2004-11-11", "rir": "ripencc", "s24": 38, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "abuse@aztelekom.az", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009120214488}, {"a": 34222, "h": "ZONER-AS", "n": "ZONER a.s.", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.371, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.841, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ZSS1-RIPE", "org": "ZONER a.s.", "pdb": null, "pfx": 2, "reg": "2004-11-22", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "noc@zoner.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000935041617}, {"a": 34224, "h": "NETERRA-AS", "n": "Neterra", "t": "Transit & backbone", "w": 8, "cc": "BG", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"shodan": {"n": 2, "p": 0.2496, "hi": 4.81, "lo": 0.63, "ips": 2, "mean": 2.29, "above": false}, "crowdsec": {"n": 4, "p": 0.5999, "hi": 6.62, "lo": 1.42, "ips": 5, "mean": 3.62, "above": false}, "vulncheck": {"n": 1, "p": 0.1678, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "phishing_db": {"n": 2, "p": 0.3776, "hi": 5.88, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "blocklist_de": {"n": 1, "p": 0.1399, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 2.105, 1.019, 0, false], ["2026-10-12", 2.543, 1.045, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.045, "se": 1.142, "ts": 1.000, "map": 4.641, "obs": 2, "own": 16.997, "comp": {"urlhaus": -0.406, "threatfox": -0.3268, "phishing_db": 3.894}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.543, "se": 0.580, "ts": 0.667, "map": 5.572, "obs": 6, "own": 17.586, "comp": {"cins": -0.89, "dshield": -1.5467, "crowdsec": 5.6926, "vulncheck": 0.3141, "blocklist_de": -0.4587}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.584, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-NL38-RIPE", "org": "Neterra Ltd.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://neterra.net"}, "pfx": 132, "reg": "2004-11-22", "rir": "ripencc", "s24": 144, "sib": 5, "tor": 3, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42240, "abuse": "abuse@neterra.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072695393586}, {"a": 34267, "h": "DEBRYANSK-AS-1", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 5, "home_connection": 2, "router_or_botnet": 1}, "n": 5}, "ev": {"cins": {"n": 2, "p": 0.4114, "hi": 6.19, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}, "crowdsec": {"n": 5, "p": 0.8786, "hi": 9.46, "lo": 2.35, "ips": 5, "mean": 5.40, "above": true}}, "h2": [["2026-10-05", 6.887, 0.011, 0, false], ["2026-10-12", 12.094, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 1.658, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.094, "se": 0.546, "ts": 0.714, "map": 25.171, "obs": 7, "own": 38.802, "comp": {"cins": 6.7821, "dshield": -1.7925, "crowdsec": 5.8859, "vulncheck": -0.8435, "blocklist_de": -5.4127}, "mass": 5.9, "listed": false}}, "abq": false, "bot": 0.456, "det": null, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 12, "reg": "2004-12-02", "rir": "ripencc", "s24": 42, "sib": 120, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52224, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 34270, "h": "INETC", "n": "Internet Connections Ltd", "t": "Broadband & mobile", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 2, "mean": 1.84, "above": false}}, "h2": [["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": 610.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.416, "det": null, "oid": "ORG-ICL5-RIPE", "org": "Internet Connections Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Selective", "web": "http://www.inetc.co.uk/"}, "pfx": 1, "reg": "2004-12-03", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "noc@inetc.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34295, "h": "ETA-BG-ASN", "n": "Geo BG Net SPLtd.", "t": "Other", "w": 10, "cc": "BG", "cf": null, "cs": {"c": {"web_exploit": 3, "bad_crawling": 1, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 6, "router_or_botnet": 1, "cve:CVE-2024-3272": 1, "cve:CVE-2024-3273": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"dshield": {"n": 1, "p": 0.1665, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 5, "p": 0.7590, "hi": 7.57, "lo": 1.88, "ips": 7, "mean": 4.32, "above": false}, "vulncheck": {"n": 1, "p": 0.1674, "hi": 4.41, "lo": 0.33, "ips": 2, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 2.781, 0.010, 0, false], ["2026-10-12", 2.970, 0.011, 0, false]], "sh": false, "uc": 179.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 0.492, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.970, "se": 0.548, "ts": 0.714, "map": 6.119, "obs": 7, "own": 3.466, "comp": {"cins": -0.9691, "dshield": 1.1968, "crowdsec": 7.5663, "vulncheck": 0.2051, "blocklist_de": -4.7941}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.172, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-EBL1-RIPE", "org": "Geo BG Net SPLtd.", "pdb": null, "pfx": 143, "reg": "2004-12-09", "rir": "ripencc", "s24": 146, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47616, "abuse": "admin@botevgrad.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007133518899}, {"a": 34296, "h": "MILLENICOM-AS", "n": "MILLENI.COM", "t": "Broadband & mobile", "w": 1, "cc": "TR", "cf": {"rb": "lo", "wb": null, "rep": 1.91, "waf": null}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1544, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-12", 0.106, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.104, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.106, "se": 1.149, "ts": 1.000, "map": 0.676, "obs": 1, "own": 1.144, "comp": {"cins": -0.1856, "dshield": 4.2045, "crowdsec": -1.6551, "vulncheck": -0.3984, "blocklist_de": -0.964}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-MTHA3-RIPE", "org": "Millenicom Telekomunikasyon Hizmetleri Anonim Sirketi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.milleni.com.tr/"}, "pfx": 196, "reg": "2004-12-10", "rir": "ripencc", "s24": 207, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 52992, "abuse": "abuse@milleni.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01393587361575}, {"a": 34300, "h": "SPACENET-AS", "n": "Internet-Cosmos", "t": "Broadband & mobile", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1386, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.023, "ts": null, "map": 0.187, "obs": 0, "own": 1.459, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.843, "ts": null, "map": 0.171, "obs": 0, "own": 0.572, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.622, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-JI6-RIPE", "org": "Internet-Cosmos LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://spacenet.ru/"}, "pfx": 8, "reg": "2004-12-10", "rir": "ripencc", "s24": 74, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": "noc@spacenet.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34305, "h": "BASEIP", "n": "Base IP B.V.", "t": "Hosting & VPS", "w": 6, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 1, "ssh_bruteforce": 5, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2023-3519": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2025-12480": 1, "cve:CVE-2025-29925": 1, "cve:CVE-2026-41940": 1}, "n": 6}, "ev": {"crowdsec": {"n": 2, "p": 0.3446, "hi": 5.60, "lo": 0.73, "ips": 6, "mean": 2.67, "above": false}}, "h2": [["2026-10-05", 2.449, 0.011, 0, false], ["2026-10-12", 1.177, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 0.250, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.177, "se": 0.927, "ts": 1.000, "map": 4.927, "obs": 2, "own": 1.005, "comp": {"cins": -0.2993, "dshield": -0.6438, "crowdsec": 5.9991, "vulncheck": -0.5248, "blocklist_de": -1.5428}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.758, "det": null, "oid": "ORG-EA207-RIPE", "org": "Base IP B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.baseip.com/"}, "pfx": 18, "reg": "2004-12-13", "rir": "ripencc", "s24": 47, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": "abuse@baseip.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34343, "h": "BIP-AS", "n": "Eweka Internet Services", "t": "Broadband & mobile", "w": 13, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 12, "web_exploit": 13, "bad_crawling": 6, "ssh_bruteforce": 13, "web_bruteforce": 12, "mail_bruteforce": 3, "cve:CVE-2002-1131": 1, "cve:CVE-2007-0885": 1, "cve:CVE-2008-2398": 1, "cve:CVE-2021-41773": 2, "cve:CVE-2022-26134": 2}, "n": 13}, "ev": {"crowdsec": {"n": 7, "p": 0.9700, "hi": 11.01, "lo": 3.33, "ips": 13, "mean": 6.70, "above": true}}, "h2": [["2026-10-05", 11.632, 0.011, 1, false], ["2026-10-12", 6.353, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 1.464, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.353, "se": 0.540, "ts": 1.000, "map": 12.927, "obs": 7, "own": 19.914, "comp": {"cins": -1.0114, "dshield": -1.6908, "crowdsec": 12.4722, "vulncheck": -0.8265, "blocklist_de": -4.9905}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.739, "det": null, "oid": "ORG-EIS3-RIPE", "org": "Eweka Internet Services B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.eweka.nl/en"}, "pfx": 28, "reg": "2004-12-21", "rir": "ripencc", "s24": 73, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@eweka.nl", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00330465685068}, {"a": 34369, "h": "AS-SHATELMOBILE", "n": "Aria Shatel PJSC", "t": "Broadband & mobile", "w": 6, "cc": "IR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 3, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1647, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 3, "p": 0.3292, "hi": 5.08, "lo": 0.90, "ips": 3, "mean": 2.62, "above": false}, "blocklist_de": {"n": 2, "p": 0.2963, "hi": 5.19, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}}, "h2": [["2026-10-05", 4.226, 0.010, 0, false], ["2026-10-12", 2.465, 0.011, 0, false]], "sh": false, "uc": 274.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.174, "obs": 0, "own": 1.119, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.465, "se": 0.570, "ts": 0.500, "map": 5.283, "obs": 6, "own": 8.177, "comp": {"cins": 2.8587, "dshield": -1.7829, "crowdsec": 0.8092, "vulncheck": -0.8419, "blocklist_de": 2.015}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.523, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-ART1-RIPE", "org": "Aria Shatel PJSC", "pdb": null, "pfx": 45, "reg": "2004-12-28", "rir": "ripencc", "s24": 198, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 94976, "abuse": "abuse@rasana.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002368591368}, {"a": 34450, "h": "WDC-AS", "n": "NET GATE COMUNICATII", "t": "Broadband & mobile", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 0.911, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.208, "det": null, "oid": "ORG-SWDC1-RIPE", "org": "Net Gate Telecom S.R.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.net-gate.ro"}, "pfx": 23, "reg": "2005-01-21", "rir": "ripencc", "s24": 30, "sib": 2, "tor": 0, "w24": 0, "drop": 7, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": "abuse@net-gate.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003550462227}, {"a": 34458, "h": "SMARTNETSLB", "n": "Smart Networks", "t": "Broadband & mobile", "w": 1, "cc": "LB", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.709, 0.013, 0, false]], "sh": false, "uc": 3125, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.709, "se": 1.474, "ts": 1.000, "map": 8.213, "obs": 1, "own": 16.330, "comp": {"cins": -0.0782, "dshield": -0.1848, "crowdsec": -0.7321, "vulncheck": -0.2129, "blocklist_de": 4.7074}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.207, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SNS31-RIPE", "org": "Smart Networks S.a.r.l", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.smartnetworkslb.net"}, "pfx": 7, "reg": "2015-05-18", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@smartnetworkslb.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006062935032}, {"a": 34471, "h": "EXCOM-AS", "n": "Free Technologies Excom", "t": "Broadband & mobile", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": 745.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.993, "ts": null, "map": 0.182, "obs": 0, "own": 1.284, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.778, "ts": null, "map": 0.147, "obs": 0, "own": 0.432, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.157, "det": null, "oid": "ORG-FTES1-RIPE", "org": "Free Technologies Excom S.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.excom.es/"}, "pfx": 77, "reg": "2010-01-25", "rir": "ripencc", "s24": 122, "sib": 17, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 38400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00256381696553}, {"a": 34502, "h": "xlink-as", "n": "Multikom Austria Telekom GmbH", "t": "Broadband & mobile", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3378, "hi": 5.54, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.619, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.158, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-MATG1-RIPE", "org": "Multikom Austria Telekom GmbH", "pdb": null, "pfx": 1, "reg": "2005-02-01", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001979035188}, {"a": 34534, "h": "BULLIONET", "n": "Harmony Hosting", "t": "Hosting & VPS", "w": 8, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 4, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 1, "cve:CVE-2025-29927": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-72898": 1}, "n": 6}, "ev": {"crowdsec": {"n": 5, "p": 0.8965, "hi": 9.91, "lo": 2.46, "ips": 6, "mean": 5.65, "above": true}, "phishing_db": {"n": 2, "p": 0.4157, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 11.253, 3.522, 1, false], ["2026-10-12", 11.434, 3.580, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 3.580, "se": 1.181, "ts": 1.000, "map": 18.410, "obs": 2, "own": 6.852, "comp": {"urlhaus": -0.2697, "threatfox": -0.2593, "phishing_db": 5.0681}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.434, "se": 0.616, "ts": 1.000, "map": 26.974, "obs": 5, "own": 5.307, "comp": {"cins": -0.7207, "dshield": -1.3255, "crowdsec": 11.1078, "vulncheck": -0.7532, "blocklist_de": -3.6198}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.661, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-FNS23-RIPE", "org": "FBW NETWORKS SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://bullionet.com"}, "pfx": 23, "reg": "2019-12-13", "rir": "ripencc", "s24": 23, "sib": 4, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@fiberway.fr", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00048189941144}, {"a": 34545, "h": "MTSLink", "n": "Webinar Tehnologii OOO", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 3.184, 0.011, 0, false], ["2026-10-12", 0.539, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.539, "se": 1.418, "ts": 1.000, "map": 5.493, "obs": 1, "own": 3.972, "comp": {"cins": -0.06, "dshield": -0.143, "crowdsec": -0.5667, "vulncheck": 4.1812, "blocklist_de": -0.3143}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-WTO1-RIPE", "org": "Webinar Tehnologii OOO", "pdb": null, "pfx": 8, "reg": "2019-11-22", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@mts-link.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34549, "h": "MEER-AS", "n": "meerfarbig GmbH & Co. KG", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1312, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.015, "ts": null, "map": 0.186, "obs": 0, "own": 2.005, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.825, "ts": null, "map": 0.164, "obs": 0, "own": 1.077, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.826, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LIGC3-RIPE", "org": "meerfarbig GmbH & Co. KG", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://meerfarbig.net"}, "pfx": 45, "reg": "2005-02-11", "rir": "ripencc", "s24": 85, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34048, "abuse": "abuse@meerfarbig.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34572, "h": "HELIANTIS-AS", "n": "HELIANTIS SAS", "t": "Transit & backbone", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 2.148, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 1.257, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.238, "det": {"shodan": {"malware": 1}}, "oid": "ORG-HS1-RIPE", "org": "HELIANTIS SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.heliantis.fr/"}, "pfx": 11, "reg": "2005-02-16", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30208, "abuse": "abuse@heliantis.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34602, "h": "STARLINK-AS", "n": "Starlink (Media Ltd)", "t": "Broadband & mobile", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0413, "hi": 2.86, "lo": 0.21, "ips": 1, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.928, "ts": null, "map": 0.165, "obs": 0, "own": 0.976, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.656, "ts": null, "map": 0.101, "obs": 0, "own": 0.246, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.426, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ML423-RIPE", "org": "MEGASVYAZ LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://starlink.ru"}, "pfx": 26, "reg": "2005-02-22", "rir": "ripencc", "s24": 308, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 148992, "abuse": "noc@starlink.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058956866045}, {"a": 34661, "h": "BREEZE-NETWORK", "n": "Briz", "t": "Broadband & mobile", "w": 5, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.5758, "hi": 7.01, "lo": 1.23, "ips": 3, "mean": 3.61, "above": false}, "vulncheck": {"n": 2, "p": 0.3571, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}}, "h2": [["2026-10-12", 1.191, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.174, "obs": 0, "own": 1.119, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.191, "se": 0.628, "ts": 0.600, "map": 2.813, "obs": 5, "own": 4.425, "comp": {"cins": -0.6578, "dshield": 9.0525, "crowdsec": -4.8544, "vulncheck": 2.2039, "blocklist_de": -3.3165}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.202, "det": {"vulncheck": {"c2_server": 1, "attack_tooling": 1}}, "oid": "ORG-TT21-RIPE", "org": "TOV TRK \"Briz\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.briz.ua"}, "pfx": 21, "reg": "2005-03-10", "rir": "ripencc", "s24": 198, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 51712, "abuse": "abuse@breezein.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00184310566398}, {"a": 34665, "h": "PINDC-AS", "n": "PIN Datacenter", "t": "Hosting & VPS", "w": 527, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 1, "web_exploit": 7, "bad_crawling": 4, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "cve:CVE-2020-11738": 1, "cve:CVE-2024-12008": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1642, "hi": 4.37, "lo": 0.33, "ips": 3, "mean": 1.84, "above": false}, "shodan": {"n": 1, "p": 0.0726, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "dshield": {"n": 1, "p": 0.1555, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "urlhaus": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 2, "p": 0.1624, "hi": 4.10, "lo": 0.53, "ips": 7, "mean": 1.96, "above": false}, "vulncheck": {"n": 2, "p": 0.3562, "hi": 5.70, "lo": 0.74, "ips": 3, "mean": 2.71, "above": false}, "phishing_db": {"n": 3, "p": 0.5815, "hi": 7.06, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}, "blocklist_de": {"n": 5, "p": 0.8377, "hi": 8.65, "lo": 2.15, "ips": 516, "mean": 4.94, "above": true}}, "h2": [["2026-10-05", 5.284, 3.255, 0, false], ["2026-10-12", 4.981, 3.357, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 3}, "lo": 3.357, "se": 0.957, "ts": 0.750, "map": 10.484, "obs": 4, "own": 3.929, "comp": {"urlhaus": 2.1541, "threatfox": -0.4721, "phishing_db": 2.294}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 5}, "lo": 4.981, "se": 0.490, "ts": 0.455, "map": 9.231, "obs": 11, "own": 1.812, "comp": {"cins": 1.6915, "dshield": -0.3829, "crowdsec": -5.1581, "vulncheck": 0.186, "blocklist_de": 7.2798}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.333, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 1, "bots": 2, "mail": 513, "apache": 513}}, "oid": "ORG-PINL1-RIPE", "org": "Petersburg Internet Network ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.pindc.ru"}, "pfx": 163, "reg": "2019-11-01", "rir": "ripencc", "s24": 201, "sib": 4, "tor": 0, "w24": 10, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 77824, "abuse": "abuse@pindc.ru", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00100624207145}, {"a": 34666, "h": "GLB1-AS", "n": "JSC \"Global Erty\"", "t": "Other", "w": 5, "cc": "GE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "urlhaus": {"n": 3, "p": 0.6461, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3918, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}}, "h2": [["2026-10-12", 5.854, 33.156, 1, false]], "sh": false, "uc": 1367.2, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 33.156, "se": 1.016, "ts": 1.000, "map": 133.779, "obs": 3, "own": 113.392, "comp": {"urlhaus": 7.976, "threatfox": -0.4845, "phishing_db": -0.9691}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.854, "se": 0.783, "ts": 0.667, "map": 18.809, "obs": 3, "own": 10.773, "comp": {"cins": -0.4244, "dshield": 3.0963, "crowdsec": 4.4466, "vulncheck": -0.6195, "blocklist_de": -2.171}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.135, "det": null, "oid": "ORG-JE5-RIPE", "org": "JSC \"Global Erty\"", "pdb": null, "pfx": 20, "reg": "2005-03-11", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019788814656}, {"a": 34689, "h": "hosteroid", "n": "hosteroid", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CS778-RIPE", "org": "Castlegem SRL", "pdb": null, "pfx": 7, "reg": "2019-10-30", "rir": "ripencc", "s24": 7, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@hosteroid.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004411982594}, {"a": 34702, "h": "WAVECOM-AS", "n": "Aktsiaselts WaveCom", "t": "Broadband & mobile", "w": 1, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.213, 0.011, 0, false], ["2026-10-12", 0.224, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 1.527, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.224, "se": 1.245, "ts": 1.000, "map": 1.722, "obs": 1, "own": 3.007, "comp": {"cins": -0.1409, "dshield": -0.3237, "crowdsec": 3.4665, "vulncheck": -0.3315, "blocklist_de": -0.7335}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.350, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AW4-RIPE", "org": "Aktsiaselts WaveCom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.wavecom.ee"}, "pfx": 20, "reg": "2005-03-18", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": "abuse@wavecom.ee", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0010163372674}, {"a": 34703, "h": "PRTNET-AS", "n": "LTD Pokrovsky radiotelefon", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 4, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.282, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.282, "se": 1.297, "ts": 1.000, "map": 2.308, "obs": 1, "own": 1.567, "comp": {"cins": -0.0877, "dshield": -0.2063, "crowdsec": -0.8175, "vulncheck": 3.7998, "blocklist_de": -0.4584}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.504, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-LPR1-RIPE", "org": "LTD Pokrovsky radiotelefon", "pdb": null, "pfx": 7, "reg": "2007-08-22", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "admin@prtcom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34757, "h": "SIBSET-NSK-AS", "n": "Sibirskie Seti AS34757", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1175, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "blocklist_de": {"n": 2, "p": 0.3642, "hi": 5.76, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}}, "h2": [["2026-10-12", 1.756, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 1.406, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.756, "se": 0.756, "ts": 0.667, "map": 5.324, "obs": 3, "own": 8.349, "comp": {"cins": -0.5554, "dshield": -1.0832, "crowdsec": -0.6392, "vulncheck": -0.6897, "blocklist_de": 6.0335}, "mass": 2.6, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-CNL7-RIPE", "org": "Sibirskie Seti Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://sibset.ru"}, "pfx": 11, "reg": "2005-03-30", "rir": "ripencc", "s24": 86, "sib": 7, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": "abuse@sibset-team.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011727942611}, {"a": 34779, "h": "T-2-AS", "n": "T-2 d.o.o.", "t": "Broadband & mobile", "w": 0, "cc": "SI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0017, "hi": 1.65, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}}, "h2": [["2026-10-12", 0.005, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.847, "ts": null, "map": 0.135, "obs": 0, "own": 0.681, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.523, "ts": null, "map": 0.058, "obs": 0, "own": 0.123, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TD6-RIPE", "org": "T-2, d.o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.t-2.net/"}, "pfx": 26, "reg": "2005-04-05", "rir": "ripencc", "s24": 876, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 224256, "abuse": "abuse@t-2.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00875001488764}, {"a": 34892, "h": "INFOLINK-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1563, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 1.320, 0.011, 0, false], ["2026-10-12", 1.432, 0.012, 0, false]], "sh": false, "uc": 1416, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.432, "se": 0.939, "ts": 0.500, "map": 6.102, "obs": 2, "own": 9.795, "comp": {"cins": -0.3143, "dshield": -0.6721, "crowdsec": 1.5761, "vulncheck": -0.5381, "blocklist_de": 3.1507}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.602, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 17, "reg": "2005-04-26", "rir": "ripencc", "s24": 40, "sib": 120, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34918, "h": "PISHGAMAN-DATACENTER", "n": "Pishgaman Toseeh Ertebatat Company (Private Joint Stock)", "t": "Hosting & VPS", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 9, "p": 0.9974, "hi": 13.95, "lo": 4.82, "ips": 9, "mean": 8.88, "above": true}, "crowdsec": {"n": 2, "p": 0.3263, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "blocklist_de": {"n": 2, "p": 0.3821, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}}, "h2": [["2026-10-05", 3.533, 0.011, 0, false], ["2026-10-12", 3.950, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 0.238, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.950, "se": 0.671, "ts": 0.500, "map": 10.152, "obs": 4, "own": 2.011, "comp": {"cins": -0.6997, "dshield": -1.2963, "crowdsec": 1.5228, "vulncheck": -0.7462, "blocklist_de": 4.9308}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.412, "det": {"shodan": {"compromised": 9}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-PTEC8-RIPE", "org": "Pishgaman Toseeh Ertebatat Company (Private Joint Stock)", "pdb": null, "pfx": 55, "reg": "2005-04-28", "rir": "ripencc", "s24": 59, "sib": 8, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 34560, "abuse": "abuse@pishgaman.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00077253858165}, {"a": 34984, "h": "TELLCOM-AS", "n": "Superonline", "t": "Broadband & mobile", "w": 39, "cc": "TR", "cf": {"rb": "", "wb": "", "rep": 3.57, "waf": 0.83}, "cs": {"c": {"http_flood": 14, "data_centre": 3, "web_exploit": 16, "bad_crawling": 7, "proxy_or_vpn": 13, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 19, "home_connection": 12, "mail_bruteforce": 10, "router_or_botnet": 14, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 5}, "n": 23}, "ev": {"cins": {"n": 4, "p": 0.0213, "hi": 2.62, "lo": 0.56, "ips": 5, "mean": 1.43, "above": false}, "shodan": {"n": 12, "p": 0.0000, "hi": 1.43, "lo": 0.56, "ips": 12, "mean": 0.95, "above": false}, "dshield": {"n": 8, "p": 0.1215, "hi": 3.45, "lo": 1.12, "ips": 8, "mean": 2.15, "above": false}, "crowdsec": {"n": 16, "p": 0.0000, "hi": 1.45, "lo": 0.65, "ips": 23, "mean": 1.02, "above": false}, "vulncheck": {"n": 2, "p": 0.0004, "hi": 1.54, "lo": 0.20, "ips": 2, "mean": 0.73, "above": false}, "blocklist_de": {"n": 6, "p": 0.0001, "hi": 1.62, "lo": 0.45, "ips": 6, "mean": 0.95, "above": false}}, "h2": [["2026-10-05", 0.556, 0.006, 0, false], ["2026-10-12", 0.693, 0.006, 0, false]], "sh": false, "uc": 63, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.709, "ts": null, "map": 0.071, "obs": 0, "own": 0.320, "comp": null, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 8, "crowdsec": 16, "vulncheck": 2, "blocklist_de": 6}, "lo": 0.693, "se": 0.401, "ts": 0.444, "map": 1.090, "obs": 36, "own": 1.681, "comp": {"cins": 4.0135, "dshield": 2.8321, "crowdsec": -0.3911, "vulncheck": -0.6421, "blocklist_de": -4.3328}, "mass": 35.7, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"c2": 6, "compromised": 6}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-BTHA1-RIPE", "org": "Superonline Iletisim Hizmetleri A.S.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.superonline.net"}, "pfx": 2528, "reg": "2005-05-12", "rir": "ripencc", "s24": 5908, "sib": 1, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2075136, "abuse": "abuse@turkcell.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.170332}, {"a": 34985, "h": "NETINNOVATIONLLC-AS-AP", "n": "Net Innovation LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.626, 0, false], ["2026-10-12", 0.012, 0.647, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.647, "se": 1.639, "ts": 1.000, "map": 7.861, "obs": 1, "own": 10.011, "comp": {"urlhaus": -0.059, "threatfox": 3.8924, "phishing_db": -0.1452}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.810, "det": {"threatfox": {"family:Cobalt Strike": 1}}, "oid": "ORG-NA115-AP-APNIC", "org": "net innovation llc", "pdb": null, "pfx": 11, "reg": "2019-07-30", "rir": "apnic", "s24": 11, "sib": 2, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 34989, "h": "SERVETHEWORLD-AS", "n": "ServeTheWorld AS", "t": "Other", "w": 6, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "web_bruteforce": 3, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2016-1555": 1, "cve:CVE-2017-12149": 1, "cve:CVE-2024-12847": 1}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.3256, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "urlhaus": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 4, "p": 0.7083, "hi": 7.65, "lo": 1.65, "ips": 4, "mean": 4.18, "above": false}, "vulncheck": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 6.356, 2.261, 0, false], ["2026-10-12", 3.366, 2.441, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 2.441, "se": 1.192, "ts": 0.500, "map": 12.292, "obs": 2, "own": 12.507, "comp": {"urlhaus": 3.3162, "threatfox": -0.3712, "phishing_db": 1.1901}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.366, "se": 0.622, "ts": 0.800, "map": 7.971, "obs": 5, "own": 4.545, "comp": {"cins": -0.6908, "dshield": -1.2837, "crowdsec": 8.2551, "vulncheck": 0.6645, "blocklist_de": -3.4757}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.813, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-SA680-RIPE", "org": "ServeTheWorld AS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://servetheworld.net/"}, "pfx": 32, "reg": "2005-05-13", "rir": "ripencc", "s24": 74, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": "abuse@servetheworld.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00265769862372}, {"a": 35042, "h": "Layer7-Networks-DE", "n": "Layer7 Networks GmbH", "t": "Other", "w": 7, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 2, "ssh_bruteforce": 4, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1971, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 3, "p": 0.6314, "hi": 7.58, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}, "crowdsec": {"n": 2, "p": 0.4038, "hi": 6.12, "lo": 0.79, "ips": 7, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 34.874, 0.011, 1, false], ["2026-10-12", 9.586, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.586, "se": 0.799, "ts": 0.667, "map": 31.721, "obs": 3, "own": 18.221, "comp": {"cins": 4.287, "dshield": -0.8893, "crowdsec": 4.3091, "vulncheck": -0.6268, "blocklist_de": -2.2293}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.802, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-LNG5-RIPE", "org": "Layer7 Networks GmbH", "pdb": null, "pfx": 11, "reg": "2005-05-23", "rir": "ripencc", "s24": 11, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse@layer7.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011788137468}, {"a": 35047, "h": "AbissNet", "n": "Abissnet", "t": "Broadband & mobile", "w": 5, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 3, "router_or_botnet": 3, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"urlhaus": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2879, "hi": 5.12, "lo": 0.67, "ips": 3, "mean": 2.44, "above": false}}, "h2": [["2026-10-05", 1.463, 3.312, 0, false], ["2026-10-12", 0.730, 3.607, 0, false]], "sh": false, "uc": 324, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 3.607, "se": 1.185, "ts": 1.000, "map": 19.321, "obs": 2, "own": 44.993, "comp": {"urlhaus": 5.9197, "threatfox": -0.4473, "phishing_db": -0.8851}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.730, "se": 0.904, "ts": 1.000, "map": 2.925, "obs": 2, "own": 4.672, "comp": {"cins": -0.3232, "dshield": -0.6888, "crowdsec": 5.6889, "vulncheck": -0.5458, "blocklist_de": -1.664}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.455, "det": null, "oid": "ORG-AS52-RIPE", "org": "Abissnet sh.a.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://abissnet.al/"}, "pfx": 28, "reg": "2005-05-23", "rir": "ripencc", "s24": 86, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00250200200491}, {"a": 35048, "h": "BITERIKA-AS", "n": "Biterika Group LLC", "t": "Other", "w": 11, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 9, "web_bruteforce": 10, "cve:CVE-2022-39290": 2}, "n": 10}, "ev": {"crowdsec": {"n": 9, "p": 0.9926, "hi": 11.96, "lo": 4.13, "ips": 10, "mean": 7.61, "above": true}, "blocklist_de": {"n": 1, "p": 0.1492, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 11.952, 0.011, 1, false], ["2026-10-12", 6.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.995, "ts": null, "map": 0.182, "obs": 0, "own": 0.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.607, "se": 0.486, "ts": 0.900, "map": 12.194, "obs": 10, "own": 6.861, "comp": {"cins": -1.3784, "dshield": -2.0668, "crowdsec": 11.5518, "vulncheck": -0.8834, "blocklist_de": -3.3286}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.874, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-BGL31-RIPE", "org": "Biterika Group LLC", "pdb": null, "pfx": 150, "reg": "2019-05-22", "rir": "ripencc", "s24": 118, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52736, "abuse": "info@biterika.ru", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0041048189721}, {"a": 35091, "h": "Teledata-AS", "n": "Teledata, Ghana", "t": "Broadband & mobile", "w": 55, "cc": "IL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 10}, "n": 10}, "ev": {"dshield": {"n": 1, "p": 0.1771, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 9, "p": 0.9945, "hi": 12.51, "lo": 4.32, "ips": 10, "mean": 7.97, "above": true}, "blocklist_de": {"n": 17, "p": 1.0000, "hi": 23.12, "lo": 10.55, "ips": 50, "mean": 16.32, "above": true}}, "h2": [["2026-10-05", 29.544, 0.011, 1, false], ["2026-10-12", 35.360, 0.012, 1, false]], "sh": false, "uc": 6486, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 17}, "lo": 35.360, "se": 0.397, "ts": 0.630, "map": 56.806, "obs": 27, "own": 86.657, "comp": {"cins": -2.8085, "dshield": -2.1535, "crowdsec": -4.1546, "vulncheck": -0.9777, "blocklist_de": 15.5277}, "mass": 29.9, "listed": false}}, "abq": true, "bot": 0.195, "det": {"blocklist_de": {"imap": 50, "mail": 50}}, "oid": "ORG-TELE1-RIPE", "org": "Teledata, Ghana", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.teledataict.com"}, "pfx": 40, "reg": "2005-06-02", "rir": "ripencc", "s24": 96, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 48128, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0001239997724}, {"a": 35100, "h": "PatrikWeb-Core", "n": "Connect2IP", "t": "Broadband & mobile", "w": 13, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 8, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2026-1581": 1, "cve:CVE-2016-15043": 1}, "n": 9}, "ev": {"dshield": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 9, "mean": 1.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 7, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 1.018, 0.011, 0, false], ["2026-10-12", 2.396, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.396, "se": 0.762, "ts": 0.333, "map": 7.287, "obs": 3, "own": 11.420, "comp": {"cins": -0.5017, "dshield": 2.7796, "crowdsec": -0.1818, "vulncheck": -0.6636, "blocklist_de": 1.9472}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.649, "det": {"blocklist_de": {"ssh": 7}}, "oid": "ORG-PA75-RIPE", "org": "Patrik Lagerman", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.as35100.net"}, "pfx": 12, "reg": "2005-06-02", "rir": "ripencc", "s24": 56, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "admin@patrikweb.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003209002872}, {"a": 35179, "h": "KORBANK-AS", "n": "Korbank", "t": "Transit & backbone", "w": 4, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2012-0392": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1286, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "crowdsec": {"n": 3, "p": 0.4921, "hi": 6.27, "lo": 1.10, "ips": 4, "mean": 3.23, "above": false}}, "h2": [["2026-10-05", 1.488, 0.011, 0, false], ["2026-10-12", 1.488, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 1.982, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.488, "se": 0.750, "ts": 1.000, "map": 4.445, "obs": 3, "own": 14.143, "comp": {"cins": -0.4881, "dshield": -0.9758, "crowdsec": 7.4924, "vulncheck": -0.6565, "blocklist_de": -2.4867}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.636, "det": {"shodan": {"c2": 1}}, "oid": "ORG-KSA63-RIPE", "org": "Korbank S. A.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://korbank.pl"}, "pfx": 31, "reg": "2005-06-16", "rir": "ripencc", "s24": 89, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23552, "abuse": "abuse@korbank.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00282503620854}, {"a": 35224, "h": "PLINQ", "n": "PLINQ", "t": "Broadband & mobile", "w": 3, "cc": "NL", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1850, "hi": 4.59, "lo": 0.34, "ips": 3, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.678, 0.011, 0, false], ["2026-10-12", 0.178, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 1.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.178, "se": 1.230, "ts": 1.000, "map": 1.284, "obs": 1, "own": 2.321, "comp": {"cins": -0.1076, "dshield": -0.2508, "crowdsec": -0.9933, "vulncheck": 3.5566, "blocklist_de": -0.5614}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.153, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-SB343-RIPE", "org": "PLINQ BV", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://plinq.nl"}, "pfx": 36, "reg": "2005-06-27", "rir": "ripencc", "s24": 62, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": "info@plinq.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006538374525}, {"a": 35228, "h": "O2BROADBAND", "n": "O2 Broadband", "t": "Broadband & mobile", "w": 1, "cc": "GB", "cf": {"rb": "hi", "wb": "hi", "rep": 0.77, "waf": 0.67}, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.0258, "hi": 2.57, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.046, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.856, "ts": null, "map": 0.138, "obs": 0, "own": 0.708, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.046, "se": 1.069, "ts": 1.000, "map": 0.250, "obs": 1, "own": 0.415, "comp": {"cins": -0.2567, "dshield": -0.5619, "crowdsec": -2.219, "vulncheck": -0.4832, "blocklist_de": 3.5263}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.055, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-ABL1-RIPE", "org": "Telefonica UK Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.o2.co.uk/abouto2/company-details"}, "pfx": 114, "reg": "2005-06-28", "rir": "ripencc", "s24": 788, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 294656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.095558}, {"a": 35236, "h": "AS35236", "n": "2 connect", "t": "Transit & backbone", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1632, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 2.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.918, "ts": null, "map": 0.195, "obs": 0, "own": 1.586, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.727, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-UIS8-RIPE", "org": "UVT Internet s.r.o.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.2connect.cz"}, "pfx": 12, "reg": "2005-06-29", "rir": "ripencc", "s24": 41, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "abuse@uvtnet.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35251, "h": "ANTI-DDOS", "n": "NetLab Global", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6142, "hi": 7.39, "lo": 1.30, "ips": 3, "mean": 3.81, "above": false}, "phishing_db": {"n": 1, "p": 0.1942, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.371, 0.514, 0, false], ["2026-10-12", 0.011, 0.536, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.536, "se": 1.578, "ts": 1.000, "map": 5.832, "obs": 1, "own": 7.065, "comp": {"urlhaus": -0.0906, "threatfox": -0.117, "phishing_db": 3.5972}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 0.378, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.732, "det": {"shodan": {"malware": 2, "compromised": 1}}, "oid": "HOSTH-5-ARIN", "org": "NetLab Global", "pdb": null, "pfx": 19, "reg": "2024-05-01", "rir": "arin", "s24": 23, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35278, "h": "SPRINTHOST", "n": "SPRINTHOST.RU LLC", "t": "Hosting & VPS", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 2, "ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 2, "p": 0.3556, "hi": 5.69, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "vulncheck": {"n": 1, "p": 0.1899, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "phishing_db": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 4, "p": 0.7932, "hi": 8.78, "lo": 1.89, "ips": 4, "mean": 4.79, "above": true}}, "h2": [["2026-10-05", 1.087, 0.423, 0, false], ["2026-10-12", 12.437, 0.440, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.440, "se": 1.531, "ts": 1.000, "map": 4.362, "obs": 1, "own": 1.981, "comp": {"urlhaus": -0.1169, "threatfox": -0.1437, "phishing_db": 3.3596}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 4}, "lo": 12.437, "se": 0.556, "ts": 0.571, "map": 26.359, "obs": 7, "own": 5.185, "comp": {"cins": -1.1008, "dshield": -1.7901, "crowdsec": -1.8309, "vulncheck": 0.0503, "blocklist_de": 9.3369}, "mass": 5.9, "listed": false}}, "abq": false, "bot": 0.897, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 4}}, "oid": "ORG-SL311-RIPE", "org": "SPRINTHOST.RU LLC", "pdb": null, "pfx": 28, "reg": "2009-12-18", "rir": "ripencc", "s24": 40, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@sprinthost.ru", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 35283, "h": "NETWORTH-MAIN-AS", "n": "NETWORTH TELECOM", "t": "Broadband & mobile", "w": 2, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "urlhaus": {"n": 2, "p": 0.4182, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 0.009, 3.466, 0, false], ["2026-10-12", 0.009, 3.790, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 3.790, "se": 1.187, "ts": 1.000, "map": 20.375, "obs": 2, "own": 47.392, "comp": {"urlhaus": 5.9659, "threatfox": -0.4452, "phishing_db": -0.8803}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.548, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.199, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AA194-RIPE", "org": "Networth Telecom SAS", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.networthtelecom.fr"}, "pfx": 8, "reg": "2005-07-11", "rir": "ripencc", "s24": 80, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "abuse@netw.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022696206637}, {"a": 35297, "h": "DATALINE-AS", "n": "Dataline Net", "t": "Transit & backbone", "w": 4, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5552, "hi": 6.81, "lo": 1.20, "ips": 3, "mean": 3.51, "above": false}, "blocklist_de": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 3.834, 0.011, 0, false], ["2026-10-12", 4.102, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 2.252, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.102, "se": 0.671, "ts": 0.750, "map": 10.624, "obs": 4, "own": 33.540, "comp": {"cins": -0.6534, "dshield": -1.2302, "crowdsec": 5.3761, "vulncheck": -0.7299, "blocklist_de": 0.9941}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.301, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-DL91-RIPE", "org": "Dataline LLC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://dataline.ua"}, "pfx": 18, "reg": "2005-07-11", "rir": "ripencc", "s24": 52, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@dataline.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0027837957618}, {"a": 35320, "h": "ETT-AS", "n": "ETT", "t": "Transit & backbone", "w": 2, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3400, "hi": 5.56, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "vulncheck": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 2.015, 0.011, 0, false], ["2026-10-12", 1.984, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 2.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.984, "se": 0.777, "ts": 0.667, "map": 6.177, "obs": 3, "own": 20.010, "comp": {"cins": -0.3904, "dshield": -0.8102, "crowdsec": 4.8531, "vulncheck": 1.563, "blocklist_de": -2.0012}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-EA223-RIPE", "org": "Eurotranstelecom Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://ett.ua"}, "pfx": 3, "reg": "2005-07-14", "rir": "ripencc", "s24": 50, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": "abuse@ett.com.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00115670762268}, {"a": 35346, "h": "EUROTELECOM", "n": "EUROTELECOM", "t": "Broadband & mobile", "w": 4, "cc": "MD", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4151, "hi": 6.22, "lo": 0.81, "ips": 4, "mean": 2.96, "above": false}}, "h2": [["2026-10-12", 1.317, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 1.862, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.317, "se": 0.964, "ts": 1.000, "map": 5.672, "obs": 2, "own": 9.581, "comp": {"cins": -0.1737, "dshield": -0.3936, "crowdsec": -1.5566, "vulncheck": 6.1558, "blocklist_de": -0.9026}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.187, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-SIS76-RIPE", "org": "SC ITNS.NET SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.eurotelecom.info"}, "pfx": 26, "reg": "2005-07-20", "rir": "ripencc", "s24": 23, "sib": 19, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": "abuse@itns.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037618793646}, {"a": 35366, "h": "ISPPRO-AS", "n": "ISPpro Internet KG", "t": "Other", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1742, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "shodan": {"n": 1, "p": 0.0994, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "crowdsec": {"n": 1, "p": 0.0834, "hi": 3.46, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.130, 0.010, 0, false], ["2026-10-12", 0.541, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.984, "ts": null, "map": 0.180, "obs": 0, "own": 0.498, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.541, "se": 0.893, "ts": 0.500, "map": 2.101, "obs": 2, "own": 1.230, "comp": {"cins": 4.4233, "dshield": -0.78, "crowdsec": 0.9934, "vulncheck": -0.585, "blocklist_de": -1.9158}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.965, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IIK1-RIPE", "org": "ISPpro Internet KG", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.isppro.de"}, "pfx": 18, "reg": "2005-07-22", "rir": "ripencc", "s24": 140, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 71680, "abuse": "abuse@isppro.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35415, "h": "WEBZILLA", "n": "Webzilla EU", "t": "Hosting & VPS", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0641, "hi": 3.20, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "phishing_db": {"n": 1, "p": 0.1550, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.291, 0.201, 0, false], ["2026-10-12", 0.007, 0.210, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.210, "se": 1.414, "ts": 1.000, "map": 1.570, "obs": 1, "own": 0.714, "comp": {"urlhaus": -0.2281, "threatfox": -0.2331, "phishing_db": 2.5383}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.697, "ts": null, "map": 0.116, "obs": 0, "own": 0.038, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.994, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WL21-RIPE", "org": "Webzilla B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.webzilla.com"}, "pfx": 219, "reg": "2005-08-03", "rir": "ripencc", "s24": 225, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 57600, "abuse": "abuse@webzilla.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00825631209}, {"a": 35425, "h": "BYTEMARK-AS", "n": "Bytemark Limited", "t": "Hosting & VPS", "w": 2, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.3599, "hi": 5.29, "lo": 0.93, "ips": 3, "mean": 2.73, "above": false}, "vulncheck": {"n": 1, "p": 0.1534, "hi": 4.26, "lo": 0.32, "ips": 2, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.085, 0.010, 0, false], ["2026-10-12", 0.080, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 0.168, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.080, "se": 1.140, "ts": 1.000, "map": 0.487, "obs": 1, "own": 0.109, "comp": {"cins": -0.1424, "dshield": -0.3271, "crowdsec": -1.2944, "vulncheck": 3.18, "blocklist_de": -0.7416}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.983, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-RL20-RIPE", "org": "Iomart Managed Services Limited", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "No", "web": "http://www.bytemark.co.uk"}, "pfx": 22, "reg": "2005-08-04", "rir": "ripencc", "s24": 218, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 55808, "abuse": "abuse@rapidswitch.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041746320603}, {"a": 35434, "h": "PIRXNET-AS", "n": "PirxNet Grzegorz Bialas", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2565, "hi": 4.87, "lo": 0.63, "ips": 2, "mean": 2.32, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 1.244, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.763, "ts": null, "map": 0.141, "obs": 0, "own": 0.403, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.190, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-PGB3-RIPE", "org": "PirxNet Grzegorz Bialas", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.pirxnet.pl"}, "pfx": 19, "reg": "2005-08-08", "rir": "ripencc", "s24": 137, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40960, "abuse": "abuse@pirxnet.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00053879285538}, {"a": 35444, "h": "DigicomAlbania-AS", "n": "Digicom Albania", "t": "Broadband & mobile", "w": 5, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "router_or_botnet": 2, "cve:CVE-2024-28000": 2}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1531, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "crowdsec": {"n": 4, "p": 0.7385, "hi": 8.00, "lo": 1.72, "ips": 4, "mean": 4.37, "above": false}, "vulncheck": {"n": 1, "p": 0.1868, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 4.464, 0.011, 0, false], ["2026-10-12", 4.490, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 1.570, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 4.490, "se": 0.624, "ts": 0.800, "map": 10.688, "obs": 5, "own": 16.646, "comp": {"cins": -0.6781, "dshield": -1.2658, "crowdsec": 8.43, "vulncheck": 0.6914, "blocklist_de": -3.4148}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.262, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-DS299-RIPE", "org": "Digicom SHPK", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.digicom.al"}, "pfx": 43, "reg": "2005-08-09", "rir": "ripencc", "s24": 54, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24064, "abuse": "abuse@digicom.al", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00264567619429}, {"a": 35480, "h": "ASP-AS", "n": "ASP Ltd", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.998, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ASP3-RIPE", "org": "ASP Ltd", "pdb": null, "pfx": 1, "reg": "2005-08-16", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@evolink.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35585, "h": "KOMNET-AS", "n": "FHU Komnet Grzegorz Poltorak", "t": "Broadband & mobile", "w": 1, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.616, 0.011, 0, false], ["2026-10-12", 0.754, 0.013, 0, false]], "sh": false, "uc": 4557.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.754, "se": 1.492, "ts": 1.000, "map": 9.027, "obs": 1, "own": 18.204, "comp": {"cins": -0.0738, "dshield": -0.1746, "crowdsec": -0.6919, "vulncheck": -0.203, "blocklist_de": 4.7372}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.128, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-FKGP1-RIPE", "org": "FHU Komnet Grzegorz Poltorak", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.komnet24.pl"}, "pfx": 2, "reg": "2015-03-20", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "info@komnet24.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35592, "h": "COOLHOUSING-AS", "n": "Coolhousing", "t": "Hosting & VPS", "w": 2, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3515, "hi": 5.66, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}, "crowdsec": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "threatfox": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.230, 0.366, 0, false], ["2026-10-12", 0.244, 0.379, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.379, "se": 1.503, "ts": 1.000, "map": 3.514, "obs": 1, "own": 1.597, "comp": {"urlhaus": -0.1245, "threatfox": 3.2826, "phishing_db": -0.2753}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.244, "se": 1.257, "ts": 1.000, "map": 1.912, "obs": 1, "own": 0.428, "comp": {"cins": -0.136, "dshield": -0.3133, "crowdsec": 3.5232, "vulncheck": -0.3235, "blocklist_de": -0.7087}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.799, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Remcos": 1}}, "oid": "ORG-CS57-RIPE", "org": "Coolhousing s.r.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://coolhousing.net/"}, "pfx": 31, "reg": "2005-09-13", "rir": "ripencc", "s24": 53, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": "abuse@coolhousing.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033399111465}, {"a": 35598, "h": "INETCOM", "n": "INETCOM", "t": "Transit & backbone", "w": 6, "cc": "RU", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1635, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 1, "p": 0.0729, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "vulncheck": {"n": 4, "p": 0.7710, "hi": 8.44, "lo": 1.82, "ips": 4, "mean": 4.61, "above": false}}, "h2": [["2026-10-05", 0.937, 0.010, 0, false], ["2026-10-12", 1.476, 0.011, 0, false]], "sh": false, "uc": 164, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.690, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 4, "blocklist_de": 0}, "lo": 1.476, "se": 0.605, "ts": 0.667, "map": 3.293, "obs": 6, "own": 10.601, "comp": {"cins": -0.6306, "dshield": 2.2905, "crowdsec": -1.2497, "vulncheck": 5.36, "blocklist_de": -3.1849}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.569, "det": {"vulncheck": {"c2_server": 1, "botnet_node": 2, "attack_tooling": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-ICL77-RIPE", "org": "INETCOM CARRIER LLC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Tbps", "pol": "Selective", "web": "https://www.inetcom.ru"}, "pfx": 28, "reg": "2005-09-14", "rir": "ripencc", "s24": 161, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 114432, "abuse": "abuse131@inetcom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004607467403}, {"a": 35612, "h": "NGI-AS", "n": "Eolo SpA", "t": "Broadband & mobile", "w": 7, "cc": "IT", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 7, "mail_bruteforce": 2}, "n": 7}, "ev": {"shodan": {"n": 2, "p": 0.0005, "hi": 1.57, "lo": 0.20, "ips": 2, "mean": 0.75, "above": false}, "crowdsec": {"n": 7, "p": 0.0274, "hi": 2.77, "lo": 0.84, "ips": 7, "mean": 1.68, "above": false}, "blocklist_de": {"n": 2, "p": 0.0197, "hi": 2.51, "lo": 0.33, "ips": 2, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.964, 0.008, 0, false], ["2026-10-12", 0.572, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.810, "ts": null, "map": 0.119, "obs": 0, "own": 0.570, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.572, "se": 0.502, "ts": 0.778, "map": 1.089, "obs": 9, "own": 1.687, "comp": {"cins": -1.4426, "dshield": -2.1247, "crowdsec": 6.3856, "vulncheck": -0.8909, "blocklist_de": -0.4485}, "mass": 8.6, "listed": false}}, "abq": false, "bot": 0.136, "det": {"shodan": {"c2": 1, "compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-NS27-RIPE", "org": "EOLO S.p.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.eolo.it"}, "pfx": 23, "reg": "2005-09-16", "rir": "ripencc", "s24": 1412, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 394240, "abuse": "abuse@eolo.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.020570901558}, {"a": 35624, "h": "SILVERSTAR-AS", "n": "Fast Servers (Pty) Ltd", "t": "Hosting & VPS", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-FAST11-RIPE", "org": "Fast Servers (Pty) Ltd", "pdb": null, "pfx": 1, "reg": "2019-01-28", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "info@finegroupservers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35661, "h": "VIRTUASYS-EU", "n": "VIRTUASYS.EU", "t": "Transit & backbone", "w": 10, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 8, "proxy_or_vpn": 1, "first_seen_30d": 10, "web_bruteforce": 7, "cve:CVE-2024-28000": 3, "cve:CVE-2026-63030": 2}, "n": 10}, "ev": {"shodan": {"n": 2, "p": 0.3842, "hi": 5.94, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 10, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 1.733, 0.465, 0, false], ["2026-10-12", 0.347, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 2.555, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.347, "se": 1.316, "ts": 1.000, "map": 3.042, "obs": 1, "own": 11.127, "comp": {"cins": -0.115, "dshield": -0.2672, "crowdsec": 3.7746, "vulncheck": -0.2866, "blocklist_de": -0.5996}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-VSS29-RIPE", "org": "VIRTUA SYSTEMS SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.virtuasys.eu/"}, "pfx": 29, "reg": "2019-01-21", "rir": "ripencc", "s24": 28, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "abuse@virtuasys.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00060562082479}, {"a": 35682, "h": "BESTINTERNETSOLUTION-AS", "n": "BEST INTERNET SOLUTION XK", "t": "Other", "w": 2, "cc": "UZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 9, "p": 0.9985, "hi": 15.06, "lo": 5.20, "ips": 9, "mean": 9.59, "above": true}, "crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 2, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 5.299, 0.011, 0, false], ["2026-10-12", 2.433, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.433, "se": 0.970, "ts": 0.500, "map": 11.012, "obs": 2, "own": 6.494, "comp": {"cins": -0.2856, "dshield": -0.6178, "crowdsec": 1.8703, "vulncheck": -0.512, "blocklist_de": 3.3378}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.773, "det": {"shodan": {"compromised": 9}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BISX1-RIPE", "org": "BEST INTERNET SOLUTION XK", "pdb": null, "pfx": 13, "reg": "2019-04-29", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 5120, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0000365192096}, {"a": 35684, "h": "SHC", "n": "SHC Netzwerktechnik GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.775, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.412, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.526, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SNG9-RIPE", "org": "SHC Netzwerktechnik GmbH", "pdb": null, "pfx": 6, "reg": "2005-10-04", "rir": "ripencc", "s24": 19, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@shc.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 35699, "h": "ADAMOEU-AS", "n": "Adamo Telecom Iberia S.A", "t": "Broadband & mobile", "w": 2, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0116, "hi": 2.20, "lo": 0.16, "ips": 1, "mean": 0.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.1484, "hi": 3.99, "lo": 0.52, "ips": 2, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.159, 0.009, 0, false], ["2026-10-12", 0.192, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.885, "ts": null, "map": 0.150, "obs": 0, "own": 0.809, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.192, "se": 0.851, "ts": 1.000, "map": 0.690, "obs": 2, "own": 1.100, "comp": {"cins": -0.4635, "dshield": -0.9353, "crowdsec": -3.6815, "vulncheck": -0.6429, "blocklist_de": 6.746}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-WNA1-RIPE", "org": "Adamo Telecom Iberia S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.adamo.es"}, "pfx": 113, "reg": "2005-10-06", "rir": "ripencc", "s24": 541, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 139008, "abuse": "abuse@adamo.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00842310785703}, {"a": 35706, "h": "NAO", "n": "Net at Once", "t": "Broadband & mobile", "w": 5, "cc": "SE", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 2}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0490, "hi": 2.98, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "dshield": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "crowdsec": {"n": 4, "p": 0.4060, "hi": 5.28, "lo": 1.14, "ips": 4, "mean": 2.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.2551, "hi": 4.86, "lo": 0.63, "ips": 2, "mean": 2.32, "above": false}}, "h2": [["2026-10-05", 2.224, 0.010, 0, false], ["2026-10-12", 2.015, 0.011, 0, false]], "sh": false, "uc": 390.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.936, "ts": null, "map": 0.168, "obs": 0, "own": 1.011, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.015, "se": 0.539, "ts": 0.571, "map": 4.125, "obs": 7, "own": 6.376, "comp": {"cins": -1.1657, "dshield": 0.6631, "crowdsec": 2.6661, "vulncheck": -0.8538, "blocklist_de": 1.501}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-NAOA1-RIPE", "org": "Net at Once Sweden AB", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.netatonce.se"}, "pfx": 8, "reg": "2005-10-07", "rir": "ripencc", "s24": 276, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 70656, "abuse": "abuse@netatonce.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00112434070504}, {"a": 35745, "h": "PROVECTOR-AS", "n": "Provector", "t": "Transit & backbone", "w": 5, "cc": "PL", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1056, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "blocklist_de": {"n": 2, "p": 0.3532, "hi": 5.67, "lo": 0.74, "ips": 4, "mean": 2.70, "above": false}}, "h2": [["2026-10-05", 1.376, 0.011, 0, false], ["2026-10-12", 1.506, 0.012, 0, false]], "sh": false, "uc": 830.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 1.909, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.506, "se": 0.753, "ts": 0.667, "map": 4.524, "obs": 3, "own": 14.413, "comp": {"cins": -0.564, "dshield": -1.0964, "crowdsec": -0.7104, "vulncheck": -0.6936, "blocklist_de": 5.9675}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.255, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-KPMD2-RIPE", "org": "Provector Sp. z o.o", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.provector.pl"}, "pfx": 15, "reg": "2008-07-14", "rir": "ripencc", "s24": 103, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32256, "abuse": "abuse@provector.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002970097806}, {"a": 35758, "h": "HQSERV_NETWORKS", "n": "HQserv Networks", "t": "Transit & backbone", "w": 2, "cc": "IL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3556, "hi": 5.69, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 2.944, 0.011, 0, false], ["2026-10-12", 1.330, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 2.382, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.330, "se": 0.934, "ts": 1.000, "map": 5.659, "obs": 2, "own": 18.414, "comp": {"cins": -0.2929, "dshield": -0.6319, "crowdsec": 6.0816, "vulncheck": -0.519, "blocklist_de": -1.5109}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.485, "det": null, "oid": "ORG-RATT2-RIPE", "org": "Rachamim Aviel Twito", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.hqserv.co.il"}, "pfx": 30, "reg": "2018-11-26", "rir": "ripencc", "s24": 40, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@hqserv.co.il", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055282662385}, {"a": 35779, "h": "MCLOUD-AS", "n": "mCloud doo", "t": "Hosting & VPS", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.913, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MD161-RIPE", "org": "mCloud doo", "pdb": null, "pfx": 8, "reg": "2018-11-23", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@mcloud.rs", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000552303765}, {"a": 35790, "h": "se-sappa", "n": "Aktiebolaget Sappa", "t": "Other", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1230, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.007, "ts": null, "map": 0.184, "obs": 0, "own": 0.548, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.807, "ts": null, "map": 0.157, "obs": 0, "own": 0.179, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AS615-RIPE", "org": "Aktiebolaget Sappa", "pdb": null, "pfx": 50, "reg": "2018-11-23", "rir": "ripencc", "s24": 98, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36352, "abuse": "abuse@sappa.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00216389405184}, {"a": 35805, "h": "SILKNET-AS", "n": "Silknet", "t": "Broadband & mobile", "w": 23, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 5, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 3, "router_or_botnet": 3, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"dshield": {"n": 1, "p": 0.0173, "hi": 2.37, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}, "urlhaus": {"n": 2, "p": 0.3181, "hi": 5.37, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "crowdsec": {"n": 6, "p": 0.0012, "hi": 2.00, "lo": 0.55, "ips": 6, "mean": 1.18, "above": false}, "vulncheck": {"n": 3, "p": 0.1584, "hi": 3.93, "lo": 0.69, "ips": 10, "mean": 2.03, "above": false}, "blocklist_de": {"n": 4, "p": 0.0561, "hi": 3.06, "lo": 0.66, "ips": 4, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.501, 0.107, 0, false], ["2026-10-12", 0.654, 0.447, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.447, "se": 1.122, "ts": 1.000, "map": 1.904, "obs": 2, "own": 4.928, "comp": {"urlhaus": 3.8239, "threatfox": -0.5149, "phishing_db": -1.039}, "mass": 5.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 3, "blocklist_de": 4}, "lo": 0.654, "se": 0.467, "ts": 0.429, "map": 1.166, "obs": 14, "own": 1.805, "comp": {"cins": -1.7943, "dshield": -0.6896, "crowdsec": 0.7396, "vulncheck": 0.5073, "blocklist_de": 2.7842}, "mass": 12.1, "listed": false}}, "abq": false, "bot": 0.159, "det": {"vulncheck": {"botnet_node": 10}, "blocklist_de": {"bots": 2, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-UTOG1-RIPE", "org": "JSC \"Silknet\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "https://silknet.com"}, "pfx": 51, "reg": "2005-10-31", "rir": "ripencc", "s24": 1856, "sib": 1, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 483072, "abuse": "abuse@silknet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01956462129648}, {"a": 35807, "h": "AS-SKYNET-SPB", "n": "SkyNet SPB", "t": "Other", "w": 16, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "cve:CVE-2023-28121": 1, "cve:CVE-2024-25600": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"dshield": {"n": 2, "p": 0.1297, "hi": 3.82, "lo": 0.50, "ips": 2, "mean": 1.82, "above": false}, "urlhaus": {"n": 1, "p": 0.1547, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 3, "p": 0.0015, "hi": 1.85, "lo": 0.33, "ips": 3, "mean": 0.96, "above": false}, "vulncheck": {"n": 3, "p": 0.2813, "hi": 4.76, "lo": 0.84, "ips": 9, "mean": 2.46, "above": false}, "blocklist_de": {"n": 1, "p": 0.0083, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.536, 0.008, 0, false], ["2026-10-12", 0.493, 0.150, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.150, "se": 1.384, "ts": 1.000, "map": 1.060, "obs": 1, "own": 1.235, "comp": {"urlhaus": 2.9155, "threatfox": -0.4157, "phishing_db": -0.8151}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 1}, "lo": 0.493, "se": 0.522, "ts": 0.333, "map": 0.970, "obs": 9, "own": 0.553, "comp": {"cins": -1.184, "dshield": 3.1107, "crowdsec": 0.0295, "vulncheck": 1.6129, "blocklist_de": -2.2062}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.490, "det": {"vulncheck": {"botnet_node": 8, "attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SA582-RIPE", "org": "SkyNet Ltd.", "pdb": {"t": null, "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "http://SkyNet.ru"}, "pfx": 9, "reg": "2005-11-01", "rir": "ripencc", "s24": 1199, "sib": 3, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 307200, "abuse": "abuse@sknt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00735750410395}, {"a": 35815, "h": "URALCOMSETI-AS", "n": "LLC Cifrovie Seti Urala", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1525, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "vulncheck": {"n": 1, "p": 0.1890, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1790, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 2.374, 0.011, 0, false], ["2026-10-12", 2.372, 0.012, 0, false]], "sh": false, "uc": 1065.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.372, "se": 0.784, "ts": 0.333, "map": 7.415, "obs": 3, "own": 4.339, "comp": {"cins": -0.4104, "dshield": -0.8451, "crowdsec": 0.642, "vulncheck": 1.4803, "blocklist_de": 2.5303}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.434, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LCSU1-RIPE", "org": "LLC Cifrovie Seti Urala", "pdb": null, "pfx": 3, "reg": "2005-11-03", "rir": "ripencc", "s24": 44, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": "abuse@convex.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004202199001}, {"a": 35816, "h": "SEVSTAR", "n": "Lancom Ltd.", "t": "Other", "w": 21, "cc": "RU", "cf": null, "cs": {"c": {"bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"dshield": {"n": 9, "p": 0.9970, "hi": 13.66, "lo": 4.72, "ips": 9, "mean": 8.70, "above": true}, "crowdsec": {"n": 2, "p": 0.1075, "hi": 3.62, "lo": 0.47, "ips": 2, "mean": 1.73, "above": false}, "vulncheck": {"n": 2, "p": 0.3326, "hi": 5.49, "lo": 0.71, "ips": 10, "mean": 2.62, "above": false}, "blocklist_de": {"n": 1, "p": 0.0997, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 1.241, 0.010, 0, false], ["2026-10-12", 3.830, 0.011, 0, false]], "sh": false, "uc": 200.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.936, "ts": null, "map": 0.167, "obs": 0, "own": 0.407, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 9, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 1}, "lo": 3.830, "se": 0.457, "ts": 0.643, "map": 6.720, "obs": 14, "own": 3.785, "comp": {"cins": -1.639, "dshield": 14.7483, "crowdsec": -5.1961, "vulncheck": 0.1786, "blocklist_de": -4.7931}, "mass": 10.3, "listed": false}}, "abq": true, "bot": 0.470, "det": {"vulncheck": {"botnet_node": 10}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LL42-RIPE", "org": "Lancom Ltd.", "pdb": null, "pfx": 15, "reg": "2005-11-03", "rir": "ripencc", "s24": 278, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 71168, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00136860078048}, {"a": 35819, "h": "Mobily-AS", "n": "Etihad Etisalat Company (Mobily)", "t": "Broadband & mobile", "w": 8, "cc": "SA", "cf": {"rb": "", "wb": "", "rep": 0.67, "waf": 0.65}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.0000, "hi": 0.95, "lo": 0.12, "ips": 2, "mean": 0.45, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.22, "lo": 0.03, "ips": 2, "mean": 0.10, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 0.75, "lo": 0.16, "ips": 4, "mean": 0.41, "above": false}}, "h2": [["2026-10-05", 0.069, 0.005, 0, false], ["2026-10-12", 0.084, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.676, "ts": null, "map": 0.056, "obs": 0, "own": 0.251, "comp": null, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.084, "se": 0.518, "ts": 0.500, "map": 0.164, "obs": 8, "own": 0.256, "comp": {"cins": -1.5534, "dshield": 1.7701, "crowdsec": -4.7273, "vulncheck": -0.9026, "blocklist_de": 5.0007}, "mass": 9.6, "listed": false}}, "abq": false, "bot": 0.105, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-EE2-RIPE", "org": "Etihad Etisalat, a joint stock company", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.mobily.com.sa"}, "pfx": 673, "reg": "2005-11-07", "rir": "ripencc", "s24": 10462, "sib": 3, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3177984, "abuse": "abuse@mobily.com.sa", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.16841}, {"a": 35830, "h": "BTTGROUP-AS", "n": "Fast Servers (Pty) Ltd", "t": "Hosting & VPS", "w": 92, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 44, "web_exploit": 85, "bad_crawling": 2, "proxy_or_vpn": 1, "web_bruteforce": 90, "cve:CVE-2019-18935": 6, "cve:CVE-2022-26134": 2, "cve:CVE-2022-39290": 4, "cve:CVE-2026-60137": 27, "cve:CVE-2026-63030": 51}, "n": 90}, "ev": {"dshield": {"n": 2, "p": 0.4092, "hi": 6.17, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 7, "p": 0.9799, "hi": 11.91, "lo": 3.61, "ips": 90, "mean": 7.25, "above": true}}, "h2": [["2026-10-05", 17.953, 0.011, 1, false], ["2026-10-12", 15.729, 0.012, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.260, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 0}, "lo": 15.729, "se": 0.500, "ts": 0.778, "map": 30.281, "obs": 9, "own": 5.922, "comp": {"cins": -1.1975, "dshield": 3.0564, "crowdsec": 9.6478, "vulncheck": -0.8588, "blocklist_de": -5.8436}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.848, "det": null, "oid": "ORG-FAST11-RIPE", "org": "Fast Servers (Pty) Ltd", "pdb": null, "pfx": 37, "reg": "2018-11-20", "rir": "ripencc", "s24": 39, "sib": 2, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "info@finegroupservers.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00079325275801}, {"a": 35847, "h": "AS-EFTL", "n": "Ezee Fiber", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0012, "hi": 1.58, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}, "crowdsec": {"n": 1, "p": 0.0003, "hi": 1.36, "lo": 0.10, "ips": 1, "mean": 0.57, "above": false}, "blocklist_de": {"n": 2, "p": 0.0611, "hi": 3.14, "lo": 0.41, "ips": 2, "mean": 1.50, "above": false}}, "h2": [["2026-10-05", 0.037, 0.008, 0, false], ["2026-10-12", 0.217, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.842, "ts": null, "map": 0.133, "obs": 0, "own": 0.664, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.217, "se": 0.716, "ts": 0.667, "map": 0.609, "obs": 3, "own": 0.956, "comp": {"cins": -0.6724, "dshield": -1.2576, "crowdsec": -1.5744, "vulncheck": -0.7368, "blocklist_de": 5.1382}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "EFTL-ARIN", "org": "Ezee Fiber", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://ezeefiber.com/"}, "pfx": 74, "reg": "2005-03-24", "rir": "arin", "s24": 939, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 293632, "abuse": "noc@ezeefiber.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01566234398262}, {"a": 35908, "h": "VPLSNET", "n": "VPLS", "t": "Transit & backbone", "w": 118, "cc": "US", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 13, "p": 0.9999, "hi": 15.38, "lo": 6.30, "ips": 118, "mean": 10.42, "above": true}}, "h2": [["2026-10-05", 0.005, 3.115, 0, false], ["2026-10-12", 0.005, 3.165, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 13}, "lo": 3.165, "se": 0.805, "ts": 1.000, "map": 7.061, "obs": 13, "own": 24.260, "comp": {"urlhaus": -1.666, "threatfox": -0.5357, "phishing_db": 5.7825}, "mass": 6.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.550, "ts": null, "map": 0.066, "obs": 0, "own": 0.291, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.807, "det": null, "oid": "VPLSI-ARIN", "org": "Krypt Technologies", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.vpls.com"}, "pfx": 461, "reg": "2005-04-06", "rir": "arin", "s24": 704, "sib": 1, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 214016, "abuse": "abuse@vpls.net", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 35916, "h": "MULTA-ASN1", "n": "MultaCOM", "t": "Hosting & VPS", "w": 19, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1}, "n": 5}, "ev": {"cins": {"n": 2, "p": 0.1466, "hi": 3.97, "lo": 0.52, "ips": 2, "mean": 1.89, "above": false}, "shodan": {"n": 30, "p": 1.0000, "hi": 10.27, "lo": 5.66, "ips": 30, "mean": 7.82, "above": true}, "crowdsec": {"n": 5, "p": 0.0053, "hi": 2.24, "lo": 0.56, "ips": 5, "mean": 1.28, "above": false}, "threatfox": {"n": 2, "p": 0.2960, "hi": 5.19, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}, "vulncheck": {"n": 2, "p": 0.1101, "hi": 3.64, "lo": 0.47, "ips": 2, "mean": 1.74, "above": false}, "phishing_db": {"n": 4, "p": 0.4347, "hi": 5.46, "lo": 1.17, "ips": 7, "mean": 2.98, "above": false}, "blocklist_de": {"n": 3, "p": 0.0608, "hi": 3.12, "lo": 0.55, "ips": 3, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.548, 1.019, 0, false], ["2026-10-12", 0.825, 0.751, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 4}, "lo": 0.751, "se": 0.920, "ts": 0.667, "map": 1.990, "obs": 6, "own": 0.816, "comp": {"urlhaus": -1.2022, "threatfox": 1.0273, "phishing_db": 2.4894}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 3}, "lo": 0.825, "se": 0.481, "ts": 0.417, "map": 1.514, "obs": 12, "own": 0.299, "comp": {"cins": 4.5808, "dshield": -2.3849, "crowdsec": -0.6776, "vulncheck": 0.0594, "blocklist_de": 0.2303}, "mass": 11.7, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"c2": 11, "compromised": 19}, "threatfox": {"family:AdaptixC2": 2}, "vulncheck": {"attack_tooling": 2}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "MULTA-ARIN", "org": "MULTACOM CORPORATION", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.multacom.com"}, "pfx": 141, "reg": "2005-04-08", "rir": "arin", "s24": 1387, "sib": 0, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1926912, "abuse": "abuse@multacom.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00000159950992}, {"a": 35986, "h": "VYVE-BROADBAND", "n": "Allegiance Communications", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2026-8181": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1589, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 2, "p": 0.0008, "hi": 1.64, "lo": 0.21, "ips": 2, "mean": 0.78, "above": false}, "threatfox": {"n": 1, "p": 0.1366, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.262, 0.355, 0, false], ["2026-10-12", 0.094, 0.377, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 0.377, "se": 1.163, "ts": 0.500, "map": 1.671, "obs": 2, "own": 4.607, "comp": {"urlhaus": 2.42, "threatfox": 0.6229, "phishing_db": -0.9031}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.094, "se": 0.825, "ts": 1.000, "map": 0.321, "obs": 2, "own": 0.510, "comp": {"cins": -0.4297, "dshield": -0.8784, "crowdsec": 4.3841, "vulncheck": -0.6228, "blocklist_de": -2.1974}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:AsyncRAT": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "VBL-52-ARIN", "org": "Vyve Broadband", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.vyvebroadband.com"}, "pfx": 701, "reg": "2008-09-09", "rir": "arin", "s24": 1071, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 386816, "abuse": "abuse@vyvebb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00980043575358}, {"a": 36002, "h": "GOMAMI", "n": "GoMami NET", "t": "Transit & backbone", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 3.089, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 2.812, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.089, "se": 0.986, "ts": 1.000, "map": 14.394, "obs": 2, "own": 47.265, "comp": {"cins": -0.2977, "dshield": -0.641, "crowdsec": -2.5294, "vulncheck": -0.5234, "blocklist_de": 8.052}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.500, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "NHL-157-ARIN", "org": "GoMami Networks", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://gomami.io"}, "pfx": 16, "reg": "2025-03-06", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "noc@gomami.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00122050594247}, {"a": 36007, "h": "KAMATERA", "n": "Kamatera, Inc.", "t": "Hosting & VPS", "w": 14, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1735, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.89, "above": false}, "shodan": {"n": 7, "p": 0.9533, "hi": 10.05, "lo": 3.04, "ips": 7, "mean": 6.12, "above": true}, "crowdsec": {"n": 4, "p": 0.5999, "hi": 6.62, "lo": 1.42, "ips": 4, "mean": 3.62, "above": false}, "vulncheck": {"n": 3, "p": 0.5966, "hi": 7.21, "lo": 1.27, "ips": 4, "mean": 3.72, "above": false}, "phishing_db": {"n": 4, "p": 0.7786, "hi": 8.55, "lo": 1.84, "ips": 4, "mean": 4.67, "above": false}, "blocklist_de": {"n": 1, "p": 0.1399, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 14.656, 5.295, 1, false], ["2026-10-12", 3.957, 3.225, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 3.225, "se": 0.932, "ts": 1.000, "map": 9.541, "obs": 4, "own": 3.554, "comp": {"urlhaus": -0.7365, "threatfox": -0.4252, "phishing_db": 5.0435}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 3, "blocklist_de": 1}, "lo": 3.957, "se": 0.526, "ts": 0.444, "map": 7.751, "obs": 9, "own": 1.534, "comp": {"cins": 2.7403, "dshield": -1.8412, "crowdsec": 2.8372, "vulncheck": 1.7049, "blocklist_de": -1.9997}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.381, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 5}, "vulncheck": {"c2_server": 3, "botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "KAMAT-ARIN", "org": "Kamatera, Inc.", "pdb": null, "pfx": 141, "reg": "2015-06-30", "rir": "arin", "s24": 144, "sib": 3, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 36864, "abuse": "abuse@cloudwm.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00625477296273}, {"a": 36025, "h": "FASTEST-INTERNET-IN-PARKCITY-UTAH", "n": "WickedFastInternet.com", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.152, "det": {"shodan": {"doublepulsar": 1}}, "oid": "WFL-41-ARIN", "org": "WickedFastInternet.com", "pdb": null, "pfx": 2, "reg": "2018-12-14", "rir": "arin", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36086, "h": "TELX-LEGACY", "n": "Digital Realty United States", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0605, "hi": 3.15, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 1.509, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.691, "ts": null, "map": 0.114, "obs": 0, "own": 0.590, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.544, "det": {"shodan": {"malware": 1}}, "oid": "THETE-23-ARIN", "org": "Telx", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Selective", "web": "https://www.digitalrealty.com"}, "pfx": 140, "reg": "2005-08-25", "rir": "arin", "s24": 236, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65280, "abuse": "ipadmin@digitalrealty.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36103, "h": "CENTRALUTAH", "n": "CentraCom", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1117, "hi": 3.66, "lo": 0.48, "ips": 2, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 0.541, 0.010, 0, false], ["2026-10-12", 0.290, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.017, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.290, "se": 0.865, "ts": 1.000, "map": 1.076, "obs": 2, "own": 1.714, "comp": {"cins": -0.3704, "dshield": -0.7748, "crowdsec": 5.0965, "vulncheck": -0.5829, "blocklist_de": -1.9014}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.177, "det": null, "oid": "CNUT-ARIN", "org": "Central Utah Telephone, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.centracom.com"}, "pfx": 126, "reg": "2006-09-14", "rir": "arin", "s24": 271, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 93440, "abuse": "abuse@centracom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36114, "h": "VERSAWEB", "n": "VegasNAP, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.685, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.880, "det": {"shodan": {"compromised": 1}}, "oid": "VEGAS-3-ARIN", "org": "VegasNAP, LLC", "pdb": null, "pfx": 3, "reg": "2005-09-07", "rir": "arin", "s24": 8, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abusereports@fiberhub.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36149, "h": "HAWAIIAN-TELCOM", "n": "Hawaiian Telcom", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.0306, "hi": 2.67, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "crowdsec": {"n": 2, "p": 0.0001, "hi": 1.30, "lo": 0.17, "ips": 3, "mean": 0.62, "above": false}, "blocklist_de": {"n": 1, "p": 0.0042, "hi": 1.86, "lo": 0.14, "ips": 2, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.131, 0.008, 0, false], ["2026-10-12", 0.203, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.809, "ts": null, "map": 0.118, "obs": 0, "own": 0.565, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.203, "se": 0.640, "ts": 0.500, "map": 0.493, "obs": 4, "own": 0.771, "comp": {"cins": -0.8069, "dshield": 1.69, "crowdsec": 0.5355, "vulncheck": -0.7788, "blocklist_de": 0.0467}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.158, "det": {"blocklist_de": {"ssh": 2}}, "oid": "HAWAI-3-ARIN", "org": "Hawaiian Telcom Services Company, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.hawaiiantel.com/"}, "pfx": 17, "reg": "2005-09-16", "rir": "arin", "s24": 1442, "sib": 5, "tor": 1, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 379392, "abuse": "abuse@hawaiiantel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0126881331133}, {"a": 36183, "h": "AKAMAI-AS", "n": "Akamai Technologies (Apple Private Relay)", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.36, "waf": 0.32}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1078, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.060, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.153, "obs": 0, "own": 0.129, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.060, "se": 1.091, "ts": 1.000, "map": 0.339, "obs": 1, "own": 0.072, "comp": {"cins": -0.2193, "dshield": 4.0351, "crowdsec": -1.9263, "vulncheck": -0.4413, "blocklist_de": -1.1361}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.010, "det": null, "oid": "AKAMAI-ARIN", "org": "Akamai Technologies, Inc.", "pdb": null, "pfx": 491, "reg": "2005-09-29", "rir": "arin", "s24": 491, "sib": 22, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 125696, "abuse": "abuse@akamai.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.202084}, {"a": 36218, "h": "WHG-CAN", "n": "hosting.com CAN1", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.872, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://hosting.com"}, "pfx": 10, "reg": "2005-10-11", "rir": "ripencc", "s24": 20, "sib": 11, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@worldhost.group", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36236, "h": "NETACTUATE", "n": "NetActuate", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0598, "hi": 3.14, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.947, "ts": null, "map": 0.171, "obs": 0, "own": 1.058, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.690, "ts": null, "map": 0.113, "obs": 0, "own": 0.289, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.961, "det": {"shodan": {"compromised": 1}}, "oid": "NETAC-4-ARIN", "org": "NetActuate, Inc", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100+Tbps", "pol": "Open", "web": "https://www.netactuate.com"}, "pfx": 196, "reg": "2005-10-26", "rir": "arin", "s24": 238, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 71168, "abuse": "abuse@netactuate.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006659952424}, {"a": 36290, "h": "THECABLE-STKITTS-01", "n": "The Cable of St. Kitts", "t": "Broadband & mobile", "w": 2, "cc": "KN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1408, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "vulncheck": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.221, 0.011, 0, false], ["2026-10-12", 1.897, 0.012, 0, false]], "sh": false, "uc": 938.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 1.551, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.897, "se": 0.779, "ts": 0.333, "map": 5.883, "obs": 3, "own": 9.404, "comp": {"cins": -0.4207, "dshield": -0.8629, "crowdsec": 0.5459, "vulncheck": 1.4394, "blocklist_de": 2.464}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.607, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "CSK-5-ARIN", "org": "The Cable of St. Kitts", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Selective", "web": "http://www.thecable.net"}, "pfx": 8, "reg": "2005-11-16", "rir": "arin", "s24": 57, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003984012576}, {"a": 36351, "h": "SOFTLAYER", "n": "SoftLayer Technologies, Inc. (an IBM Company)", "t": "Hyperscale cloud", "w": 7, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "web_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 13, "p": 0.0000, "hi": 0.66, "lo": 0.27, "ips": 13, "mean": 0.45, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.16, "lo": 0.02, "ips": 2, "mean": 0.08, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.56, "lo": 0.04, "ips": 1, "mean": 0.24, "above": false}, "phishing_db": {"n": 3, "p": 0.0000, "hi": 0.98, "lo": 0.17, "ips": 3, "mean": 0.51, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}}, "h2": [["2026-10-05", 0.018, 0.055, 0, false], ["2026-10-12", 0.022, 0.057, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.057, "se": 1.116, "ts": 1.000, "map": 0.192, "obs": 3, "own": 0.186, "comp": {"urlhaus": -1.1893, "threatfox": -0.4949, "phishing_db": 1.658}, "mass": 5.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.022, "se": 0.641, "ts": 0.500, "map": 0.052, "obs": 4, "own": 0.022, "comp": {"cins": -0.8254, "dshield": -1.4652, "crowdsec": 0.3723, "vulncheck": 0.4144, "blocklist_de": -0.0664}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.980, "det": {"shodan": {"compromised": 13}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "IBMC-24-ARIN", "org": "IBM Cloud", "pdb": {"t": "Content", "sc": "North America", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.ibm.com/cloud"}, "pfx": 339, "reg": "2005-12-12", "rir": "arin", "s24": 14163, "sib": 8, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3755520, "abuse": "abuse@softlayer.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01675858161256}, {"a": 36352, "h": "AS-COLOCROSSING", "n": "ColoCrossing", "t": "Hosting & VPS", "w": 523, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 5.72, "waf": 3.63}, "cs": {"c": {"http_flood": 70, "data_centre": 140, "web_exploit": 151, "bad_crawling": 36, "proxy_or_vpn": 24, "first_seen_30d": 20, "ssh_bruteforce": 81, "web_bruteforce": 86, "home_connection": 5, "mail_bruteforce": 10, "router_or_botnet": 3, "cve:CVE-2017-9841": 35, "cve:CVE-2019-9082": 28, "cve:CVE-2018-20062": 32, "cve:CVE-2023-22527": 9, "cve:CVE-2024-25600": 8}, "n": 198}, "ev": {"cins": {"n": 19, "p": 0.9998, "hi": 10.56, "lo": 5.02, "ips": 19, "mean": 7.58, "above": true}, "shodan": {"n": 341, "p": 1.0000, "hi": 40.15, "lo": 33.60, "ips": 341, "mean": 36.82, "above": true}, "dshield": {"n": 12, "p": 0.8544, "hi": 6.29, "lo": 2.49, "ips": 12, "mean": 4.20, "above": true}, "urlhaus": {"n": 12, "p": 0.9997, "hi": 14.31, "lo": 5.66, "ips": 12, "mean": 9.57, "above": true}, "crowdsec": {"n": 178, "p": 1.0000, "hi": 17.82, "lo": 13.93, "ips": 198, "mean": 15.82, "above": true}, "threatfox": {"n": 31, "p": 1.0000, "hi": 26.22, "lo": 14.60, "ips": 33, "mean": 20.06, "above": true}, "vulncheck": {"n": 24, "p": 1.0000, "hi": 11.12, "lo": 5.73, "ips": 26, "mean": 8.24, "above": true}, "phishing_db": {"n": 157, "p": 1.0000, "hi": 61.89, "lo": 47.62, "ips": 210, "mean": 54.56, "above": true}, "blocklist_de": {"n": 39, "p": 1.0000, "hi": 9.88, "lo": 5.85, "ips": 41, "mean": 7.76, "above": true}}, "h2": [["2026-10-05", 7.753, 11.632, 2, false], ["2026-10-12", 7.203, 10.946, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 12, "threatfox": 31, "phishing_db": 157}, "lo": 10.946, "se": 0.711, "ts": 0.785, "map": 21.136, "obs": 200, "own": 7.424, "comp": {"urlhaus": -0.0967, "threatfox": 0.3557, "phishing_db": 4.4182}, "mass": 106.1, "listed": true}, "prov": false, "attack": {"n": {"cins": 19, "dshield": 12, "crowdsec": 178, "vulncheck": 24, "blocklist_de": 39}, "lo": 7.203, "se": 0.354, "ts": 0.654, "map": 10.793, "obs": 272, "own": 2.107, "comp": {"cins": 2.9658, "dshield": -1.9505, "crowdsec": 8.8099, "vulncheck": -0.3638, "blocklist_de": -5.6888}, "mass": 230.8, "listed": false}}, "abq": true, "bot": 0.391, "det": {"shodan": {"c2": 62, "malware": 8, "compromised": 270, "doublepulsar": 1}, "threatfox": {"family:Remcos": 7, "family:PureRAT": 4, "family:AdaptixC2": 4, "family:Cobalt Strike": 7, "family:Unknown malware": 4}, "vulncheck": {"c2_server": 3, "botnet_node": 1, "attack_tooling": 22}, "blocklist_de": {"ftp": 2, "ssh": 32, "bots": 3, "imap": 2, "mail": 3, "apache": 2, "bruteforcelogin": 1}}, "oid": "HOSTP-7-ARIN", "org": "HostPapa", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.colocrossing.com"}, "pfx": 3283, "reg": "2005-12-12", "rir": "arin", "s24": 3880, "sib": 11, "tor": 2, "w24": 422, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 1073920, "abuse": null, "score": 1.0000, "groups": ["sensors", "cloudflare", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": 0.053247}, {"a": 36374, "h": "STELLAR-ASSOCIATION", "n": "Stellar Association", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0707, "hi": 3.29, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.106, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.709, "ts": null, "map": 0.120, "obs": 0, "own": 0.316, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.194, "det": {"shodan": {"compromised": 1}}, "oid": "SAL-65-ARIN", "org": "Stellar Association, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.stellarllc.net"}, "pfx": 17, "reg": "2005-12-16", "rir": "arin", "s24": 206, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54784, "abuse": "ipadmin@stellarllc.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36454, "h": "WHG-DAL", "n": "hosting.com USC1", "t": "Hosting & VPS", "w": 5, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 3, "bad_crawling": 2, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2024-2473": 1, "cve:CVE-2023-23752": 1, "cve:CVE-2024-28000": 3, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.5688, "hi": 6.94, "lo": 1.22, "ips": 3, "mean": 3.58, "above": false}, "crowdsec": {"n": 5, "p": 0.8656, "hi": 9.17, "lo": 2.28, "ips": 5, "mean": 5.23, "above": true}, "blocklist_de": {"n": 1, "p": 0.1743, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 8.245, 0.011, 0, false], ["2026-10-12", 7.051, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.242, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.051, "se": 0.572, "ts": 0.833, "map": 15.344, "obs": 6, "own": 3.018, "comp": {"cins": -0.9266, "dshield": -1.5913, "crowdsec": 8.1306, "vulncheck": -0.8087, "blocklist_de": -0.6796}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.896, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "No", "web": "http://hosting.com"}, "pfx": 51, "reg": "2013-05-30", "rir": "ripencc", "s24": 55, "sib": 11, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@worldhost.group", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 36530, "h": "FUTURE-LAIN", "n": "FUTURE-LAIN", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.556, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.556, "se": 1.412, "ts": 1.000, "map": 5.805, "obs": 1, "own": 1.405, "comp": {"cins": -0.0867, "dshield": 4.7319, "crowdsec": -0.8084, "vulncheck": -0.2311, "blocklist_de": -0.4532}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ICL-258-ARIN", "org": "IDC Cube", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://lain.sh"}, "pfx": 7, "reg": "2024-07-29", "rir": "arin", "s24": 8, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@4eva.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00094085761455}, {"a": 36666, "h": "GTCOMM", "n": "GloboTech Communications", "t": "Other", "w": 2, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0985, "hi": 3.64, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "phishing_db": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 1.146, 0.274, 0, false], ["2026-10-12", 0.155, 0.287, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.287, "se": 1.454, "ts": 1.000, "map": 2.386, "obs": 1, "own": 2.802, "comp": {"urlhaus": -0.1786, "threatfox": -0.1973, "phishing_db": 2.8717}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.155, "se": 1.193, "ts": 1.000, "map": 1.071, "obs": 1, "own": 0.672, "comp": {"cins": -0.1629, "dshield": -0.371, "crowdsec": 3.2096, "vulncheck": -0.366, "blocklist_de": -0.8474}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "GLOBO-ARIN", "org": "GloboTech Communications", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.globo.tech"}, "pfx": 13, "reg": "2008-01-25", "rir": "arin", "s24": 114, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29440, "abuse": "abuse@globo.tech", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00061443850328}, {"a": 36728, "h": "EMERYTELCOM", "n": "Emery Telcom", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1815, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "shodan": {"n": 2, "p": 0.2989, "hi": 5.22, "lo": 0.68, "ips": 2, "mean": 2.49, "above": false}}, "h2": [["2026-10-05", 0.172, 0.011, 0, false], ["2026-10-12", 0.182, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.007, "ts": null, "map": 0.184, "obs": 0, "own": 1.364, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.182, "se": 1.218, "ts": 1.000, "map": 1.323, "obs": 1, "own": 2.298, "comp": {"cins": 4.8625, "dshield": -0.3879, "crowdsec": -1.5343, "vulncheck": -0.3778, "blocklist_de": -0.8887}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.156, "det": {"shodan": {"c2": 2}}, "oid": "EMERY-ARIN", "org": "Emery Telcom", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.emerytelcom.com"}, "pfx": 8, "reg": "2006-03-30", "rir": "arin", "s24": 97, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24832, "abuse": "noc@emerytelcom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36850, "h": "UNC-CH", "n": "University of North Carolina at Chapel Hill", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 3, "web_bruteforce": 3, "home_connection": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2021-26086": 3, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 2}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.0009, "hi": 1.53, "lo": 0.11, "ips": 3, "mean": 0.64, "above": false}}, "h2": [["2026-10-05", 0.042, 0.009, 0, false], ["2026-10-12", 0.043, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.855, "ts": null, "map": 0.138, "obs": 0, "own": 0.285, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.043, "se": 1.061, "ts": 1.000, "map": 0.228, "obs": 1, "own": 0.139, "comp": {"cins": -0.2379, "dshield": -0.5248, "crowdsec": 2.3741, "vulncheck": -0.4629, "blocklist_de": -1.2312}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.112, "det": null, "oid": "UNC-1-ARIN", "org": "University of North Carolina at Chapel Hill", "pdb": null, "pfx": 8, "reg": "2006-05-15", "rir": "arin", "s24": 794, "sib": 1, "tor": 3, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 203520, "abuse": "abuse@unc.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 36866, "h": "JTL", "n": "Jamii Telecommunications", "t": "Broadband & mobile", "w": 10, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 3, "router_or_botnet": 5, "cve:CVE-2024-28000": 3}, "n": 8}, "ev": {"shodan": {"n": 1, "p": 0.0431, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "crowdsec": {"n": 8, "p": 0.9033, "hi": 8.03, "lo": 2.61, "ips": 8, "mean": 5.01, "above": true}, "blocklist_de": {"n": 4, "p": 0.6358, "hi": 6.93, "lo": 1.49, "ips": 4, "mean": 3.78, "above": false}}, "h2": [["2026-10-05", 2.482, 0.010, 0, false], ["2026-10-12", 3.771, 0.011, 0, false]], "sh": false, "uc": 151, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.930, "ts": null, "map": 0.166, "obs": 0, "own": 0.985, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 4}, "lo": 3.771, "se": 0.467, "ts": 0.667, "map": 6.763, "obs": 12, "own": 10.407, "comp": {"cins": -1.7256, "dshield": -2.3575, "crowdsec": 4.8969, "vulncheck": -0.9184, "blocklist_de": 3.4098}, "mass": 11.2, "listed": false}}, "abq": false, "bot": 0.219, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-JTL1-AFRINIC", "org": "Jamii Telecommunications Limited", "pdb": {"t": "NSP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.faiba.co.ke/"}, "pfx": 5, "reg": "2005-08-09", "rir": "afrinic", "s24": 300, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 76800, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00425192207024}, {"a": 36873, "h": "VNL1-AS", "n": "Airtel Networks Nigeria", "t": "Broadband & mobile", "w": 17, "cc": "NG", "cf": {"rb": "hi", "wb": "hi", "rep": 0.62, "waf": 0.54}, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0000, "hi": 0.68, "lo": 0.05, "ips": 1, "mean": 0.29, "above": false}, "blocklist_de": {"n": 15, "p": 0.9416, "hi": 6.75, "lo": 2.93, "ips": 16, "mean": 4.68, "above": true}}, "h2": [["2026-10-05", 0.133, 0.007, 0, false], ["2026-10-12", 1.070, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.775, "ts": null, "map": 0.102, "obs": 0, "own": 0.474, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 15}, "lo": 1.070, "se": 0.438, "ts": 0.938, "map": 1.826, "obs": 16, "own": 2.811, "comp": {"cins": -2.5083, "dshield": -2.855, "crowdsec": -10.0075, "vulncheck": -0.9658, "blocklist_de": 18.3325}, "mass": 22.9, "listed": false}}, "abq": false, "bot": 0.109, "det": {"blocklist_de": {"bots": 16}}, "oid": "ORG-VNL1-AFRINIC", "org": "Airtel Networks Limited", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.airtel.com.ng"}, "pfx": 545, "reg": "2005-10-24", "rir": "afrinic", "s24": 2259, "sib": 0, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 712448, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.118815}, {"a": 36884, "h": "MAROCCONNECT", "n": "Wana Corporate", "t": "Other", "w": 16, "cc": "MA", "cf": {"rb": "lo", "wb": null, "rep": 1.84, "waf": null}, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.0006, "hi": 1.60, "lo": 0.21, "ips": 2, "mean": 0.76, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.31, "lo": 0.02, "ips": 1, "mean": 0.13, "above": false}, "blocklist_de": {"n": 12, "p": 0.0315, "hi": 2.85, "lo": 1.13, "ips": 13, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.043, 0.006, 0, false], ["2026-10-12", 0.394, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.715, "ts": null, "map": 0.074, "obs": 0, "own": 0.134, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 12}, "lo": 0.394, "se": 0.448, "ts": 0.800, "map": 0.681, "obs": 15, "own": 0.385, "comp": {"cins": -2.3882, "dshield": -0.4616, "crowdsec": -9.6676, "vulncheck": -0.9603, "blocklist_de": 14.4877}, "mass": 20.6, "listed": false}}, "abq": false, "bot": 0.175, "det": {"blocklist_de": {"ssh": 1, "bots": 11, "apache": 1}}, "oid": "ORG-MC5-AFRINIC", "org": "Wana Corporate", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.inwi.ma"}, "pfx": 287, "reg": "2007-12-28", "rir": "afrinic", "s24": 5433, "sib": 1, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3376640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03751083399267}, {"a": 36901, "h": "DATANET", "n": "Datanet Superblock1", "t": "Enterprise, edu & gov", "w": 0, "cc": "UG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2697.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 3.481, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 4.984, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.360, "det": null, "oid": "ORG-DL2-AFRINIC", "org": "DATANET.COM LLC", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://datanet.ug/"}, "pfx": 12, "reg": "2006-04-28", "rir": "afrinic", "s24": 12, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001617380036}, {"a": 36903, "h": "MT-MPLS", "n": "Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM", "t": "Broadband & mobile", "w": 21, "cc": "MA", "cf": {"rb": "", "wb": "", "rep": 2.51, "waf": 1.50}, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0000, "hi": 0.95, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 0.37, "lo": 0.06, "ips": 3, "mean": 0.19, "above": false}, "dshield": {"n": 14, "p": 0.1942, "hi": 3.60, "lo": 1.52, "ips": 14, "mean": 2.47, "above": false}, "threatfox": {"n": 4, "p": 0.1451, "hi": 3.75, "lo": 0.81, "ips": 4, "mean": 2.05, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.57, "lo": 0.07, "ips": 2, "mean": 0.27, "above": false}}, "h2": [["2026-10-05", 0.149, 0.093, 0, false], ["2026-10-12", 0.191, 0.095, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 0.095, "se": 1.062, "ts": 1.000, "map": 0.291, "obs": 4, "own": 0.937, "comp": {"urlhaus": -1.1943, "threatfox": 2.5786, "phishing_db": -0.994}, "mass": 5.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 14, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.191, "se": 0.443, "ts": 0.824, "map": 0.323, "obs": 17, "own": 0.501, "comp": {"cins": 0.5276, "dshield": 16.2697, "crowdsec": -10.3156, "vulncheck": -0.9489, "blocklist_de": -5.2683}, "mass": 17.0, "listed": false}}, "abq": false, "bot": 0.260, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:AsyncRAT": 4}, "blocklist_de": {"ftp": 1, "bots": 1}}, "oid": "ORG-ONDP1-AFRINIC", "org": "Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM", "pdb": null, "pfx": 1352, "reg": "2006-05-23", "rir": "afrinic", "s24": 9401, "sib": 2, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2644480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.088034}, {"a": 36905, "h": "Creolink", "n": "Creolink Communications", "t": "Broadband & mobile", "w": 1, "cc": "CM", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.009, 0.512, 0, false]], "sh": false, "uc": 425.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.512, "se": 1.579, "ts": 1.000, "map": 5.480, "obs": 1, "own": 16.788, "comp": {"urlhaus": 4.0179, "threatfox": -0.2408, "phishing_db": -0.4499}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.599, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "ORG-CC1-AFRINIC", "org": "Creolink Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.creolink.cm"}, "pfx": 16, "reg": "2006-06-01", "rir": "afrinic", "s24": 68, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001794694401}, {"a": 36908, "h": "VTL-ASN", "n": "Vodacom Tanzania", "t": "Broadband & mobile", "w": 5, "cc": "TZ", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 3, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.2506, "hi": 4.56, "lo": 0.80, "ips": 3, "mean": 2.35, "above": false}, "blocklist_de": {"n": 2, "p": 0.2611, "hi": 4.91, "lo": 0.64, "ips": 2, "mean": 2.34, "above": false}}, "h2": [["2026-10-12", 1.375, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.939, "ts": null, "map": 0.169, "obs": 0, "own": 1.025, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.375, "se": 0.604, "ts": 0.600, "map": 3.144, "obs": 5, "own": 4.880, "comp": {"cins": -0.9144, "dshield": -1.5765, "crowdsec": 2.5093, "vulncheck": -0.8059, "blocklist_de": 3.3266}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.085, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-VTL1-AFRINIC", "org": "Vodacom Tanzania Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.vodacom.co.tz/"}, "pfx": 33, "reg": "2006-08-01", "rir": "afrinic", "s24": 264, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 165376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01103119348245}, {"a": 36909, "h": "HABARI-CO-TZ-AS", "n": "Habari Node", "t": "Broadband & mobile", "w": 2, "cc": "TZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3653, "hi": 5.77, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "blocklist_de": {"n": 1, "p": 0.1834, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 3.627, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.627, "se": 0.772, "ts": 0.667, "map": 11.382, "obs": 3, "own": 17.838, "comp": {"cins": -0.4786, "dshield": -0.9603, "crowdsec": 3.8216, "vulncheck": -0.6513, "blocklist_de": 2.0943}, "mass": 2.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ANM1-AFRINIC", "org": "Habari Node Public Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.habari.co.tz"}, "pfx": 30, "reg": "2006-08-01", "rir": "afrinic", "s24": 34, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050696293197}, {"a": 36912, "h": "ORANGECM", "n": "Orange Cameroun", "t": "Broadband & mobile", "w": 4, "cc": "CM", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "first_seen_30d": 3, "ssh_bruteforce": 2, "web_bruteforce": 3, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-20062": 3}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0697, "hi": 3.28, "lo": 0.25, "ips": 1, "mean": 1.38, "above": false}, "dshield": {"n": 1, "p": 0.0514, "hi": 3.02, "lo": 0.23, "ips": 1, "mean": 1.27, "above": false}, "crowdsec": {"n": 3, "p": 0.0036, "hi": 2.04, "lo": 0.36, "ips": 3, "mean": 1.05, "above": false}, "blocklist_de": {"n": 2, "p": 0.0465, "hi": 2.95, "lo": 0.38, "ips": 2, "mean": 1.41, "above": false}}, "h2": [["2026-10-12", 0.610, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.129, "obs": 0, "own": 0.636, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.610, "se": 0.539, "ts": 0.429, "map": 1.246, "obs": 7, "own": 1.932, "comp": {"cins": 2.4241, "dshield": 0.3463, "crowdsec": -0.8714, "vulncheck": -0.8726, "blocklist_de": 0.5869}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.164, "det": {"blocklist_de": {"mail": 1, "apache": 1}}, "oid": "ORG-OCS1-AFRINIC", "org": "Orange Cameroun SA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.orange.cm"}, "pfx": 290, "reg": "2006-08-08", "rir": "afrinic", "s24": 1056, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 476416, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01001426216031}, {"a": 36913, "h": "TELEKOM-NETWORKS-MALAWI", "n": "TELEKOM NETWORKS MALAWI LTD", "t": "Broadband & mobile", "w": 8, "cc": "MW", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 7, "router_or_botnet": 5, "cve:CVE-2024-6387": 1}, "n": 8}, "ev": {"crowdsec": {"n": 7, "p": 0.9821, "hi": 12.18, "lo": 3.69, "ips": 8, "mean": 7.41, "above": true}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 14.827, 0.011, 1, false], ["2026-10-12", 18.378, 0.012, 1, false]], "sh": false, "uc": 17670, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 1}, "lo": 18.378, "se": 0.520, "ts": 0.875, "map": 36.318, "obs": 8, "own": 55.777, "comp": {"cins": -1.1282, "dshield": -1.8195, "crowdsec": 10.661, "vulncheck": -0.8478, "blocklist_de": -1.8794}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.346, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-TNML1-AFRINIC", "org": "TELEKOM NETWORKS MALAWI LTD", "pdb": null, "pfx": 29, "reg": "2015-10-29", "rir": "afrinic", "s24": 30, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0000436663008}, {"a": 36914, "h": "KENET-AS", "n": "KENET", "t": "Other", "w": 5, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0001, "hi": 1.25, "lo": 0.09, "ips": 1, "mean": 0.53, "above": false}, "crowdsec": {"n": 4, "p": 0.0027, "hi": 2.04, "lo": 0.44, "ips": 4, "mean": 1.11, "above": false}, "blocklist_de": {"n": 2, "p": 0.0252, "hi": 2.62, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.486, 0.008, 0, false], ["2026-10-12", 0.388, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.816, "ts": null, "map": 0.121, "obs": 0, "own": 0.236, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.388, "se": 0.562, "ts": 0.667, "map": 0.822, "obs": 6, "own": 0.468, "comp": {"cins": -1.1192, "dshield": -1.8099, "crowdsec": 3.1393, "vulncheck": -0.8462, "blocklist_de": 1.8341}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.210, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-KEN1-AFRINIC", "org": "Kenya Education Network", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.kenet.or.ke"}, "pfx": 552, "reg": "2006-09-15", "rir": "afrinic", "s24": 1311, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 604928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013085699392}, {"a": 36920, "h": "KKON", "n": "KKON Technologies", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 674, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.713, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.576, "det": null, "oid": "ORG-KTL2-AFRINIC", "org": "KKON Technologies Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": null, "pol": "Open", "web": "http://www.kkontech.com"}, "pfx": 49, "reg": "2006-10-31", "rir": "afrinic", "s24": 49, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00216545617372}, {"a": 36924, "h": "GVA-Canalbox", "n": "Canal+ Telecom Africa", "t": "Broadband & mobile", "w": 9, "cc": "CI", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0647, "hi": 3.21, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "crowdsec": {"n": 2, "p": 0.0027, "hi": 1.88, "lo": 0.24, "ips": 2, "mean": 0.90, "above": false}, "phishing_db": {"n": 1, "p": 0.0722, "hi": 3.31, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "blocklist_de": {"n": 5, "p": 0.4719, "hi": 5.40, "lo": 1.34, "ips": 5, "mean": 3.08, "above": false}}, "h2": [["2026-10-05", 0.789, 0.098, 0, false], ["2026-10-12", 0.929, 0.103, 0, false]], "sh": false, "uc": 60.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.103, "se": 1.357, "ts": 1.000, "map": 0.650, "obs": 1, "own": 2.013, "comp": {"urlhaus": -0.3552, "threatfox": -0.3044, "phishing_db": 1.8554}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.929, "se": 0.518, "ts": 0.625, "map": 1.822, "obs": 8, "own": 2.817, "comp": {"cins": -1.487, "dshield": -0.0862, "crowdsec": -4.3485, "vulncheck": -0.8958, "blocklist_de": 8.811}, "mass": 9.0, "listed": false}}, "abq": false, "bot": 0.220, "det": {"blocklist_de": {"bots": 4, "imap": 1, "mail": 1}}, "oid": "ORG-GCDS1-AFRINIC", "org": "GVA Cote d'Ivoire SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "Selective", "web": "http://www.gva.africa"}, "pfx": 42, "reg": "2016-06-20", "rir": "afrinic", "s24": 883, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 267008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02144135181188}, {"a": 36925, "h": "ASMedi", "n": "Meditelecom", "t": "Broadband & mobile", "w": 29, "cc": "MA", "cf": {"rb": "lo", "wb": null, "rep": 2.30, "waf": null}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 2, "first_seen_30d": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1}, "n": 3}, "ev": {"cins": {"n": 3, "p": 0.0002, "hi": 1.56, "lo": 0.27, "ips": 3, "mean": 0.80, "above": false}, "dshield": {"n": 2, "p": 0.0000, "hi": 1.04, "lo": 0.13, "ips": 2, "mean": 0.49, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.30, "lo": 0.05, "ips": 3, "mean": 0.15, "above": false}, "blocklist_de": {"n": 21, "p": 0.0158, "hi": 2.73, "lo": 1.34, "ips": 21, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.100, 0.005, 0, false], ["2026-10-12", 0.517, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.682, "ts": null, "map": 0.059, "obs": 0, "own": 0.263, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 21}, "lo": 0.517, "se": 0.405, "ts": 0.724, "map": 0.826, "obs": 29, "own": 1.274, "comp": {"cins": 1.447, "dshield": -1.9032, "crowdsec": -10.3592, "vulncheck": -0.989, "blocklist_de": 13.0069}, "mass": 43.2, "listed": false}}, "abq": false, "bot": 0.186, "det": {"blocklist_de": {"bots": 16, "imap": 1, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ME1-AFRINIC", "org": "MEDITELECOM", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.orange.ma"}, "pfx": 291, "reg": "2006-11-28", "rir": "afrinic", "s24": 9412, "sib": 0, "tor": 0, "w24": 29, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8230144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04715055402803}, {"a": 36926, "h": "CKL1-ASN", "n": "Airtel Networks Kenya", "t": "Broadband & mobile", "w": 38, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 14, "web_exploit": 20, "bad_crawling": 5, "proxy_or_vpn": 15, "ssh_bruteforce": 7, "web_bruteforce": 34, "home_connection": 29, "mail_bruteforce": 21, "router_or_botnet": 36, "cve:CVE-2025-4396": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 5, "cve:CVE-2026-63030": 5}, "n": 37}, "ev": {"crowdsec": {"n": 33, "p": 0.0176, "hi": 2.79, "lo": 1.58, "ips": 37, "mean": 2.15, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.68, "lo": 0.05, "ips": 1, "mean": 0.29, "above": false}}, "h2": [["2026-10-05", 0.509, 0.006, 0, false], ["2026-10-12", 0.559, 0.006, 0, false]], "sh": false, "uc": 237.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.713, "ts": null, "map": 0.073, "obs": 0, "own": 0.328, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 33, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.559, "se": 0.399, "ts": 0.971, "map": 0.888, "obs": 34, "own": 1.370, "comp": {"cins": -2.7048, "dshield": -2.9548, "crowdsec": 18.2574, "vulncheck": -0.9739, "blocklist_de": -10.349}, "mass": 27.5, "listed": false}}, "abq": false, "bot": 0.143, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-CKL1-AFRINIC", "org": "Airtel Networks Kenya Limited", "pdb": {"t": "NSP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.africa.airtel.com/kenya/"}, "pfx": 165, "reg": "2006-12-04", "rir": "afrinic", "s24": 5567, "sib": 0, "tor": 0, "w24": 34, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2972672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02819954558224}, {"a": 36935, "h": "Vodafone-EG", "n": "Vodafone Egypt", "t": "Broadband & mobile", "w": 4, "cc": "EG", "cf": {"rb": "hi", "wb": "hi", "rep": 1.22, "waf": 1.07}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0000, "hi": 1.01, "lo": 0.08, "ips": 1, "mean": 0.42, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.09, "lo": 0.08, "ips": 1, "mean": 0.46, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 0.75, "lo": 0.10, "ips": 2, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.033, 0.029, 0, false], ["2026-10-12", 0.037, 0.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.031, "se": 1.328, "ts": 1.000, "map": 0.166, "obs": 1, "own": 0.587, "comp": {"urlhaus": -0.6378, "threatfox": -0.4022, "phishing_db": 0.8729}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.037, "se": 0.691, "ts": 0.667, "map": 0.099, "obs": 3, "own": 0.156, "comp": {"cins": -0.7778, "dshield": 1.7843, "crowdsec": -5.499, "vulncheck": -0.7706, "blocklist_de": 4.3428}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.073, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-RT2-AFRINIC", "org": "Vodafone Data", "pdb": null, "pfx": 1295, "reg": "2007-02-02", "rir": "afrinic", "s24": 6876, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3683840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.059856}, {"a": 36943, "h": "ZA-1-Grid", "n": "1-grid.com", "t": "Hosting & VPS", "w": 3, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0228, "hi": 2.57, "lo": 0.33, "ips": 2, "mean": 1.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.0497, "hi": 2.99, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}}, "h2": [["2026-10-05", 0.440, 0.009, 0, false], ["2026-10-12", 0.328, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.884, "ts": null, "map": 0.150, "obs": 0, "own": 0.125, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.328, "se": 0.722, "ts": 0.667, "map": 0.924, "obs": 3, "own": 0.185, "comp": {"cins": -0.6033, "dshield": -1.1564, "crowdsec": 2.4783, "vulncheck": -0.7104, "blocklist_de": 1.3065}, "mass": 2.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-KAL1-AFRINIC", "org": "1 GRID (PTY) LTD", "pdb": {"t": "Content", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://1-grid.com"}, "pfx": 6, "reg": "2018-09-24", "rir": "afrinic", "s24": 545, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 140032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011706878185}, {"a": 36947, "h": "ALGTEL-AS", "n": "Algeria Telecom", "t": "Broadband & mobile", "w": 50, "cc": "DZ", "cf": {"rb": "", "wb": "", "rep": 1.57, "waf": 1.24}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 5, "home_connection": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.13, "lo": 0.01, "ips": 1, "mean": 0.05, "above": false}, "dshield": {"n": 11, "p": 0.0001, "hi": 1.82, "lo": 0.69, "ips": 11, "mean": 1.20, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.23, "lo": 0.06, "ips": 5, "mean": 0.13, "above": false}, "vulncheck": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.20, "above": false}, "blocklist_de": {"n": 33, "p": 0.0004, "hi": 2.33, "lo": 1.32, "ips": 33, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.171, 0.016, 0, false], ["2026-10-12", 0.457, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.652, "ts": null, "map": 0.045, "obs": 0, "own": 0.206, "comp": null, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 11, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 33}, "lo": 0.457, "se": 0.387, "ts": 0.660, "map": 0.718, "obs": 50, "own": 1.107, "comp": {"cins": -3.5231, "dshield": 1.3718, "crowdsec": -10.6494, "vulncheck": -0.9056, "blocklist_de": 14.768}, "mass": 66.6, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 4, "bots": 25, "imap": 2, "mail": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-TA23-AFRINIC", "org": "Telecom Algeria", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.algerietelecom.dz"}, "pfx": 543, "reg": "2007-04-27", "rir": "afrinic", "s24": 16721, "sib": 2, "tor": 0, "w24": 50, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8281088, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.110194}, {"a": 36955, "h": "Matrix-ASN1", "n": "Matrix Telecoms", "t": "Broadband & mobile", "w": 0, "cc": "CM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1624, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 1.658, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.194, "obs": 0, "own": 0.771, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.291, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MT1-AFRINIC", "org": "Matrix Telecoms SA", "pdb": {"t": "NSP", "sc": "Africa", "tr": "20-100Mbps", "pol": "Open", "web": "https://matrixtelecoms.com"}, "pfx": 38, "reg": "2020-10-29", "rir": "afrinic", "s24": 42, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005738554185}, {"a": 36958, "h": "CWSeychelles-AS", "n": "Cable & Wireless Seychelles", "t": "Broadband & mobile", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 313.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 1.450, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.169, "obs": 0, "own": 0.564, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.151, "det": null, "oid": "ORG-ACW1-AFRINIC", "org": "Cable & Wireless (Seychelles) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.cwseychelles.com"}, "pfx": 84, "reg": "2007-06-28", "rir": "afrinic", "s24": 76, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 57856, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00098245328328}, {"a": 36962, "h": "MTNZ-AS", "n": "MTN Zambia", "t": "Hosting & VPS", "w": 1, "cc": "ZM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-12", 0.247, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.245, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.247, "se": 1.259, "ts": 1.000, "map": 1.939, "obs": 1, "own": 0.434, "comp": {"cins": -0.1354, "dshield": -0.3119, "crowdsec": 3.5308, "vulncheck": -0.3225, "blocklist_de": -0.7054}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MTN2-AFRINIC", "org": "MTN Zambia", "pdb": {"t": "Network Services", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.mtn.zm"}, "pfx": 54, "reg": "2007-07-16", "rir": "afrinic", "s24": 52, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0075691798416}, {"a": 36969, "h": "MTL-AS", "n": "Malawi Telecommunications", "t": "Broadband & mobile", "w": 1, "cc": "MW", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-12", 0.253, 0.012, 0, false]], "sh": false, "uc": 468.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 1.597, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.253, "se": 1.262, "ts": 1.000, "map": 1.996, "obs": 1, "own": 3.510, "comp": {"cins": -0.1341, "dshield": -0.309, "crowdsec": 3.5466, "vulncheck": -0.3202, "blocklist_de": -0.6985}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.120, "det": null, "oid": "ORG-MTL5-AFRINIC", "org": "Malawi Telecommunications Limited", "pdb": {"t": "NSP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.mtl.mw/"}, "pfx": 32, "reg": "2007-08-10", "rir": "afrinic", "s24": 50, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 22016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001429624512}, {"a": 36992, "h": "ETISALAT-MISR", "n": "ETISALAT MISR", "t": "Broadband & mobile", "w": 12, "cc": "EG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2019-18935": 1}, "n": 5}, "ev": {"cins": {"n": 2, "p": 0.0000, "hi": 0.55, "lo": 0.07, "ips": 2, "mean": 0.26, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 0.16, "lo": 0.04, "ips": 5, "mean": 0.09, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.36, "lo": 0.03, "ips": 1, "mean": 0.15, "above": false}, "blocklist_de": {"n": 8, "p": 0.0000, "hi": 0.53, "lo": 0.17, "ips": 8, "mean": 0.33, "above": false}}, "h2": [["2026-10-05", 0.069, 0.013, 0, false], ["2026-10-12", 0.087, 0.014, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.014, "se": 1.340, "ts": 1.000, "map": 0.072, "obs": 1, "own": 0.283, "comp": {"urlhaus": -0.8886, "threatfox": -0.4539, "phishing_db": 0.331}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 8}, "lo": 0.087, "se": 0.454, "ts": 0.533, "map": 0.151, "obs": 15, "own": 0.234, "comp": {"cins": 2.4672, "dshield": -2.7932, "crowdsec": -5.1622, "vulncheck": -0.9606, "blocklist_de": 5.9504}, "mass": 20.8, "listed": false}}, "abq": false, "bot": 0.253, "det": {"blocklist_de": {"ssh": 4, "bots": 1, "imap": 3, "mail": 3}}, "oid": "ORG-EM1-AFRINIC", "org": "ETISALAT MISR", "pdb": {"t": "NSP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Selective", "web": "Http://www.etisalat.com.eg"}, "pfx": 1943, "reg": "2007-12-10", "rir": "afrinic", "s24": 24691, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14657024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04347569726175}, {"a": 36994, "h": "Vodacom-VB", "n": "Vodacom", "t": "Broadband & mobile", "w": 10, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 3, "router_or_botnet": 2}, "n": 5}, "ev": {"cins": {"n": 2, "p": 0.0272, "hi": 2.66, "lo": 0.34, "ips": 2, "mean": 1.27, "above": false}, "crowdsec": {"n": 5, "p": 0.0000, "hi": 1.09, "lo": 0.27, "ips": 5, "mean": 0.62, "above": false}, "blocklist_de": {"n": 6, "p": 0.0201, "hi": 2.65, "lo": 0.73, "ips": 6, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.275, 0.007, 0, false], ["2026-10-12", 0.503, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.749, "ts": null, "map": 0.090, "obs": 0, "own": 0.410, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 6}, "lo": 0.503, "se": 0.463, "ts": 0.462, "map": 0.892, "obs": 13, "own": 1.380, "comp": {"cins": 3.4032, "dshield": -2.6272, "crowdsec": -3.343, "vulncheck": -0.9458, "blocklist_de": 4.7926}, "mass": 16.1, "listed": false}}, "abq": false, "bot": 0.188, "det": {"blocklist_de": {"bots": 3, "imap": 3, "mail": 3}}, "oid": "ORG-VA67-AFRINIC", "org": "Vodacom", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.vodacom.co.za"}, "pfx": 141, "reg": "2007-12-13", "rir": "afrinic", "s24": 3245, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1143552, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01902580729809}, {"a": 37006, "h": "LiquidTelecommunicationRwanda", "n": "Liquid Telecommunication Rwanda Limited", "t": "Broadband & mobile", "w": 2, "cc": "RW", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2745, "hi": 5.02, "lo": 0.65, "ips": 2, "mean": 2.39, "above": false}, "blocklist_de": {"n": 1, "p": 0.1576, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 2.301, 0.011, 0, false], ["2026-10-12", 1.491, 0.012, 0, false]], "sh": false, "uc": 785.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.491, "se": 0.752, "ts": 0.667, "map": 4.465, "obs": 3, "own": 7.001, "comp": {"cins": -0.5241, "dshield": -1.0339, "crowdsec": 3.317, "vulncheck": -0.6749, "blocklist_de": 1.8057}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.108, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-ASRL1-AFRINIC", "org": "Liquid Telecommunication Rwanda Limited", "pdb": null, "pfx": 71, "reg": "2008-02-15", "rir": "afrinic", "s24": 96, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058394714819}, {"a": 37012, "h": "ComSysGH-AS", "n": "Comsys (GH) Limited", "t": "Other", "w": 1, "cc": "GH", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 0.303, 0.012, 0, false]], "sh": false, "uc": 1833.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.303, "se": 1.292, "ts": 1.000, "map": 2.539, "obs": 1, "own": 1.655, "comp": {"cins": -0.1231, "dshield": -0.2851, "crowdsec": 3.6768, "vulncheck": -0.3013, "blocklist_de": -0.6418}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.341, "det": null, "oid": "ORG-CL7-AFRINIC", "org": "Comsys (GH) Limited", "pdb": null, "pfx": 38, "reg": "2008-03-18", "rir": "afrinic", "s24": 36, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00031737642958}, {"a": 37019, "h": "IAL", "n": "INTERSAT AFRICA LTD", "t": "Other", "w": 0, "cc": "KE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.682, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.927, "ts": null, "map": 0.198, "obs": 0, "own": 0.297, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.323, "det": null, "oid": "ORG-IAL1-AFRINIC", "org": "INTERSAT AFRICA LTD", "pdb": null, "pfx": 38, "reg": "2008-05-14", "rir": "afrinic", "s24": 38, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000022930548}, {"a": 37020, "h": "CELTEL-DRC", "n": "Airtel DRC AS37020", "t": "Broadband & mobile", "w": 0, "cc": "CD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 354.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 1.450, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.169, "obs": 0, "own": 0.564, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.116, "det": null, "oid": "ORG-CD1-AFRINIC", "org": "CELTEL DRC", "pdb": {"t": null, "sc": "Africa", "tr": null, "pol": "Open", "web": "http://africa.airtel.com"}, "pfx": 64, "reg": "2008-05-23", "rir": "afrinic", "s24": 76, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01243617697368}, {"a": 37035, "h": "MIC-AS", "n": "HONORA Tanzania PLC", "t": "Transit & backbone", "w": 1, "cc": "TZ", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.0428, "hi": 2.89, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}}, "h2": [["2026-10-12", 0.056, 0.010, 0, false]], "sh": false, "uc": 58.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.147, "obs": 0, "own": 1.109, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.056, "se": 1.085, "ts": 1.000, "map": 0.311, "obs": 1, "own": 1.055, "comp": {"cins": -0.2447, "dshield": -0.5383, "crowdsec": -2.1261, "vulncheck": -0.4704, "blocklist_de": 3.605}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.064, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-MTL6-AFRINIC", "org": "MIC TANZANIA LTD", "pdb": {"t": "NSP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.yas.co.tz"}, "pfx": 109, "reg": "2008-08-01", "rir": "afrinic", "s24": 601, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 189440, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00996956633659}, {"a": 37049, "h": "SADV", "n": "SADV", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-12", 0.218, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.218, "se": 1.241, "ts": 1.000, "map": 1.661, "obs": 1, "own": 2.896, "comp": {"cins": -0.1425, "dshield": -0.3273, "crowdsec": 3.4471, "vulncheck": -0.3342, "blocklist_de": -0.7421}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-SL94-AFRINIC", "org": "SADV (Pty) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Open", "web": "https://sadv.co.za/"}, "pfx": 35, "reg": "2008-08-21", "rir": "afrinic", "s24": 64, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 24064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0079760592135}, {"a": 37054, "h": "Telecom-Malagasy", "n": "TELMA", "t": "Broadband & mobile", "w": 2, "cc": "MG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.96, "lo": 0.07, "ips": 1, "mean": 0.41, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 1.07, "lo": 0.14, "ips": 2, "mean": 0.51, "above": false}}, "h2": [["2026-10-05", 0.111, 0.007, 0, false], ["2026-10-12", 0.059, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.790, "ts": null, "map": 0.109, "obs": 0, "own": 0.514, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.059, "se": 0.811, "ts": 1.000, "map": 0.198, "obs": 2, "own": 0.315, "comp": {"cins": -0.454, "dshield": -0.9194, "crowdsec": 4.1025, "vulncheck": -0.6374, "blocklist_de": -2.3178}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.117, "det": {"shodan": {"compromised": 1}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-TM3-AFRINIC", "org": "Telecom Malagasy", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.telma.mg/"}, "pfx": 185, "reg": "2019-02-08", "rir": "afrinic", "s24": 1843, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1282560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00822973710546}, {"a": 37061, "h": "Safaricom", "n": "Safaricom AS37061", "t": "Broadband & mobile", "w": 20, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 7, "web_bruteforce": 6, "home_connection": 9, "mail_bruteforce": 3, "router_or_botnet": 6, "cve:CVE-2024-4577": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-63030": 1, "cve:CVE-2026-75650": 1}, "n": 15}, "ev": {"shodan": {"n": 4, "p": 0.2766, "hi": 4.53, "lo": 0.97, "ips": 4, "mean": 2.47, "above": false}, "dshield": {"n": 1, "p": 0.1096, "hi": 3.77, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "crowdsec": {"n": 14, "p": 0.9955, "hi": 9.64, "lo": 4.07, "ips": 15, "mean": 6.61, "above": true}, "blocklist_de": {"n": 6, "p": 0.8263, "hi": 7.83, "lo": 2.17, "ips": 7, "mean": 4.63, "above": true}}, "h2": [["2026-10-05", 5.147, 0.009, 0, false], ["2026-10-12", 4.412, 0.010, 0, false]], "sh": false, "uc": 123.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.895, "ts": null, "map": 0.154, "obs": 0, "own": 0.844, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 6}, "lo": 4.412, "se": 0.419, "ts": 0.667, "map": 7.371, "obs": 21, "own": 11.319, "comp": {"cins": -2.3333, "dshield": -1.5495, "crowdsec": 5.8371, "vulncheck": -0.9576, "blocklist_de": 2.3947}, "mass": 19.5, "listed": false}}, "abq": false, "bot": 0.251, "det": {"shodan": {"compromised": 2, "doublepulsar": 2}, "blocklist_de": {"ssh": 4, "bots": 3}}, "oid": "ORG-SL70-AFRINIC", "org": "Safaricom Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.safaricom.co.ke"}, "pfx": 128, "reg": "2008-10-17", "rir": "afrinic", "s24": 478, "sib": 1, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 245504, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.01062290314356}, {"a": 37063, "h": "RTL-AS", "n": "Roke Investments International", "t": "Transit & backbone", "w": 4, "cc": "UG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 2, "p": 0.4193, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1365, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "blocklist_de": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.942, 0.011, 0, false], ["2026-10-12", 1.010, 4.435, 0, false]], "sh": false, "uc": 856.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 4.435, "se": 1.197, "ts": 1.000, "map": 24.549, "obs": 2, "own": 80.902, "comp": {"urlhaus": 6.1271, "threatfox": -0.4373, "phishing_db": -0.8629}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.010, "se": 0.921, "ts": 0.500, "map": 4.189, "obs": 2, "own": 13.632, "comp": {"cins": -0.3329, "dshield": -0.7067, "crowdsec": 1.3894, "vulncheck": -0.5538, "blocklist_de": 3.03}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.127, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RIIL1-AFRINIC", "org": "Roke Investments International Ltd", "pdb": {"t": "NSP", "sc": "Africa", "tr": null, "pol": "Selective", "web": "http://www.roketelkom.co.ug"}, "pfx": 65, "reg": "2008-10-23", "rir": "afrinic", "s24": 62, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31232, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029579964613}, {"a": 37088, "h": "VDT-AS", "n": "VDT COMMUNICATIONS", "t": "Hosting & VPS", "w": 1, "cc": "NG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 1.154, 0.011, 0, false], ["2026-10-12", 1.234, 0.012, 0, false]], "sh": false, "uc": 732.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.234, "se": 0.931, "ts": 0.500, "map": 5.219, "obs": 2, "own": 1.067, "comp": {"cins": -0.322, "dshield": -0.6865, "crowdsec": 1.4985, "vulncheck": -0.5447, "blocklist_de": 3.1007}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.633, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-VCL2-AFRINIC", "org": "VDT COMMUNICATIONS LIMITED", "pdb": {"t": "Network Services", "sc": "Global", "tr": "20-50Gbps", "pol": "Selective", "web": "https://vdtcomms.com"}, "pfx": 42, "reg": "2009-02-19", "rir": "afrinic", "s24": 48, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014464079715}, {"a": 37100, "h": "SEACOM-AS", "n": "SEACOM", "t": "Transit & backbone", "w": 15, "cc": "MU", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 5, "ssh_bruteforce": 2, "web_bruteforce": 14, "mail_bruteforce": 14, "router_or_botnet": 14, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 15}, "ev": {"crowdsec": {"n": 13, "p": 0.0000, "hi": 1.70, "lo": 0.70, "ips": 15, "mean": 1.15, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.86, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}}, "h2": [["2026-10-05", 0.356, 0.006, 0, false], ["2026-10-12", 0.307, 0.007, 0, false]], "sh": false, "uc": 137.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.732, "ts": null, "map": 0.082, "obs": 0, "own": 0.524, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.307, "se": 0.455, "ts": 0.929, "map": 0.537, "obs": 14, "own": 1.688, "comp": {"cins": -1.8357, "dshield": -2.4392, "crowdsec": 11.8425, "vulncheck": -0.9271, "blocklist_de": -5.8695}, "mass": 12.5, "listed": false}}, "abq": false, "bot": 0.187, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SL75-AFRINIC", "org": "SEACOM Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.seacom.com"}, "pfx": 10, "reg": "2009-05-28", "rir": "afrinic", "s24": 4191, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1072896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00312352307638}, {"a": 37105, "h": "RAIN-GROUP-HOLDINGS", "n": "rain Networks", "t": "Transit & backbone", "w": 6, "cc": "ZA", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.2982, "hi": 4.87, "lo": 0.86, "ips": 3, "mean": 2.51, "above": false}, "blocklist_de": {"n": 3, "p": 0.1103, "hi": 3.57, "lo": 0.63, "ips": 3, "mean": 1.84, "above": false}}, "h2": [["2026-10-12", 0.491, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.127, "obs": 0, "own": 0.892, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.491, "se": 0.563, "ts": 0.500, "map": 1.045, "obs": 6, "own": 3.295, "comp": {"cins": -1.1705, "dshield": 5.6797, "crowdsec": -7.2769, "vulncheck": -0.8546, "blocklist_de": 5.0596}, "mass": 6.4, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "ORG-RGHL1-AFRINIC", "org": "RAIN GROUP HOLDINGS (PTY) LTD", "pdb": {"t": "NSP", "sc": "Africa", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.rain.co.za/"}, "pfx": 32, "reg": "2009-06-15", "rir": "afrinic", "s24": 1096, "sib": 5, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 602368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03450547432015}, {"a": 37109, "h": "MyISP-AS", "n": "MyISP", "t": "Broadband & mobile", "w": 0, "cc": "KE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1015.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 1.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.457, "det": null, "oid": "ORG-ML5-AFRINIC", "org": "MyISP Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "Open", "web": "https://www.myisp.co.ke"}, "pfx": 22, "reg": "2009-06-26", "rir": "afrinic", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006481376312}, {"a": 37119, "h": "unitel-AS", "n": "Unitel SA", "t": "Transit & backbone", "w": 5, "cc": "AO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0132, "hi": 2.25, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.98, "lo": 0.13, "ips": 2, "mean": 0.46, "above": false}, "blocklist_de": {"n": 2, "p": 0.0038, "hi": 1.97, "lo": 0.26, "ips": 2, "mean": 0.94, "above": false}}, "h2": [["2026-10-05", 0.053, 0.007, 0, false], ["2026-10-12", 0.207, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.782, "ts": null, "map": 0.106, "obs": 0, "own": 0.700, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.207, "se": 0.593, "ts": 0.400, "map": 0.462, "obs": 5, "own": 1.464, "comp": {"cins": -1.0152, "dshield": 1.0656, "crowdsec": -1.1884, "vulncheck": -0.8273, "blocklist_de": 2.5872}, "mass": 5.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-US9-AFRINIC", "org": "UNITEL SA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.unitel.ao"}, "pfx": 32, "reg": "2009-07-27", "rir": "afrinic", "s24": 2052, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 923648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01215063412384}, {"a": 37123, "h": "TELCO-ZW", "n": "Telecontract Pvt Ltd", "t": "Transit & backbone", "w": 0, "cc": "ZW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 2.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 2.057, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.525, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TPL2-AFRINIC", "org": "Telecontract Pvt Ltd", "pdb": {"t": "NSP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.telco.co.zw"}, "pfx": 24, "reg": "2009-07-31", "rir": "afrinic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010302970548}, {"a": 37133, "h": "airtel-tz-as", "n": "Airtel Tanzania", "t": "Broadband & mobile", "w": 7, "cc": "TZ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "blocklist_de": {"n": 6, "p": 0.9085, "hi": 9.33, "lo": 2.59, "ips": 6, "mean": 5.52, "above": true}}, "h2": [["2026-10-12", 2.790, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.170, "obs": 0, "own": 1.041, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 6}, "lo": 2.790, "se": 0.539, "ts": 0.857, "map": 5.731, "obs": 7, "own": 8.832, "comp": {"cins": -1.3783, "dshield": 0.1521, "crowdsec": -8.054, "vulncheck": -0.8834, "blocklist_de": 13.3031}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.089, "det": {"blocklist_de": {"bots": 3, "imap": 1, "mail": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-CT1-AFRINIC", "org": "Airtel Tanzania", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://africa.airtel.com/tanzania"}, "pfx": 72, "reg": "2009-08-25", "rir": "afrinic", "s24": 251, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 69888, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01195346246148}, {"a": 37148, "h": "globacom-as", "n": "Globacom Limited", "t": "Other", "w": 3, "cc": "NG", "cf": {"rb": "hi", "wb": "hi", "rep": 1.28, "waf": 1.12}, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2026-8181": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2642, "hi": 4.93, "lo": 0.64, "ips": 2, "mean": 2.35, "above": false}, "blocklist_de": {"n": 1, "p": 0.1545, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 1.291, 0.011, 0, false], ["2026-10-12", 1.389, 0.012, 0, false]], "sh": false, "uc": 724.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.003, "ts": null, "map": 0.184, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.389, "se": 0.750, "ts": 0.667, "map": 4.153, "obs": 3, "own": 2.383, "comp": {"cins": -0.5276, "dshield": -1.0395, "crowdsec": 3.2782, "vulncheck": -0.6766, "blocklist_de": 1.7831}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.079, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-GL1-AFRINIC", "org": "Globacom Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.gloworld.com/ng/"}, "pfx": 92, "reg": "2009-09-17", "rir": "afrinic", "s24": 104, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.05711}, {"a": 37153, "h": "xneelo", "n": "xneelo (Formerly Hetzner SA)", "t": "Hosting & VPS", "w": 2, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0022, "hi": 1.70, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}, "vulncheck": {"n": 2, "p": 0.1956, "hi": 4.38, "lo": 0.57, "ips": 2, "mean": 2.09, "above": false}}, "h2": [["2026-10-05", 0.380, 0.009, 0, false], ["2026-10-12", 0.074, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.851, "ts": null, "map": 0.137, "obs": 0, "own": 0.107, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.074, "se": 0.854, "ts": 1.000, "map": 0.257, "obs": 2, "own": 0.055, "comp": {"cins": -0.2792, "dshield": -0.6055, "crowdsec": -2.3903, "vulncheck": 4.7527, "blocklist_de": -1.441}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.913, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-HC1-AFRINIC", "org": "Xneelo (Pty) Ltd", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://xneelo.co.za"}, "pfx": 46, "reg": "2009-10-26", "rir": "afrinic", "s24": 835, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 214784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00209373019456}, {"a": 37154, "h": "ZAMTEL", "n": "ZAMTEL", "t": "Broadband & mobile", "w": 5, "cc": "ZM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0000, "hi": 1.19, "lo": 0.21, "ips": 3, "mean": 0.61, "above": false}, "blocklist_de": {"n": 4, "p": 0.0357, "hi": 2.83, "lo": 0.61, "ips": 5, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.305, 0.007, 0, false], ["2026-10-12", 0.339, 0.008, 0, false]], "sh": false, "uc": 109.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.781, "ts": null, "map": 0.105, "obs": 0, "own": 0.490, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.339, "se": 0.537, "ts": 0.571, "map": 0.683, "obs": 7, "own": 1.061, "comp": {"cins": -1.3674, "dshield": -2.0566, "crowdsec": -1.4356, "vulncheck": -0.882, "blocklist_de": 6.7547}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.170, "det": {"blocklist_de": {"imap": 2, "mail": 5}}, "oid": "ORG-ZTCL1-AFRINIC", "org": "Zambia Telecommunications Company Ltd aka ZAMTEL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.zamtel.zm"}, "pfx": 71, "reg": "2009-11-08", "rir": "afrinic", "s24": 2081, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 551424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00195162122454}, {"a": 37168, "h": "CELL-C", "n": "Cell C", "t": "Transit & backbone", "w": 3, "cc": "ZA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.0000, "hi": 0.95, "lo": 0.17, "ips": 3, "mean": 0.49, "above": false}}, "h2": [["2026-10-12", 0.041, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.702, "ts": null, "map": 0.068, "obs": 0, "own": 0.433, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.041, "se": 0.692, "ts": 1.000, "map": 0.110, "obs": 3, "own": 0.352, "comp": {"cins": -0.8277, "dshield": -1.4681, "crowdsec": -5.7514, "vulncheck": -0.7845, "blocklist_de": 8.0196}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.077, "det": {"blocklist_de": {"bots": 1, "imap": 2, "mail": 2}}, "oid": "ORG-CC2-AFRINIC", "org": "Cell C (Pty) Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.cellc.co.za"}, "pfx": 37, "reg": "2010-01-29", "rir": "afrinic", "s24": 6656, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4927488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02525269233985}, {"a": 37182, "h": "TERNET", "n": "Tanzania Education And Research Network", "t": "Enterprise, edu & gov", "w": 9, "cc": "TZ", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 3, "bad_crawling": 1, "ssh_bruteforce": 7, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 8}, "ev": {"shodan": {"n": 1, "p": 0.1057, "hi": 3.73, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "dshield": {"n": 1, "p": 0.1703, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 4, "p": 0.6248, "hi": 6.83, "lo": 1.47, "ips": 8, "mean": 3.73, "above": false}, "blocklist_de": {"n": 3, "p": 0.5558, "hi": 6.82, "lo": 1.20, "ips": 5, "mean": 3.52, "above": false}}, "h2": [["2026-10-05", 5.715, 0.010, 0, false], ["2026-10-12", 5.208, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.990, "ts": null, "map": 0.181, "obs": 0, "own": 2.137, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.208, "se": 0.519, "ts": 0.500, "map": 10.225, "obs": 8, "own": 57.223, "comp": {"cins": -1.2898, "dshield": 0.3572, "crowdsec": 1.4647, "vulncheck": -0.872, "blocklist_de": 4.0585}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.359, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 5}}, "oid": "ORG-TEAR1-AFRINIC", "org": "Tanzania Education And Research Network", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.ternet.or.tz"}, "pfx": 39, "reg": "2010-03-02", "rir": "afrinic", "s24": 128, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011276759686}, {"a": 37199, "h": "VANILLA", "n": "Vanilla", "t": "Broadband & mobile", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1193, "hi": 3.88, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.003, "ts": null, "map": 0.184, "obs": 0, "own": 1.339, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.799, "ts": null, "map": 0.154, "obs": 0, "own": 0.473, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-FPCC1-AFRINIC", "org": "Vanilla", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "http://vanilla.co.za"}, "pfx": 9, "reg": "2010-04-12", "rir": "afrinic", "s24": 104, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53248, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003688361446}, {"a": 37204, "h": "TELONE", "n": "Telone Zimbabwe", "t": "Broadband & mobile", "w": 3, "cc": "ZW", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "home_connection": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "dshield": {"n": 1, "p": 0.1872, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 2, "p": 0.3385, "hi": 5.54, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}, "blocklist_de": {"n": 2, "p": 0.3875, "hi": 5.97, "lo": 0.78, "ips": 2, "mean": 2.84, "above": false}}, "h2": [["2026-10-05", 2.514, 0.011, 0, false], ["2026-10-12", 6.285, 0.012, 0, false]], "sh": false, "uc": 631, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 1.590, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 6.285, "se": 0.614, "ts": 0.400, "map": 14.646, "obs": 5, "own": 22.656, "comp": {"cins": -0.8401, "dshield": 1.5846, "crowdsec": 0.2442, "vulncheck": -0.7877, "blocklist_de": 3.8769}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.127, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-TPL1-AFRINIC", "org": "Telone PVT Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.telone.co.zw"}, "pfx": 63, "reg": "2010-04-16", "rir": "afrinic", "s24": 51, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49664, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00324365401698}, {"a": 37209, "h": "HYPERIA", "n": "Hyperia", "t": "Broadband & mobile", "w": 1, "cc": "NG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.459, 0.011, 0, false], ["2026-10-12", 0.500, 0.012, 0, false]], "sh": false, "uc": 1380.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.500, "se": 1.390, "ts": 1.000, "map": 5.014, "obs": 1, "own": 9.417, "comp": {"cins": -0.1018, "dshield": -0.238, "crowdsec": -0.9424, "vulncheck": -0.2616, "blocklist_de": 4.5498}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.564, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-HL1-AFRINIC", "org": "Hyperia Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.hyperia.com"}, "pfx": 15, "reg": "2010-05-06", "rir": "afrinic", "s24": 15, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011502329366}, {"a": 37211, "h": "MAX-NET-FOR-INTERNET-SERVICES", "n": "MAX NET FOR INTERNET SERVICES", "t": "Broadband & mobile", "w": 1, "cc": "SD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 2.759, 0.011, 0, false], ["2026-10-12", 3.022, 0.012, 0, false]], "sh": false, "uc": 2760.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.022, "se": 0.983, "ts": 0.500, "map": 14.043, "obs": 2, "own": 22.676, "comp": {"cins": -0.2739, "dshield": -0.5953, "crowdsec": 1.9918, "vulncheck": -0.5007, "blocklist_de": 3.4139}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.210, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-MNFI1-AFRINIC", "org": "MAX NET FOR INTERNET SERVICES", "pdb": null, "pfx": 8, "reg": "2015-09-08", "rir": "afrinic", "s24": 15, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003238281723}, {"a": 37215, "h": "MAREN", "n": "Malawi Research and Education Network", "t": "Enterprise, edu & gov", "w": 3, "cc": "MW", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2026-8181": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.4295, "hi": 5.79, "lo": 1.02, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 1.086, 0.010, 0, false], ["2026-10-12", 1.083, 0.011, 0, false]], "sh": false, "uc": 311.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.990, "ts": null, "map": 0.181, "obs": 0, "own": 2.137, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.083, "se": 0.744, "ts": 1.000, "map": 3.199, "obs": 3, "own": 18.206, "comp": {"cins": -0.5033, "dshield": -1.0005, "crowdsec": 7.2864, "vulncheck": -0.6644, "blocklist_de": -2.5617}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.232, "det": null, "oid": "ORG-MRAE1-AFRINIC", "org": "Malawi Research and Education Network - MAREN", "pdb": {"t": "Educational/Research", "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.maren.ac.mw"}, "pfx": 46, "reg": "2014-08-22", "rir": "afrinic", "s24": 128, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 60928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007370326912}, {"a": 37218, "h": "University-of-Dodoma", "n": "The University of Dodoma", "t": "Other", "w": 0, "cc": "TZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-TUOD1-AFRINIC", "org": "The University of Dodoma", "pdb": null, "pfx": 3, "reg": "2010-06-09", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001133898518}, {"a": 37228, "h": "Olleh-Rwanda-Networks", "n": "KT RWANDA NETWORK", "t": "Other", "w": 4, "cc": "RW", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "shodan": {"n": 1, "p": 0.0427, "hi": 2.88, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "crowdsec": {"n": 2, "p": 0.0942, "hi": 3.49, "lo": 0.45, "ips": 2, "mean": 1.66, "above": false}, "blocklist_de": {"n": 2, "p": 0.2424, "hi": 4.76, "lo": 0.62, "ips": 2, "mean": 2.27, "above": false}}, "h2": [["2026-10-05", 0.704, 0.010, 0, false], ["2026-10-12", 1.310, 0.011, 0, false]], "sh": false, "uc": 141.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.929, "ts": null, "map": 0.166, "obs": 0, "own": 0.396, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.310, "se": 0.605, "ts": 0.400, "map": 3.014, "obs": 5, "own": 1.713, "comp": {"cins": 3.0988, "dshield": -1.6587, "crowdsec": -0.941, "vulncheck": -0.8209, "blocklist_de": 2.8189}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.170, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ORN1-AFRINIC", "org": "KT RWANDA NETWORK Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.ktrn.rw/"}, "pfx": 130, "reg": "2010-06-22", "rir": "afrinic", "s24": 302, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 209920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00129820762467}, {"a": 37269, "h": "ICSL", "n": "Information Connectivity Solutions", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1801.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.640, "det": null, "oid": "ORG-ICSL1-AFRINIC", "org": "Information Connectivity Solutions Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Selective", "web": "https://www.ic-sol.net"}, "pfx": 19, "reg": "2010-10-21", "rir": "afrinic", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002338344346}, {"a": 37282, "h": "MAINONE", "n": "MainOne Cable Company", "t": "Broadband & mobile", "w": 4, "cc": "NG", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.1269, "hi": 3.70, "lo": 0.65, "ips": 3, "mean": 1.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.1939, "hi": 4.36, "lo": 0.57, "ips": 2, "mean": 2.08, "above": false}}, "h2": [["2026-10-05", 0.371, 0.009, 0, false], ["2026-10-12", 0.912, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.906, "ts": null, "map": 0.158, "obs": 0, "own": 0.887, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.912, "se": 0.601, "ts": 0.600, "map": 2.068, "obs": 5, "own": 3.214, "comp": {"cins": -0.9356, "dshield": -1.6021, "crowdsec": 2.2984, "vulncheck": -0.8107, "blocklist_de": 3.1704}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.208, "det": {"blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "ORG-MCC1-AFRINIC", "org": "Main one Cable Company Nigeria Limited", "pdb": {"t": "NSP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.mainone.net/"}, "pfx": 8, "reg": "2010-11-29", "rir": "afrinic", "s24": 413, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 105984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0025205440531}, {"a": 37284, "h": "Aljeel-net", "n": "Aljeel Aljadeed for Technology", "t": "Broadband & mobile", "w": 10, "cc": "LY", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 9, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 9, "web_bruteforce": 9, "router_or_botnet": 1, "cve:CVE-2017-9841": 8, "cve:CVE-2019-9082": 8, "cve:CVE-2018-20062": 8}, "n": 10}, "ev": {"shodan": {"n": 1, "p": 0.0562, "hi": 3.09, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "crowdsec": {"n": 3, "p": 0.2660, "hi": 4.66, "lo": 0.82, "ips": 10, "mean": 2.40, "above": false}}, "h2": [["2026-10-05", 0.896, 0.010, 0, false], ["2026-10-12", 0.600, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.170, "obs": 0, "own": 1.042, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.600, "se": 0.732, "ts": 1.000, "map": 1.743, "obs": 3, "own": 2.733, "comp": {"cins": -0.5317, "dshield": -1.046, "crowdsec": 6.9074, "vulncheck": -0.6786, "blocklist_de": -2.7018}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.285, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-AAFT1-AFRINIC", "org": "Aljeel Aljadeed For Technology", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Open", "web": "https://aljeel.ly"}, "pfx": 115, "reg": "2010-12-06", "rir": "afrinic", "s24": 250, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 84736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0039657579}, {"a": 37288, "h": "WACREN", "n": "West and Central African Research Network", "t": "Enterprise, edu & gov", "w": 0, "cc": "SN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.682, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WACA1-AFRINIC", "org": "West and Central African Research Network", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.wacren.net"}, "pfx": 1, "reg": "2010-12-28", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 37292, "h": "OTI-AS", "n": "Omnium des Telecom et de l'Internet (OTI Telecom)", "t": "Broadband & mobile", "w": 16, "cc": "BJ", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 10, "p": 0.9996, "hi": 16.30, "lo": 5.93, "ips": 16, "mean": 10.57, "above": true}}, "h2": [["2026-10-05", 28.127, 0.011, 1, false], ["2026-10-12", 30.237, 0.012, 1, false]], "sh": false, "uc": 4769.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 1.693, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 10}, "lo": 30.237, "se": 0.483, "ts": 1.000, "map": 56.272, "obs": 10, "own": 85.927, "comp": {"cins": -1.7815, "dshield": -2.3996, "crowdsec": -9.3242, "vulncheck": -0.923, "blocklist_de": 19.8521}, "mass": 11.8, "listed": false}}, "abq": false, "bot": 0.317, "det": {"blocklist_de": {"imap": 16, "mail": 16}}, "oid": "ORG-OTI1-AFRINIC", "org": "Omnium des Telecom et de l'Internet (OTI Telecom)", "pdb": null, "pfx": 15, "reg": "2011-02-25", "rir": "afrinic", "s24": 38, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.0000470019305}, {"a": 37294, "h": "TNM", "n": "TELEKOM NETWORKS MALAWI", "t": "Broadband & mobile", "w": 1, "cc": "MW", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.0511, "hi": 3.02, "lo": 0.23, "ips": 1, "mean": 1.27, "above": false}}, "h2": [["2026-10-05", 0.057, 0.009, 0, false], ["2026-10-12", 0.060, 0.010, 0, false]], "sh": false, "uc": 1068.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.886, "ts": null, "map": 0.151, "obs": 0, "own": 0.813, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.060, "se": 1.093, "ts": 1.000, "map": 0.342, "obs": 1, "own": 0.572, "comp": {"cins": -0.2395, "dshield": -0.528, "crowdsec": -2.0857, "vulncheck": -0.4647, "blocklist_de": 3.6389}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.143, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TNML1-AFRINIC", "org": "TELEKOM NETWORKS MALAWI LTD", "pdb": {"t": "NSP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.tnm.co.mw"}, "pfx": 131, "reg": "2011-03-01", "rir": "afrinic", "s24": 534, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 207104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00288992333312}, {"a": 37308, "h": "COOLLINK", "n": "Coollink", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 667.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.897, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.715, "det": null, "oid": "ORG-SBAC1-AFRINIC", "org": "Steam Broadcasting and Communications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.coollink.ng"}, "pfx": 31, "reg": "2011-03-23", "rir": "afrinic", "s24": 31, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001272386001}, {"a": 37315, "h": "CipherWave", "n": "CipherWave", "t": "Transit & backbone", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2298, "hi": 4.65, "lo": 0.60, "ips": 2, "mean": 2.22, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 1.678, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.738, "ts": null, "map": 0.131, "obs": 0, "own": 0.734, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.301, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-CA6-AFRINIC", "org": "Cipherwave", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.cipherwave.co.za"}, "pfx": 48, "reg": "2011-04-12", "rir": "afrinic", "s24": 165, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 88064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009597578072}, {"a": 37317, "h": "AccessGlobal-AS", "n": "AccessGlobal Communication", "t": "Other", "w": 2, "cc": "ZA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3895, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 2.782, 0.011, 0, false], ["2026-10-12", 1.327, 0.012, 0, false]], "sh": false, "uc": 406.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.327, "se": 0.936, "ts": 1.000, "map": 5.660, "obs": 2, "own": 3.325, "comp": {"cins": -0.3471, "dshield": -0.7326, "crowdsec": -2.8887, "vulncheck": -0.5651, "blocklist_de": 7.6605}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.195, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-ACL7-AFRINIC", "org": "AccessGlobal Communication (Pty) Ltd", "pdb": {"t": null, "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.accessglobalcommunication.co.za"}, "pfx": 4, "reg": "2018-10-12", "rir": "afrinic", "s24": 48, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000788826243}, {"a": 37323, "h": "NETPAGE", "n": "Netpage Company", "t": "Broadband & mobile", "w": 6, "cc": "GM", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 4, "p": 0.8043, "hi": 8.96, "lo": 1.93, "ips": 6, "mean": 4.90, "above": true}}, "h2": [["2026-10-05", 10.401, 0.011, 1, false], ["2026-10-12", 11.850, 0.012, 1, false]], "sh": false, "uc": 996.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 11.850, "se": 0.686, "ts": 1.000, "map": 31.890, "obs": 4, "own": 49.404, "comp": {"cins": -0.7376, "dshield": -1.3487, "crowdsec": -5.2893, "vulncheck": -0.7585, "blocklist_de": 12.9901}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.186, "det": {"blocklist_de": {"imap": 4, "mail": 6}}, "oid": "ORG-NCL1-AFRINIC", "org": "Netpage Company Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.netpage.info"}, "pfx": 20, "reg": "2011-04-26", "rir": "afrinic", "s24": 20, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00016048414719}, {"a": 37332, "h": "ZOL", "n": "Zimbabwe Online", "t": "Other", "w": 4, "cc": "ZW", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 3, "web_bruteforce": 3, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.1245, "hi": 3.68, "lo": 0.65, "ips": 3, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.0696, "hi": 3.28, "lo": 0.25, "ips": 1, "mean": 1.38, "above": false}}, "h2": [["2026-10-05", 0.835, 0.009, 0, false], ["2026-10-12", 0.623, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.905, "ts": null, "map": 0.157, "obs": 0, "own": 0.356, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.623, "se": 0.650, "ts": 0.750, "map": 1.553, "obs": 4, "own": 0.886, "comp": {"cins": -0.7469, "dshield": -1.3613, "crowdsec": 4.2882, "vulncheck": -0.7614, "blocklist_de": 0.4149}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.110, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-ZO1-AFRINIC", "org": "Zimbabwe Online", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.zimonline.co.za/"}, "pfx": 73, "reg": "2011-05-23", "rir": "afrinic", "s24": 417, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 113152, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00192463229946}, {"a": 37342, "h": "MOVITEL", "n": "Movitel", "t": "Broadband & mobile", "w": 7, "cc": "MZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 5, "web_bruteforce": 4, "mail_bruteforce": 5}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.0278, "hi": 2.67, "lo": 0.35, "ips": 5, "mean": 1.27, "above": false}, "blocklist_de": {"n": 4, "p": 0.5046, "hi": 5.91, "lo": 1.27, "ips": 6, "mean": 3.23, "above": false}}, "h2": [["2026-10-05", 0.515, 0.009, 0, false], ["2026-10-12", 1.061, 0.010, 0, false]], "sh": false, "uc": 491.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.152, "obs": 0, "own": 0.825, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.061, "se": 0.565, "ts": 0.667, "map": 2.267, "obs": 6, "own": 3.511, "comp": {"cins": -1.1823, "dshield": -1.8761, "crowdsec": -2.4118, "vulncheck": -0.8565, "blocklist_de": 8.5386}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.175, "det": {"blocklist_de": {"bots": 1, "imap": 3, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MS5-AFRINIC", "org": "Movitel, SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Open", "web": "http://movitel.co.mz/"}, "pfx": 541, "reg": "2011-05-31", "rir": "afrinic", "s24": 512, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 899072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0080283569856}, {"a": 37349, "h": "Aptus", "n": "Aptus Solutions Ltd", "t": "Broadband & mobile", "w": 0, "cc": "TZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 623.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.691, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.162, "det": null, "oid": "ORG-ASL3-AFRINIC", "org": "Aptus Solutions Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.maisha.co.tz"}, "pfx": 17, "reg": "2011-06-28", "rir": "afrinic", "s24": 52, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016072876794}, {"a": 37350, "h": "dds55", "n": "Dynamic Data Solutions LTD", "t": "Broadband & mobile", "w": 0, "cc": "GH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 717.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 1.721, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.937, "ts": null, "map": 0.201, "obs": 0, "own": 0.845, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.295, "det": null, "oid": "ORG-IISG1-AFRINIC", "org": "Dimension Data Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://dds55.com/"}, "pfx": 25, "reg": "2011-06-29", "rir": "afrinic", "s24": 35, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002212213017}, {"a": 37358, "h": "BITCO", "n": "BitCo", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1242, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "crowdsec": {"n": 1, "p": 0.1104, "hi": 3.78, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.164, 0.011, 0, false], ["2026-10-12", 0.171, 0.012, 0, false]], "sh": false, "uc": 211.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 1.367, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.171, "se": 1.207, "ts": 1.000, "map": 1.222, "obs": 1, "own": 2.106, "comp": {"cins": -0.1568, "dshield": -0.3578, "crowdsec": 3.2809, "vulncheck": -0.3567, "blocklist_de": -0.8156}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.201, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BA10-AFRINIC", "org": "BitCo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.bitco.co.za"}, "pfx": 22, "reg": "2011-07-13", "rir": "afrinic", "s24": 96, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0021580718346}, {"a": 37371, "h": "HORMUUD", "n": "Hormuud Telecom Somalia", "t": "Broadband & mobile", "w": 7, "cc": "SO", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1890, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "urlhaus": {"n": 1, "p": 0.1974, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3509, "hi": 5.65, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}, "vulncheck": {"n": 3, "p": 0.6321, "hi": 7.58, "lo": 1.34, "ips": 4, "mean": 3.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1794, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 7.755, 0.591, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.591, "se": 1.620, "ts": 1.000, "map": 6.810, "obs": 1, "own": 21.586, "comp": {"urlhaus": 4.1353, "threatfox": -0.2072, "phishing_db": -0.3836}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 1}, "lo": 7.755, "se": 0.572, "ts": 0.429, "map": 16.692, "obs": 7, "own": 26.048, "comp": {"cins": -0.8133, "dshield": 1.6697, "crowdsec": 0.4794, "vulncheck": 2.8649, "blocklist_de": 0.0079}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.056, "det": {"vulncheck": {"botnet_node": 4}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HTSI1-AFRINIC", "org": "Hormuud Telecom Somalia INC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://hormuud.com/"}, "pfx": 43, "reg": "2011-09-05", "rir": "afrinic", "s24": 43, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01046837961102}, {"a": 37385, "h": "SONITEL", "n": "SONITEL", "t": "Other", "w": 5, "cc": "NE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 4, "router_or_botnet": 3}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 5, "p": 0.8727, "hi": 9.32, "lo": 2.32, "ips": 5, "mean": 5.32, "above": true}}, "h2": [["2026-10-05", 5.518, 0.011, 0, false], ["2026-10-12", 5.799, 0.012, 0, false]], "sh": false, "uc": 2693.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.799, "se": 0.611, "ts": 1.000, "map": 13.573, "obs": 5, "own": 7.678, "comp": {"cins": -0.7508, "dshield": -1.3667, "crowdsec": 10.6458, "vulncheck": -0.7626, "blocklist_de": -3.764}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.290, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SNDT2-AFRINIC", "org": "Societe Nigerienne des Telecommunications (SONITEL)", "pdb": null, "pfx": 11, "reg": "2011-10-14", "rir": "afrinic", "s24": 48, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00017089989744}, {"a": 37410, "h": "LONESTAR", "n": "Lonestar Communications", "t": "Other", "w": 2, "cc": "LR", "cf": null, "cs": {"c": {"web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3540, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}}, "h2": [["2026-10-12", 1.304, 0.012, 0, false]], "sh": false, "uc": 2572.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.672, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.304, "se": 0.933, "ts": 1.000, "map": 5.540, "obs": 2, "own": 3.247, "comp": {"cins": -0.2939, "dshield": -0.6337, "crowdsec": 6.069, "vulncheck": -0.5199, "blocklist_de": -1.5158}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.098, "det": null, "oid": "ORG-LCC1-AFRINIC", "org": "Lonestar Communications Corporation", "pdb": null, "pfx": 28, "reg": "2012-01-18", "rir": "afrinic", "s24": 41, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00143616409118}, {"a": 37413, "h": "HYMAX", "n": "Hymax Talking Solutions", "t": "Other", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.359, "det": {"shodan": {"malware": 1}}, "oid": "ORG-HTS2-AFRINIC", "org": "Hymax Talking Solutions", "pdb": null, "pfx": 1, "reg": "2012-01-20", "rir": "afrinic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027046660475}, {"a": 37424, "h": "Spacetel", "n": "MTN BENIN", "t": "Other", "w": 0, "cc": "BJ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.093, "det": null, "oid": "ORG-SBS2-AFRINIC", "org": "SPACETEL BENIN SA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.mtn.bj"}, "pfx": 19, "reg": "2019-10-10", "rir": "afrinic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0032864371832}, {"a": 37429, "h": "Spidernet", "n": "Spidernet", "t": "Other", "w": 18, "cc": "BI", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 17, "mail_bruteforce": 9, "router_or_botnet": 14}, "n": 18}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 18, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": 131445.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.665, "det": null, "oid": "ORG-SSB1-AFRINIC", "org": "SPIDERNET SPRL BURUNDI", "pdb": {"t": null, "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.spidernet-bi.com"}, "pfx": 1, "reg": "2012-03-08", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003267221484}, {"a": 37440, "h": "Airtel-MW", "n": "Airtel Malawi", "t": "Broadband & mobile", "w": 1, "cc": "MW", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1497, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-12", 0.261, 0.012, 0, false]], "sh": false, "uc": 2445, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 1.619, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.261, "se": 1.268, "ts": 1.000, "map": 2.089, "obs": 1, "own": 3.682, "comp": {"cins": -0.132, "dshield": -0.3045, "crowdsec": 3.5713, "vulncheck": -0.3167, "blocklist_de": -0.6877}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.142, "det": null, "oid": "ORG-ZM1-AFRINIC", "org": "Airtel Malawi Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.airtel.mw"}, "pfx": 37, "reg": "2012-04-16", "rir": "afrinic", "s24": 47, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00583812367872}, {"a": 37451, "h": "CongoTelecom", "n": "Congo Telecom", "t": "Broadband & mobile", "w": 5, "cc": "CG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "crowdsec": {"n": 2, "p": 0.3653, "hi": 5.77, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "blocklist_de": {"n": 1, "p": 0.1834, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.433, 0.011, 0, false], ["2026-10-12", 5.998, 0.012, 0, false]], "sh": false, "uc": 1863.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.998, "se": 0.676, "ts": 0.500, "map": 15.759, "obs": 4, "own": 24.471, "comp": {"cins": -0.6365, "dshield": 2.2695, "crowdsec": 2.1424, "vulncheck": -0.7236, "blocklist_de": 1.0993}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.336, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-CT6-AFRINIC", "org": "CONGO TELECOM", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.congotelecom.cg"}, "pfx": 34, "reg": "2013-05-29", "rir": "afrinic", "s24": 34, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00220406956527}, {"a": 37457, "h": "Telkom-Internet", "n": "Telkom Internet", "t": "Broadband & mobile", "w": 17, "cc": "ZA", "cf": {"rb": "hi", "wb": "hi", "rep": 1.19, "waf": 1.04}, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-12847": 1}, "n": 1}, "ev": {"dshield": {"n": 8, "p": 0.1010, "hi": 3.34, "lo": 1.09, "ips": 8, "mean": 2.08, "above": false}, "urlhaus": {"n": 3, "p": 0.3082, "hi": 4.94, "lo": 0.87, "ips": 3, "mean": 2.55, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.27, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.38, "lo": 0.34, "ips": 5, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.022, 0.169, 0, false], ["2026-10-12", 0.255, 0.356, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 0.356, "se": 1.019, "ts": 1.000, "map": 1.164, "obs": 3, "own": 3.129, "comp": {"urlhaus": 3.4576, "threatfox": -0.5526, "phishing_db": -1.1272}, "mass": 11.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.255, "se": 0.457, "ts": 0.571, "map": 0.442, "obs": 14, "own": 0.686, "comp": {"cins": -2.047, "dshield": 9.1282, "crowdsec": -8.5939, "vulncheck": -0.9417, "blocklist_de": 3.0327}, "mass": 15.2, "listed": false}}, "abq": false, "bot": 0.091, "det": {"blocklist_de": {"bots": 4, "imap": 1, "mail": 1}}, "oid": "ORG-TSL2-AFRINIC", "org": "Telkom SA Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.telkomsa.net/"}, "pfx": 1661, "reg": "2012-06-12", "rir": "afrinic", "s24": 6161, "sib": 6, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3094016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.061561}, {"a": 37468, "h": "ANGOLA-CABLES", "n": "Angola Cables", "t": "Broadband & mobile", "w": 2, "cc": "AO", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1592, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "vulncheck": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.221, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.934, "ts": null, "map": 0.167, "obs": 0, "own": 1.002, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.221, "se": 0.877, "ts": 0.500, "map": 0.822, "obs": 2, "own": 1.344, "comp": {"cins": -0.3015, "dshield": -0.6481, "crowdsec": 1.7063, "vulncheck": 1.9949, "blocklist_de": -1.5541}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-AC4-AFRINIC", "org": "Angola Cables", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.angolacables.co.ao/"}, "pfx": 15, "reg": "2012-07-02", "rir": "afrinic", "s24": 37, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000775239209}, {"a": 37480, "h": "Cobranet", "n": "Cobranet Limited", "t": "Broadband & mobile", "w": 3, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.3830, "hi": 5.45, "lo": 0.96, "ips": 3, "mean": 2.81, "above": false}, "blocklist_de": {"n": 1, "p": 0.1347, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 1.408, 0.010, 0, false], ["2026-10-12", 1.500, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.975, "ts": null, "map": 0.178, "obs": 0, "own": 1.193, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.500, "se": 0.659, "ts": 0.750, "map": 3.788, "obs": 4, "own": 5.897, "comp": {"cins": -0.7029, "dshield": -1.3008, "crowdsec": 4.7902, "vulncheck": -0.7473, "blocklist_de": 0.6862}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CL8-AFRINIC", "org": "Cobranet Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.cobranet.ng"}, "pfx": 152, "reg": "2012-07-15", "rir": "afrinic", "s24": 159, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00067560464958}, {"a": 37487, "h": "GUINEANET", "n": "guineanet", "t": "Other", "w": 0, "cc": "GQ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 5737.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.331, "det": null, "oid": "ORG-GA4-AFRINIC", "org": "guineanet", "pdb": null, "pfx": 1, "reg": "2012-08-03", "rir": "afrinic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000129419191}, {"a": 37492, "h": "ORANGE-TN", "n": "Orange Tunisie", "t": "Broadband & mobile", "w": 16, "cc": "TN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.0003, "hi": 1.50, "lo": 0.19, "ips": 2, "mean": 0.71, "above": false}, "dshield": {"n": 6, "p": 0.0064, "hi": 2.32, "lo": 0.64, "ips": 6, "mean": 1.37, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.37, "lo": 0.06, "ips": 3, "mean": 0.19, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 1.44, "lo": 0.44, "ips": 7, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.183, 0.005, 0, false], ["2026-10-12", 0.303, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.694, "ts": null, "map": 0.064, "obs": 0, "own": 0.288, "comp": null, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.303, "se": 0.438, "ts": 0.389, "map": 0.515, "obs": 18, "own": 0.797, "comp": {"cins": 2.286, "dshield": 3.8702, "crowdsec": -7.6646, "vulncheck": -0.9631, "blocklist_de": 3.2017}, "mass": 21.8, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"ssh": 4, "bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-OT3-AFRINIC", "org": "Orange Tunisie", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.orange.tn"}, "pfx": 211, "reg": "2012-08-22", "rir": "afrinic", "s24": 7588, "sib": 1, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5736448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0145894343616}, {"a": 37506, "h": "Zinox", "n": "Zinox Telecommunications Limited", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.791, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.610, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ZTL1-AFRINIC", "org": "Zinox Telecommunications Limited", "pdb": null, "pfx": 9, "reg": "2012-10-17", "rir": "afrinic", "s24": 40, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 37517, "h": "CVTS1", "n": "CV Telecom", "t": "Broadband & mobile", "w": 6, "cc": "CV", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.2130, "hi": 4.52, "lo": 0.59, "ips": 2, "mean": 2.15, "above": false}, "dshield": {"n": 2, "p": 0.3599, "hi": 5.73, "lo": 0.74, "ips": 2, "mean": 2.73, "above": false}, "crowdsec": {"n": 3, "p": 0.3479, "hi": 5.21, "lo": 0.92, "ips": 3, "mean": 2.69, "above": false}, "blocklist_de": {"n": 3, "p": 0.5170, "hi": 6.48, "lo": 1.14, "ips": 3, "mean": 3.34, "above": false}}, "h2": [["2026-10-05", 1.226, 0.010, 0, false], ["2026-10-12", 3.674, 0.011, 0, false]], "sh": false, "uc": 225, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 1.143, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.674, "se": 0.519, "ts": 0.375, "map": 7.255, "obs": 8, "own": 11.186, "comp": {"cins": -1.308, "dshield": 2.6291, "crowdsec": -0.9784, "vulncheck": -0.8745, "blocklist_de": 3.907}, "mass": 7.4, "listed": false}}, "abq": false, "bot": 0.170, "det": {"shodan": {"c2": 2}, "blocklist_de": {"bots": 1, "imap": 2, "mail": 2}}, "oid": "ORG-CVTS1-AFRINIC", "org": "CABO VERDE TELECOM, S.A", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.alou.cv/"}, "pfx": 42, "reg": "2012-11-08", "rir": "afrinic", "s24": 184, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00151171243656}, {"a": 37521, "h": "Internet-Solutions-NG", "n": "Internet Solutions Nigeria", "t": "Broadband & mobile", "w": 2, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4073, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-12", 4.129, 0.012, 0, false]], "sh": false, "uc": 13454.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.129, "se": 1.003, "ts": 1.000, "map": 20.050, "obs": 2, "own": 32.420, "comp": {"cins": -0.2367, "dshield": -0.5224, "crowdsec": 6.8377, "vulncheck": -0.4615, "blocklist_de": -1.2252}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.631, "det": null, "oid": "ORG-ISNL1-AFRINIC", "org": "Internet Solutions Nigeria Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.isn.ng"}, "pfx": 9, "reg": "2012-11-12", "rir": "afrinic", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008950041794}, {"a": 37540, "h": "WINROCK-NG", "n": "Winrock Nigeria", "t": "Other", "w": 7, "cc": "NG", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 7, "mail_bruteforce": 6, "router_or_botnet": 3}, "n": 7}, "ev": {"crowdsec": {"n": 4, "p": 0.8072, "hi": 9.01, "lo": 1.94, "ips": 7, "mean": 4.92, "above": true}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 53.468, 0.011, 1, false], ["2026-10-12", 41.431, 0.013, 1, false]], "sh": false, "uc": 48046.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 41.431, "se": 0.629, "ts": 0.800, "map": 100.514, "obs": 5, "own": 56.678, "comp": {"cins": -0.7038, "dshield": -1.302, "crowdsec": 8.0764, "vulncheck": -0.7476, "blocklist_de": 0.6809}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.648, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-WNL1-AFRINIC", "org": "Winrock Nigeria Limited", "pdb": null, "pfx": 10, "reg": "2012-12-21", "rir": "afrinic", "s24": 6, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00005495384784}, {"a": 37545, "h": "BBSS", "n": "Burundi Backbone System", "t": "Transit & backbone", "w": 1, "cc": "BI", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.352, 0.011, 0, false], ["2026-10-12", 0.376, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 2.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.376, "se": 1.331, "ts": 1.000, "map": 3.394, "obs": 1, "own": 12.505, "comp": {"cins": -0.11, "dshield": -0.2563, "crowdsec": 3.8337, "vulncheck": -0.2774, "blocklist_de": -0.5742}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.247, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BBSS1-AFRINIC", "org": "Burundi Backbone System SM", "pdb": {"t": "NSP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.bbs.bi"}, "pfx": 41, "reg": "2013-01-16", "rir": "afrinic", "s24": 24, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010977271848}, {"a": 37549, "h": "Innovative_Networks", "n": "Innovative Networks", "t": "Broadband & mobile", "w": 2, "cc": "ZA", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3751, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-12", 1.755, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.755, "se": 0.949, "ts": 1.000, "map": 7.678, "obs": 2, "own": 12.320, "comp": {"cins": -0.2792, "dshield": -0.6055, "crowdsec": 6.2636, "vulncheck": -0.5059, "blocklist_de": -1.4411}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TTC1-AFRINIC", "org": "Triponza Trading 376 CC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.innovationnetworks.co.za"}, "pfx": 29, "reg": "2013-01-29", "rir": "afrinic", "s24": 28, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003504058643}, {"a": 37563, "h": "SOMTEL", "n": "SOMTEL INTERNATIONAL", "t": "Broadband & mobile", "w": 0, "cc": "SO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 5742.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.063, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SIL2-AFRINIC", "org": "SOMTEL INTERNATIONAL Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.somtelnetwork.net"}, "pfx": 10, "reg": "2013-02-21", "rir": "afrinic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00255938723238}, {"a": 37577, "h": "Orange-BF", "n": "Orange Burkina Faso", "t": "Broadband & mobile", "w": 5, "cc": "BF", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0016, "hi": 1.78, "lo": 0.23, "ips": 2, "mean": 0.85, "above": false}, "blocklist_de": {"n": 3, "p": 0.1445, "hi": 3.83, "lo": 0.67, "ips": 3, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.446, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.841, "ts": null, "map": 0.132, "obs": 0, "own": 0.660, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.446, "se": 0.598, "ts": 0.600, "map": 1.008, "obs": 5, "own": 1.569, "comp": {"cins": -1.029, "dshield": -1.7108, "crowdsec": -1.2944, "vulncheck": -0.83, "blocklist_de": 6.2663}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.189, "det": {"blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "ORG-ABFS1-AFRINIC", "org": "Orange Burkina Faso", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.orange.bf/"}, "pfx": 407, "reg": "2013-03-21", "rir": "afrinic", "s24": 957, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 246016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00746763996384}, {"a": 37586, "h": null, "n": "ONATEL", "t": "Other", "w": 0, "cc": "ZZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.152, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 5, "reg": null, "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003079007566}, {"a": 37605, "h": "GTNL1-AS", "n": "I-WORLD NETWORKS", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2807.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.189, "det": null, "oid": "ORG-GTNL1-AFRINIC", "org": "General Telecommunication Networks (NIG) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://iwm.ng"}, "pfx": 17, "reg": "2013-07-29", "rir": "afrinic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023131421346}, {"a": 37611, "h": "AFRIHOST-SP", "n": "Afrihost", "t": "Broadband & mobile", "w": 15, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 5, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 2}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.95, "lo": 0.07, "ips": 1, "mean": 0.40, "above": false}, "dshield": {"n": 3, "p": 0.1500, "hi": 3.87, "lo": 0.68, "ips": 3, "mean": 2.00, "above": false}, "urlhaus": {"n": 1, "p": 0.1341, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 6, "p": 0.0012, "hi": 1.99, "lo": 0.55, "ips": 6, "mean": 1.18, "above": false}, "phishing_db": {"n": 1, "p": 0.0219, "hi": 2.48, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "blocklist_de": {"n": 4, "p": 0.0554, "hi": 3.06, "lo": 0.66, "ips": 5, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.440, 0.251, 0, false], ["2026-10-12", 0.711, 0.268, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 0.268, "se": 1.156, "ts": 0.500, "map": 1.153, "obs": 2, "own": 3.232, "comp": {"urlhaus": 2.1234, "threatfox": -0.4738, "phishing_db": 0.1186}, "mass": 3.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.711, "se": 0.462, "ts": 0.462, "map": 1.256, "obs": 13, "own": 1.941, "comp": {"cins": -1.8785, "dshield": 2.4228, "crowdsec": -0.0166, "vulncheck": -0.9303, "blocklist_de": 2.0244}, "mass": 13.0, "listed": false}}, "abq": false, "bot": 0.192, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1, "imap": 3, "mail": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-AS7-AFRINIC", "org": "AFRIHOST SP (PTY) LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.afrihost.com"}, "pfx": 19, "reg": "2013-08-20", "rir": "afrinic", "s24": 1862, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 478208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03807268773185}, {"a": 37622, "h": "MTML-AS", "n": "Mahanagar Telephone (Mauritius)", "t": "Broadband & mobile", "w": 0, "cc": "MU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 1.013, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MTL2-AFRINIC", "org": "Mahanagar Telephone (Mauritius) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.chili.mu"}, "pfx": 7, "reg": "2013-09-16", "rir": "afrinic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018910629415}, {"a": 37645, "h": "ZAP-Angola", "n": "ZAP-Angola", "t": "Broadband & mobile", "w": 2, "cc": "AO", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0650, "hi": 3.18, "lo": 0.41, "ips": 2, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.661, 0.010, 0, false], ["2026-10-12", 0.226, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.161, "obs": 0, "own": 0.922, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.226, "se": 0.855, "ts": 1.000, "map": 0.823, "obs": 2, "own": 1.310, "comp": {"cins": -0.3834, "dshield": -0.7978, "crowdsec": 4.9381, "vulncheck": -0.5922, "blocklist_de": -1.9662}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-FSDI1-AFRINIC", "org": "Finstar - Sociedade de Investimento e Participacoes S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.zap.co.ao"}, "pfx": 55, "reg": "2013-10-28", "rir": "afrinic", "s24": 368, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 94208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00439052146524}, {"a": 37650, "h": "CM-Value-AS", "n": "CM Value Added Services", "t": "Transit & backbone", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 237.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.016, "ts": null, "map": 0.186, "obs": 0, "own": 2.011, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.165, "obs": 0, "own": 1.084, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.312, "det": null, "oid": "ORG-CVAS1-AFRINIC", "org": "CM Value Added Services (Pty) Ltd", "pdb": {"t": "NSP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.cmvas.co.za"}, "pfx": 9, "reg": "2013-11-06", "rir": "afrinic", "s24": 84, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 43008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 37654, "h": "RwEdNet-AS", "n": "ORG-RMoE1-AFRINIC", "t": "Other", "w": 0, "cc": "RW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.200, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RMOE1-AFRINIC", "org": "Rwanda Ministry of Education", "pdb": null, "pfx": 10, "reg": "2013-11-08", "rir": "afrinic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044986943342}, {"a": 37662, "h": "WIOCC-AS", "n": "WIOCC", "t": "Transit & backbone", "w": 5, "cc": "MU", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 4, "router_or_botnet": 3, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 3, "p": 0.5674, "hi": 6.93, "lo": 1.22, "ips": 4, "mean": 3.57, "above": false}}, "h2": [["2026-10-05", 8.505, 0.011, 0, false], ["2026-10-12", 4.715, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 2.324, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.715, "se": 0.674, "ts": 0.750, "map": 12.311, "obs": 4, "own": 38.903, "comp": {"cins": 3.8121, "dshield": -1.2324, "crowdsec": 5.3574, "vulncheck": -0.7305, "blocklist_de": -3.3025}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.142, "det": null, "oid": "ORG-WIOC1-AFRINIC", "org": "West Indian Ocean Cable Company", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://wiocc.net/"}, "pfx": 32, "reg": "2013-11-26", "rir": "afrinic", "s24": 45, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00111295729902}, {"a": 37671, "h": "GLOBALNET-AS", "n": "3S INF", "t": "Other", "w": 4, "cc": "TN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0054, "hi": 2.06, "lo": 0.27, "ips": 2, "mean": 0.98, "above": false}, "dshield": {"n": 2, "p": 0.1667, "hi": 4.14, "lo": 0.54, "ips": 2, "mean": 1.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.0576, "hi": 3.10, "lo": 0.40, "ips": 2, "mean": 1.47, "above": false}}, "h2": [["2026-10-05", 0.038, 0.008, 0, false], ["2026-10-12", 0.316, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.132, "obs": 0, "own": 0.265, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.316, "se": 0.644, "ts": 0.500, "map": 0.771, "obs": 4, "own": 0.441, "comp": {"cins": -0.8377, "dshield": 4.6654, "crowdsec": -5.8013, "vulncheck": -0.7871, "blocklist_de": 3.8948}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.238, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-IA51-AFRINIC", "org": "3S INF", "pdb": null, "pfx": 38, "reg": "2013-06-21", "rir": "afrinic", "s24": 965, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 255488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.004894044624}, {"a": 37678, "h": "BOFINET", "n": "Botswana Fibre Networks", "t": "Broadband & mobile", "w": 1, "cc": "BW", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1315, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-12", 0.210, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.210, "se": 1.235, "ts": 1.000, "map": 1.587, "obs": 1, "own": 2.762, "comp": {"cins": -0.1446, "dshield": -0.3318, "crowdsec": 3.4224, "vulncheck": -0.3376, "blocklist_de": -0.7529}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-BFNL1-AFRINIC", "org": "BOTSWANA FIBRE NETWORKS (Proprietary) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.bofinet.co.bw"}, "pfx": 6, "reg": "2013-07-10", "rir": "afrinic", "s24": 68, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004966913288}, {"a": 37680, "h": "COOL-IDEAS", "n": "Cool Ideas", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0450, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.0962, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.293, 0.010, 0, false], ["2026-10-12", 0.090, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.993, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.090, "se": 1.132, "ts": 1.000, "map": 0.555, "obs": 1, "own": 0.937, "comp": {"cins": -0.2136, "dshield": -0.476, "crowdsec": -1.881, "vulncheck": -0.4344, "blocklist_de": 3.8091}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.205, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-CIC1-AFRINIC", "org": "Cool Ideas Service Provider (Pty) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.coolideas.co.za"}, "pfx": 24, "reg": "2013-07-15", "rir": "afrinic", "s24": 292, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 141056, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00674197328}, {"a": 37682, "h": "TIZETI-AS", "n": "Tizeti Network", "t": "Broadband & mobile", "w": 1, "cc": "NG", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1525, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-12", 0.271, 0.012, 0, false]], "sh": false, "uc": 665.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.271, "se": 1.274, "ts": 1.000, "map": 2.193, "obs": 1, "own": 3.875, "comp": {"cins": -0.1298, "dshield": -0.2997, "crowdsec": 3.5975, "vulncheck": -0.3129, "blocklist_de": -0.6762}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.151, "det": null, "oid": "ORG-TNL2-AFRINIC", "org": "Tizeti Network Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "Open", "web": "https://www.tizeti.com"}, "pfx": 40, "reg": "2013-07-18", "rir": "afrinic", "s24": 44, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044390463686}, {"a": 37684, "h": "ANGANI-AS", "n": "Angani", "t": "Hosting & VPS", "w": 1, "cc": "KE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.338, 0.011, 0, false], ["2026-10-12", 0.435, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.435, "se": 1.360, "ts": 1.000, "map": 4.121, "obs": 1, "own": 0.970, "comp": {"cins": -0.1113, "dshield": -0.2591, "crowdsec": -1.0261, "vulncheck": -0.2798, "blocklist_de": 4.4863}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.508, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"mail": 1}}, "oid": "ORG-AL4-AFRINIC", "org": "Angani Limited", "pdb": {"t": "Content", "sc": "Africa", "tr": null, "pol": "Open", "web": "http://www.angani.co"}, "pfx": 10, "reg": "2013-07-18", "rir": "afrinic", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013213604875}, {"a": 37688, "h": "BCNL1-AS", "n": "BACKBONE CONNECTIVITY NETWORK (NIGERIA) LIMITED", "t": "Other", "w": 2, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 2, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 2.417, 0.011, 0, false], ["2026-10-12", 0.449, 0.012, 0, false]], "sh": false, "uc": 4090.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.449, "se": 1.366, "ts": 1.000, "map": 4.316, "obs": 1, "own": 2.917, "comp": {"cins": -0.0994, "dshield": -0.2325, "crowdsec": 3.9635, "vulncheck": -0.2568, "blocklist_de": -0.5188}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.157, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-BCNL1-AFRINIC", "org": "BACKBONE CONNECTIVITY NETWORK (NIGERIA) LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://bcnnigeria.net"}, "pfx": 17, "reg": "2013-07-25", "rir": "afrinic", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019562026634}, {"a": 37693, "h": "TUNISIANA", "n": "Ooredoo Tunisia", "t": "Broadband & mobile", "w": 14, "cc": "TN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 6, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"crowdsec": {"n": 4, "p": 0.0000, "hi": 0.35, "lo": 0.07, "ips": 7, "mean": 0.19, "above": false}, "phishing_db": {"n": 2, "p": 0.0000, "hi": 1.11, "lo": 0.14, "ips": 2, "mean": 0.53, "above": false}, "blocklist_de": {"n": 7, "p": 0.0000, "hi": 1.17, "lo": 0.35, "ips": 7, "mean": 0.71, "above": false}}, "h2": [["2026-10-05", 0.052, 0.073, 0, false], ["2026-10-12", 0.143, 0.051, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.051, "se": 1.179, "ts": 1.000, "map": 0.199, "obs": 2, "own": 0.673, "comp": {"urlhaus": -0.9382, "threatfox": -0.4619, "phishing_db": 1.4098}, "mass": 3.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.143, "se": 0.480, "ts": 0.636, "map": 0.262, "obs": 11, "own": 0.406, "comp": {"cins": -1.9554, "dshield": -2.5231, "crowdsec": -3.7183, "vulncheck": -0.9357, "blocklist_de": 9.1853}, "mass": 14.0, "listed": false}}, "abq": false, "bot": 0.180, "det": {"blocklist_de": {"bots": 5, "imap": 2, "mail": 2}}, "oid": "ORG-TS4-AFRINIC", "org": "OOREDOO TUNISIE SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.ooredoo.tn"}, "pfx": 353, "reg": "2014-01-30", "rir": "afrinic", "s24": 9592, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4897792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0220611083616}, {"a": 37705, "h": "TOPNET", "n": "TOPNET / tunisia", "t": "Transit & backbone", "w": 27, "cc": "TN", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.78, "lo": 0.10, "ips": 2, "mean": 0.37, "above": false}, "dshield": {"n": 16, "p": 0.9945, "hi": 8.75, "lo": 3.90, "ips": 16, "mean": 6.12, "above": true}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.49, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "blocklist_de": {"n": 10, "p": 0.2048, "hi": 3.75, "lo": 1.36, "ips": 10, "mean": 2.43, "above": false}}, "h2": [["2026-10-05", 0.209, 0.007, 0, false], ["2026-10-12", 0.958, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.748, "ts": null, "map": 0.090, "obs": 0, "own": 0.579, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 16, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.958, "se": 0.409, "ts": 0.593, "map": 1.562, "obs": 27, "own": 4.891, "comp": {"cins": -2.7473, "dshield": 11.3156, "crowdsec": -10.6338, "vulncheck": -0.9755, "blocklist_de": 4.881}, "mass": 28.5, "listed": false}}, "abq": false, "bot": 0.237, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1, "bots": 8, "mail": 1}}, "oid": "ORG-TA40-AFRINIC", "org": "TOPNET", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.topnet.tn"}, "pfx": 101, "reg": "2014-11-20", "rir": "afrinic", "s24": 3293, "sib": 0, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1454080, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.01833739879104}, {"a": 37707, "h": "SEY-IX-PEERING", "n": "SEY-IX Route Servers", "t": "Hosting & VPS", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.937, "det": null, "oid": "ORG-SA66-AFRINIC", "org": "SEYCHELLES INTERNET EXCHANGE POINT ASSOCIATION", "pdb": {"t": "Route Server", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.seyix.sc"}, "pfx": 1, "reg": "2015-01-30", "rir": "afrinic", "s24": 1, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 37963, "h": "ALIBABA-CN-NET", "n": "Alibaba (China)", "t": "Hyperscale cloud", "w": 1518, "cc": "US", "cf": {"rb": "lo", "wb": "lo", "rep": 1.83, "waf": 1.70}, "cs": {"c": {"http_flood": 80, "web_exploit": 762, "bad_crawling": 36, "proxy_or_vpn": 441, "first_seen_30d": 52, "ssh_bruteforce": 571, "web_bruteforce": 145, "mail_bruteforce": 31, "router_or_botnet": 548, "cve:CVE-2017-9841": 20, "cve:CVE-2019-8318": 698, "cve:CVE-2024-6387": 61, "cve:CVE-2018-20062": 14, "cve:CVE-2021-43798": 25}, "n": 1173}, "ev": {"cins": {"n": 100, "p": 1.0000, "hi": 7.13, "lo": 5.14, "ips": 101, "mean": 6.10, "above": true}, "shodan": {"n": 684, "p": 1.0000, "hi": 9.15, "lo": 8.07, "ips": 684, "mean": 8.60, "above": true}, "dshield": {"n": 27, "p": 0.0000, "hi": 1.78, "lo": 0.95, "ips": 27, "mean": 1.34, "above": false}, "urlhaus": {"n": 33, "p": 1.0000, "hi": 10.02, "lo": 5.68, "ips": 33, "mean": 7.72, "above": true}, "crowdsec": {"n": 672, "p": 1.0000, "hi": 7.25, "lo": 6.38, "ips": 1173, "mean": 6.81, "above": true}, "threatfox": {"n": 125, "p": 1.0000, "hi": 21.81, "lo": 16.26, "ips": 125, "mean": 18.95, "above": true}, "vulncheck": {"n": 28, "p": 0.0000, "hi": 1.89, "lo": 1.02, "ips": 28, "mean": 1.43, "above": false}, "phishing_db": {"n": 26, "p": 0.0000, "hi": 1.90, "lo": 1.00, "ips": 26, "mean": 1.42, "above": false}, "blocklist_de": {"n": 87, "p": 0.0006, "hi": 2.57, "lo": 1.81, "ips": 88, "mean": 2.18, "above": false}}, "h2": [["2026-10-05", 2.744, 1.755, 0, false], ["2026-10-12", 2.744, 1.821, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 33, "threatfox": 125, "phishing_db": 26}, "lo": 1.821, "se": 0.782, "ts": 0.679, "map": 3.697, "obs": 184, "own": 2.666, "comp": {"urlhaus": 1.8795, "threatfox": 1.713, "phishing_db": -0.6587}, "mass": 195.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 100, "dshield": 27, "crowdsec": 672, "vulncheck": 28, "blocklist_de": 87}, "lo": 2.744, "se": 0.353, "ts": 0.735, "map": 4.093, "obs": 914, "own": 1.681, "comp": {"cins": 6.6012, "dshield": -2.5766, "crowdsec": 10.083, "vulncheck": -0.8044, "blocklist_de": -10.5005}, "mass": 832.8, "listed": false}}, "abq": true, "bot": 0.941, "det": {"shodan": {"c2": 67, "malware": 18, "compromised": 599}, "threatfox": {"family:VShell": 5, "family:AdaptixC2": 7, "family:VBREVSHELL": 3, "family:Cobalt Strike": 99, "family:Unknown malware": 4}, "vulncheck": {"c2_server": 26, "attack_tooling": 2}, "blocklist_de": {"ftp": 18, "ssh": 68, "imap": 2, "mail": 2}}, "oid": "@aut-45102-APNIC", "org": "Alibaba (US) Technology Co., Ltd.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://alibabagroup.com/"}, "pfx": 726, "reg": "2006-03-08", "rir": "apnic", "s24": 36814, "sib": 13, "tor": 0, "w24": 997, "drop": 0, "hist": [["2026-10-05", 0.9972], ["2026-10-12", 0.9977]], "ipv4": 20428288, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "cins"], "traffic": 0.02435211239422}, {"a": 38001, "h": "NEWMEDIAEXPRESS-AS-AP", "n": "NewMedia Express Pte Ltd", "t": "Transit & backbone", "w": 4, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 3, "proxy_or_vpn": 3, "web_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-41940": 2, "cve:CVE-2026-63030": 2}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1359, "hi": 4.07, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 2, "p": 0.2989, "hi": 5.21, "lo": 0.68, "ips": 3, "mean": 2.48, "above": false}, "blocklist_de": {"n": 1, "p": 0.1647, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.749, 0.011, 0, false], ["2026-10-12", 1.781, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.020, "ts": null, "map": 0.187, "obs": 0, "own": 2.048, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.781, "se": 0.756, "ts": 0.667, "map": 5.386, "obs": 3, "own": 17.154, "comp": {"cins": -0.5149, "dshield": -1.0192, "crowdsec": 3.4178, "vulncheck": -0.6703, "blocklist_de": 1.864}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.875, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-NEPL1-AP-APNIC", "org": "NewMedia Express Pte Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.newmediaexpress.com"}, "pfx": 68, "reg": "2006-04-26", "rir": "apnic", "s24": 78, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": "support@newmediaexpress.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002909009332}, {"a": 38019, "h": "CMNET-V4TIANJIN-AS-AP", "n": "China Mobile Tianjin Province Network", "t": "Broadband & mobile", "w": 8, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 3, "cve:CVE-2024-6387": 2}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.1951, "hi": 4.37, "lo": 0.57, "ips": 3, "mean": 2.08, "above": false}, "crowdsec": {"n": 3, "p": 0.0039, "hi": 2.06, "lo": 0.36, "ips": 3, "mean": 1.06, "above": false}, "blocklist_de": {"n": 4, "p": 0.2417, "hi": 4.33, "lo": 0.93, "ips": 4, "mean": 2.36, "above": false}}, "h2": [["2026-10-05", 1.255, 0.008, 0, false], ["2026-10-12", 0.966, 0.009, 0, false]], "sh": false, "uc": 130, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.834, "ts": null, "map": 0.129, "obs": 0, "own": 0.639, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.966, "se": 0.503, "ts": 0.444, "map": 1.853, "obs": 9, "own": 2.864, "comp": {"cins": 4.8828, "dshield": -2.3156, "crowdsec": -3.5499, "vulncheck": -0.9137, "blocklist_de": 3.9069}, "mass": 10.7, "listed": false}}, "abq": false, "bot": 0.396, "det": {"blocklist_de": {"ssh": 2, "imap": 2, "mail": 2}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 288, "reg": "2006-05-17", "rir": "apnic", "s24": 1040, "sib": 28, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 579840, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00553896546294}, {"a": 38022, "h": "REANNZ-NZ-AP", "n": "REANNZ", "t": "Enterprise, edu & gov", "w": 0, "cc": "NZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1584, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 2.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.190, "obs": 0, "own": 2.645, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.290, "det": {"shodan": {"doublepulsar": 1}}, "oid": null, "org": null, "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.reannz.co.nz"}, "pfx": 13, "reg": "2006-05-19", "rir": "apnic", "s24": 47, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": "noc@reannz.co.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000959634}, {"a": 38031, "h": "OPTIMAX-BD-AS-AP", "n": "OPTIMAX", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3525, "hi": 5.66, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}}, "h2": [["2026-10-12", 1.279, 0.012, 0, false]], "sh": false, "uc": 3878.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 1.658, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.279, "se": 0.932, "ts": 1.000, "map": 5.427, "obs": 2, "own": 8.691, "comp": {"cins": -0.2948, "dshield": -0.6355, "crowdsec": 6.0566, "vulncheck": -0.5207, "blocklist_de": -1.5206}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.382, "det": null, "oid": "ORG-OCL2-AP-APNIC", "org": "OptiMax Communication Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.optimaxbd.net"}, "pfx": 66, "reg": "2006-05-25", "rir": "apnic", "s24": 42, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 34816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38053, "h": "NEESATECH-AS-AP", "n": "Neesa Technologies Pvt. Ltd.", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.966, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-NTPL9-AP-APNIC", "org": "Neesa Technologies Pvt. Ltd.", "pdb": null, "pfx": 4, "reg": "2009-09-18", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38060, "h": "BIZNET-IXP-INA-AP", "n": "BIX Indonesia Route Servers", "t": "Hosting & VPS", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6222, "hi": 7.48, "lo": 1.32, "ips": 3, "mean": 3.86, "above": false}}, "h2": [["2026-10-12", 7.225, 0.012, 0, false]], "sh": false, "uc": 2083.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.225, "se": 0.789, "ts": 1.000, "map": 23.486, "obs": 3, "own": 4.686, "comp": {"cins": -0.4133, "dshield": -0.8502, "crowdsec": 8.5415, "vulncheck": -0.6124, "blocklist_de": -2.1156}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.254, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-PSPN1-AP-APNIC", "org": "BIZNET", "pdb": {"t": "Route Server", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.bix.id"}, "pfx": 14, "reg": "2006-06-13", "rir": "apnic", "s24": 14, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@biznetnetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38074, "h": "SDCC-AS-AP", "n": "SDCC OpenNetwork", "t": "Enterprise, edu & gov", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 4.045, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 8.137, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.360, "det": {"shodan": {"doublepulsar": 1}}, "oid": null, "org": null, "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.sdconw.com/"}, "pfx": 3, "reg": "2021-02-04", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@m.sdconw.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38095, "h": "SKB-QRIXNETSDM-AS-KR", "n": "SK Broadband Co Ltd", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1637, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "shodan": {"n": 1, "p": 0.0715, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.115, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.958, "ts": null, "map": 0.174, "obs": 0, "own": 1.109, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.115, "se": 1.160, "ts": 1.000, "map": 0.746, "obs": 1, "own": 1.272, "comp": {"cins": 4.7967, "dshield": -0.4508, "crowdsec": -1.7822, "vulncheck": -0.419, "blocklist_de": -1.0441}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"compromised": 1}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": null, "pfx": 12, "reg": "2006-07-07", "rir": "apnic", "s24": 204, "sib": 23, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 75520, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003626381248}, {"a": 38109, "h": "SKB-TCNINTERNET-AS-KR", "n": "SK Broadband Co Ltd", "t": "Broadband & mobile", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0631, "hi": 3.16, "lo": 0.41, "ips": 2, "mean": 1.51, "above": false}, "blocklist_de": {"n": 2, "p": 0.2104, "hi": 4.50, "lo": 0.58, "ips": 2, "mean": 2.14, "above": false}}, "h2": [["2026-10-05", 0.690, 0.010, 0, false], ["2026-10-12", 0.739, 0.010, 0, false]], "sh": false, "uc": 282.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.160, "obs": 0, "own": 0.917, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.739, "se": 0.653, "ts": 0.500, "map": 1.849, "obs": 4, "own": 2.884, "comp": {"cins": -0.7872, "dshield": -1.4153, "crowdsec": 0.7119, "vulncheck": -0.7733, "blocklist_de": 4.2724}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.155, "det": {"blocklist_de": {"mail": 2}}, "oid": "@family-49552", "org": "SK Broadband Co Ltd", "pdb": null, "pfx": 7, "reg": "2006-07-07", "rir": "apnic", "s24": 373, "sib": 23, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 99328, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005439571872}, {"a": 38136, "h": "AKARI-NETWORKS-AS-AP", "n": "Akari Networks Limited", "t": "Other", "w": 7, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "dshield": {"n": 3, "p": 0.6070, "hi": 7.32, "lo": 1.29, "ips": 3, "mean": 3.77, "above": false}, "urlhaus": {"n": 1, "p": 0.1946, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1004, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "phishing_db": {"n": 1, "p": 0.1761, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.3481, "hi": 5.63, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}}, "h2": [["2026-10-05", 1.222, 0.278, 0, false], ["2026-10-12", 5.175, 1.874, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 1.874, "se": 1.182, "ts": 0.500, "map": 9.157, "obs": 2, "own": 9.396, "comp": {"urlhaus": 3.1925, "threatfox": -0.3865, "phishing_db": 1.0346}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.175, "se": 0.543, "ts": 0.429, "map": 10.566, "obs": 7, "own": 5.966, "comp": {"cins": 2.6474, "dshield": 5.5635, "crowdsec": -4.9178, "vulncheck": -0.8579, "blocklist_de": 1.3162}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.378, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-ANL13-AP-APNIC", "org": "Akari Networks Limited", "pdb": {"t": null, "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://akari.hk"}, "pfx": 96, "reg": "2021-02-15", "rir": "apnic", "s24": 111, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38656, "abuse": "abuse+apnic@akari.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03973309359595}, {"a": 38149, "h": "RATELINDONET-AS-ID", "n": "BakrieTelecom", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.354, "det": null, "oid": "@aut-38149-APNIC", "org": "PT. Bakrie Telecom", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": null}, "pfx": 2, "reg": "2006-07-12", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38186, "h": "FTG-AS-AP", "n": "Forewin Telecom Group Limited", "t": "Broadband & mobile", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 12, "p": 0.9989, "hi": 12.55, "lo": 4.96, "ips": 12, "mean": 8.39, "above": true}, "crowdsec": {"n": 1, "p": 0.0388, "hi": 2.82, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.085, 0.010, 0, false], ["2026-10-12", 0.092, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 1.034, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.092, "se": 1.133, "ts": 1.000, "map": 0.567, "obs": 1, "own": 0.956, "comp": {"cins": -0.1932, "dshield": -0.4343, "crowdsec": 2.8656, "vulncheck": -0.4085, "blocklist_de": -1.0028}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.430, "det": {"shodan": {"compromised": 12}}, "oid": "ORG-FTGL1-AP-APNIC", "org": "Forewin Telecom Group Limited", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.hkt.cc"}, "pfx": 257, "reg": "2006-07-26", "rir": "apnic", "s24": 257, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 65792, "abuse": "abuse@hkt.cc", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0003301561328}, {"a": 38193, "h": "TWA-AS-AP", "n": "Trans World Associates", "t": "Transit & backbone", "w": 2, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2758, "hi": 5.03, "lo": 0.65, "ips": 2, "mean": 2.40, "above": false}}, "h2": [["2026-10-12", 0.679, 0.012, 0, false]], "sh": false, "uc": 225.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 1.949, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.679, "se": 0.900, "ts": 1.000, "map": 2.684, "obs": 2, "own": 8.705, "comp": {"cins": -0.3273, "dshield": -0.6962, "crowdsec": 5.6377, "vulncheck": -0.5491, "blocklist_de": -1.6842}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.108, "det": null, "oid": "ORG-TAL1-AP-APNIC", "org": "TRANS WORLD ASSOCIATES (PVT) LIMITED", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.tw1.com"}, "pfx": 97, "reg": "2006-08-02", "rir": "apnic", "s24": 95, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 28160, "abuse": "abuse@tw1.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00212453795411}, {"a": 38195, "h": "SUPERLOOP-AS-AP", "n": "Superloop", "t": "Transit & backbone", "w": 5, "cc": "AU", "cf": {"rb": "hi", "wb": "hi", "rep": 1.02, "waf": 0.89}, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0922, "hi": 3.57, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}, "dshield": {"n": 1, "p": 0.0739, "hi": 3.34, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "phishing_db": {"n": 3, "p": 0.4054, "hi": 5.61, "lo": 0.99, "ips": 3, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 0.200, 0.543, 0, false], ["2026-10-12", 0.133, 0.555, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.555, "se": 1.029, "ts": 1.000, "map": 1.838, "obs": 3, "own": 7.055, "comp": {"urlhaus": -0.7624, "threatfox": -0.4306, "phishing_db": 3.4278}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.133, "se": 0.839, "ts": 0.500, "map": 0.467, "obs": 2, "own": 1.514, "comp": {"cins": 4.2466, "dshield": 2.97, "crowdsec": -3.6242, "vulncheck": -0.6378, "blocklist_de": -2.3216}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.151, "det": null, "oid": "ORG-SPL2-AP-APNIC", "org": "SUPERLOOP (AUSTRALIA) PTY LTD", "pdb": {"t": "NSP", "sc": "Australia", "tr": null, "pol": "Selective", "web": "http://www.superloop.com/"}, "pfx": 149, "reg": "2006-08-09", "rir": "apnic", "s24": 782, "sib": 26, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 215808, "abuse": "abuse@superloop.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.071805}, {"a": 38200, "h": "BTSNET-AS-BD-AP", "n": "BTS Communications", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1943, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.331, 0.012, 0, false]], "sh": false, "uc": 1041.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.331, "se": 1.323, "ts": 1.000, "map": 2.835, "obs": 1, "own": 5.323, "comp": {"cins": -0.081, "dshield": -0.191, "crowdsec": -0.7569, "vulncheck": 3.888, "blocklist_de": -0.4233}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.198, "det": {"vulncheck": {"c2_server": 1}}, "oid": "ORG-BCL4-AP-APNIC", "org": "BTS Communications (BD) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.mirnet.com.bd"}, "pfx": 21, "reg": "2006-08-14", "rir": "apnic", "s24": 21, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002395597875}, {"a": 38203, "h": "ADNTELECOMLTD-BD", "n": "ADN Telecom Ltd.", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1408, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-12", 0.233, 0.012, 0, false]], "sh": false, "uc": 349.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 1.551, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.233, "se": 1.251, "ts": 1.000, "map": 1.811, "obs": 1, "own": 3.170, "comp": {"cins": -0.1385, "dshield": -0.3187, "crowdsec": 3.4939, "vulncheck": -0.3277, "blocklist_de": -0.7215}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.232, "det": null, "oid": "ORG-ATL2-AP-APNIC", "org": "ADN Telecom Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.adnsl.net"}, "pfx": 67, "reg": "2006-08-17", "rir": "apnic", "s24": 57, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 28160, "abuse": "abuse@adnsl.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00337141055026}, {"a": 38209, "h": "CAMINTEL-AS", "n": "Camintel", "t": "Other", "w": 2, "cc": "KH", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1722, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 2, "p": 0.3718, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 5.934, 0.011, 0, false], ["2026-10-12", 4.060, 0.012, 0, false]], "sh": false, "uc": 4244.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.715, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.060, "se": 0.775, "ts": 0.667, "map": 12.737, "obs": 3, "own": 7.305, "comp": {"cins": -0.4732, "dshield": -0.9514, "crowdsec": 3.8825, "vulncheck": -0.6484, "blocklist_de": 2.1286}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.126, "det": {"shodan": {"c2": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CS7-AP-APNIC", "org": "Camintel S.A", "pdb": {"t": null, "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.camintel.com"}, "pfx": 29, "reg": "2006-08-30", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007721970744}, {"a": 38210, "h": "RANKSTEL-AS-BD", "n": "Ranks Telecom Limited", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3027.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.172, "det": null, "oid": "ORG-RTL2-AP-APNIC", "org": "Ranks Telecom Ltd.", "pdb": null, "pfx": 8, "reg": "2006-08-30", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@rankstelecom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050941154716}, {"a": 38235, "h": "MEKONGNET-ADC-AS-AP", "n": "MekongNet", "t": "Broadband & mobile", "w": 4, "cc": "KH", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2011-3600": 1, "cve:CVE-2016-15043": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2017-1000170": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0793, "hi": 3.41, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "dshield": {"n": 1, "p": 0.1589, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 3, "p": 0.3479, "hi": 5.21, "lo": 0.92, "ips": 3, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 1.683, 0.010, 0, false], ["2026-10-12", 1.227, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 1.143, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.227, "se": 0.656, "ts": 0.750, "map": 3.098, "obs": 4, "own": 4.821, "comp": {"cins": -0.671, "dshield": 2.1465, "crowdsec": 5.1654, "vulncheck": -0.7363, "blocklist_de": -3.3802}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.110, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ADC1-AP-APNIC", "org": "ANGKOR DATA COMMUNICATION GROUP CO., LTD. (A D C)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.mekongnet.com.kh"}, "pfx": 218, "reg": "2006-09-29", "rir": "apnic", "s24": 184, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 100096, "abuse": "abuse@corp.mekongnet.com.kh", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01334253763832}, {"a": 38244, "h": "VINAGAME-AS-VN", "n": "VNG Corporation", "t": "Hosting & VPS", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.6439, "hi": 7.00, "lo": 1.51, "ips": 4, "mean": 3.82, "above": false}, "crowdsec": {"n": 1, "p": 0.0813, "hi": 3.43, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "phishing_db": {"n": 1, "p": 0.1698, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.461, 0.983, 0, false], ["2026-10-12", 0.133, 0.259, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.259, "se": 1.440, "ts": 1.000, "map": 2.070, "obs": 1, "own": 0.934, "comp": {"urlhaus": -0.1947, "threatfox": -0.2096, "phishing_db": 2.7582}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.133, "se": 1.175, "ts": 1.000, "map": 0.894, "obs": 1, "own": 0.194, "comp": {"cins": -0.1715, "dshield": -0.3889, "crowdsec": 3.1118, "vulncheck": -0.3785, "blocklist_de": -0.8912}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.881, "det": {"shodan": {"c2": 1, "compromised": 3}}, "oid": "@aut-38244-APNIC", "org": "VNG Corporation", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://vng.com.vn"}, "pfx": 125, "reg": "2006-10-04", "rir": "apnic", "s24": 144, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 84992, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024722849312}, {"a": 38253, "h": "HANOITELECOM-AS-VN", "n": "Hanoi Telecom JSC", "t": "Broadband & mobile", "w": 3, "cc": "VN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"shodan": {"n": 3, "p": 0.6286, "hi": 7.54, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}, "crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 3, "mean": 2.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 13.129, 0.011, 1, false], ["2026-10-12", 8.309, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 8.309, "se": 0.794, "ts": 0.667, "map": 26.951, "obs": 3, "own": 42.244, "comp": {"cins": -0.4377, "dshield": -0.892, "crowdsec": 4.2903, "vulncheck": -0.6278, "blocklist_de": 2.3549}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.854, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-38253-APNIC", "org": "Hanoi Telecom JSC", "pdb": null, "pfx": 15, "reg": "2006-10-04", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003718790586}, {"a": 38264, "h": "WATEEN-IMS-PK-AS-AP", "n": "Wateen Telecom", "t": "Broadband & mobile", "w": 22, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 7, "ssh_bruteforce": 7, "web_bruteforce": 10, "home_connection": 10, "mail_bruteforce": 6, "router_or_botnet": 7, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 15}, "ev": {"shodan": {"n": 3, "p": 0.0638, "hi": 3.15, "lo": 0.56, "ips": 3, "mean": 1.63, "above": false}, "dshield": {"n": 2, "p": 0.2228, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}, "crowdsec": {"n": 12, "p": 0.9118, "hi": 6.90, "lo": 2.73, "ips": 15, "mean": 4.61, "above": true}, "blocklist_de": {"n": 8, "p": 0.9181, "hi": 8.33, "lo": 2.71, "ips": 8, "mean": 5.19, "above": true}}, "h2": [["2026-10-05", 1.643, 0.009, 0, false], ["2026-10-12", 3.461, 0.010, 0, false]], "sh": false, "uc": 251.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.867, "ts": null, "map": 0.143, "obs": 0, "own": 0.745, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 8}, "lo": 3.461, "se": 0.417, "ts": 0.545, "map": 5.757, "obs": 22, "own": 8.844, "comp": {"cins": -2.457, "dshield": -0.6096, "crowdsec": 2.0342, "vulncheck": -0.9635, "blocklist_de": 5.14}, "mass": 21.8, "listed": false}}, "abq": true, "bot": 0.128, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1, "bots": 3, "imap": 2, "mail": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-WTL1-AP-APNIC", "org": "Wateen Telecom Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.wateen.com"}, "pfx": 263, "reg": "2006-10-17", "rir": "apnic", "s24": 684, "sib": 1, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 183808, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00868365375229}, {"a": 38266, "h": "VIL-AS-AP", "n": "Vodafone Idea", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 0.60, "waf": 0.49}, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.1496, "hi": 3.78, "lo": 0.81, "ips": 4, "mean": 2.06, "above": false}, "blocklist_de": {"n": 4, "p": 0.0109, "hi": 2.39, "lo": 0.51, "ips": 4, "mean": 1.31, "above": false}}, "h2": [["2026-10-05", 0.331, 0.007, 0, false], ["2026-10-12", 0.315, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.764, "ts": null, "map": 0.097, "obs": 0, "own": 0.445, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.315, "se": 0.517, "ts": 0.500, "map": 0.611, "obs": 8, "own": 0.949, "comp": {"cins": -1.49, "dshield": 6.1282, "crowdsec": -8.4346, "vulncheck": -0.8961, "blocklist_de": 5.5941}, "mass": 9.0, "listed": false}}, "abq": true, "bot": 0.091, "det": {"blocklist_de": {"bots": 3, "imap": 1, "mail": 1}}, "oid": "ORG-VIL2-AP-APNIC", "org": "Vodafone Idea Ltd. (VIL)", "pdb": null, "pfx": 767, "reg": "2006-10-17", "rir": "apnic", "s24": 2639, "sib": 6, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1091328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.202523}, {"a": 38283, "h": "CHINANET-SCIDC-AS-AP", "n": "CHINANET SiChuan Telecom Internet Data Center", "t": "Hosting & VPS", "w": 21, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 15, "web_bruteforce": 2, "mail_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 9, "cve:CVE-2024-6587": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-43798": 2}, "n": 18}, "ev": {"cins": {"n": 1, "p": 0.0776, "hi": 3.38, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "shodan": {"n": 19, "p": 0.9988, "hi": 9.19, "lo": 4.37, "ips": 19, "mean": 6.59, "above": true}, "crowdsec": {"n": 17, "p": 0.9765, "hi": 7.22, "lo": 3.30, "ips": 18, "mean": 5.10, "above": true}, "threatfox": {"n": 1, "p": 0.1426, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "blocklist_de": {"n": 7, "p": 0.7356, "hi": 6.51, "lo": 1.97, "ips": 8, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 3.157, 0.090, 0, false], ["2026-10-12", 2.837, 0.094, 0, false]], "sh": false, "uc": 136.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.094, "se": 1.356, "ts": 1.000, "map": 0.580, "obs": 1, "own": 0.283, "comp": {"urlhaus": -0.3432, "threatfox": 1.992, "phishing_db": -0.5668}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 7}, "lo": 2.837, "se": 0.411, "ts": 0.680, "map": 4.645, "obs": 25, "own": 0.910, "comp": {"cins": -0.3758, "dshield": -2.8946, "crowdsec": 5.5565, "vulncheck": -0.9691, "blocklist_de": 1.6124}, "mass": 24.5, "listed": false}}, "abq": true, "bot": 0.822, "det": {"shodan": {"compromised": 19}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 1, "ssh": 5, "imap": 1, "mail": 2}}, "oid": "@aut-38283-APNIC", "org": "CHINANET SiChuan Telecom Internet Data Center", "pdb": null, "pfx": 525, "reg": "2006-11-14", "rir": "apnic", "s24": 952, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.0690]], "ipv4": 350976, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00087666292818}, {"a": 38320, "h": "MMS-AS-ID", "n": "Maxindo Mitra Solusi", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1035, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "crowdsec": {"n": 3, "p": 0.4233, "hi": 5.74, "lo": 1.01, "ips": 3, "mean": 2.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1441, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 1.650, 0.010, 0, false], ["2026-10-12", 1.771, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 1.256, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.771, "se": 0.661, "ts": 0.750, "map": 4.498, "obs": 4, "own": 7.001, "comp": {"cins": -0.6946, "dshield": -1.289, "crowdsec": 4.8875, "vulncheck": -0.7445, "blocklist_de": 0.7379}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.345, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "@family-34098", "org": "PT Maxindo Mitra Solusi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.maxindo.net.id"}, "pfx": 160, "reg": "2006-12-29", "rir": "apnic", "s24": 132, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 57856, "abuse": "abuse@maxindo.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0018883791982}, {"a": 38333, "h": "SYMBIO-AS-AU-AP", "n": "Symbio Networks", "t": "Broadband & mobile", "w": 1, "cc": "AU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0023, "hi": 1.72, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}}, "h2": [["2026-10-05", 0.141, 0.009, 0, false], ["2026-10-12", 0.048, 0.010, 0, false]], "sh": false, "uc": 79.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.869, "ts": null, "map": 0.144, "obs": 0, "own": 0.753, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.048, "se": 1.072, "ts": 1.000, "map": 0.264, "obs": 1, "own": 0.439, "comp": {"cins": -0.2306, "dshield": -0.5103, "crowdsec": 2.4529, "vulncheck": -0.4546, "blocklist_de": -1.1941}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.191, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SNPL1-AP-APNIC", "org": "Symbio Networks Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://symbio.global"}, "pfx": 143, "reg": "2007-01-24", "rir": "apnic", "s24": 664, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 359936, "abuse": "abuse@symbionetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022072632446}, {"a": 38365, "h": "Baidu", "n": "Baidu Netcom Science and Technology Co., Ltd.", "t": "Hyperscale cloud", "w": 263, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 17, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 14, "ssh_bruteforce": 211, "web_bruteforce": 13, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2017-9841": 10, "cve:CVE-2019-9082": 9, "cve:CVE-2024-6387": 174, "cve:CVE-2018-20062": 10, "cve:CVE-2021-41773": 5}, "n": 218}, "ev": {"cins": {"n": 10, "p": 0.9912, "hi": 10.87, "lo": 3.95, "ips": 10, "mean": 7.05, "above": true}, "shodan": {"n": 138, "p": 1.0000, "hi": 41.45, "lo": 31.34, "ips": 138, "mean": 36.24, "above": true}, "dshield": {"n": 1, "p": 0.0357, "hi": 2.76, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}, "urlhaus": {"n": 2, "p": 0.3459, "hi": 5.61, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}, "crowdsec": {"n": 178, "p": 1.0000, "hi": 44.52, "lo": 34.81, "ips": 218, "mean": 39.54, "above": true}, "threatfox": {"n": 12, "p": 0.9999, "hi": 16.15, "lo": 6.39, "ips": 12, "mean": 10.80, "above": true}, "vulncheck": {"n": 2, "p": 0.1174, "hi": 3.71, "lo": 0.48, "ips": 2, "mean": 1.77, "above": false}, "phishing_db": {"n": 5, "p": 0.6256, "hi": 6.38, "lo": 1.59, "ips": 5, "mean": 3.64, "above": false}, "blocklist_de": {"n": 116, "p": 1.0000, "hi": 55.88, "lo": 41.20, "ips": 135, "mean": 48.31, "above": true}}, "h2": [["2026-10-05", 26.917, 3.054, 2, false], ["2026-10-12", 29.595, 3.211, 2, false]], "sh": false, "uc": 95.9, "v2": {"band": 2, "host": {"n": {"urlhaus": 2, "threatfox": 12, "phishing_db": 5}, "lo": 3.211, "se": 0.804, "ts": 0.632, "map": 7.173, "obs": 19, "own": 4.956, "comp": {"urlhaus": 0.8448, "threatfox": 2.4423, "phishing_db": 0.3093}, "mass": 13.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 10, "dshield": 1, "crowdsec": 178, "vulncheck": 2, "blocklist_de": 116}, "lo": 29.595, "se": 0.347, "ts": 0.580, "map": 42.994, "obs": 307, "own": 17.545, "comp": {"cins": -1.4289, "dshield": -3.427, "crowdsec": 2.9023, "vulncheck": -0.9731, "blocklist_de": 8.0815}, "mass": 313.4, "listed": true}}, "abq": false, "bot": 0.968, "det": {"shodan": {"c2": 5, "malware": 2, "compromised": 131}, "threatfox": {"family:Sliver": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 10}, "vulncheck": {"c2_server": 1, "other_infrastructure": 1}, "blocklist_de": {"ftp": 4, "ssh": 130, "imap": 1, "mail": 1}}, "oid": "@aut-55967-APNIC", "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.baidu.com"}, "pfx": 118, "reg": "2007-01-25", "rir": "apnic", "s24": 1327, "sib": 9, "tor": 0, "w24": 211, "drop": 0, "hist": [["2026-10-05", 0.9972], ["2026-10-12", 0.9977]], "ipv4": 612864, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.00058457620078}, {"a": 38466, "h": "UMOBILE-AS-AP", "n": "U Mobile", "t": "Broadband & mobile", "w": 10, "cc": "MY", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.3691, "hi": 5.81, "lo": 0.75, "ips": 3, "mean": 2.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1357, "hi": 4.06, "lo": 0.30, "ips": 7, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.481, 0.010, 0, false], ["2026-10-12", 0.977, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.199, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.977, "se": 0.743, "ts": 0.667, "map": 2.896, "obs": 3, "own": 4.542, "comp": {"cins": -0.549, "dshield": 6.2632, "crowdsec": -4.2187, "vulncheck": -0.6868, "blocklist_de": 1.6484}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.099, "det": {"blocklist_de": {"bots": 7}}, "oid": "ORG-UMSB1-AP-APNIC", "org": "U Mobile Sdn Bhd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.u.com.my/"}, "pfx": 61, "reg": "2007-02-27", "rir": "apnic", "s24": 156, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54784, "abuse": "abuse@u.com.my", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04588208248827}, {"a": 38482, "h": "BIZNET2-AS-ID", "n": "Biznet ISP", "t": "Other", "w": 7, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.1508, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 5, "p": 0.8636, "hi": 9.13, "lo": 2.27, "ips": 6, "mean": 5.21, "above": true}, "blocklist_de": {"n": 2, "p": 0.3834, "hi": 5.93, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 6.484, 0.011, 0, false], ["2026-10-12", 8.886, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 0.625, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.886, "se": 0.543, "ts": 0.714, "map": 18.336, "obs": 7, "own": 10.335, "comp": {"cins": -1.0935, "dshield": -1.7822, "crowdsec": 6.0003, "vulncheck": -0.8418, "blocklist_de": 2.0197}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.345, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-PSPN1-AP-APNIC", "org": "BIZNET", "pdb": null, "pfx": 57, "reg": "2007-03-16", "rir": "apnic", "s24": 57, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": "abuse@biznetnetworks.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0007298178712}, {"a": 38493, "h": "ROYALGREENINCBD-TRANSIT-AS-AP", "n": "Royal Green Online", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.463, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 1.249, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.205, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RGOL1-AP-APNIC", "org": "Royal Green Communication Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.pacenet.net"}, "pfx": 16, "reg": "2007-03-26", "rir": "apnic", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@royalgreen.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034250370976}, {"a": 38511, "h": "TACHYON-AS-ID", "n": "Remala Abadi", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": {"rb": "lo", "wb": null, "rep": 1.61, "waf": null}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 3, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"shodan": {"n": 3, "p": 0.2733, "hi": 4.71, "lo": 0.83, "ips": 3, "mean": 2.43, "above": false}, "crowdsec": {"n": 3, "p": 0.2114, "hi": 4.29, "lo": 0.76, "ips": 3, "mean": 2.22, "above": false}}, "h2": [["2026-10-05", 0.256, 0.010, 0, false], ["2026-10-12", 0.510, 0.011, 0, false]], "sh": false, "uc": 149.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.929, "ts": null, "map": 0.165, "obs": 0, "own": 0.981, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.510, "se": 0.729, "ts": 1.000, "map": 1.464, "obs": 3, "own": 2.295, "comp": {"cins": -0.54, "dshield": -1.0591, "crowdsec": 6.7986, "vulncheck": -0.6826, "blocklist_de": -2.7425}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.224, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 1}}, "oid": "@aut-38511-APNIC", "org": "PT Remala Abadi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://tachyon.net.id"}, "pfx": 507, "reg": "2007-03-28", "rir": "apnic", "s24": 303, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 462848, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0097967954348}, {"a": 38513, "h": "LINTASARTA-AS-ID", "n": "Cloudeka", "t": "Hosting & VPS", "w": 23, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 8, "ssh_bruteforce": 4, "web_bruteforce": 19, "mail_bruteforce": 19, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 5}, "n": 23}, "ev": {"shodan": {"n": 4, "p": 0.7717, "hi": 8.45, "lo": 1.82, "ips": 4, "mean": 4.62, "above": false}, "crowdsec": {"n": 9, "p": 0.9978, "hi": 14.23, "lo": 4.92, "ips": 23, "mean": 9.06, "above": true}, "blocklist_de": {"n": 3, "p": 0.6192, "hi": 7.44, "lo": 1.31, "ips": 4, "mean": 3.84, "above": false}}, "h2": [["2026-10-05", 23.565, 0.011, 1, false], ["2026-10-12", 25.299, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.260, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 3}, "lo": 25.299, "se": 0.465, "ts": 0.750, "map": 45.852, "obs": 12, "own": 8.950, "comp": {"cins": -1.5938, "dshield": -2.2535, "crowdsec": 8.4045, "vulncheck": -0.9066, "blocklist_de": 1.5685}, "mass": 9.9, "listed": false}}, "abq": false, "bot": 0.790, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 4}}, "oid": "@aut-38513-APNIC", "org": "PT Aplikanusa Lintasarta", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://cloudeka.id"}, "pfx": 34, "reg": "2007-03-28", "rir": "apnic", "s24": 39, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 38527, "h": "MLINK-AS-ID", "n": "Medialink", "t": "Transit & backbone", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 140.209, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.494, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-38527-APNIC", "org": "JAWA POS NATIONAL NETWORK MEDIALINK, PT", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://medialink.net.id"}, "pfx": 4, "reg": "2007-03-28", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@medialink.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38532, "h": "EXABYTES-AS-AP", "n": "Exabytes Network Singapore", "t": "Hosting & VPS", "w": 5, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 2, "p": 0.3278, "hi": 5.45, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}, "phishing_db": {"n": 2, "p": 0.4044, "hi": 6.12, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 2.031, 1.915, 0, false], ["2026-10-12", 2.338, 1.950, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.950, "se": 1.157, "ts": 1.000, "map": 9.218, "obs": 2, "own": 3.536, "comp": {"urlhaus": -0.3332, "threatfox": -0.2938, "phishing_db": 4.4744}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.338, "se": 0.763, "ts": 0.667, "map": 7.138, "obs": 3, "own": 1.428, "comp": {"cins": 4.1304, "dshield": -1.0086, "crowdsec": 3.4906, "vulncheck": -0.667, "blocklist_de": -2.5863}, "mass": 2.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ENPL3-AP-APNIC", "org": "Exabytes Network (Singapore) Pte. Ltd.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.exabytes.sg"}, "pfx": 17, "reg": "2007-03-30", "rir": "apnic", "s24": 58, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": "abuse@exabytes.sg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013862406376}, {"a": 38547, "h": "WITRIBE-AS-AP", "n": "WITRIBE PAKISTAN LIMITED", "t": "Broadband & mobile", "w": 0, "cc": "PK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.983, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WPL15-AP-APNIC", "org": "Wi-Tribe Pakistan Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://wi-tribe.pk"}, "pfx": 5, "reg": "2007-04-23", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38553, "h": "DCTECHMSI-AS-AP", "n": "DctecH Microservices Incorporated", "t": "Broadband & mobile", "w": 1, "cc": "PH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.289, 0.011, 0, false], ["2026-10-12", 0.308, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 1.721, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.308, "se": 1.295, "ts": 1.000, "map": 2.591, "obs": 1, "own": 4.620, "comp": {"cins": -0.1222, "dshield": -0.2831, "crowdsec": 3.6878, "vulncheck": -0.2996, "blocklist_de": -0.637}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.108, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-DMS1-AP-APNIC", "org": "DC Tech Micro Services Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.dctechmicro.com"}, "pfx": 35, "reg": "2007-04-26", "rir": "apnic", "s24": 35, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "noc@dctechmicro.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00163378114078}, {"a": 38562, "h": "IOLBD-AS", "n": "Innovative Online", "t": "Other", "w": 7, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 3, "web_bruteforce": 5, "router_or_botnet": 5, "cve:CVE-2024-6387": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1967, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6240, "hi": 7.49, "lo": 1.32, "ips": 5, "mean": 3.87, "above": false}, "vulncheck": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.228, 0.011, 0, false], ["2026-10-12", 17.928, 0.012, 1, false]], "sh": false, "uc": 4777.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 0}, "lo": 17.928, "se": 0.638, "ts": 0.600, "map": 43.339, "obs": 5, "own": 24.704, "comp": {"cins": 3.7916, "dshield": -1.2461, "crowdsec": 5.244, "vulncheck": 0.7215, "blocklist_de": -3.3483}, "mass": 3.2, "listed": false}}, "abq": true, "bot": 0.197, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-IOL1-AP-APNIC", "org": "Innovative Online Ltd.", "pdb": null, "pfx": 13, "reg": "2007-05-09", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00186309566808}, {"a": 38565, "h": "NCELL-AS-NP", "n": "Ncell Axiata Limited", "t": "Transit & backbone", "w": 4, "cc": "NP", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0138, "hi": 2.36, "lo": 0.31, "ips": 2, "mean": 1.13, "above": false}, "dshield": {"n": 1, "p": 0.0741, "hi": 3.34, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "crowdsec": {"n": 1, "p": 0.0010, "hi": 1.54, "lo": 0.12, "ips": 1, "mean": 0.65, "above": false}, "blocklist_de": {"n": 2, "p": 0.0879, "hi": 3.43, "lo": 0.45, "ips": 2, "mean": 1.63, "above": false}}, "h2": [["2026-10-05", 0.042, 0.009, 0, false], ["2026-10-12", 0.379, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.856, "ts": null, "map": 0.139, "obs": 0, "own": 1.011, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.379, "se": 0.646, "ts": 0.500, "map": 0.937, "obs": 4, "own": 2.971, "comp": {"cins": -0.8252, "dshield": 1.6317, "crowdsec": -2.6824, "vulncheck": -0.7838, "blocklist_de": 3.9881}, "mass": 4.1, "listed": false}}, "abq": true, "bot": 0.125, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-NPL10-AP-APNIC", "org": "Ncell Pty. Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.ncell.com.np"}, "pfx": 66, "reg": "2007-05-15", "rir": "apnic", "s24": 780, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 805120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00772452977436}, {"a": 38623, "h": "VIETTELCAMBODIA-AS-AP", "n": "Viettel (Cambodia) Pte. Ltd.", "t": "Broadband & mobile", "w": 24, "cc": "KH", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "proxy_or_vpn": 4, "ssh_bruteforce": 7, "web_bruteforce": 7, "home_connection": 6, "mail_bruteforce": 8, "router_or_botnet": 5, "cve:CVE-2017-9841": 1, "cve:CVE-2022-22965": 1, "cve:CVE-2024-28000": 1}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.3338, "hi": 5.51, "lo": 0.72, "ips": 2, "mean": 2.62, "above": false}, "dshield": {"n": 3, "p": 0.5258, "hi": 6.55, "lo": 1.15, "ips": 3, "mean": 3.38, "above": false}, "urlhaus": {"n": 1, "p": 0.1855, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 11, "p": 0.9857, "hi": 9.56, "lo": 3.64, "ips": 14, "mean": 6.30, "above": true}, "vulncheck": {"n": 1, "p": 0.1322, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 5, "p": 0.7704, "hi": 7.71, "lo": 1.92, "ips": 5, "mean": 4.40, "above": false}}, "h2": [["2026-10-05", 4.949, 0.010, 0, false], ["2026-10-12", 6.658, 0.273, 0, false]], "sh": false, "uc": 1791.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.273, "se": 1.455, "ts": 1.000, "map": 2.289, "obs": 1, "own": 6.598, "comp": {"urlhaus": 3.475, "threatfox": -0.349, "phishing_db": -0.6718}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 11, "vulncheck": 1, "blocklist_de": 5}, "lo": 6.658, "se": 0.418, "ts": 0.500, "map": 10.928, "obs": 22, "own": 16.767, "comp": {"cins": 2.4738, "dshield": 0.6898, "crowdsec": 1.6447, "vulncheck": -0.6717, "blocklist_de": -0.3516}, "mass": 20.5, "listed": false}}, "abq": true, "bot": 0.139, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 3, "mail": 4}}, "oid": "ORG-VPL4-AP-APNIC", "org": "VIETTEL (CAMBODIA) PTE., LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://metfone.com.kh/en"}, "pfx": 556, "reg": "2007-08-06", "rir": "apnic", "s24": 340, "sib": 0, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 398592, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0320159974619}, {"a": 38631, "h": "LINE", "n": "LINE Corporation", "t": "Hosting & VPS", "w": 11, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 8, "home_connection": 3, "cve:CVE-2023-42793": 1}, "n": 11}, "ev": {"crowdsec": {"n": 1, "p": 0.0126, "hi": 2.23, "lo": 0.17, "ips": 11, "mean": 0.94, "above": false}}, "h2": [["2026-10-05", 0.064, 0.009, 0, false], ["2026-10-12", 0.066, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 0.136, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.066, "se": 1.100, "ts": 1.000, "map": 0.381, "obs": 1, "own": 0.081, "comp": {"cins": -0.2126, "dshield": -0.4739, "crowdsec": 2.6502, "vulncheck": -0.4332, "blocklist_de": -1.102}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.892, "det": null, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.lycorp.co.jp/"}, "pfx": 149, "reg": "2007-08-20", "rir": "apnic", "s24": 423, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 143104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00102932651315}, {"a": 38661, "h": "HCLC-AS-KR", "n": "abcle", "t": "Other", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0005, "hi": 1.56, "lo": 0.20, "ips": 2, "mean": 0.75, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.00, "lo": 0.07, "ips": 1, "mean": 0.42, "above": false}}, "h2": [["2026-10-05", 0.028, 0.008, 0, false], ["2026-10-12", 0.028, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.810, "ts": null, "map": 0.119, "obs": 0, "own": 0.229, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.028, "se": 1.029, "ts": 1.000, "map": 0.142, "obs": 1, "own": 0.086, "comp": {"cins": -0.2619, "dshield": -0.5722, "crowdsec": 2.1173, "vulncheck": -0.4887, "blocklist_de": -1.3536}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.515, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-38661-APNIC", "org": "abcle", "pdb": null, "pfx": 113, "reg": "2007-08-24", "rir": "apnic", "s24": 1416, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 387072, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002823828826}, {"a": 38676, "h": "FLEXNET-AS-KR", "n": "flexnetworks", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0415, "hi": 2.86, "lo": 0.21, "ips": 1, "mean": 1.21, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.928, "ts": null, "map": 0.165, "obs": 0, "own": 0.394, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.657, "ts": null, "map": 0.101, "obs": 0, "own": 0.090, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.196, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38676-APNIC", "org": "flexnetworks", "pdb": null, "pfx": 209, "reg": "2007-08-24", "rir": "apnic", "s24": 307, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 103424, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000515124582}, {"a": 38680, "h": "CMBHK-AS-KR", "n": "CMB", "t": "Other", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0861, "hi": 3.49, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "crowdsec": {"n": 1, "p": 0.0696, "hi": 3.28, "lo": 0.25, "ips": 1, "mean": 1.38, "above": false}, "blocklist_de": {"n": 1, "p": 0.1317, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.432, 0.010, 0, false], ["2026-10-12", 0.458, 0.011, 0, false]], "sh": false, "uc": 337.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 0.473, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.458, "se": 0.885, "ts": 0.500, "map": 1.767, "obs": 2, "own": 1.032, "comp": {"cins": -0.3765, "dshield": -0.7855, "crowdsec": 0.9634, "vulncheck": -0.5872, "blocklist_de": 2.7485}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.143, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "@family-53839", "org": "CMB", "pdb": null, "pfx": 45, "reg": "2007-08-24", "rir": "apnic", "s24": 168, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43776, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004846003442}, {"a": 38684, "h": "CMBDAEJEON-AS-KR", "n": "CMB Daejeon Broadcasting Co,.Ltd", "t": "Other", "w": 6, "cc": "KR", "cf": null, "cs": {"c": {"web_exploit": 1, "router_or_botnet": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 5, "mean": 1.84, "above": false}, "crowdsec": {"n": 1, "p": 0.0536, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.772, 0.010, 0, false], ["2026-10-12", 0.391, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 0.444, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.391, "se": 0.879, "ts": 0.500, "map": 1.488, "obs": 2, "own": 0.871, "comp": {"cins": 4.3844, "dshield": -0.8117, "crowdsec": 0.822, "vulncheck": -0.5977, "blocklist_de": -2.0056}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.148, "det": null, "oid": "@aut-38684-APNIC", "org": "CMB Daejeon Broadcasting Co,.Ltd", "pdb": null, "pfx": 74, "reg": "2007-08-24", "rir": "apnic", "s24": 208, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 87808, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007466836356}, {"a": 38690, "h": "HYOSUNGITX-AS-KR", "n": "HyosungITX", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0344, "hi": 2.74, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.920, "ts": null, "map": 0.163, "obs": 0, "own": 0.380, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.642, "ts": null, "map": 0.096, "obs": 0, "own": 0.084, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.326, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-152210-APNIC", "org": "HyosungITX", "pdb": null, "pfx": 17, "reg": "2007-08-24", "rir": "apnic", "s24": 342, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 129024, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000032260781}, {"a": 38700, "h": "SMILESERV-AS-KR", "n": "SMILESERV", "t": "Other", "w": 5, "cc": "KR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"shodan": {"n": 19, "p": 1.0000, "hi": 13.31, "lo": 6.33, "ips": 19, "mean": 9.55, "above": true}, "crowdsec": {"n": 5, "p": 0.2903, "hi": 4.45, "lo": 1.11, "ips": 5, "mean": 2.54, "above": false}, "blocklist_de": {"n": 3, "p": 0.3183, "hi": 5.01, "lo": 0.88, "ips": 3, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 2.397, 0.009, 0, false], ["2026-10-12", 1.396, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.152, "obs": 0, "own": 0.332, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.396, "se": 0.518, "ts": 0.625, "map": 2.730, "obs": 8, "own": 1.544, "comp": {"cins": -1.351, "dshield": -2.0414, "crowdsec": 3.1199, "vulncheck": -0.88, "blocklist_de": 3.5503}, "mass": 7.8, "listed": false}}, "abq": false, "bot": 0.717, "det": {"shodan": {"compromised": 19}, "blocklist_de": {"ssh": 3}}, "oid": "@aut-38700-APNIC", "org": "SMILESERV", "pdb": null, "pfx": 6, "reg": "2007-08-24", "rir": "apnic", "s24": 512, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 262144, "abuse": "hostmaster@nic.or.kr", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0009239457738}, {"a": 38713, "h": "CONNECT2B-AS-PK", "n": "Satcomm", "t": "Broadband & mobile", "w": 4, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"cins": {"n": 3, "p": 0.6339, "hi": 7.60, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "crowdsec": {"n": 2, "p": 0.3446, "hi": 5.60, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}}, "h2": [["2026-10-12", 7.463, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 1.619, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.463, "se": 0.618, "ts": 0.600, "map": 17.665, "obs": 5, "own": 27.379, "comp": {"cins": 11.5741, "dshield": -1.5769, "crowdsec": -0.3862, "vulncheck": -0.806, "blocklist_de": -4.5399}, "mass": 4.6, "listed": false}}, "abq": true, "bot": 0.222, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SL20-AP-APNIC", "org": "Satcomm (Pvt.) Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.satcomm.pk"}, "pfx": 47, "reg": "2007-08-27", "rir": "apnic", "s24": 47, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045501399625}, {"a": 38719, "h": "DREAMSCAPE-AS-AP", "n": "Dreamscape Networks", "t": "Hosting & VPS", "w": 13, "cc": "AU", "cf": null, "cs": {"c": {"ssh_bruteforce": 4, "home_connection": 3}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.2716, "hi": 4.70, "lo": 0.83, "ips": 4, "mean": 2.42, "above": false}, "phishing_db": {"n": 4, "p": 0.7517, "hi": 8.17, "lo": 1.76, "ips": 7, "mean": 4.47, "above": false}, "blocklist_de": {"n": 4, "p": 0.6703, "hi": 7.25, "lo": 1.56, "ips": 6, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 0.320, 2.045, 0, false], ["2026-10-12", 2.534, 2.070, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 2.070, "se": 0.942, "ts": 1.000, "map": 6.137, "obs": 4, "own": 2.344, "comp": {"urlhaus": -0.789, "threatfox": -0.4359, "phishing_db": 4.6653}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.534, "se": 0.540, "ts": 0.571, "map": 5.189, "obs": 7, "own": 1.021, "comp": {"cins": -1.2633, "dshield": -1.9575, "crowdsec": -0.6237, "vulncheck": -0.8684, "blocklist_de": 7.7531}, "mass": 7.1, "listed": false}}, "abq": true, "bot": 0.920, "det": {"blocklist_de": {"ssh": 6}}, "oid": "ORG-DNPL4-AP-APNIC", "org": "Dreamscape Networks PTY LTD", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.dreamscapenetworks.com"}, "pfx": 65, "reg": "2007-08-31", "rir": "apnic", "s24": 245, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 64000, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001238257395}, {"a": 38726, "h": "VTCDIGICOM-AS-VN", "n": "VTC DIGICOM Co., Ltd", "t": "Transit & backbone", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 2.061, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.169, "obs": 0, "own": 1.145, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.415, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38726-APNIC", "org": "VTC DIGICOM", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Selective", "web": "http://digicom.vtc.vn"}, "pfx": 20, "reg": "2007-09-14", "rir": "apnic", "s24": 76, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30976, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000237157599}, {"a": 38731, "h": "VTDC-AS-VN", "n": "Vietel - CHT Compamy Ltd", "t": "Other", "w": 20, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 9, "web_bruteforce": 8, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1}, "n": 15}, "ev": {"cins": {"n": 2, "p": 0.3785, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}, "shodan": {"n": 16, "p": 1.0000, "hi": 18.02, "lo": 8.03, "ips": 16, "mean": 12.61, "above": true}, "crowdsec": {"n": 15, "p": 1.0000, "hi": 16.12, "lo": 7.00, "ips": 15, "mean": 11.16, "above": true}, "threatfox": {"n": 1, "p": 0.1882, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "phishing_db": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 5, "p": 0.8544, "hi": 8.95, "lo": 2.22, "ips": 5, "mean": 5.11, "above": true}}, "h2": [["2026-10-05", 15.047, 0.906, 1, false], ["2026-10-12", 14.109, 0.920, 1, false]], "sh": false, "uc": 800.4, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.920, "se": 1.142, "ts": 0.500, "map": 4.037, "obs": 2, "own": 4.246, "comp": {"urlhaus": -0.4006, "threatfox": 1.7655, "phishing_db": 1.6569}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 15, "vulncheck": 1, "blocklist_de": 5}, "lo": 14.109, "se": 0.413, "ts": 0.652, "map": 23.019, "obs": 23, "own": 12.898, "comp": {"cins": 2.4375, "dshield": -2.7981, "crowdsec": 6.0217, "vulncheck": -0.6749, "blocklist_de": -0.4562}, "mass": 20.7, "listed": false}}, "abq": true, "bot": 0.750, "det": {"shodan": {"compromised": 16}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 1, "ssh": 2, "imap": 2, "mail": 2}}, "oid": "@aut-38731-APNIC", "org": "Vietel - CHT Compamy Ltd", "pdb": null, "pfx": 111, "reg": "2007-09-14", "rir": "apnic", "s24": 163, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 60672, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00100406017208}, {"a": 38732, "h": "CMCTELECOM-VN", "n": "CMC Telecom Infrastructure Company", "t": "Broadband & mobile", "w": 6, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"shodan": {"n": 9, "p": 0.9981, "hi": 14.58, "lo": 5.04, "ips": 9, "mean": 9.29, "above": true}, "crowdsec": {"n": 4, "p": 0.7649, "hi": 8.35, "lo": 1.80, "ips": 5, "mean": 4.56, "above": false}, "vulncheck": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 16.121, 0.426, 1, false], ["2026-10-12", 12.199, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 2}, "lo": 12.199, "se": 0.555, "ts": 0.571, "map": 25.779, "obs": 7, "own": 39.813, "comp": {"cins": -0.9983, "dshield": -1.6758, "crowdsec": 4.4387, "vulncheck": 0.1681, "blocklist_de": 2.7106}, "mass": 5.2, "listed": false}}, "abq": true, "bot": 0.788, "det": {"shodan": {"c2": 1, "compromised": 8}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@family-53558", "org": "CMC Telecom Infrastructure Company", "pdb": null, "pfx": 36, "reg": "2007-09-14", "rir": "apnic", "s24": 36, "sib": 4, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 11520, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0003366043569}, {"a": 38733, "h": "CMCTELECOM-VN", "n": "CMC Telecom Infrastructure Company", "t": "Broadband & mobile", "w": 7, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 1, "first_seen_30d": 3, "ssh_bruteforce": 7, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 2, "p": 0.3842, "hi": 5.94, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "crowdsec": {"n": 4, "p": 0.7765, "hi": 8.52, "lo": 1.83, "ips": 7, "mean": 4.65, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 13.129, 0.011, 1, false], ["2026-10-12", 14.305, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 14.305, "se": 0.577, "ts": 0.667, "map": 31.244, "obs": 6, "own": 48.186, "comp": {"cins": 3.1644, "dshield": -1.6232, "crowdsec": 4.9491, "vulncheck": -0.8146, "blocklist_de": -0.8402}, "mass": 4.9, "listed": false}}, "abq": true, "bot": 0.810, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@family-53558", "org": "CMC Telecom Infrastructure Company", "pdb": null, "pfx": 28, "reg": "2007-09-14", "rir": "apnic", "s24": 28, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020193604186}, {"a": 38744, "h": "AONB-AS-AP", "n": "AlwaysOn Network Bangladesh", "t": "Other", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "phishing_db": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1879, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 2.103, 0.528, 0, false]], "sh": false, "uc": 976.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.528, "se": 1.574, "ts": 1.000, "map": 5.708, "obs": 1, "own": 6.900, "comp": {"urlhaus": -0.0925, "threatfox": -0.119, "phishing_db": 3.5795}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.103, "se": 0.961, "ts": 0.500, "map": 9.434, "obs": 2, "own": 5.557, "comp": {"cins": -0.293, "dshield": -0.632, "crowdsec": 1.793, "vulncheck": -0.5191, "blocklist_de": 3.289}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.182, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-AONB1-AP-APNIC", "org": "Always On Network Bangladesh Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.alwayson.com.bd/"}, "pfx": 26, "reg": "2007-09-18", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "noc@alwayson.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38758, "h": "HYPERNET-AS-ID", "n": "Hipernet Indodata AS38758", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "shodan": {"n": 1, "p": 0.1211, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "dshield": {"n": 1, "p": 0.1760, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1069, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-12", 1.457, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 1.350, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.457, "se": 0.752, "ts": 0.333, "map": 4.342, "obs": 3, "own": 6.816, "comp": {"cins": 4.073, "dshield": 2.6502, "crowdsec": -0.4649, "vulncheck": -0.68, "blocklist_de": -2.7164}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.212, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38758-APNIC", "org": "PT. HIPERNET INDODATA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.hypernet.co.id"}, "pfx": 114, "reg": "2007-09-28", "rir": "apnic", "s24": 101, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 48896, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001694784102}, {"a": 38760, "h": "IDNIC-MSA-AS-ID", "n": "PT Media Sarana Akses", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.791, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38760-APNIC", "org": "PT Media Sarana Akses", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://mediasaranaakses.co.id/"}, "pfx": 4, "reg": "2007-09-28", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@gmedia.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38771, "h": "CYBERPLUS-AS-ID", "n": "Cyberplus Media Pratama", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2109.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.278, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38771-APNIC", "org": "PT Cyberplus Media Pratama", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://cyberplus.net.id"}, "pfx": 12, "reg": "2007-09-28", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "support@cyberplus.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005814895812}, {"a": 38788, "h": "IDNIC-ICLOUD-AS-ID", "n": "PT Indonesian Cloud", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 1.763, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.923, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-38788-APNIC", "org": "PT Indonesian Cloud", "pdb": null, "pfx": 9, "reg": "2007-09-28", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 38794, "h": "UIH-BBB-AS-AP", "n": "United Information Highway (UIH)", "t": "Broadband & mobile", "w": 2, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.2245, "hi": 4.38, "lo": 0.77, "ips": 3, "mean": 2.26, "above": false}, "crowdsec": {"n": 1, "p": 0.0194, "hi": 2.42, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}, "phishing_db": {"n": 1, "p": 0.1330, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.071, 0.159, 0, false], ["2026-10-12", 0.074, 0.166, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.166, "se": 1.391, "ts": 1.000, "map": 1.165, "obs": 1, "own": 3.477, "comp": {"urlhaus": -0.2673, "threatfox": -0.2579, "phishing_db": 2.304}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.074, "se": 1.110, "ts": 1.000, "map": 0.434, "obs": 1, "own": 0.727, "comp": {"cins": -0.2062, "dshield": -0.461, "crowdsec": 2.7203, "vulncheck": -0.4253, "blocklist_de": -1.0696}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.202, "det": {"shodan": {"compromised": 3}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.uih.co.th"}, "pfx": 142, "reg": "2007-10-04", "rir": "apnic", "s24": 360, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 165632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00492127310238}, {"a": 38819, "h": "HKCSL-AS-AP", "n": "CSL Limited", "t": "Broadband & mobile", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1920, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.1847, "hi": 4.29, "lo": 0.56, "ips": 2, "mean": 2.04, "above": false}, "blocklist_de": {"n": 1, "p": 0.1291, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 1.861, 0.010, 0, false], ["2026-10-12", 0.885, 0.360, 0, false]], "sh": false, "uc": 324, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.360, "se": 1.501, "ts": 1.000, "map": 3.330, "obs": 1, "own": 9.747, "comp": {"urlhaus": 3.7216, "threatfox": -0.3074, "phishing_db": -0.5849}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.885, "se": 0.741, "ts": 0.667, "map": 2.580, "obs": 3, "own": 4.047, "comp": {"cins": -0.5513, "dshield": -1.0767, "crowdsec": 3.0234, "vulncheck": -0.6878, "blocklist_de": 1.6337}, "mass": 2.6, "listed": false}}, "abq": true, "bot": 0.078, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-CL2-AP-APNIC", "org": "CSL Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.hkcsl.com"}, "pfx": 69, "reg": "2007-10-25", "rir": "apnic", "s24": 176, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01094485298808}, {"a": 38841, "h": "kbro-AS-TW", "n": "kbro", "t": "Broadband & mobile", "w": 14, "cc": "TW", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 5, "web_bruteforce": 2, "home_connection": 7, "mail_bruteforce": 5, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-12847": 1}, "n": 9}, "ev": {"shodan": {"n": 5, "p": 0.0003, "hi": 1.76, "lo": 0.44, "ips": 5, "mean": 1.00, "above": false}, "dshield": {"n": 4, "p": 0.1950, "hi": 4.06, "lo": 0.87, "ips": 4, "mean": 2.22, "above": false}, "crowdsec": {"n": 9, "p": 0.0020, "hi": 2.18, "lo": 0.75, "ips": 9, "mean": 1.39, "above": false}, "blocklist_de": {"n": 3, "p": 0.0072, "hi": 2.22, "lo": 0.39, "ips": 3, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 0.622, 0.007, 0, false], ["2026-10-12", 0.682, 0.008, 0, false]], "sh": false, "uc": 59.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.773, "ts": null, "map": 0.101, "obs": 0, "own": 0.468, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.682, "se": 0.443, "ts": 0.563, "map": 1.154, "obs": 16, "own": 1.782, "comp": {"cins": -2.0312, "dshield": 3.3428, "crowdsec": 3.0282, "vulncheck": -0.9407, "blocklist_de": -1.8624}, "mass": 14.9, "listed": false}}, "abq": true, "bot": 0.206, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-38841-APNIC", "org": "kbro CO. Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.kbro.com.tw"}, "pfx": 443, "reg": "2007-12-13", "rir": "apnic", "s24": 2329, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1647104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03096706929335}, {"a": 38843, "h": "PUMO-NET", "n": "PUMO NETWORK DIGITAL TECHNOLOGY CO.,LTD", "t": "Other", "w": 1, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.9808, "hi": 12.02, "lo": 3.64, "ips": 7, "mean": 7.31, "above": true}, "vulncheck": {"n": 1, "p": 0.1890, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.224, 0.011, 0, false], ["2026-10-12", 0.218, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.218, "se": 1.258, "ts": 1.000, "map": 1.658, "obs": 1, "own": 1.108, "comp": {"cins": -0.0988, "dshield": -0.2313, "crowdsec": -0.916, "vulncheck": 3.6613, "blocklist_de": -0.5159}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.938, "det": {"shodan": {"c2": 3, "malware": 1, "compromised": 1, "doublepulsar": 2}, "vulncheck": {"attack_tooling": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 12, "reg": "2007-12-13", "rir": "apnic", "s24": 44, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 22784, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00001008144405}, {"a": 38851, "h": "TNET-NET", "n": "TNET Communication", "t": "Broadband & mobile", "w": 2, "cc": "TW", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1300, "hi": 3.83, "lo": 0.50, "ips": 2, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.589, 0.010, 0, false], ["2026-10-12", 0.319, 0.011, 0, false]], "sh": false, "uc": 183.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.170, "obs": 0, "own": 1.052, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.319, "se": 0.868, "ts": 1.000, "map": 1.184, "obs": 2, "own": 1.886, "comp": {"cins": -0.3659, "dshield": -0.7666, "crowdsec": 5.1529, "vulncheck": -0.5795, "blocklist_de": -1.8784}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.190, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.twt.com.tw"}, "pfx": 56, "reg": "2007-12-13", "rir": "apnic", "s24": 243, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 84480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007641281028}, {"a": 38901, "h": "EZECOM-AS-AP", "n": "EZECOM", "t": "Other", "w": 1, "cc": "KH", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.009, 0.440, 0, false]], "sh": false, "uc": 885.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.440, "se": 1.542, "ts": 1.000, "map": 4.396, "obs": 1, "own": 5.297, "comp": {"urlhaus": 3.8914, "threatfox": -0.272, "phishing_db": -0.5125}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.798, "ts": null, "map": 0.154, "obs": 0, "own": 0.172, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.187, "det": null, "oid": "ORG-EL1-AP-APNIC", "org": "EZECOM CO., LTD.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://ezecom.com.kh"}, "pfx": 178, "reg": "2008-02-12", "rir": "apnic", "s24": 105, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 86016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00189941530338}, {"a": 39028, "h": "ULSK-AS", "n": "JSC \"ER-Telecom Holding\" Ulyanovsk branch", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1029, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.1533, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.614, 0.011, 0, false], ["2026-10-12", 0.660, 0.012, 0, false]], "sh": false, "uc": 507.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.001, "ts": null, "map": 0.183, "obs": 0, "own": 1.329, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.660, "se": 0.901, "ts": 0.500, "map": 2.614, "obs": 2, "own": 4.180, "comp": {"cins": -0.3565, "dshield": -0.7498, "crowdsec": 1.1564, "vulncheck": -0.5725, "blocklist_de": 2.877}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.454, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 33, "reg": "2011-02-07", "rir": "ripencc", "s24": 107, "sib": 121, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 48384, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004534975291}, {"a": 39033, "h": "MEDIAOPERATOR-AS", "n": "Mediaoperator LLC", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.782, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-ML808-RIPE", "org": "Mediaoperator LLC", "pdb": null, "pfx": 2, "reg": "2018-10-26", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39067, "h": "Etanetas", "n": "Etanetas", "t": "Broadband & mobile", "w": 0, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 1.539, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.244, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UA137-RIPE", "org": "ETANETAS UAB", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": null, "pol": "Selective", "web": "http://www.etanetas.lt"}, "pfx": 3, "reg": "2009-01-15", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@etanetas.lt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002103107985}, {"a": 39074, "h": "IR-SEPANTA", "n": "Sepanta Communication Development Co. Ltd", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3175, "hi": 5.37, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.1700, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 1.863, 0.011, 0, false], ["2026-10-12", 2.074, 0.012, 0, false]], "sh": false, "uc": 661.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 0.607, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.074, "se": 0.759, "ts": 0.667, "map": 6.349, "obs": 3, "own": 3.642, "comp": {"cins": -0.5068, "dshield": -1.0063, "crowdsec": 3.5064, "vulncheck": -0.6663, "blocklist_de": 1.915}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.365, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SCDC1-RIPE", "org": "Sepanta Communication Development Co. Ltd", "pdb": null, "pfx": 65, "reg": "2005-12-07", "rir": "ripencc", "s24": 65, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": "abuse@sepanta.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028871165505}, {"a": 39090, "h": "BRANDL", "n": "Brandl Services GmbH", "t": "Broadband & mobile", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5943, "hi": 7.19, "lo": 1.27, "ips": 3, "mean": 3.71, "above": false}}, "h2": [["2026-10-05", 0.292, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 1.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.822, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-BSG8-RIPE", "org": "Brandl Services GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.brandl-services.com"}, "pfx": 3, "reg": "2012-09-03", "rir": "ripencc", "s24": 37, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "ripe@brandl-services.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00047488004205}, {"a": 39122, "h": "BLACKNIGHT-AS", "n": "Blacknight Internet Solutions", "t": "Hosting & VPS", "w": 5, "cc": "IE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2745, "hi": 5.02, "lo": 0.65, "ips": 2, "mean": 2.39, "above": false}, "vulncheck": {"n": 2, "p": 0.3902, "hi": 5.99, "lo": 0.78, "ips": 3, "mean": 2.86, "above": false}}, "h2": [["2026-10-12", 1.564, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.008, "ts": null, "map": 0.185, "obs": 0, "own": 0.211, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.564, "se": 0.689, "ts": 0.500, "map": 4.123, "obs": 4, "own": 0.836, "comp": {"cins": -0.4883, "dshield": -0.9762, "crowdsec": 3.7122, "vulncheck": 3.0504, "blocklist_de": -2.4879}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.892, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-BISL2-RIPE", "org": "Blacknight Internet Solutions Limited", "pdb": {"t": "Content", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.blacknight.com"}, "pfx": 23, "reg": "2005-12-16", "rir": "ripencc", "s24": 96, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": "abuse@blacknight.ie", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00121645595961}, {"a": 39184, "h": "UltraNET-AS", "n": "UltraNET Bulgaria", "t": "Broadband & mobile", "w": 3, "cc": "BG", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1523, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "crowdsec": {"n": 2, "p": 0.1485, "hi": 3.99, "lo": 0.52, "ips": 2, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.687, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 1.087, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.687, "se": 0.734, "ts": 0.667, "map": 1.980, "obs": 3, "own": 3.104, "comp": {"cins": -0.5273, "dshield": 2.6789, "crowdsec": 3.2818, "vulncheck": -0.6765, "blocklist_de": -2.6801}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.173, "det": null, "oid": "ORG-UO129-RIPE", "org": "UltraNET Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.ultranet.biz"}, "pfx": 199, "reg": "2005-12-29", "rir": "ripencc", "s24": 218, "sib": 0, "tor": 1, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 76800, "abuse": "abuse@ultranet.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00146818137375}, {"a": 39216, "h": "Pulk", "n": "Pulk Company", "t": "Transit & backbone", "w": 4, "cc": "IQ", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1582, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "blocklist_de": {"n": 2, "p": 0.3964, "hi": 6.05, "lo": 0.79, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-12", 3.535, 0.613, 0, false]], "sh": false, "uc": 4430.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.613, "se": 1.632, "ts": 1.000, "map": 7.199, "obs": 1, "own": 32.801, "comp": {"urlhaus": 4.1642, "threatfox": -0.1981, "phishing_db": -0.3659}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.535, "se": 0.773, "ts": 0.667, "map": 11.112, "obs": 3, "own": 35.392, "comp": {"cins": -0.5172, "dshield": -1.0229, "crowdsec": -0.3155, "vulncheck": -0.6715, "blocklist_de": 6.3288}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.199, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-ASTA2-RIPE", "org": "Pulk Company for General Trading, Communications & Investment, Ltd.", "pdb": {"t": "NSP", "sc": "Middle East", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.pulkcompany.com/"}, "pfx": 38, "reg": "2010-05-26", "rir": "ripencc", "s24": 38, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "ripe@pulkcompany.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033144254364}, {"a": 39232, "h": "UNINET", "n": "Uninet (Azerbaijan)", "t": "Broadband & mobile", "w": 4, "cc": "AZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0189, "hi": 2.41, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}, "blocklist_de": {"n": 2, "p": 0.2142, "hi": 4.53, "lo": 0.59, "ips": 3, "mean": 2.16, "above": false}}, "h2": [["2026-10-05", 1.060, 0.010, 0, false], ["2026-10-12", 0.500, 0.011, 0, false]], "sh": false, "uc": 70.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.915, "ts": null, "map": 0.161, "obs": 0, "own": 0.925, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.500, "se": 0.731, "ts": 0.667, "map": 1.441, "obs": 3, "own": 2.263, "comp": {"cins": -0.6251, "dshield": -1.1888, "crowdsec": -1.2061, "vulncheck": -0.7192, "blocklist_de": 5.4985}, "mass": 3.0, "listed": false}}, "abq": true, "bot": 0.165, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "ORG-UA66-RIPE", "org": "Uninet LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.uninet.az"}, "pfx": 94, "reg": "2006-01-13", "rir": "ripencc", "s24": 364, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 184320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01261675077432}, {"a": 39255, "h": "PGG-SA", "n": "Polska Grupa Gornicza S.A.", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.261, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-PGGS2-RIPE", "org": "Polska Grupa Gornicza S.A.", "pdb": null, "pfx": 2, "reg": "2006-01-19", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39264, "h": "METROMAX-AS", "n": "Region Svyaz Konsalt LLC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1056, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "blocklist_de": {"n": 1, "p": 0.1549, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 2.146, 0.011, 0, false], ["2026-10-12", 0.683, 0.012, 0, false]], "sh": false, "uc": 523.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 0.541, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.683, "se": 0.902, "ts": 0.500, "map": 2.702, "obs": 2, "own": 1.581, "comp": {"cins": -0.3549, "dshield": -0.7468, "crowdsec": 1.1727, "vulncheck": -0.5712, "blocklist_de": 2.8878}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.471, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-SKL7-RIPE", "org": "\"Region Svyaz Konsalt\" LLC", "pdb": null, "pfx": 38, "reg": "2006-01-20", "rir": "ripencc", "s24": 103, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "noc@metromax.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035573472935}, {"a": 39287, "h": "materialism", "n": "ab stract", "t": "Hosting & VPS", "w": 5, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7375, "hi": 7.99, "lo": 1.72, "ips": 4, "mean": 4.37, "above": false}, "threatfox": {"n": 3, "p": 0.6402, "hi": 7.67, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}, "phishing_db": {"n": 2, "p": 0.4012, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 0.626, 1.711, 0, false], ["2026-10-12", 0.009, 7.686, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 2}, "lo": 7.686, "se": 0.876, "ts": 0.600, "map": 20.951, "obs": 5, "own": 7.488, "comp": {"urlhaus": -0.7574, "threatfox": 3.4038, "phishing_db": 2.0219}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.076, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.871, "det": {"shodan": {"c2": 4}, "threatfox": {"family:Sliver": 3}}, "oid": "ORG-MS858-RIPE", "org": "Materialism s.r.l.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://abstract.fi"}, "pfx": 9, "reg": "2006-01-24", "rir": "ripencc", "s24": 68, "sib": 1, "tor": 3, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "abuse@materiali.sm", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00052988752901}, {"a": 39297, "h": "ARTEFACT", "n": "Prikarpatinserv LLC", "t": "Other", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 14.019, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-NL204-RIPE", "org": "Prikarpatinserv LLC", "pdb": null, "pfx": 2, "reg": "2006-01-26", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39318, "h": "PSKZ-AST", "n": "PS Internet Company LLP", "t": "Other", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8033, "hi": 8.94, "lo": 1.92, "ips": 4, "mean": 4.89, "above": true}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.628, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-PICL3-RIPE", "org": "PS Internet Company LLP", "pdb": null, "pfx": 15, "reg": "2021-02-10", "rir": "ripencc", "s24": 11, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 4864, "abuse": "abuse@ps.kz", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00010454176012}, {"a": 39337, "h": "Corpsoft24", "n": "Corp Soft", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.978, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-JS148-RIPE", "org": "JSC \"Corp Soft\"", "pdb": {"t": null, "sc": null, "tr": null, "pol": "Open", "web": "http://www.corpsoft24.ru"}, "pfx": 17, "reg": "2018-05-28", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "support@corpsoft24.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39351, "h": "ESAB-AS", "n": "31173 Services", "t": "Transit & backbone", "w": 53, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 43, "web_exploit": 47, "bad_crawling": 38, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 14, "web_bruteforce": 42, "home_connection": 1, "mail_bruteforce": 20, "cve:CVE-2017-9841": 14, "cve:CVE-2021-3129": 14, "cve:CVE-2025-4396": 6, "cve:CVE-2018-20062": 9, "cve:CVE-2021-41773": 19}, "n": 49}, "ev": {"shodan": {"n": 2, "p": 0.3465, "hi": 5.61, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}, "dshield": {"n": 3, "p": 0.6266, "hi": 7.52, "lo": 1.33, "ips": 3, "mean": 3.88, "above": false}, "crowdsec": {"n": 18, "p": 1.0000, "hi": 23.18, "lo": 10.81, "ips": 49, "mean": 16.50, "above": true}, "blocklist_de": {"n": 4, "p": 0.7836, "hi": 8.63, "lo": 1.86, "ips": 4, "mean": 4.71, "above": false}}, "h2": [["2026-10-05", 39.727, 0.011, 1, false], ["2026-10-12", 39.043, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 2.206, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 18, "vulncheck": 0, "blocklist_de": 4}, "lo": 39.043, "se": 0.402, "ts": 0.720, "map": 63.034, "obs": 25, "own": 195.477, "comp": {"cins": -2.3551, "dshield": 0.8025, "crowdsec": 10.1922, "vulncheck": -0.9587, "blocklist_de": -2.1436}, "mass": 19.7, "listed": false}}, "abq": false, "bot": 0.783, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-SA1601-RIPE", "org": "31173 Services AB", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.31173.se"}, "pfx": 53, "reg": "2006-02-06", "rir": "ripencc", "s24": 57, "sib": 2, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": "abuse@31173.se", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00807950650628}, {"a": 39368, "h": "Serverir", "n": "Serverir", "t": "Hosting & VPS", "w": 2, "cc": "AE", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.421, 0.011, 0, false], ["2026-10-12", 5.197, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.197, "se": 1.023, "ts": 0.500, "map": 26.075, "obs": 2, "own": 5.414, "comp": {"cins": 4.6446, "dshield": -0.5905, "crowdsec": -2.3314, "vulncheck": -0.4982, "blocklist_de": 3.4302}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.940, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-MR252-RIPE", "org": "Mahdiar Rafiee", "pdb": null, "pfx": 8, "reg": "2018-01-18", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001546136745}, {"a": 39378, "h": "servinga", "n": "servinga", "t": "Hosting & VPS", "w": 9, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 5, "p": 0.9140, "hi": 10.44, "lo": 2.60, "ips": 8, "mean": 5.96, "above": true}}, "h2": [["2026-10-05", 0.458, 31.837, 1, false], ["2026-10-12", 0.494, 31.815, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 31.815, "se": 0.848, "ts": 1.000, "map": 86.862, "obs": 5, "own": 29.133, "comp": {"urlhaus": -0.6695, "threatfox": -0.41, "phishing_db": 7.1701}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.494, "se": 1.386, "ts": 1.000, "map": 4.926, "obs": 1, "own": 1.173, "comp": {"cins": -0.0935, "dshield": -0.2194, "crowdsec": 4.0349, "vulncheck": -0.2452, "blocklist_de": -0.4885}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.524, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SG288-RIPE", "org": "servinga GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.servinga.com"}, "pfx": 13, "reg": "2018-01-16", "rir": "ripencc", "s24": 14, "sib": 5, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 3584, "abuse": "abuse@servinga.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 39392, "h": "SuperNetwork", "n": "SH.cz", "t": "Hosting & VPS", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2697, "hi": 4.98, "lo": 0.65, "ips": 2, "mean": 2.37, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.181, "obs": 0, "own": 0.197, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.776, "ts": null, "map": 0.146, "obs": 0, "own": 0.054, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.977, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-SS59-RIPE", "org": "SH.cz s.r.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.sh.cz"}, "pfx": 12, "reg": "2006-02-14", "rir": "ripencc", "s24": 124, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32512, "abuse": "abuse@superhosting.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00053350244155}, {"a": 39401, "h": "LINKPLUSBG", "n": "Link+", "t": "Transit & backbone", "w": 3, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1904, "hi": 4.65, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.238, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 2.407, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.238, "se": 1.270, "ts": 1.000, "map": 1.847, "obs": 1, "own": 6.888, "comp": {"cins": -0.0952, "dshield": -0.2231, "crowdsec": -0.8836, "vulncheck": 3.7061, "blocklist_de": -0.497}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.151, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-LL290-RIPE", "org": "Link+ Ltd", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.link.bg"}, "pfx": 45, "reg": "2006-02-15", "rir": "ripencc", "s24": 38, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@link.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025515384921}, {"a": 39405, "h": "FULLSAVE-AS", "n": "Eurofiber France - FullSave", "t": "Broadband & mobile", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1331, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.204, 0.011, 0, false], ["2026-10-12", 0.214, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 1.500, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.214, "se": 1.238, "ts": 1.000, "map": 1.623, "obs": 1, "own": 2.827, "comp": {"cins": -0.1436, "dshield": -0.3296, "crowdsec": 3.4346, "vulncheck": -0.3359, "blocklist_de": -0.7476}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.429, "det": null, "oid": "ORG-EFS19-RIPE", "org": "Eurofiber France SAS", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "No", "web": "https://www.fullsave.com"}, "pfx": 23, "reg": "2006-02-15", "rir": "ripencc", "s24": 66, "sib": 6, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "abuse-fr@eurofiber.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00047456709677}, {"a": 39421, "h": "SAPINET-AS", "n": "Sapinet", "t": "Transit & backbone", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2024-3721": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2025-32355": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 24.113, 0.011, 1, false], ["2026-10-12", 0.725, 0.928, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.928, "se": 1.813, "ts": 1.000, "map": 13.743, "obs": 1, "own": 81.131, "comp": {"urlhaus": 4.4638, "threatfox": -0.0778, "phishing_db": -0.1393}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 34.483, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SS1190-RIPE", "org": "Sapinet SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://sapi.net"}, "pfx": 6, "reg": "2017-12-14", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@sapinet.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39435, "h": "EVOLGOGRAD-AS", "n": "JSC \"ER-Telecom Holding\" Vologograd branch", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1529, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "crowdsec": {"n": 2, "p": 0.1099, "hi": 3.64, "lo": 0.47, "ips": 2, "mean": 1.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1007, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 1.639, 0.010, 0, false], ["2026-10-12", 0.988, 0.011, 0, false]], "sh": false, "uc": 206.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.013, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.988, "se": 0.657, "ts": 0.500, "map": 2.498, "obs": 4, "own": 3.897, "comp": {"cins": 3.5358, "dshield": -1.4088, "crowdsec": 0.7564, "vulncheck": -0.7719, "blocklist_de": 0.1978}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.441, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 71, "reg": "2006-02-22", "rir": "ripencc", "s24": 274, "sib": 121, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 122368, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014202360865}, {"a": 39442, "h": "UNICO-AS", "n": "UNICO", "t": "Other", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 7, "web_bruteforce": 6, "mail_bruteforce": 7, "cve:CVE-2025-22457": 2}, "n": 7}, "ev": {"crowdsec": {"n": 7, "p": 0.9576, "hi": 10.26, "lo": 3.11, "ips": 7, "mean": 6.24, "above": true}, "blocklist_de": {"n": 4, "p": 0.7551, "hi": 8.22, "lo": 1.77, "ips": 4, "mean": 4.49, "above": false}}, "h2": [["2026-10-05", 10.955, 0.011, 1, false], ["2026-10-12", 9.243, 0.012, 0, false]], "sh": false, "uc": 3213.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.002, "ts": null, "map": 0.183, "obs": 0, "own": 0.537, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 4}, "lo": 9.243, "se": 0.476, "ts": 0.636, "map": 17.038, "obs": 11, "own": 9.575, "comp": {"cins": -1.604, "dshield": -2.2618, "crowdsec": 4.4729, "vulncheck": -0.9076, "blocklist_de": 4.5296}, "mass": 10.0, "listed": false}}, "abq": false, "bot": 0.516, "det": {"blocklist_de": {"imap": 3, "mail": 4}}, "oid": "ORG-JU2-RIPE", "org": "JSC RDE \"Unico\"", "pdb": null, "pfx": 36, "reg": "2006-02-22", "rir": "ripencc", "s24": 106, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 41728, "abuse": "noc@unico.com.ru", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 39486, "h": "HOSTROYALE", "n": "HostRoyale Technologies Pvt Ltd", "t": "Hosting & VPS", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 10, "web_exploit": 9, "bad_crawling": 9, "proxy_or_vpn": 2, "web_bruteforce": 6, "mail_bruteforce": 2, "cve:CVE-2017-9841": 5, "cve:CVE-2017-16894": 3, "cve:CVE-2018-20062": 2, "cve:CVE-2019-17050": 3, "cve:CVE-2024-28000": 3}, "n": 11}, "ev": {"crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 11, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 4.076, 0.011, 0, false], ["2026-10-12", 1.834, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.834, "se": 0.953, "ts": 0.500, "map": 8.031, "obs": 2, "own": 1.646, "comp": {"cins": -0.3009, "dshield": -0.6469, "crowdsec": 1.7128, "vulncheck": -0.5262, "blocklist_de": 3.2381}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.811, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-HTPL1-RIPE", "org": "HostRoyale Technologies Pvt Ltd", "pdb": null, "pfx": 25, "reg": "2019-09-13", "rir": "ripencc", "s24": 29, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "abuse@hostroyale.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00128961785537}, {"a": 39493, "h": "RU-KSTV", "n": "CJSC Kolomna-Sviaz TV", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.342, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 0.476, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.738, "ts": null, "map": 0.131, "obs": 0, "own": 0.132, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.459, "det": null, "oid": "ORG-JKT4-RIPE", "org": "CJSC Kolomna-Sviaz TV", "pdb": null, "pfx": 7, "reg": "2006-03-06", "rir": "ripencc", "s24": 165, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50432, "abuse": "abuse@golutvin.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39494, "h": "RU-CENTER-AS", "n": "JSC \"RU-CENTER\"", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1379, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "blocklist_de": {"n": 1, "p": 0.1659, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.210, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.586, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.210, "se": 1.237, "ts": 1.000, "map": 1.586, "obs": 1, "own": 1.013, "comp": {"cins": -0.1589, "dshield": -0.3624, "crowdsec": -1.4337, "vulncheck": -0.36, "blocklist_de": 4.17}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.969, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-JR15-RIPE", "org": "JSC \"RU-CENTER\"", "pdb": null, "pfx": 28, "reg": "2006-03-07", "rir": "ripencc", "s24": 75, "sib": 10, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22016, "abuse": "abuse@nic.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39521, "h": "TNGNET", "n": "TNGNET B.V.", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3173, "hi": 5.37, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 0.575, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.832, "ts": null, "map": 0.166, "obs": 0, "own": 0.199, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.779, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-TB92-RIPE", "org": "TNGNET B.V.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.tngnet.com"}, "pfx": 42, "reg": "2015-03-09", "rir": "ripencc", "s24": 81, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": "abuse@tngnet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39572, "h": "ADVANCEDHOSTERS-AS", "n": "ADVANCED HOSTING", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.1722, "hi": 4.19, "lo": 0.54, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.171, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.691, "ts": null, "map": 0.114, "obs": 0, "own": 0.037, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-DGGB1-RIPE", "org": "DataWeb Global Group B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://advancedhosting.com"}, "pfx": 89, "reg": "2006-03-21", "rir": "ripencc", "s24": 236, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 73472, "abuse": "abuse@datawebglobalgroup.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.025135256435}, {"a": 39600, "h": "BUNNY-TECHNOLOGY-LLC", "n": "BUNNY-TECHNOLOGY-LLC", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.901, 0.011, 0, false], ["2026-10-12", 1.545, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.545, "se": 0.943, "ts": 0.500, "map": 6.677, "obs": 2, "own": 3.924, "comp": {"cins": -0.3099, "dshield": -0.6638, "crowdsec": 1.6209, "vulncheck": -0.5343, "blocklist_de": 3.1795}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.776, "det": {"blocklist_de": {"ssh": 1}}, "oid": "BTL-272-ARIN", "org": "BUNNY TECHNOLOGY LLC", "pdb": null, "pfx": 30, "reg": "2023-08-28", "rir": "arin", "s24": 36, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000303614382}, {"a": 39603, "h": "P4NET", "n": "PLAY", "t": "Broadband & mobile", "w": 2, "cc": "PL", "cf": {"rb": "hi", "wb": "hi", "rep": 0.88, "waf": 0.77}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0106, "hi": 2.16, "lo": 0.16, "ips": 1, "mean": 0.91, "above": false}, "urlhaus": {"n": 1, "p": 0.1245, "hi": 3.94, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 0.020, 0.098, 0, false], ["2026-10-12", 0.021, 0.108, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.108, "se": 1.358, "ts": 1.000, "map": 0.717, "obs": 1, "own": 2.103, "comp": {"urlhaus": 2.608, "threatfox": -0.4418, "phishing_db": -0.8729}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.021, "se": 1.006, "ts": 1.000, "map": 0.098, "obs": 1, "own": 0.162, "comp": {"cins": -0.2819, "dshield": 3.7317, "crowdsec": -2.4112, "vulncheck": -0.5086, "blocklist_de": -1.4551}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.077, "det": null, "oid": "ORG-PSZO7-RIPE", "org": "P4 Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.play.pl/"}, "pfx": 19, "reg": "2006-03-24", "rir": "ripencc", "s24": 2208, "sib": 10, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 647168, "abuse": "abuse@play.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.083472}, {"a": 39605, "h": "IGUANESOLUTIONS", "n": "Iguane Solutions", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.113, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.478, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ISS11-RIPE", "org": "Iguane Solutions SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.iguanasolutionsusa.com"}, "pfx": 8, "reg": "2006-03-24", "rir": "ripencc", "s24": 32, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@iguanesolutions.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39608, "h": "LANETUA-AS", "n": "Lanet Network", "t": "Broadband & mobile", "w": 4, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2022-39290": 1, "cve:CVE-2024-28000": 3}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.0443, "hi": 2.94, "lo": 0.63, "ips": 4, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.777, 0.009, 0, false], ["2026-10-12", 0.328, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.855, "ts": null, "map": 0.138, "obs": 0, "own": 0.706, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.328, "se": 0.643, "ts": 1.000, "map": 0.796, "obs": 4, "own": 1.242, "comp": {"cins": -0.7333, "dshield": -1.3428, "crowdsec": 7.6781, "vulncheck": -0.7571, "blocklist_de": -3.6799}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.188, "det": null, "oid": "ORG-LNL15-RIPE", "org": "Lanet Network Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.lanet.ua"}, "pfx": 16, "reg": "2006-03-24", "rir": "ripencc", "s24": 796, "sib": 8, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 204032, "abuse": "abuse@lanet.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00723295926117}, {"a": 39611, "h": "Tibo-AS", "n": "Tibo Communications", "t": "Broadband & mobile", "w": 1, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 0.303, 0.012, 0, false]], "sh": false, "uc": 846.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.303, "se": 1.292, "ts": 1.000, "map": 2.539, "obs": 1, "own": 4.522, "comp": {"cins": -0.1231, "dshield": -0.2851, "crowdsec": 3.6768, "vulncheck": -0.3013, "blocklist_de": -0.6418}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.279, "det": null, "oid": "ORG-AOS2-RIPE", "org": "Tibo Communications Sh.p.k", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://tibo.al"}, "pfx": 13, "reg": "2006-03-24", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021252010027}, {"a": 39618, "h": "HostCram", "n": "HostCram AS39618", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.499, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HL157-RIPE", "org": "HostCram LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.hostcram.com"}, "pfx": 2, "reg": "2017-11-03", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@hostcram.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39642, "h": "Sinal-AS", "n": "Sinal", "t": "Broadband & mobile", "w": 3, "cc": "DK", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 1.11, "lo": 0.14, "ips": 2, "mean": 0.53, "above": false}, "dshield": {"n": 1, "p": 0.0110, "hi": 2.18, "lo": 0.16, "ips": 1, "mean": 0.92, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.93, "lo": 0.12, "ips": 2, "mean": 0.44, "above": false}}, "h2": [["2026-10-05", 0.050, 0.007, 0, false], ["2026-10-12", 0.090, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.778, "ts": null, "map": 0.104, "obs": 0, "own": 0.481, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.090, "se": 0.701, "ts": 0.667, "map": 0.242, "obs": 3, "own": 0.381, "comp": {"cins": -0.6295, "dshield": 2.2945, "crowdsec": 2.2121, "vulncheck": -0.7209, "blocklist_de": -3.1795}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.124, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "ORG-EA200-RIPE", "org": "Sinal A/S", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://sinal.dk/"}, "pfx": 41, "reg": "2006-03-31", "rir": "ripencc", "s24": 2182, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 560128, "abuse": "abuse@norlys.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01501472030748}, {"a": 39650, "h": "AtrinCommunication", "n": "Atrin Communications and Information Technology", "t": "Enterprise, edu & gov", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 3027.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 3.335, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 4.414, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.653, "det": null, "oid": "ORG-ACAI3-RIPE", "org": "Atrin Information & Communications Technology Company PJS", "pdb": {"t": "Enterprise", "sc": "Middle East", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.atrinnet.net"}, "pfx": 16, "reg": "2017-11-02", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@atrinnet.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001285260423}, {"a": 39704, "h": "CJ2-AS", "n": "CJ2 Hosting", "t": "Hosting & VPS", "w": 1, "cc": "NL", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3232, "hi": 5.42, "lo": 0.70, "ips": 2, "mean": 2.58, "above": false}, "crowdsec": {"n": 1, "p": 0.1251, "hi": 3.95, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 0.756, 0.011, 0, false], ["2026-10-12", 0.198, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.224, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.198, "se": 1.226, "ts": 1.000, "map": 1.459, "obs": 1, "own": 0.323, "comp": {"cins": -0.1485, "dshield": -0.3402, "crowdsec": 3.3771, "vulncheck": -0.3438, "blocklist_de": -0.773}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.857, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-CH8-RIPE", "org": "CJ2 Hosting B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://cj2.nl"}, "pfx": 15, "reg": "2006-04-12", "rir": "ripencc", "s24": 76, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": "abuse@cj2.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39716, "h": "VIP-LUBLIN-PL-AS", "n": "FIBERPLAY", "t": "Broadband & mobile", "w": 9, "cc": "PL", "cf": null, "cs": {"c": {"home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 2, "mean": 1.88, "above": false}, "blocklist_de": {"n": 4, "p": 0.8016, "hi": 8.91, "lo": 1.92, "ips": 7, "mean": 4.87, "above": true}}, "h2": [["2026-10-05", 8.114, 0.011, 0, false], ["2026-10-12", 13.856, 0.012, 1, false]], "sh": false, "uc": 3968.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 1.835, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 13.856, "se": 0.620, "ts": 0.800, "map": 32.578, "obs": 5, "own": 50.265, "comp": {"cins": -0.9008, "dshield": -1.5599, "crowdsec": -3.1884, "vulncheck": -0.8027, "blocklist_de": 11.3291}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.177, "det": {"blocklist_de": {"imap": 7, "mail": 7}}, "oid": "ORG-VARS1-RIPE", "org": "VIP AGENCJA REKLAMY sp. z o.o", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://fiberplay.pl"}, "pfx": 13, "reg": "2006-04-13", "rir": "ripencc", "s24": 25, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "abuse@vip-net.pl", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 39785, "h": "AXIOMA", "n": "Axioma", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.3826, "hi": 5.93, "lo": 0.77, "ips": 3, "mean": 2.82, "above": false}}, "h2": [["2026-10-12", 0.362, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 1.292, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.362, "se": 0.907, "ts": 1.000, "map": 1.396, "obs": 2, "own": 2.340, "comp": {"cins": -0.2188, "dshield": -0.4865, "crowdsec": -1.9225, "vulncheck": 5.4887, "blocklist_de": -1.1337}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.498, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-AL447-RIPE", "org": "Axioma, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://axioma24.ru"}, "pfx": 36, "reg": "2006-04-25", "rir": "ripencc", "s24": 119, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 33280, "abuse": "abuse@axioma24.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 39791, "h": "TPS-AS", "n": "Telco Pro Services, a. s.", "t": "Transit & backbone", "w": 1, "cc": "CZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1275, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.1667, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.831, 0.011, 0, false], ["2026-10-12", 0.895, 0.012, 0, false]], "sh": false, "uc": 674.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 2.082, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.895, "se": 0.915, "ts": 0.500, "map": 3.639, "obs": 2, "own": 11.835, "comp": {"cins": -0.3399, "dshield": -0.7196, "crowdsec": 1.3197, "vulncheck": -0.5595, "blocklist_de": 2.9845}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.156, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CA786-RIPE", "org": "Telco Pro Services, a. s.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.telcoproservices.cz/"}, "pfx": 3, "reg": "2006-04-25", "rir": "ripencc", "s24": 73, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "noc-telco@cez.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058921771015}, {"a": 39798, "h": "MivoCloud", "n": "MivoCloud", "t": "Hosting & VPS", "w": 9, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 1, "first_seen_30d": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "phishing_db": {"n": 5, "p": 0.9126, "hi": 10.40, "lo": 2.58, "ips": 8, "mean": 5.93, "above": true}}, "h2": [["2026-10-05", 1.937, 20.028, 1, false], ["2026-10-12", 0.384, 20.820, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 20.820, "se": 0.854, "ts": 1.000, "map": 56.705, "obs": 5, "own": 19.338, "comp": {"urlhaus": -0.7074, "threatfox": -0.4188, "phishing_db": 6.7903}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 0.810, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.476, "det": null, "oid": "ORG-MS569-RIPE", "org": "MivoCloud SRL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.mivocloud.com"}, "pfx": 20, "reg": "2015-03-24", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 5888, "abuse": "abuse@mivocloud.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.0001521719355}, {"a": 39812, "h": "KAMENSKTEL-AS", "n": "KAMENSKTEL", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1638, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-12", 0.097, 0.370, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.370, "se": 1.506, "ts": 1.000, "map": 3.462, "obs": 1, "own": 4.095, "comp": {"urlhaus": 3.746, "threatfox": -0.3027, "phishing_db": -0.5752}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.097, "se": 1.159, "ts": 1.000, "map": 0.609, "obs": 1, "own": 0.394, "comp": {"cins": -0.1342, "dshield": -0.3092, "crowdsec": -1.2239, "vulncheck": 3.264, "blocklist_de": -0.699}, "mass": 0.6, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-CJSC9-RIPE", "org": "Closed Joint Stock Company Radiotelephone", "pdb": null, "pfx": 13, "reg": "2006-04-27", "rir": "ripencc", "s24": 164, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 41984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037923217255}, {"a": 39832, "h": "NO-OPERA", "n": "Opera Software AS", "t": "Hosting & VPS", "w": 65, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 23, "data_centre": 52, "web_exploit": 65, "bad_crawling": 28, "web_bruteforce": 56, "cve:CVE-2024-6587": 1, "cve:CVE-2024-48914": 23}, "n": 65}, "ev": {"crowdsec": {"n": 4, "p": 0.7591, "hi": 8.27, "lo": 1.78, "ips": 65, "mean": 4.52, "above": false}}, "h2": [["2026-10-05", 4.589, 0.011, 0, false], ["2026-10-12", 4.871, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.259, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.871, "se": 0.672, "ts": 1.000, "map": 12.640, "obs": 4, "own": 2.500, "comp": {"cins": -0.6054, "dshield": -1.1595, "crowdsec": 9.469, "vulncheck": -0.7113, "blocklist_de": -3.0623}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.092, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-OSA28-RIPE", "org": "Opera Norway AS", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.opera.com/"}, "pfx": 16, "reg": "2006-05-02", "rir": "ripencc", "s24": 40, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "abuse@opera.software", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0305165276698}, {"a": 39845, "h": "LV-2CLOUD-ASN16", "n": "2 Cloud Ltd.", "t": "Hosting & VPS", "w": 8, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 7, "web_exploit": 1, "bad_crawling": 1}, "n": 7}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 7, "mean": 1.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 29.284, 0.011, 1, false], ["2026-10-12", 5.907, 0.013, 0, false]], "sh": false, "uc": 129882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 5.907, "se": 1.049, "ts": 0.500, "map": 30.522, "obs": 2, "own": 6.548, "comp": {"cins": -0.1629, "dshield": -0.3709, "crowdsec": 3.2098, "vulncheck": 2.9835, "blocklist_de": -0.8473}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.673, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-CL378-RIPE", "org": "2 Cloud Ltd.", "pdb": null, "pfx": 5, "reg": "2017-10-19", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@2cloud.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010237097463}, {"a": 39891, "h": "ALJAWWALSTC-AS", "n": "Saudi Telecom Company JSC", "t": "Broadband & mobile", "w": 9, "cc": "SA", "cf": {"rb": "", "wb": "", "rep": 0.35, "waf": 0.37}, "cs": null, "ev": {"dshield": {"n": 5, "p": 0.0361, "hi": 2.85, "lo": 0.71, "ips": 5, "mean": 1.63, "above": false}, "blocklist_de": {"n": 4, "p": 0.0000, "hi": 1.44, "lo": 0.31, "ips": 4, "mean": 0.79, "above": false}}, "h2": [["2026-10-05", 0.012, 0.006, 0, false], ["2026-10-12", 0.196, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.720, "ts": null, "map": 0.076, "obs": 0, "own": 0.343, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.196, "se": 0.502, "ts": 0.556, "map": 0.367, "obs": 9, "own": 0.570, "comp": {"cins": -1.6158, "dshield": 7.3302, "crowdsec": -8.8356, "vulncheck": -0.9087, "blocklist_de": 4.4205}, "mass": 10.2, "listed": false}}, "abq": true, "bot": 0.113, "det": {"blocklist_de": {"bots": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-SSTC1-RIPE", "org": "Saudi Telecom Company JSC", "pdb": null, "pfx": 5044, "reg": "2006-05-10", "rir": "ripencc", "s24": 4981, "sib": 4, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2401792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.279999}, {"a": 39927, "h": "Elight-AS", "n": "E-Light Telecom", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.1065, "hi": 3.61, "lo": 0.47, "ips": 3, "mean": 1.72, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.02, "lo": 0.08, "ips": 1, "mean": 0.43, "above": false}, "blocklist_de": {"n": 1, "p": 0.0050, "hi": 1.92, "lo": 0.14, "ips": 1, "mean": 0.81, "above": false}}, "h2": [["2026-10-05", 0.028, 0.008, 0, false], ["2026-10-12", 0.211, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.120, "obs": 0, "own": 0.575, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.211, "se": 0.640, "ts": 0.500, "map": 0.516, "obs": 4, "own": 0.806, "comp": {"cins": -0.8066, "dshield": 4.8226, "crowdsec": -2.5541, "vulncheck": -0.7788, "blocklist_de": 0.0483}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.397, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-EA385-RIPE", "org": "E-Light-Telecom Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://goodline.info/"}, "pfx": 20, "reg": "2006-05-18", "rir": "ripencc", "s24": 1378, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 354816, "abuse": "abuse@eltc.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00272477382485}, {"a": 40004, "h": "CONRAD", "n": "CONRADIT, LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.8940, "hi": 9.84, "lo": 2.45, "ips": 5, "mean": 5.62, "above": true}, "vulncheck": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.263, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.263, "se": 1.285, "ts": 1.000, "map": 2.095, "obs": 1, "own": 1.415, "comp": {"cins": -0.0909, "dshield": -0.2136, "crowdsec": -0.8461, "vulncheck": 3.7588, "blocklist_de": -0.4751}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.893, "det": {"shodan": {"c2": 1, "compromised": 4}, "vulncheck": {"attack_tooling": 1}}, "oid": "CL-2094-ARIN", "org": "CONRADIT, LLC", "pdb": null, "pfx": 1, "reg": "2024-02-06", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 8192, "abuse": "admin@conradit.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0001231441032}, {"a": 40021, "h": "CONTABO-40021", "n": "Contabo USA", "t": "Hosting & VPS", "w": 85, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 4.54}, "cs": {"c": {"http_flood": 8, "data_centre": 30, "web_exploit": 23, "bad_crawling": 3, "proxy_or_vpn": 5, "first_seen_30d": 8, "ssh_bruteforce": 17, "web_bruteforce": 23, "mail_bruteforce": 3, "cve:CVE-2017-9841": 7, "cve:CVE-2019-9082": 6, "cve:CVE-2018-20062": 8, "cve:CVE-2025-55182": 7, "cve:CVE-2026-63030": 3}, "n": 34}, "ev": {"cins": {"n": 3, "p": 0.4837, "hi": 6.20, "lo": 1.09, "ips": 3, "mean": 3.20, "above": false}, "shodan": {"n": 186, "p": 1.0000, "hi": 92.75, "lo": 72.89, "ips": 186, "mean": 82.57, "above": true}, "dshield": {"n": 3, "p": 0.4417, "hi": 5.88, "lo": 1.04, "ips": 3, "mean": 3.03, "above": false}, "urlhaus": {"n": 1, "p": 0.1759, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 34, "p": 1.0000, "hi": 17.59, "lo": 10.05, "ips": 34, "mean": 13.60, "above": true}, "threatfox": {"n": 12, "p": 1.0000, "hi": 17.82, "lo": 7.05, "ips": 12, "mean": 11.92, "above": true}, "vulncheck": {"n": 20, "p": 1.0000, "hi": 22.18, "lo": 10.74, "ips": 22, "mean": 16.02, "above": true}, "phishing_db": {"n": 9, "p": 0.9935, "hi": 12.18, "lo": 4.21, "ips": 9, "mean": 7.76, "above": true}, "blocklist_de": {"n": 8, "p": 0.9380, "hi": 8.83, "lo": 2.87, "ips": 8, "mean": 5.51, "above": true}}, "h2": [["2026-10-05", 11.260, 6.336, 1, false], ["2026-10-12", 9.127, 6.621, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 12, "phishing_db": 9}, "lo": 6.621, "se": 0.766, "ts": 0.545, "map": 14.053, "obs": 22, "own": 5.048, "comp": {"urlhaus": -0.4231, "threatfox": 2.8529, "phishing_db": 1.8392}, "mass": 11.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 3, "crowdsec": 34, "vulncheck": 20, "blocklist_de": 8}, "lo": 9.127, "se": 0.375, "ts": 0.500, "map": 14.168, "obs": 68, "own": 2.765, "comp": {"cins": 1.1351, "dshield": -1.4258, "crowdsec": 7.1001, "vulncheck": 1.6493, "blocklist_de": -4.414}, "mass": 46.2, "listed": false}}, "abq": false, "bot": 0.879, "det": {"shodan": {"c2": 36, "malware": 3, "compromised": 143, "doublepulsar": 4}, "threatfox": {"family:Mirai": 1, "family:AsyncRAT": 5, "family:Evilginx": 3, "family:AdaptixC2": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 8, "botnet_node": 2, "attack_tooling": 10, "other_infrastructure": 2}, "blocklist_de": {"ftp": 1, "ssh": 4, "bots": 3}}, "oid": "CONTA-48-ARIN", "org": "Contabo Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://contabo.com"}, "pfx": 94, "reg": "2023-05-16", "rir": "arin", "s24": 592, "sib": 0, "tor": 0, "w24": 76, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 151552, "abuse": "abuse@contabo.de", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.04591089591439}, {"a": 40028, "h": "AS40028", "n": "3zCanada", "t": "Transit & backbone", "w": 2, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2018-2392": 1, "cve:CVE-2021-3152": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2023-38950": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3263, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}}, "h2": [["2026-10-05", 2.083, 0.011, 0, false], ["2026-10-12", 0.981, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 2.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.981, "se": 0.918, "ts": 1.000, "map": 4.051, "obs": 2, "own": 13.162, "comp": {"cins": -0.3082, "dshield": -0.6607, "crowdsec": 5.8825, "vulncheck": -0.5328, "blocklist_de": -1.5881}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "SPDNE-ARIN", "org": "1651884 Ontario Inc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.3z.ca"}, "pfx": 49, "reg": "2006-06-09", "rir": "arin", "s24": 59, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34048, "abuse": "SUPPORT@spdnetwork.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012790081773}, {"a": 40029, "h": "NOVUS-3", "n": "Novus Entertainment Inc.", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0533, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "phishing_db": {"n": 1, "p": 0.1490, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.007, 0.187, 0, false], ["2026-10-12", 0.007, 0.197, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.197, "se": 1.407, "ts": 1.000, "map": 1.433, "obs": 1, "own": 4.236, "comp": {"urlhaus": -0.2397, "threatfox": -0.2408, "phishing_db": 2.4664}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.678, "ts": null, "map": 0.109, "obs": 0, "own": 0.273, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.161, "det": {"shodan": {"compromised": 1}}, "oid": "NOVUS-3-ARIN", "org": "Novus Entertainment Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.novusnow.ca"}, "pfx": 94, "reg": "2006-06-09", "rir": "arin", "s24": 260, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 105216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.004934724305}, {"a": 40065, "h": "CNSERVERS", "n": "CNSERVERS", "t": "Hosting & VPS", "w": 16, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0320, "hi": 2.69, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}, "shodan": {"n": 14, "p": 0.5137, "hi": 4.52, "lo": 1.91, "ips": 14, "mean": 3.10, "above": false}, "dshield": {"n": 2, "p": 0.0659, "hi": 3.19, "lo": 0.41, "ips": 2, "mean": 1.52, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 1.34, "lo": 0.24, "ips": 3, "mean": 0.69, "above": false}, "threatfox": {"n": 1, "p": 0.1050, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "phishing_db": {"n": 7, "p": 0.7921, "hi": 7.00, "lo": 2.12, "ips": 8, "mean": 4.26, "above": false}, "blocklist_de": {"n": 3, "p": 0.0247, "hi": 2.65, "lo": 0.47, "ips": 3, "mean": 1.37, "above": false}}, "h2": [["2026-10-05", 0.617, 0.832, 0, false], ["2026-10-12", 0.516, 0.832, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 7}, "lo": 0.832, "se": 0.890, "ts": 0.875, "map": 2.066, "obs": 8, "own": 0.842, "comp": {"urlhaus": -1.4335, "threatfox": 0.0723, "phishing_db": 3.7131}, "mass": 5.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.516, "se": 0.503, "ts": 0.333, "map": 0.977, "obs": 9, "own": 0.193, "comp": {"cins": 1.8105, "dshield": 1.6931, "crowdsec": -2.9314, "vulncheck": -0.905, "blocklist_de": 1.7035}, "mass": 9.8, "listed": false}}, "abq": false, "bot": 0.855, "det": {"shodan": {"compromised": 14}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 3}}, "oid": "CL-17-ARIN", "org": "CNSERVERS LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "http://cnservers.com"}, "pfx": 508, "reg": "2011-04-11", "rir": "arin", "s24": 1800, "sib": 0, "tor": 0, "w24": 15, "drop": 1, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0012]], "ipv4": 653824, "abuse": "HOSTMASTER@cnservers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00887183730366}, {"a": 40092, "h": "ONIAAS", "n": "ONIAAS", "t": "Other", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7230, "hi": 7.82, "lo": 1.68, "ips": 4, "mean": 4.27, "above": false}, "crowdsec": {"n": 1, "p": 0.1220, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "phishing_db": {"n": 3, "p": 0.6210, "hi": 7.46, "lo": 1.31, "ips": 3, "mean": 3.85, "above": false}}, "h2": [["2026-10-05", 1.187, 3.280, 0, false], ["2026-10-12", 0.192, 3.319, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 3.319, "se": 1.002, "ts": 1.000, "map": 11.481, "obs": 3, "own": 11.136, "comp": {"urlhaus": -0.5328, "threatfox": -0.3726, "phishing_db": 4.9723}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.192, "se": 1.222, "ts": 1.000, "map": 1.404, "obs": 1, "own": 0.890, "comp": {"cins": -0.1503, "dshield": -0.344, "crowdsec": 3.356, "vulncheck": -0.3467, "blocklist_de": -0.7822}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.970, "det": {"shodan": {"compromised": 4}}, "oid": "HOSTP-7-ARIN", "org": "HostPapa", "pdb": null, "pfx": 22, "reg": "2006-06-22", "rir": "arin", "s24": 80, "sib": 11, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027314994626}, {"a": 40107, "h": "QTS-DFW", "n": "QTS Dallas", "t": "Transit & backbone", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"bad_crawling": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.250, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 2.261, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.250, "se": 1.260, "ts": 1.000, "map": 1.967, "obs": 1, "own": 7.022, "comp": {"cins": -0.1347, "dshield": -0.3105, "crowdsec": 3.5386, "vulncheck": -0.3213, "blocklist_de": -0.702}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.270, "det": {"shodan": {"c2": 1}}, "oid": "QTS-9-ARIN", "org": "Quality Technology Services, LLC", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.qtsdatacenters.com/data-centers/irving"}, "pfx": 17, "reg": "2014-04-24", "rir": "arin", "s24": 51, "sib": 15, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": "abuse@q.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40156, "h": "THEOPT-HOU", "n": "The Optimal Link Corporation", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1616, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "vulncheck": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1794, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.227, 0.011, 0, false], ["2026-10-12", 1.055, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 0.665, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.055, "se": 0.948, "ts": 0.500, "map": 4.463, "obs": 2, "own": 2.710, "comp": {"cins": -0.2509, "dshield": -0.5505, "crowdsec": -2.1741, "vulncheck": 2.3006, "blocklist_de": 3.5644}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.884, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "THEOPT-2-ARIN", "org": "The Optimal Link Corporation", "pdb": {"t": null, "sc": "North America", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.oplink.net"}, "pfx": 10, "reg": "2006-08-02", "rir": "arin", "s24": 43, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": "abuse@oplink.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40193, "h": "AS-TRIT", "n": "Trit Networks, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.462, "det": null, "oid": "TRITN-ARIN", "org": "Trit Networks, LLC", "pdb": null, "pfx": 8, "reg": "2006-08-16", "rir": "arin", "s24": 40, "sib": 0, "tor": 0, "w24": 0, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": "abuse@trit.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40244, "h": "TURNKEY-INTERNET", "n": "Turnkey Internet", "t": "Transit & backbone", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.5407, "hi": 6.16, "lo": 1.33, "ips": 4, "mean": 3.37, "above": false}, "crowdsec": {"n": 1, "p": 0.0473, "hi": 2.96, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}, "vulncheck": {"n": 1, "p": 0.1518, "hi": 4.24, "lo": 0.32, "ips": 2, "mean": 1.79, "above": false}, "phishing_db": {"n": 5, "p": 0.8789, "hi": 9.46, "lo": 2.35, "ips": 5, "mean": 5.40, "above": true}, "blocklist_de": {"n": 1, "p": 0.1135, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.096, 2.953, 0, false], ["2026-10-12", 0.571, 2.971, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 2.971, "se": 0.896, "ts": 1.000, "map": 8.067, "obs": 5, "own": 27.793, "comp": {"urlhaus": -0.9122, "threatfox": -0.4578, "phishing_db": 5.0839}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.571, "se": 0.755, "ts": 0.333, "map": 1.701, "obs": 3, "own": 5.519, "comp": {"cins": -0.4777, "dshield": -0.9588, "crowdsec": 0.0292, "vulncheck": 1.2323, "blocklist_de": 2.1}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.815, "det": {"shodan": {"compromised": 3, "doublepulsar": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "TURNK-1-ARIN", "org": "Turnkey Internet Inc.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Selective", "web": "https://turnkeyinternet.net"}, "pfx": 40, "reg": "2006-09-21", "rir": "arin", "s24": 227, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 58368, "abuse": "abuse@hivelocity.net", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 40339, "h": "JUMP-TRADING-LLC", "n": "Jump Trading", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 3.274, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 4.192, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.552, "det": null, "oid": "JTL-13-ARIN", "org": "Jump Trading LLC", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.jumptrading.com"}, "pfx": 18, "reg": "2007-01-30", "rir": "arin", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "network@jumptrading.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40355, "h": "SUNDANCE-NET", "n": "Sundance International LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 4.308, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "SIL-58-ARIN", "org": "Sundance International LLC", "pdb": null, "pfx": 10, "reg": "2012-05-08", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "noc@sundanceint.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40389, "h": "BLUERIVER-ASN-0", "n": "Blueriver Networking Services, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"compromised": 1}}, "oid": "BNS-29-ARIN", "org": "Blueriver Networking Services, Inc.", "pdb": null, "pfx": 1, "reg": "2007-02-07", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@blueriver.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40509, "h": "FLY", "n": "FLY", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 8, "p": 0.9364, "hi": 8.79, "lo": 2.86, "ips": 8, "mean": 5.48, "above": true}, "vulncheck": {"n": 4, "p": 0.7304, "hi": 7.91, "lo": 1.70, "ips": 4, "mean": 4.32, "above": false}}, "h2": [["2026-10-05", 0.544, 0.010, 0, false], ["2026-10-12", 0.409, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.930, "ts": null, "map": 0.166, "obs": 0, "own": 0.152, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 0.409, "se": 0.691, "ts": 1.000, "map": 1.047, "obs": 4, "own": 0.217, "comp": {"cins": -0.3975, "dshield": -0.8227, "crowdsec": -3.2414, "vulncheck": 7.9377, "blocklist_de": -2.0369}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.919, "det": {"shodan": {"c2": 7, "compromised": 1}, "vulncheck": {"attack_tooling": 4}}, "oid": "FLYIO-ARIN", "org": "Fly.io, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://fly.io"}, "pfx": 193, "reg": "2017-12-20", "rir": "arin", "s24": 301, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 77056, "abuse": "abuse@fly.io", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00030825384428}, {"a": 40564, "h": "VOCOM-LAX-QUINBY-1", "n": "Vocom International Telecommunication INC", "t": "Broadband & mobile", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"first_seen_30d": 4, "ssh_bruteforce": 10}, "n": 10}, "ev": {"crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 10, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 1.951, 0.011, 0, false], ["2026-10-12", 0.376, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.376, "se": 1.331, "ts": 1.000, "map": 3.394, "obs": 1, "own": 6.155, "comp": {"cins": -0.11, "dshield": -0.2563, "crowdsec": 3.8337, "vulncheck": -0.2774, "blocklist_de": -0.5742}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.269, "det": null, "oid": "VIT-20-ARIN", "org": "VOCOM International Telecommunication, INC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://vocom.com"}, "pfx": 24, "reg": "2008-01-28", "rir": "arin", "s24": 24, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 40663, "h": "INTERNET-SPEECH-AND-PRIVACY-LLC", "n": "Internet Speech & Privacy LLC", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2018-20062": 3, "cve:CVE-2021-41773": 2, "cve:CVE-2021-44228": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "dshield": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 4, "p": 0.7989, "hi": 8.87, "lo": 1.91, "ips": 4, "mean": 4.85, "above": true}}, "h2": [["2026-10-05", 13.524, 0.011, 1, false], ["2026-10-12", 20.776, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.776, "se": 0.621, "ts": 0.800, "map": 49.608, "obs": 5, "own": 27.985, "comp": {"cins": -0.6961, "dshield": 2.0588, "crowdsec": 8.1815, "vulncheck": -0.745, "blocklist_de": -3.5014}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.927, "det": {"shodan": {"compromised": 1}}, "oid": "IL-849-ARIN", "org": "IncogNet LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://isp.llc"}, "pfx": 12, "reg": "2025-03-26", "rir": "arin", "s24": 12, "sib": 0, "tor": 4, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@as40663.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00017931806685}, {"a": 40676, "h": "AS40676", "n": "Psychz Networks", "t": "Hosting & VPS", "w": 30, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 12, "data_centre": 3, "web_exploit": 18, "bad_crawling": 11, "proxy_or_vpn": 2, "ssh_bruteforce": 9, "web_bruteforce": 14, "home_connection": 4, "mail_bruteforce": 2, "cve:CVE-2012-3153": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2017-12149": 5, "cve:CVE-2018-13379": 5, "cve:CVE-2025-22457": 2}, "n": 19}, "ev": {"cins": {"n": 1, "p": 0.0994, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "shodan": {"n": 5, "p": 0.2373, "hi": 4.18, "lo": 1.04, "ips": 5, "mean": 2.39, "above": false}, "crowdsec": {"n": 16, "p": 0.9923, "hi": 8.43, "lo": 3.76, "ips": 19, "mean": 5.90, "above": true}, "threatfox": {"n": 1, "p": 0.1555, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 6, "p": 0.8771, "hi": 8.64, "lo": 2.40, "ips": 9, "mean": 5.10, "above": true}, "blocklist_de": {"n": 1, "p": 0.0321, "hi": 2.70, "lo": 0.20, "ips": 1, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 2.750, 0.105, 0, false], ["2026-10-12", 2.529, 0.111, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.111, "se": 1.365, "ts": 1.000, "map": 0.705, "obs": 1, "own": 0.339, "comp": {"urlhaus": -0.3131, "threatfox": 2.1247, "phishing_db": -0.5358}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 16, "vulncheck": 6, "blocklist_de": 1}, "lo": 2.529, "se": 0.422, "ts": 0.667, "map": 4.201, "obs": 24, "own": 0.824, "comp": {"cins": 0.5798, "dshield": -2.6459, "crowdsec": 11.2166, "vulncheck": 1.188, "blocklist_de": -7.5094}, "mass": 16.5, "listed": false}}, "abq": false, "bot": 0.783, "det": {"shodan": {"malware": 2, "compromised": 3}, "threatfox": {"family:RansomHub": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 8}, "blocklist_de": {"ssh": 1}}, "oid": "PS-184-ARIN", "org": "Psychz Networks", "pdb": {"t": "Content", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.psychz.net"}, "pfx": 465, "reg": "2008-02-26", "rir": "arin", "s24": 708, "sib": 0, "tor": 1, "w24": 24, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 195840, "abuse": "abuse@psychz.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": ["crowdsec"], "traffic": 0.0183079087749}, {"a": 40861, "h": "PARAD-40-ASN", "n": "Paradise Networks", "t": "Other", "w": 20, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4427": 1, "cve:CVE-2025-4428": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1800, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1197, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "threatfox": {"n": 7, "p": 0.9872, "hi": 12.98, "lo": 3.93, "ips": 17, "mean": 7.90, "above": true}, "phishing_db": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 12.045, 6.455, 1, false], ["2026-10-12", 0.752, 11.293, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 1}, "lo": 11.293, "se": 0.804, "ts": 0.875, "map": 26.834, "obs": 8, "own": 24.563, "comp": {"urlhaus": -1.0453, "threatfox": 5.8806, "phishing_db": 0.0805}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.752, "se": 0.905, "ts": 0.500, "map": 3.027, "obs": 2, "own": 1.769, "comp": {"cins": -0.3229, "dshield": 3.5418, "crowdsec": 1.4898, "vulncheck": -0.5454, "blocklist_de": -1.662}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.648, "det": {"threatfox": {"family:DCRat": 4, "family:Remcos": 6, "family:PureRAT": 1, "family:AsyncRAT": 6}}, "oid": "PARAD-40-ARIN", "org": "Paradise Networks LLC", "pdb": null, "pfx": 83, "reg": "2008-05-05", "rir": "arin", "s24": 83, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 21248, "abuse": "netops+ipy@certida.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.0000054130927}, {"a": 40880, "h": "NAICOM", "n": "NAICOM CORPORATION", "t": "Hosting & VPS", "w": 14, "cc": "PR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4214, "hi": 6.28, "lo": 0.82, "ips": 14, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 4.449, 0.011, 0, false], ["2026-10-12", 4.149, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.149, "se": 1.031, "ts": 1.000, "map": 20.305, "obs": 2, "own": 4.419, "comp": {"cins": -0.1363, "dshield": -0.3139, "crowdsec": -1.2424, "vulncheck": 6.8074, "blocklist_de": -0.7101}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.196, "det": {"vulncheck": {"botnet_node": 14}}, "oid": "NC-1182-ARIN", "org": "NAICOM CORPORATION", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://site.naicom.com"}, "pfx": 3, "reg": "2020-04-23", "rir": "arin", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000168410277}, {"a": 40994, "h": "Alwyzon", "n": "Alwyzon", "t": "Hosting & VPS", "w": 1, "cc": "AT", "cf": null, "cs": {"c": {"data_centre": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6128, "hi": 7.38, "lo": 1.30, "ips": 3, "mean": 3.80, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.352, 0.011, 0, false], ["2026-10-12", 0.376, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.376, "se": 1.331, "ts": 1.000, "map": 3.394, "obs": 1, "own": 0.785, "comp": {"cins": -0.11, "dshield": -0.2563, "crowdsec": 3.8337, "vulncheck": -0.2774, "blocklist_de": -0.5742}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.554, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-MH145-RIPE", "org": "Hohl IT e.U.", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.alwyzon.com"}, "pfx": 24, "reg": "2020-10-06", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@alwyzon.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008088753582}, {"a": 41009, "h": "VIZITNETUA-AS", "n": "PE Vizit-Service", "t": "Broadband & mobile", "w": 45, "cc": "UA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6437, "hi": 7.71, "lo": 1.36, "ips": 45, "mean": 3.98, "above": false}}, "h2": [["2026-10-12", 5.372, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 5.372, "se": 0.819, "ts": 1.000, "map": 17.587, "obs": 3, "own": 28.975, "comp": {"cins": -0.231, "dshield": -0.511, "crowdsec": -2.0191, "vulncheck": 8.218, "blocklist_de": -1.1961}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.311, "det": {"vulncheck": {"botnet_node": 45}}, "oid": "ORG-OM82-RIPE", "org": "Oleksandr Melnyk", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://vizit-net.com"}, "pfx": 7, "reg": "2006-05-30", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046990930497}, {"a": 41046, "h": "NEJTV-AS", "n": "Nej TV a.s.", "t": "Broadband & mobile", "w": 3, "cc": "CZ", "cf": null, "cs": {"c": {"home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2351, "hi": 4.70, "lo": 0.61, "ips": 2, "mean": 2.24, "above": false}, "blocklist_de": {"n": 1, "p": 0.1455, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-12", 1.162, 0.410, 0, false]], "sh": false, "uc": 503.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.410, "se": 1.526, "ts": 1.000, "map": 3.960, "obs": 1, "own": 11.728, "comp": {"urlhaus": 3.8288, "threatfox": -0.2858, "phishing_db": -0.5406}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.162, "se": 0.746, "ts": 0.667, "map": 3.442, "obs": 3, "own": 5.398, "comp": {"cins": -0.5369, "dshield": -1.0542, "crowdsec": 3.1776, "vulncheck": -0.6811, "blocklist_de": 1.7244}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.187, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-STAN1-RIPE", "org": "O2 Czech Republic, a.s.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.nej.cz"}, "pfx": 8, "reg": "2006-06-06", "rir": "ripencc", "s24": 128, "sib": 15, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 53248, "abuse": "abuse@o2.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020881112735}, {"a": 41075, "h": "ATW-AS", "n": "ATW Internet Kft.", "t": "Hosting & VPS", "w": 8, "cc": "HU", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 2, "web_exploit": 7, "bad_crawling": 5, "proxy_or_vpn": 7, "ssh_bruteforce": 6, "web_bruteforce": 8, "mail_bruteforce": 5, "cve:CVE-2017-9841": 5, "cve:CVE-2020-5902": 1, "cve:CVE-2018-20062": 5, "cve:CVE-2021-41773": 3, "cve:CVE-2021-43798": 1}, "n": 8}, "ev": {"crowdsec": {"n": 4, "p": 0.6730, "hi": 7.28, "lo": 1.57, "ips": 8, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 8.870, 0.011, 0, false], ["2026-10-12", 2.181, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.007, "ts": null, "map": 0.184, "obs": 0, "own": 0.211, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.181, "se": 0.662, "ts": 1.000, "map": 5.582, "obs": 4, "own": 1.106, "comp": {"cins": -0.6422, "dshield": -1.214, "crowdsec": 8.9362, "vulncheck": -0.7257, "blocklist_de": -3.2411}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.894, "det": null, "oid": "ORG-AIK1-RIPE", "org": "ATW Internet Kft.", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://atw.hu"}, "pfx": 31, "reg": "2006-06-09", "rir": "ripencc", "s24": 97, "sib": 0, "tor": 7, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30464, "abuse": "abuse@atw.co.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050321767504}, {"a": 41079, "h": "CF-GDA", "n": "Cyber_Folks S.A.", "t": "Other", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 2}, "n": 3}, "ev": {"shodan": {"n": 6, "p": 0.9419, "hi": 10.44, "lo": 2.90, "ips": 6, "mean": 6.17, "above": true}, "crowdsec": {"n": 3, "p": 0.5361, "hi": 6.64, "lo": 1.17, "ips": 3, "mean": 3.43, "above": false}}, "h2": [["2026-10-05", 3.095, 0.011, 0, false], ["2026-10-12", 1.995, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 0.611, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.995, "se": 0.757, "ts": 1.000, "map": 6.073, "obs": 3, "own": 3.480, "comp": {"cins": -0.4738, "dshield": -0.9523, "crowdsec": 7.6883, "vulncheck": -0.6487, "blocklist_de": -2.416}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.990, "det": {"shodan": {"compromised": 6}}, "oid": "ORG-OSZO10-RIPE", "org": "Cyber_Folks S.A.", "pdb": null, "pfx": 24, "reg": "2006-06-09", "rir": "ripencc", "s24": 63, "sib": 6, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 16128, "abuse": "abuse@cyberfolks.pl", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00055570004178}, {"a": 41096, "h": "TIM-UMAN-AS", "n": "TOV TV&Radio Company 'TIM'", "t": "Broadband & mobile", "w": 2, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4103, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-12", 1.464, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.464, "se": 0.939, "ts": 1.000, "map": 6.236, "obs": 2, "own": 9.992, "comp": {"cins": -0.2907, "dshield": 8.0084, "crowdsec": -2.4772, "vulncheck": -0.5169, "blocklist_de": -1.4996}, "mass": 1.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-TIM3-RIPE", "org": "TOV TV&Radio Company 'TIM'", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://itim.net"}, "pfx": 38, "reg": "2006-06-14", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00103114749969}, {"a": 41151, "h": "DIGITALIT-AS", "n": "Digital IT Consulting SRL", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.636, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SDIC1-RIPE", "org": "Digital IT Consulting SRL", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.digitalit.ro"}, "pfx": 2, "reg": "2006-06-21", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005234600133}, {"a": 41155, "h": "orbitdc", "n": "Orbit Telekom Sanayi ve Ticaret Limited Sirketi", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 1.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.210, "det": null, "oid": "ORG-DYTS1-RIPE", "org": "Orbit Telekom Sanayi ve Ticaret Limited Sirketi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://orbittelekom.com"}, "pfx": 19, "reg": "2021-02-10", "rir": "ripencc", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@orbittelekom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 41202, "h": "UNITEL", "n": "Unitel Uzbekistan", "t": "Other", "w": 4, "cc": "UZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "dshield": {"n": 2, "p": 0.4145, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1879, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.951, 0.011, 0, false], ["2026-10-12", 8.310, 0.012, 0, false]], "sh": false, "uc": 1920.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 8.310, "se": 0.680, "ts": 0.500, "map": 21.778, "obs": 4, "own": 12.367, "comp": {"cins": -0.623, "dshield": 5.8221, "crowdsec": -1.1895, "vulncheck": -0.7183, "blocklist_de": 1.1833}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-UL64-RIPE", "org": "UNITEL LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://beeline.uz"}, "pfx": 17, "reg": "2006-06-29", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "abuse@beeline.uz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0084904658648}, {"a": 41280, "h": "BG-SKYNET", "n": "SKYNET BULGARIA Ltd.", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.532, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.173, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-SBL7-RIPE", "org": "SKYNET BULGARIA Ltd.", "pdb": null, "pfx": 5, "reg": "2015-02-27", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000895239982}, {"a": 41281, "h": "KEFF", "n": "KeFF Networks", "t": "Hosting & VPS", "w": 13, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 12, "web_exploit": 13, "bad_crawling": 13, "proxy_or_vpn": 13, "ssh_bruteforce": 1, "web_bruteforce": 13, "mail_bruteforce": 9, "cve:CVE-2012-3153": 2, "cve:CVE-2015-9406": 6, "cve:CVE-2017-9841": 12, "cve:CVE-2018-13379": 4, "cve:CVE-2018-20062": 5}, "n": 13}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 13, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 21.661, 0.011, 1, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 2.871, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.663, "det": null, "oid": "ORG-KNL18-RIPE", "org": "KeFF Networks Ltd", "pdb": {"t": "Non-Profit", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://keff.org"}, "pfx": 4, "reg": "2012-09-10", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 13, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@as41281.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 41313, "h": "NOVATEL-AS", "n": "Novatel", "t": "Transit & backbone", "w": 6, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3490, "hi": 5.63, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "threatfox": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 6, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.226, 0.360, 0, false], ["2026-10-12", 0.010, 0.373, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.373, "se": 1.500, "ts": 1.000, "map": 3.440, "obs": 1, "own": 14.385, "comp": {"urlhaus": -0.1264, "threatfox": 3.2669, "phishing_db": -0.2787}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.184, "obs": 0, "own": 1.363, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"c2": 2}, "threatfox": {"family:Unknown malware": 6}}, "oid": "ORG-NA318-RIPE", "org": "\"NOVATEL\" EOOD", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.novatel.bg"}, "pfx": 23, "reg": "2006-07-21", "rir": "ripencc", "s24": 55, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45312, "abuse": "abuse@novatel.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018682868564}, {"a": 41329, "h": "BITEL-AS-RIPE", "n": "Sky Mobile", "t": "Broadband & mobile", "w": 1, "cc": "KG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.457, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.457, "se": 1.371, "ts": 1.000, "map": 4.431, "obs": 1, "own": 8.229, "comp": {"cins": -0.1078, "dshield": -0.2513, "crowdsec": -0.9952, "vulncheck": -0.2732, "blocklist_de": 4.5098}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.193, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-ML768-RIPE", "org": "\"Sky Mobile\" LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.beeline.kg"}, "pfx": 19, "reg": "2006-07-25", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00252113260356}, {"a": 41330, "h": "T2-NOVOSIBIRSK-AS", "n": "T2 Novosibirsk", "t": "Other", "w": 8, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 7, "p": 0.9826, "hi": 12.25, "lo": 3.71, "ips": 8, "mean": 7.45, "above": true}}, "h2": [["2026-10-12", 3.548, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 7, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.548, "se": 0.538, "ts": 1.000, "map": 7.278, "obs": 7, "own": 4.107, "comp": {"cins": -1.0491, "dshield": 17.2015, "crowdsec": -6.775, "vulncheck": -0.8338, "blocklist_de": -5.1651}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.357, "det": null, "oid": "ORG-MCC1-RIPE", "org": "T2 Mobile LLC", "pdb": {"t": null, "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://msk.t2.ru/"}, "pfx": 6, "reg": "2006-07-25", "rir": "ripencc", "s24": 136, "sib": 8, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 35840, "abuse": "abuse_ripe@t2.ru", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00805442827035}, {"a": 41344, "h": "VOL-AS", "n": "Vist on-line", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1929, "hi": 4.68, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.288, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.729, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.288, "se": 1.300, "ts": 1.000, "map": 2.369, "obs": 1, "own": 1.611, "comp": {"cins": -0.0869, "dshield": -0.2044, "crowdsec": -0.8097, "vulncheck": 3.811, "blocklist_de": -0.4539}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.488, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-VOL2-RIPE", "org": "Vist on-line LTD", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "https://volgaspot.ru/"}, "pfx": 13, "reg": "2006-07-27", "rir": "ripencc", "s24": 27, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "support@volgaspot.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008309095872}, {"a": 41354, "h": "its-tg", "n": "ITS Technology Group", "t": "Broadband & mobile", "w": 1, "cc": "GB", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0099, "hi": 2.14, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}}, "h2": [["2026-10-12", 0.062, 0.010, 0, false]], "sh": false, "uc": 77.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 0.857, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.062, "se": 1.095, "ts": 1.000, "map": 0.357, "obs": 1, "own": 0.597, "comp": {"cins": -0.2157, "dshield": -0.4803, "crowdsec": 2.6156, "vulncheck": -0.437, "blocklist_de": -1.118}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.177, "det": null, "oid": "ORG-ITGL2-RIPE", "org": "ITS Technology Group Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.itstechnologygroup.com/"}, "pfx": 42, "reg": "2017-08-10", "rir": "ripencc", "s24": 458, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 119296, "abuse": "support@itstechnologygroup.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00784986888348}, {"a": 41368, "h": "TVALMANSA-ASN", "n": "Spotting Brands Technologies S.L.", "t": "Broadband & mobile", "w": 19, "cc": "ES", "cf": null, "cs": {"c": {"mail_bruteforce": 7, "router_or_botnet": 1}, "n": 7}, "ev": {"crowdsec": {"n": 3, "p": 0.4036, "hi": 5.60, "lo": 0.99, "ips": 7, "mean": 2.89, "above": false}, "blocklist_de": {"n": 7, "p": 0.9745, "hi": 11.38, "lo": 3.45, "ips": 15, "mean": 6.92, "above": true}}, "h2": [["2026-10-05", 5.208, 0.010, 0, false], ["2026-10-12", 7.180, 0.011, 0, false]], "sh": false, "uc": 2548.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 1.224, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 7}, "lo": 7.180, "se": 0.487, "ts": 0.700, "map": 13.497, "obs": 10, "own": 20.721, "comp": {"cins": -1.6875, "dshield": -2.3281, "crowdsec": -3.6522, "vulncheck": -0.9151, "blocklist_de": 12.5791}, "mass": 10.8, "listed": false}}, "abq": false, "bot": 0.169, "det": {"blocklist_de": {"imap": 14, "mail": 15}}, "oid": "ORG-SBTS6-RIPE", "org": "Spotting Brands Technologies S.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.populoos.es/"}, "pfx": 77, "reg": "2006-08-02", "rir": "ripencc", "s24": 145, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43520, "abuse": "abuse.es@masorange.es", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00076427080269}, {"a": 41419, "h": "KAZRENA-AS", "n": "KazRENA", "t": "Other", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.178, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KA99-RIPE", "org": "KazRENA", "pdb": null, "pfx": 2, "reg": "2006-08-16", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005457157349}, {"a": 41436, "h": "CloudWebManage-EU", "n": "Kamatera EU", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.7797, "hi": 8.57, "lo": 1.84, "ips": 4, "mean": 4.68, "above": false}, "crowdsec": {"n": 2, "p": 0.3685, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}, "phishing_db": {"n": 1, "p": 0.1923, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 22.625, 0.457, 1, false], ["2026-10-12", 3.846, 0.476, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.476, "se": 1.549, "ts": 1.000, "map": 4.917, "obs": 1, "own": 2.250, "comp": {"urlhaus": -0.1058, "threatfox": -0.1327, "phishing_db": 3.4575}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.846, "se": 0.774, "ts": 0.667, "map": 12.019, "obs": 3, "own": 2.401, "comp": {"cins": -0.476, "dshield": -0.956, "crowdsec": 3.8511, "vulncheck": -0.6499, "blocklist_de": 2.1109}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.654, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-KI35-RIPE", "org": "Kamatera Inc", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.kamatera.com"}, "pfx": 32, "reg": "2015-08-11", "rir": "ripencc", "s24": 32, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@cloudwm.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001571329875}, {"a": 41496, "h": "RO-TVSAT-AS", "n": "TV SAT 2002", "t": "Broadband & mobile", "w": 3, "cc": "RO", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 3, "p": 0.6406, "hi": 7.68, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 0.009, 7.837, 0, false], ["2026-10-12", 0.009, 8.629, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 8.629, "se": 0.993, "ts": 1.000, "map": 31.557, "obs": 3, "own": 69.579, "comp": {"urlhaus": 6.6213, "threatfox": -0.5117, "phishing_db": -1.0316}, "mass": 4.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.795, "ts": null, "map": 0.153, "obs": 0, "own": 0.465, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.195, "det": null, "oid": "ORG-TSS37-RIPE", "org": "TV SAT 2002 SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.tvsatrm.ro"}, "pfx": 41, "reg": "2006-09-01", "rir": "ripencc", "s24": 107, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27392, "abuse": "abuse@tvsat.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041638120146}, {"a": 41508, "h": "PL-IWACOM-AS", "n": "IWACOM Sp. z o.o.", "t": "Broadband & mobile", "w": 1, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7728, "hi": 8.47, "lo": 1.82, "ips": 4, "mean": 4.62, "above": false}, "vulncheck": {"n": 1, "p": 0.1904, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.238, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 1.693, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.238, "se": 1.270, "ts": 1.000, "map": 1.847, "obs": 1, "own": 3.390, "comp": {"cins": -0.0952, "dshield": -0.2231, "crowdsec": -0.8836, "vulncheck": 3.7061, "blocklist_de": -0.497}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.416, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-ZMWS1-RIPE", "org": "ZINET.NET.PL Sp. z.o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.iwacom.pl"}, "pfx": 20, "reg": "2006-09-05", "rir": "ripencc", "s24": 38, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": "abuse@zinet.net.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057969999906}, {"a": 41560, "h": "UT-SVR", "n": "UGMK-Telecom LLC", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0615, "hi": 3.17, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "blocklist_de": {"n": 2, "p": 0.3025, "hi": 5.24, "lo": 0.68, "ips": 2, "mean": 2.50, "above": false}}, "h2": [["2026-10-05", 0.396, 0.010, 0, false], ["2026-10-12", 0.899, 0.011, 0, false]], "sh": false, "uc": 370, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.175, "obs": 0, "own": 1.138, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.899, "se": 0.742, "ts": 0.667, "map": 2.638, "obs": 3, "own": 4.138, "comp": {"cins": -0.5926, "dshield": -1.1402, "crowdsec": -0.9453, "vulncheck": -0.706, "blocklist_de": 5.7476}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.440, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-UL18-RIPE", "org": "UGMK-Telecom LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://ugmk-telecom.ru/"}, "pfx": 55, "reg": "2006-09-14", "rir": "ripencc", "s24": 187, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51200, "abuse": "ripe@ugmk-telecom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00043741334175}, {"a": 41564, "h": "AS41564", "n": "Packet Exchange AS41564", "t": "Hosting & VPS", "w": 67, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 38, "web_exploit": 48, "bad_crawling": 8, "proxy_or_vpn": 21, "ssh_bruteforce": 10, "web_bruteforce": 52, "mail_bruteforce": 3, "cve:CVE-2017-9841": 35, "cve:CVE-2017-16894": 4, "cve:CVE-2022-35914": 40, "cve:CVE-2022-46604": 35, "cve:CVE-2023-49103": 7}, "n": 52}, "ev": {"crowdsec": {"n": 4, "p": 0.5112, "hi": 5.96, "lo": 1.28, "ips": 52, "mean": 3.25, "above": false}, "vulncheck": {"n": 1, "p": 0.1564, "hi": 4.29, "lo": 0.32, "ips": 15, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.971, 0.010, 0, false], ["2026-10-12", 1.341, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.959, "ts": null, "map": 0.174, "obs": 0, "own": 0.172, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.341, "se": 0.616, "ts": 0.800, "map": 3.128, "obs": 5, "own": 0.622, "comp": {"cins": -0.7318, "dshield": -1.3408, "crowdsec": 7.6978, "vulncheck": 0.5815, "blocklist_de": -3.6729}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.790, "det": {"vulncheck": {"botnet_node": 15}, "blocklist_de": {"bots": 1}}, "oid": "ORG-ONL20-RIPE", "org": "Orion Network Limited", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://packetexchange.eu"}, "pfx": 197, "reg": "2017-07-20", "rir": "ripencc", "s24": 202, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51968, "abuse": "abuse@packetexchange.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00156160215717}, {"a": 41608, "h": "NextGenWebs-NL", "n": "NextGenWebs, S.L.", "t": "Other", "w": 21, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 19, "data_centre": 1, "web_exploit": 19, "bad_crawling": 10, "ssh_bruteforce": 12, "web_bruteforce": 18, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-34351": 1, "cve:CVE-2025-30208": 2}, "n": 20}, "ev": {"shodan": {"n": 2, "p": 0.4076, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 5, "p": 0.9070, "hi": 10.21, "lo": 2.54, "ips": 20, "mean": 5.83, "above": true}, "vulncheck": {"n": 1, "p": 0.1966, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 61.716, 0.011, 1, false], ["2026-10-12", 35.207, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 1}, "lo": 35.207, "se": 0.557, "ts": 0.714, "map": 74.447, "obs": 7, "own": 41.972, "comp": {"cins": -0.9047, "dshield": -1.5647, "crowdsec": 8.4278, "vulncheck": 0.2928, "blocklist_de": -0.5475}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.986, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-NS394-RIPE", "org": "NextGenWebs, S.L.", "pdb": null, "pfx": 11, "reg": "2017-07-19", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse@nextgenwebs.es", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0008508073225}, {"a": 41634, "h": "SVEA", "n": "svea.net", "t": "Other", "w": 1, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.791, "det": null, "oid": "ORG-SHA74-RIPE", "org": "Svea Hosting AB", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://svea.net"}, "pfx": 3, "reg": "2020-03-27", "rir": "ripencc", "s24": 3, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@svea.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018053163956}, {"a": 41653, "h": "AQUARAY", "n": "Aqua Ray", "t": "Hosting & VPS", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.327, 0.011, 0, false], ["2026-10-12", 0.347, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.347, "se": 1.316, "ts": 1.000, "map": 3.042, "obs": 1, "own": 0.698, "comp": {"cins": -0.115, "dshield": -0.2672, "crowdsec": 3.7746, "vulncheck": -0.2866, "blocklist_de": -0.5996}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.930, "det": null, "oid": "ORG-ARS22-RIPE", "org": "Aqua Ray SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.aquaray.com"}, "pfx": 10, "reg": "2006-09-28", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "abuse@aquaray.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 41661, "h": "ERTH-CHEL-AS", "n": "JSC \"ER-Telecom Holding\" Chelyabinsk branch", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1895, "hi": 4.33, "lo": 0.56, "ips": 2, "mean": 2.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.1307, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.405, 0.010, 0, false], ["2026-10-12", 0.903, 0.011, 0, false]], "sh": false, "uc": 322.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.970, "ts": null, "map": 0.177, "obs": 0, "own": 1.168, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.903, "se": 0.741, "ts": 0.667, "map": 2.648, "obs": 3, "own": 4.154, "comp": {"cins": -0.55, "dshield": -1.0747, "crowdsec": 3.0374, "vulncheck": -0.6872, "blocklist_de": 1.642}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.465, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 39, "reg": "2006-10-02", "rir": "ripencc", "s24": 171, "sib": 121, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 70400, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004741046618}, {"a": 41668, "h": "ERTH-KAZAN-AS", "n": "JSC \"ER-Telecom\" Holding Kazan branch", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 3, "p": 0.2705, "hi": 4.69, "lo": 0.83, "ips": 3, "mean": 2.42, "above": false}, "blocklist_de": {"n": 1, "p": 0.1082, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 2.224, 0.010, 0, false], ["2026-10-12", 1.381, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.170, "obs": 0, "own": 1.048, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.381, "se": 0.603, "ts": 0.600, "map": 3.151, "obs": 5, "own": 4.890, "comp": {"cins": -0.8656, "dshield": 1.5054, "crowdsec": 3.0065, "vulncheck": -0.7942, "blocklist_de": -0.3108}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.446, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 61, "reg": "2006-10-03", "rir": "ripencc", "s24": 246, "sib": 121, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 114944, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00101130402065}, {"a": 41676, "h": "JMDI", "n": "JMDI", "t": "Broadband & mobile", "w": 3, "cc": "PL", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 3, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.158, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 1.450, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.158, "se": 1.215, "ts": 1.000, "map": 1.101, "obs": 1, "own": 1.979, "comp": {"cins": -0.1129, "dshield": -0.2627, "crowdsec": -1.0402, "vulncheck": 3.4947, "blocklist_de": -0.5892}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.140, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-JJM1-RIPE", "org": "JMDI Jacek Maleszko", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.jmdi.pl"}, "pfx": 9, "reg": "2006-10-05", "rir": "ripencc", "s24": 76, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": "abuse@jmdi.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00345841652442}, {"a": 41733, "h": "ZTELECOM-AS", "n": "Perspektiva, Ltd", "t": "Broadband & mobile", "w": 6, "cc": "RU", "cf": {"rb": "lo", "wb": null, "rep": 1.71, "waf": null}, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.1326, "hi": 3.85, "lo": 0.50, "ips": 2, "mean": 1.83, "above": false}, "urlhaus": {"n": 1, "p": 0.1553, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 1, "p": 0.0456, "hi": 2.93, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "blocklist_de": {"n": 2, "p": 0.0347, "hi": 2.78, "lo": 0.36, "ips": 2, "mean": 1.33, "above": false}}, "h2": [["2026-10-05", 0.287, 0.557, 0, false], ["2026-10-12", 0.301, 0.151, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.151, "se": 1.384, "ts": 1.000, "map": 1.072, "obs": 1, "own": 3.096, "comp": {"urlhaus": 2.9236, "threatfox": -0.4149, "phishing_db": -0.8134}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.301, "se": 0.611, "ts": 0.400, "map": 0.693, "obs": 5, "own": 1.086, "comp": {"cins": -0.9032, "dshield": 4.3444, "crowdsec": -6.1178, "vulncheck": 0.2949, "blocklist_de": 3.4089}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.449, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.interzet.ru"}, "pfx": 137, "reg": "2006-10-16", "rir": "ripencc", "s24": 1179, "sib": 121, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 410112, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00291101918415}, {"a": 41745, "h": "FORTIS-AS", "n": "Baykov Ilya Sergeevich, Hosting services", "t": "Hosting & VPS", "w": 24, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 5, "bad_crawling": 5, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2023-50164": 2, "cve:CVE-2025-54236": 1}, "n": 8}, "ev": {"cins": {"n": 3, "p": 0.5814, "hi": 7.06, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}, "shodan": {"n": 10, "p": 0.9934, "hi": 11.32, "lo": 4.12, "ips": 10, "mean": 7.34, "above": true}, "dshield": {"n": 1, "p": 0.1495, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 8, "p": 0.9408, "hi": 8.91, "lo": 2.90, "ips": 8, "mean": 5.56, "above": true}, "vulncheck": {"n": 6, "p": 0.9445, "hi": 10.55, "lo": 2.93, "ips": 6, "mean": 6.24, "above": true}, "phishing_db": {"n": 4, "p": 0.7550, "hi": 8.22, "lo": 1.77, "ips": 5, "mean": 4.49, "above": false}, "blocklist_de": {"n": 1, "p": 0.1118, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 6.988, 2.162, 0, false], ["2026-10-12", 6.149, 2.158, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 2.158, "se": 0.941, "ts": 1.000, "map": 6.397, "obs": 4, "own": 2.438, "comp": {"urlhaus": -0.7839, "threatfox": -0.4349, "phishing_db": 4.7008}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 8, "vulncheck": 6, "blocklist_de": 1}, "lo": 6.149, "se": 0.443, "ts": 0.421, "map": 10.594, "obs": 19, "own": 2.079, "comp": {"cins": 6.9602, "dshield": -0.9397, "crowdsec": 2.5465, "vulncheck": 1.6035, "blocklist_de": -6.4165}, "mass": 13.7, "listed": false}}, "abq": false, "bot": 0.568, "det": {"shodan": {"malware": 1, "compromised": 9}, "vulncheck": {"c2_server": 6}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HIP1-RIPE", "org": "Baykov Ilya Sergeevich", "pdb": null, "pfx": 233, "reg": "2021-02-05", "rir": "ripencc", "s24": 233, "sib": 0, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.9962], ["2026-10-12", 0.8435]], "ipv4": 59648, "abuse": "abuse@fortis.host", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00295808157339}, {"a": 41750, "h": "AS-MEGALINE-KG", "n": "Megaline Ltd.", "t": "Broadband & mobile", "w": 4, "cc": "KG", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1503, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "dshield": {"n": 1, "p": 0.1388, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "blocklist_de": {"n": 2, "p": 0.2472, "hi": 4.80, "lo": 0.62, "ips": 2, "mean": 2.29, "above": false}}, "h2": [["2026-10-12", 1.006, 0.011, 0, false]], "sh": false, "uc": 92.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.993, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.006, "se": 0.657, "ts": 0.500, "map": 2.546, "obs": 4, "own": 3.968, "comp": {"cins": 3.417, "dshield": 1.5947, "crowdsec": -5.7973, "vulncheck": -0.7869, "blocklist_de": 3.9007}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.210, "det": {"blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NA222-RIPE", "org": "Mega-Line Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "http://mega.kg"}, "pfx": 25, "reg": "2006-10-19", "rir": "ripencc", "s24": 292, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 133120, "abuse": "abuse@mega.kg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00248422163643}, {"a": 41770, "h": "IMINGO", "n": "Leonard Birritteri trading as IMINGO SERVICES", "t": "Other", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.631, "det": null, "oid": "ORG-IS68-RIPE", "org": "Leonard Birritteri trading as IMINGO SERVICES", "pdb": null, "pfx": 1, "reg": "2006-10-23", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 41798, "h": "TTC-AS", "n": "Transtelecom Kazakhstan", "t": "Broadband & mobile", "w": 7, "cc": "KZ", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"crowdsec": {"n": 4, "p": 0.5429, "hi": 6.18, "lo": 1.33, "ips": 7, "mean": 3.38, "above": false}}, "h2": [["2026-10-05", 1.710, 0.330, 0, false], ["2026-10-12", 1.241, 0.011, 0, false]], "sh": false, "uc": 735.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.149, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.241, "se": 0.656, "ts": 1.000, "map": 3.136, "obs": 4, "own": 4.881, "comp": {"cins": -0.6687, "dshield": -1.2522, "crowdsec": 8.5622, "vulncheck": -0.7355, "blocklist_de": -3.3691}, "mass": 3.2, "listed": false}}, "abq": true, "bot": 0.250, "det": null, "oid": "ORG-TA238-RIPE", "org": "JSC Transtelecom", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.ttc.kz"}, "pfx": 189, "reg": "2006-10-26", "rir": "ripencc", "s24": 181, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 83200, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00327089256942}, {"a": 41820, "h": "NOVI-AS", "n": "PP \"New information systems\"", "t": "Broadband & mobile", "w": 8, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 6, "home_connection": 4, "router_or_botnet": 4, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"dshield": {"n": 1, "p": 0.1922, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 5, "p": 0.8910, "hi": 9.76, "lo": 2.43, "ips": 6, "mean": 5.57, "above": true}, "blocklist_de": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 6.136, 0.011, 0, false], ["2026-10-12", 15.831, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 15.831, "se": 0.543, "ts": 0.714, "map": 32.880, "obs": 7, "own": 50.563, "comp": {"cins": -1.0195, "dshield": 1.0537, "crowdsec": 6.9165, "vulncheck": -0.8281, "blocklist_de": -1.236}, "mass": 5.3, "listed": false}}, "abq": false, "bot": 0.255, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-NISP2-RIPE", "org": "New Information Systems PP", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://novi.uz.ua"}, "pfx": 33, "reg": "2006-10-30", "rir": "ripencc", "s24": 29, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": "admin@novi.uz.ua", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00150071732973}, {"a": 41843, "h": "ERTH-OMSK-AS", "n": "JSC \"ER-Telecom Holding\" Omsk branch", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.5535, "hi": 6.80, "lo": 1.20, "ips": 3, "mean": 3.51, "above": false}, "crowdsec": {"n": 1, "p": 0.0378, "hi": 2.80, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "blocklist_de": {"n": 1, "p": 0.1041, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.302, 0.010, 0, false], ["2026-10-12", 1.307, 0.011, 0, false]], "sh": false, "uc": 220, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.940, "ts": null, "map": 0.169, "obs": 0, "own": 1.029, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.307, "se": 0.602, "ts": 0.600, "map": 2.996, "obs": 5, "own": 4.650, "comp": {"cins": -0.8719, "dshield": 7.5063, "crowdsec": -2.9984, "vulncheck": -0.7958, "blocklist_de": -0.3491}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.456, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 64, "reg": "2006-11-02", "rir": "ripencc", "s24": 261, "sib": 121, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 113664, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011727317679}, {"a": 41847, "h": "STEALTH-NETWORKS", "n": "Pixie Networks Ltd", "t": "Transit & backbone", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "phishing_db": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.626, 0, false], ["2026-10-12", 0.012, 0.651, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.651, "se": 1.639, "ts": 1.000, "map": 7.937, "obs": 1, "own": 35.504, "comp": {"urlhaus": -0.0649, "threatfox": -0.0881, "phishing_db": 3.8507}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 2.787, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.165, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SNTD1-RIPE", "org": "Daniel O'Mahony", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.peerpointinternet.co.uk"}, "pfx": 9, "reg": "2006-11-02", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@mypixie.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 41881, "h": "Fanava-AS", "n": "Fanava Group", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7315, "hi": 7.92, "lo": 1.70, "ips": 4, "mean": 4.33, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 0.590, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.845, "ts": null, "map": 0.171, "obs": 0, "own": 0.211, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.606, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-FG8-RIPE", "org": "Fanava Group", "pdb": null, "pfx": 59, "reg": "2006-11-08", "rir": "ripencc", "s24": 73, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@fanava.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025280766825}, {"a": 41897, "h": "SAT-TRAKT-AS", "n": "Sat-Trakt", "t": "Other", "w": 5, "cc": "RS", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1426, "hi": 4.14, "lo": 0.31, "ips": 5, "mean": 1.75, "above": false}}, "h2": [["2026-10-12", 0.069, 0.011, 0, false]], "sh": false, "uc": 111, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.936, "ts": null, "map": 0.167, "obs": 0, "own": 0.407, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.069, "se": 1.125, "ts": 1.000, "map": 0.402, "obs": 1, "own": 0.257, "comp": {"cins": -0.1496, "dshield": -0.3426, "crowdsec": -1.3555, "vulncheck": 3.109, "blocklist_de": -0.7787}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.178, "det": {"vulncheck": {"botnet_node": 5}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SD9-RIPE", "org": "Sat-Trakt D.O.O.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.sattrakt.com"}, "pfx": 127, "reg": "2006-11-10", "rir": "ripencc", "s24": 278, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 103168, "abuse": "abuse@sattrakt.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00232852154063}, {"a": 41922, "h": "MIS70", "n": "MIS70 LTD", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3613.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.164, "det": null, "oid": "ORG-ML428-RIPE", "org": "MIS70 LTD", "pdb": null, "pfx": 9, "reg": "2006-11-16", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012780604889}, {"a": 41960, "h": "NEXTPERTISE", "n": "Nextpertise", "t": "Transit & backbone", "w": 3, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.2058, "hi": 4.26, "lo": 0.75, "ips": 3, "mean": 2.20, "above": false}}, "h2": [["2026-10-05", 0.768, 0.010, 0, false], ["2026-10-12", 0.500, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.928, "ts": null, "map": 0.165, "obs": 0, "own": 1.387, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.500, "se": 0.729, "ts": 1.000, "map": 1.438, "obs": 3, "own": 4.580, "comp": {"cins": -0.5408, "dshield": -1.0604, "crowdsec": 6.7875, "vulncheck": -0.683, "blocklist_de": -2.7466}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.241, "det": null, "oid": "ORG-IA661-RIPE", "org": "Nextpertise B.V.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.nextpertise.nl"}, "pfx": 76, "reg": "2006-11-23", "rir": "ripencc", "s24": 309, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80640, "abuse": "abuse@nextpertise.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00094821265612}, {"a": 41967, "h": "TKS-AS", "n": "Sumski Telecom Systems Ltd", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.156, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-TKS1-RIPE", "org": "Sumski Telecom Systems Ltd", "pdb": null, "pfx": 6, "reg": "2006-11-24", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@tks.sumy.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030516262812}, {"a": 41987, "h": "ITI-AS", "n": "Nalbandian Marko", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.194, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NMV2-RIPE", "org": "Nalbandian Marko", "pdb": null, "pfx": 3, "reg": "2006-11-28", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42003, "h": "OGERONET", "n": "OGERONET", "t": "Other", "w": 2, "cc": "LB", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.1742, "hi": 4.20, "lo": 0.55, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.063, 0.009, 0, false], ["2026-10-12", 0.216, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.897, "ts": null, "map": 0.155, "obs": 0, "own": 0.344, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.216, "se": 0.856, "ts": 1.000, "map": 0.788, "obs": 2, "own": 0.460, "comp": {"cins": -0.4559, "dshield": -0.9227, "crowdsec": -3.6321, "vulncheck": -0.6386, "blocklist_de": 6.8051}, "mass": 2.1, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-LA84-RIPE", "org": "OGERO", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.ogero.gov.lb"}, "pfx": 72, "reg": "2006-12-01", "rir": "ripencc", "s24": 465, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 124672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.006708627387}, {"a": 42038, "h": "VLADLINK-AS", "n": "Vladivostokskaya Set Ltd", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1773, "hi": 4.23, "lo": 0.55, "ips": 2, "mean": 2.01, "above": false}}, "h2": [["2026-10-05", 0.380, 0.010, 0, false], ["2026-10-12", 0.398, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 0.461, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.398, "se": 0.877, "ts": 1.000, "map": 1.510, "obs": 2, "own": 0.881, "comp": {"cins": -0.3543, "dshield": -0.7457, "crowdsec": 5.2967, "vulncheck": -0.5707, "blocklist_de": -1.8203}, "mass": 1.6, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-KSS20-RIPE", "org": "Krivets Sergey Sergeevich", "pdb": null, "pfx": 11, "reg": "2006-12-08", "rir": "ripencc", "s24": 184, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082446497595}, {"a": 42083, "h": "GUNEYDOGUTELEKOM", "n": "Guneydogu Telekom", "t": "Broadband & mobile", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 4.075, 0.012, 0, false]], "sh": false, "uc": 2929.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.075, "se": 1.003, "ts": 0.500, "map": 19.743, "obs": 2, "own": 31.981, "comp": {"cins": -0.2577, "dshield": -0.5638, "crowdsec": 2.1624, "vulncheck": -0.4843, "blocklist_de": 3.5198}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.206, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-GTIV1-RIPE", "org": "Guneydogu Telekom int.bil. ve ilt. hiz. tic. ltd. sti.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.kapsamnet.com.tr"}, "pfx": 10, "reg": "2017-06-16", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "ripespam@kapsamnet.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004923578616}, {"a": 42116, "h": "ERTH-NCHLN-AS", "n": "JSC \"ER-Telecom Holding\" Naberezhnye Chelny branch", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1510, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 1, "p": 0.0480, "hi": 2.97, "lo": 0.22, "ips": 2, "mean": 1.25, "above": false}, "blocklist_de": {"n": 2, "p": 0.2815, "hi": 5.07, "lo": 0.66, "ips": 3, "mean": 2.42, "above": false}}, "h2": [["2026-10-05", 0.341, 0.010, 0, false], ["2026-10-12", 1.176, 0.011, 0, false]], "sh": false, "uc": 251.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.951, "ts": null, "map": 0.172, "obs": 0, "own": 1.077, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.176, "se": 0.657, "ts": 0.500, "map": 2.960, "obs": 4, "own": 4.611, "comp": {"cins": -0.7647, "dshield": 1.8273, "crowdsec": -2.2579, "vulncheck": -0.7668, "blocklist_de": 4.441}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.435, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 58, "reg": "2006-12-20", "rir": "ripencc", "s24": 225, "sib": 121, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 104960, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009915327345}, {"a": 42155, "h": "CH-EVARD-4", "n": "Evard AG", "t": "Other", "w": 1, "cc": "CH", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.442, 0.011, 0, false], ["2026-10-12", 1.545, 0.012, 0, false]], "sh": false, "uc": 911.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.545, "se": 0.943, "ts": 0.500, "map": 6.677, "obs": 2, "own": 3.924, "comp": {"cins": -0.3099, "dshield": -0.6638, "crowdsec": 1.6209, "vulncheck": -0.5343, "blocklist_de": 3.1795}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-EAA2-RIPE", "org": "Evard AG", "pdb": null, "pfx": 2, "reg": "2006-12-28", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@evard.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015917076132}, {"a": 42159, "h": "DELTAHOST-AS", "n": "Zemlyaniy Dmitro Leonidovich", "t": "Hosting & VPS", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9589, "hi": 11.31, "lo": 3.14, "ips": 6, "mean": 6.69, "above": true}, "phishing_db": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.379, 0.522, 0, false], ["2026-10-12", 0.011, 0.543, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.543, "se": 1.582, "ts": 1.000, "map": 5.963, "obs": 1, "own": 2.775, "comp": {"urlhaus": -0.0887, "threatfox": -0.1149, "phishing_db": 3.6154}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.215, "obs": 0, "own": 0.134, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.922, "det": {"shodan": {"compromised": 6}}, "oid": "ORG-FZDL2-RIPE", "org": "Zemlyaniy Dmitro Leonidovich", "pdb": null, "pfx": 8, "reg": "2009-08-17", "rir": "ripencc", "s24": 22, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 6656, "abuse": "abuse@deltahost.com.ua", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 42201, "h": "PVDataNet", "n": "PVDataNet AB", "t": "Transit & backbone", "w": 10, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 8, "bad_crawling": 3, "proxy_or_vpn": 5, "ssh_bruteforce": 6, "web_bruteforce": 9, "mail_bruteforce": 2, "cve:CVE-2015-4455": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2024-35694": 1, "cve:CVE-2024-48914": 1}, "n": 9}, "ev": {"crowdsec": {"n": 5, "p": 0.9035, "hi": 10.11, "lo": 2.51, "ips": 9, "mean": 5.77, "above": true}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 18.860, 0.011, 1, false], ["2026-10-12", 23.750, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 2.840, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 23.750, "se": 0.577, "ts": 0.833, "map": 52.114, "obs": 6, "own": 162.913, "comp": {"cins": -0.8716, "dshield": -1.5238, "crowdsec": 8.8854, "vulncheck": -0.7957, "blocklist_de": -0.3472}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.592, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PKSA4-RIPE", "org": "PVDataNet AB", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://pvdatanet.com"}, "pfx": 15, "reg": "2020-09-25", "rir": "ripencc", "s24": 15, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "abuse@pvdatanet.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00011585438048}, {"a": 42235, "h": "IDC-AS", "n": "Internet Solutions Moçambique", "t": "Enterprise, edu & gov", "w": 1, "cc": "MZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 1.146, 0.011, 0, false], ["2026-10-12", 1.234, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 2.718, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.234, "se": 0.931, "ts": 0.500, "map": 5.219, "obs": 2, "own": 30.407, "comp": {"cins": -0.322, "dshield": -0.6865, "crowdsec": 1.4985, "vulncheck": -0.5447, "blocklist_de": 3.1007}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-IDC3-RIPE", "org": "INTRA DATA COMMUNICATION", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Restrictive", "web": "https://www.is.co.mz/"}, "pfx": 4, "reg": "2007-01-19", "rir": "ripencc", "s24": 48, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "netops@is.co.mz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001619908689}, {"a": 42237, "h": "w1n", "n": "W1N", "t": "Broadband & mobile", "w": 13, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 1, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 5, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 5, "home_connection": 11, "cve:CVE-2024-0204": 1, "cve:CVE-2024-6387": 5, "cve:CVE-2018-20062": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2022-26134": 1}, "n": 12}, "ev": {"dshield": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 6, "p": 0.9636, "hi": 11.63, "lo": 3.23, "ips": 12, "mean": 6.87, "above": true}, "phishing_db": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 3, "p": 0.6422, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 133.663, 0.722, 1, false], ["2026-10-12", 107.029, 0.747, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.747, "se": 1.693, "ts": 1.000, "map": 9.913, "obs": 1, "own": 33.043, "comp": {"urlhaus": -0.0475, "threatfox": -0.0669, "phishing_db": 4.0345}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 107.029, "se": 0.488, "ts": 0.600, "map": 201.231, "obs": 10, "own": 307.417, "comp": {"cins": -1.3583, "dshield": 0.1976, "crowdsec": 5.2499, "vulncheck": -0.8809, "blocklist_de": 3.4898}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.938, "det": {"blocklist_de": {"ssh": 3}}, "oid": "ORG-WL303-RIPE", "org": "w1n ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://w1n.nl"}, "pfx": 7, "reg": "2017-08-10", "rir": "ripencc", "s24": 7, "sib": 4, "tor": 5, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@w1n.nl", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00010223451884}, {"a": 42248, "h": "Vida-Optics", "n": "Vida-Optics", "t": "Transit & backbone", "w": 1, "cc": "BG", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1307, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-12", 0.209, 0.012, 0, false]], "sh": false, "uc": 1885.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 2.110, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.209, "se": 1.234, "ts": 1.000, "map": 1.570, "obs": 1, "own": 5.548, "comp": {"cins": -0.1451, "dshield": -0.3329, "crowdsec": 3.4165, "vulncheck": -0.3384, "blocklist_de": -0.7556}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.189, "det": null, "oid": "ORG-OL19-RIPE", "org": "Vida optics TVV Ltd.", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://vidaoptics.com"}, "pfx": 22, "reg": "2007-01-23", "rir": "ripencc", "s24": 69, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027919534643}, {"a": 42293, "h": "AVALA-AS", "n": "ET PAVLIN ILIEV - AVALA", "t": "Other", "w": 2, "cc": "BG", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.211, 0.012, 0, false], ["2026-10-12", 1.385, 0.013, 0, false]], "sh": false, "uc": 38281.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.385, "se": 1.717, "ts": 1.000, "map": 22.773, "obs": 1, "own": 21.732, "comp": {"cins": -0.0313, "dshield": -0.0755, "crowdsec": -0.2996, "vulncheck": -0.0965, "blocklist_de": 5.0223}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.183, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-EPIA1-RIPE", "org": "ET PAVLIN ILIEV - AVALA", "pdb": null, "pfx": 1, "reg": "2018-11-14", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42306, "h": "EDERA_Group", "n": "Edera Group", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 1.432, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.548, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.153, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BS47-RIPE", "org": "Edera Group a.s.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.edera.cz"}, "pfx": 8, "reg": "2007-01-30", "rir": "ripencc", "s24": 80, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0015560121743}, {"a": 42313, "h": "ONEALBANIA-AS", "n": "One Albania", "t": "Other", "w": 6, "cc": "AL", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 4}, "ev": {"dshield": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "urlhaus": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 4, "p": 0.4060, "hi": 5.28, "lo": 1.14, "ips": 4, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 0.812, 0.275, 0, false], ["2026-10-12", 1.170, 0.299, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.299, "se": 1.469, "ts": 1.000, "map": 2.583, "obs": 1, "own": 3.012, "comp": {"urlhaus": 3.5567, "threatfox": -0.3363, "phishing_db": -0.6451}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.170, "se": 0.601, "ts": 0.800, "map": 2.652, "obs": 5, "own": 1.506, "comp": {"cins": -0.8263, "dshield": 1.6283, "crowdsec": 6.4742, "vulncheck": -0.7841, "blocklist_de": -4.1232}, "mass": 4.1, "listed": false}}, "abq": true, "bot": 0.336, "det": null, "oid": "ORG-AMCS2-RIPE", "org": "ONE ALBANIA SH.A.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.one.al"}, "pfx": 70, "reg": "2007-01-31", "rir": "ripencc", "s24": 276, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 227584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00433319200816}, {"a": 42337, "h": "RESPINA-AS", "n": "Respina Networks & Beyond PJSC", "t": "Enterprise, edu & gov", "w": 11, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 1, "first_seen_30d": 4, "ssh_bruteforce": 7, "web_bruteforce": 5, "mail_bruteforce": 1, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 4, "cve:CVE-2018-20062": 4}, "n": 7}, "ev": {"cins": {"n": 3, "p": 0.4048, "hi": 5.61, "lo": 0.99, "ips": 3, "mean": 2.89, "above": false}, "shodan": {"n": 8, "p": 0.4805, "hi": 4.91, "lo": 1.60, "ips": 8, "mean": 3.06, "above": false}, "crowdsec": {"n": 6, "p": 0.1162, "hi": 3.47, "lo": 0.96, "ips": 7, "mean": 2.05, "above": false}, "phishing_db": {"n": 1, "p": 0.0702, "hi": 3.29, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "blocklist_de": {"n": 1, "p": 0.0186, "hi": 2.41, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}}, "h2": [["2026-10-05", 2.006, 0.097, 0, false], ["2026-10-12", 1.137, 0.102, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.102, "se": 1.357, "ts": 1.000, "map": 0.639, "obs": 1, "own": 3.341, "comp": {"urlhaus": -0.3581, "threatfox": -0.3057, "phishing_db": 1.842}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.137, "se": 0.491, "ts": 0.600, "map": 2.098, "obs": 10, "own": 11.789, "comp": {"cins": 8.2191, "dshield": -2.3053, "crowdsec": 2.0335, "vulncheck": -0.9126, "blocklist_de": -4.9}, "mass": 10.6, "listed": false}}, "abq": true, "bot": 0.400, "det": {"shodan": {"malware": 1, "compromised": 7}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-RNB1-RIPE", "org": "Respina Networks & Beyond PJSC", "pdb": {"t": "Enterprise", "sc": "Middle East", "tr": "50-100Gbps", "pol": "No", "web": "http://www.respina.net"}, "pfx": 735, "reg": "2007-02-05", "rir": "ripencc", "s24": 907, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 480256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00456875187255}, {"a": 42366, "h": "TERRATRANSIT-AS", "n": "TerraTransit", "t": "Transit & backbone", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "web_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2386, "hi": 4.73, "lo": 0.61, "ips": 2, "mean": 2.25, "above": false}}, "h2": [["2026-10-05", 2.315, 0.010, 0, false], ["2026-10-12", 0.545, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.991, "ts": null, "map": 0.181, "obs": 0, "own": 1.813, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.545, "se": 0.890, "ts": 1.000, "map": 2.115, "obs": 2, "own": 6.854, "comp": {"cins": -0.3384, "dshield": -0.7168, "crowdsec": 5.4963, "vulncheck": -0.5583, "blocklist_de": -1.7403}, "mass": 1.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TA251-RIPE", "org": "TerraTransit AG", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.terratransit.de"}, "pfx": 112, "reg": "2007-02-09", "rir": "ripencc", "s24": 125, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53248, "abuse": "abuse@terratransit.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00139830015585}, {"a": 42397, "h": "BUNEA-HIGH-VOLUME-NETWORK", "n": "Bunea TELECOM SRL", "t": "Broadband & mobile", "w": 4, "cc": "RO", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.801, 0, false], ["2026-10-12", 7.877, 0.827, 0, false]], "sh": true, "uc": 7031.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.827, "se": 1.740, "ts": 1.000, "map": 11.627, "obs": 1, "own": 41.510, "comp": {"urlhaus": -0.032, "threatfox": 4.1941, "phishing_db": -0.0826}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.573, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Cobalt Strike": 1, "family:Unknown malware": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BTS48-RIPE", "org": "Bunea TELECOM SRL", "pdb": null, "pfx": 4, "reg": "2018-05-23", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@bunea.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42422, "h": "SECURITYNET-AS", "n": "SecurityNet.cz s.r.o.", "t": "Other", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6300, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}, "threatfox": {"n": 1, "p": 0.1983, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.610, 0, false], ["2026-10-12", 0.012, 0.631, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.631, "se": 1.630, "ts": 1.000, "map": 7.561, "obs": 1, "own": 9.558, "comp": {"urlhaus": -0.0619, "threatfox": 3.8625, "phishing_db": -0.1515}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.731, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Unknown malware": 1}}, "oid": "ORG-SS1167-RIPE", "org": "SecurityNet.cz s.r.o.", "pdb": null, "pfx": 13, "reg": "2021-03-05", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@securitynet.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001814057188}, {"a": 42425, "h": "ASN-AVANZATI", "n": "PSA", "t": "Broadband & mobile", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 1.013, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PS53-RIPE", "org": "PSA S.r.l.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.bandablu.it"}, "pfx": 24, "reg": "2008-09-15", "rir": "ripencc", "s24": 24, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@avanzati.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010103485125}, {"a": 42447, "h": "EQUTECHNOLOGIES-AS", "n": "EQU Technologies LLP", "t": "Other", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.723, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ETL35-RIPE", "org": "EQU Technologies LLP", "pdb": null, "pfx": 3, "reg": "2019-09-11", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "info@equhost.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003131473359}, {"a": 42473, "h": "AS-ANEXIA", "n": "Anexia", "t": "Hosting & VPS", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.3779, "hi": 5.11, "lo": 1.10, "ips": 4, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.161, "obs": 0, "own": 0.142, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.632, "ts": null, "map": 0.092, "obs": 0, "own": 0.028, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.908, "det": {"shodan": {"doublepulsar": 4}}, "oid": "ORG-AIG10-RIPE", "org": "Anexia Cloud Solutions GmbH", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.anexia.com"}, "pfx": 298, "reg": "2007-02-27", "rir": "ripencc", "s24": 370, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 95488, "abuse": "abuse@anexia.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019456991633}, {"a": 42474, "h": "IL", "n": "SmartApe OU", "t": "Other", "w": 14, "cc": "EE", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 12, "mean": 2.99, "above": false}, "blocklist_de": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 20.534, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 2}, "lo": 20.534, "se": 0.732, "ts": 0.500, "map": 58.506, "obs": 4, "own": 34.268, "comp": {"cins": -0.4385, "dshield": -0.8933, "crowdsec": -3.5175, "vulncheck": 3.3709, "blocklist_de": 6.9412}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.555, "det": {"vulncheck": {"botnet_node": 12}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-SO162-RIPE", "org": "SmartApe OU", "pdb": null, "pfx": 6, "reg": "2019-11-07", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "abuse@smartape.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009929466183}, {"a": 42498, "h": "GERKON-AS", "n": "Gerkon", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.234, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 1.684, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.234, "se": 1.268, "ts": 1.000, "map": 1.812, "obs": 1, "own": 3.323, "comp": {"cins": -0.0958, "dshield": -0.2245, "crowdsec": -0.8893, "vulncheck": 3.6982, "blocklist_de": -0.5003}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.442, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-GL303-RIPE", "org": "Gerkon LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://sevencom.ru/"}, "pfx": 49, "reg": "2007-03-02", "rir": "ripencc", "s24": 39, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": "info@sevencom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42503, "h": "PL-OKTAWAVE-AS", "n": "Oktawave AS42503", "t": "Hosting & VPS", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3749, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.937, "ts": null, "map": 0.201, "obs": 0, "own": 0.108, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.870, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-OSZO12-RIPE", "org": "Oktawave S.A.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://oktawave.com"}, "pfx": 3, "reg": "2007-03-02", "rir": "ripencc", "s24": 35, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@oktawave.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42525, "h": "GlobalConnect-AS42525", "n": "GlobalConnect AS42525", "t": "Transit & backbone", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0533, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 1.464, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.678, "ts": null, "map": 0.109, "obs": 0, "own": 0.556, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.219, "det": {"shodan": {"malware": 1}}, "oid": "ORG-GA85-RIPE", "org": "GlobalConnect A/S", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Restrictive", "web": "http://globalconnect.dk/"}, "pfx": 13, "reg": "2007-03-07", "rir": "ripencc", "s24": 260, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67072, "abuse": "abuse@globalconnect.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00157530093662}, {"a": 42532, "h": "VEESP-LV-AS", "n": "Veesp SIA", "t": "Transit & backbone", "w": 3, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 6, "p": 0.9126, "hi": 9.44, "lo": 2.62, "ips": 6, "mean": 5.58, "above": true}, "crowdsec": {"n": 2, "p": 0.2457, "hi": 4.78, "lo": 0.62, "ips": 2, "mean": 2.28, "above": false}, "vulncheck": {"n": 1, "p": 0.1729, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.541, 0.010, 0, false], ["2026-10-12", 0.939, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 1.837, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.939, "se": 0.761, "ts": 0.667, "map": 2.836, "obs": 3, "own": 9.182, "comp": {"cins": -0.4232, "dshield": -0.8671, "crowdsec": 4.4613, "vulncheck": 1.4298, "blocklist_de": -2.1648}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.417, "det": {"shodan": {"malware": 2, "compromised": 4}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-VS198-RIPE", "org": "SIA VEESP", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://veesp.com"}, "pfx": 32, "reg": "2007-03-09", "rir": "ripencc", "s24": 119, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 31232, "abuse": "abuse@veesp.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00424231522605}, {"a": 42552, "h": "AS42552", "n": "Niles sp. z o.o.", "t": "Other", "w": 1, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 5664.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 8.823, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.149, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NSZO5-RIPE", "org": "Niles sp. z o.o.", "pdb": null, "pfx": 1, "reg": "2007-03-09", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42560, "h": "BA-TELEMACH-AS", "n": "Telemach BH d.o.o. Sarajevo", "t": "Other", "w": 2, "cc": "BA", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1124, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "urlhaus": {"n": 1, "p": 0.1761, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.434, 0.195, 0, false], ["2026-10-12", 0.057, 0.213, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.213, "se": 1.421, "ts": 1.000, "map": 1.654, "obs": 1, "own": 1.914, "comp": {"urlhaus": 3.2468, "threatfox": -0.38, "phishing_db": -0.7376}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.057, "se": 1.089, "ts": 1.000, "map": 0.322, "obs": 1, "own": 0.197, "comp": {"cins": 4.6976, "dshield": -0.5428, "crowdsec": -2.1438, "vulncheck": -0.4729, "blocklist_de": -1.2774}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-GA121-RIPE", "org": "Telemach BH d.o.o. Sarajevo", "pdb": null, "pfx": 35, "reg": "2007-03-13", "rir": "ripencc", "s24": 586, "sib": 7, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 169216, "abuse": "abuse@telemach.ba", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01043237593995}, {"a": 42610, "h": "NCNET-AS", "n": "Rostelecom MRB Moscow", "t": "Broadband & mobile", "w": 22, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 9, "web_bruteforce": 8, "home_connection": 12, "mail_bruteforce": 11}, "n": 16}, "ev": {"dshield": {"n": 2, "p": 0.0520, "hi": 3.03, "lo": 0.39, "ips": 2, "mean": 1.44, "above": false}, "crowdsec": {"n": 15, "p": 0.2167, "hi": 3.65, "lo": 1.59, "ips": 16, "mean": 2.53, "above": false}, "phishing_db": {"n": 1, "p": 0.0183, "hi": 2.40, "lo": 0.18, "ips": 1, "mean": 1.01, "above": false}, "blocklist_de": {"n": 11, "p": 0.7585, "hi": 5.79, "lo": 2.20, "ips": 11, "mean": 3.81, "above": false}}, "h2": [["2026-10-05", 1.475, 0.062, 0, false], ["2026-10-12", 1.620, 0.065, 0, false]], "sh": false, "uc": 282.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.065, "se": 1.338, "ts": 1.000, "map": 0.378, "obs": 1, "own": 1.224, "comp": {"urlhaus": -0.4527, "threatfox": -0.3452, "phishing_db": 1.452}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 15, "vulncheck": 0, "blocklist_de": 11}, "lo": 1.620, "se": 0.406, "ts": 0.536, "map": 2.639, "obs": 28, "own": 4.060, "comp": {"cins": -2.7756, "dshield": -1.2419, "crowdsec": 1.2077, "vulncheck": -0.9765, "blocklist_de": 6.1503}, "mass": 29.3, "listed": false}}, "abq": false, "bot": 0.427, "det": {"blocklist_de": {"ssh": 1, "bots": 2, "imap": 7, "mail": 8}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "http://moscow.rt.ru"}, "pfx": 32, "reg": "2007-03-22", "rir": "ripencc", "s24": 2003, "sib": 120, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 531200, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00911434418895}, {"a": 42611, "h": "ZZOOMM", "n": "Zzoomm", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.189, "obs": 0, "own": 0.720, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 4}}, "oid": "ORG-FFL5-RIPE", "org": "Full Fibre Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://zzoomm.com"}, "pfx": 5, "reg": "2007-03-22", "rir": "ripencc", "s24": 48, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "abuse@fullfibre.co", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00576472036738}, {"a": 42675, "h": "OBEHOSTING", "n": "Obehosting", "t": "Hosting & VPS", "w": 2, "cc": "SE", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1974, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.339, 3.062, 0, false], ["2026-10-12", 0.011, 0.494, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.494, "se": 1.560, "ts": 1.000, "map": 5.183, "obs": 1, "own": 2.398, "comp": {"urlhaus": -0.091, "threatfox": 3.575, "phishing_db": -0.2123}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.211, "obs": 0, "own": 0.124, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:Remcos": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-OA1026-RIPE", "org": "Obehosting AB", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "No", "web": "https://obe.net/hosting"}, "pfx": 11, "reg": "2018-07-23", "rir": "ripencc", "s24": 26, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@obe.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00065742652305}, {"a": 42682, "h": "ERTH-NNOV-AS", "n": "JSC \"ER-Telecom Holding\" Nizhny Novgorod branch", "t": "Broadband & mobile", "w": 9, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 3}, "ev": {"dshield": {"n": 4, "p": 0.6701, "hi": 7.25, "lo": 1.56, "ips": 4, "mean": 3.96, "above": false}, "crowdsec": {"n": 3, "p": 0.0881, "hi": 3.38, "lo": 0.60, "ips": 3, "mean": 1.74, "above": false}, "blocklist_de": {"n": 4, "p": 0.5197, "hi": 6.01, "lo": 1.29, "ips": 4, "mean": 3.29, "above": false}}, "h2": [["2026-10-05", 1.815, 0.009, 0, false], ["2026-10-12", 2.163, 0.010, 0, false]], "sh": false, "uc": 260.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.153, "obs": 0, "own": 0.839, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.163, "se": 0.477, "ts": 0.364, "map": 3.976, "obs": 11, "own": 6.127, "comp": {"cins": -1.6762, "dshield": 5.0816, "crowdsec": -3.5804, "vulncheck": -0.9142, "blocklist_de": 3.8629}, "mass": 10.7, "listed": false}}, "abq": false, "bot": 0.401, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 2}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 115, "reg": "2007-04-02", "rir": "ripencc", "s24": 487, "sib": 121, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 222464, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002203666465}, {"a": 42708, "h": "GLESYS", "n": "Portlane", "t": "Transit & backbone", "w": 43, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 12, "web_exploit": 12, "bad_crawling": 10, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 13, "home_connection": 7, "mail_bruteforce": 2, "cve:CVE-2017-9841": 4, "cve:CVE-2024-4577": 3, "cve:CVE-2025-4396": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1}, "n": 16}, "ev": {"shodan": {"n": 7, "p": 0.6150, "hi": 5.72, "lo": 1.73, "ips": 7, "mean": 3.48, "above": false}, "dshield": {"n": 1, "p": 0.0929, "hi": 3.57, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "crowdsec": {"n": 8, "p": 0.6149, "hi": 5.52, "lo": 1.80, "ips": 16, "mean": 3.44, "above": false}, "threatfox": {"n": 5, "p": 0.8853, "hi": 9.62, "lo": 2.39, "ips": 21, "mean": 5.49, "above": true}, "phishing_db": {"n": 2, "p": 0.2547, "hi": 4.86, "lo": 0.63, "ips": 3, "mean": 2.31, "above": false}, "blocklist_de": {"n": 2, "p": 0.1288, "hi": 3.81, "lo": 0.50, "ips": 2, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 2.167, 1.735, 0, false], ["2026-10-12", 1.588, 1.728, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 2}, "lo": 1.728, "se": 0.875, "ts": 0.714, "map": 4.359, "obs": 7, "own": 15.562, "comp": {"urlhaus": -1.1704, "threatfox": 3.4532, "phishing_db": 0.8157}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.588, "se": 0.477, "ts": 0.727, "map": 2.913, "obs": 11, "own": 9.131, "comp": {"cins": -1.5823, "dshield": -0.2838, "crowdsec": 6.6425, "vulncheck": -0.9055, "blocklist_de": -1.4081}, "mass": 9.8, "listed": false}}, "abq": false, "bot": 0.829, "det": {"shodan": {"compromised": 6, "doublepulsar": 1}, "threatfox": {"family:DCRat": 5, "family:AsyncRAT": 16}, "blocklist_de": {"bots": 2}}, "oid": "ORG-GISA2-RIPE", "org": "Glesys AB", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://glesys.com/"}, "pfx": 194, "reg": "2007-04-04", "rir": "ripencc", "s24": 607, "sib": 6, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 155904, "abuse": "abuse@glesys.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00579847713401}, {"a": 42730, "h": "EVANZOAS", "n": "EVANZO e-commerce GmbH", "t": "Other", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0840, "hi": 3.46, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}, "blocklist_de": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 0.957, 0.010, 0, false], ["2026-10-12", 0.538, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.984, "ts": null, "map": 0.180, "obs": 0, "own": 0.499, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.538, "se": 0.891, "ts": 0.500, "map": 2.083, "obs": 2, "own": 1.218, "comp": {"cins": -0.368, "dshield": -0.7705, "crowdsec": 1.0445, "vulncheck": -0.5811, "blocklist_de": 2.8027}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-EEG3-RIPE", "org": "EVANZO e-commerce GmbH", "pdb": null, "pfx": 10, "reg": "2007-04-05", "rir": "ripencc", "s24": 139, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35584, "abuse": "abuse@1blu.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42739, "h": "FONE-ASN", "n": "HAWE TELEKOM", "t": "Broadband & mobile", "w": 4, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1361, "hi": 4.07, "lo": 0.30, "ips": 4, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.128, 0.010, 0, false], ["2026-10-12", 0.135, 0.011, 0, false]], "sh": false, "uc": 110.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.201, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.135, "se": 1.178, "ts": 1.000, "map": 0.911, "obs": 1, "own": 1.560, "comp": {"cins": -0.1874, "dshield": -0.4223, "crowdsec": -1.6699, "vulncheck": -0.4008, "blocklist_de": 3.9813}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-FSZO2-RIPE", "org": "Hawe Telekom S.A.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://hawetelekom.com"}, "pfx": 11, "reg": "2007-04-10", "rir": "ripencc", "s24": 155, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45312, "abuse": "abuse@hawetelekom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056544229248}, {"a": 42764, "h": "ORG-AS304-RIPE", "n": "Arpitel", "t": "Other", "w": 3, "cc": "IT", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 2, "p": 0.4227, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.670, 14.697, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 14.697, "se": 1.305, "ts": 1.000, "map": 103.562, "obs": 2, "own": 96.777, "comp": {"urlhaus": 7.3152, "threatfox": -0.358, "phishing_db": -0.6908}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 5.435, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-AS304-RIPE", "org": "Arpitel s.r.l.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.arpitel.it"}, "pfx": 5, "reg": "2019-05-31", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 42772, "h": "A1-BY-AS", "n": "Velcom", "t": "Other", "w": 9, "cc": "BY", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2020-5902": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0052, "hi": 2.05, "lo": 0.27, "ips": 2, "mean": 0.98, "above": false}, "dshield": {"n": 1, "p": 0.0575, "hi": 3.11, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "crowdsec": {"n": 1, "p": 0.0003, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}, "vulncheck": {"n": 4, "p": 0.5265, "hi": 6.06, "lo": 1.30, "ips": 5, "mean": 3.31, "above": false}, "blocklist_de": {"n": 2, "p": 0.0566, "hi": 3.08, "lo": 0.40, "ips": 2, "mean": 1.47, "above": false}}, "h2": [["2026-10-05", 0.135, 0.008, 0, false], ["2026-10-12", 0.483, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.839, "ts": null, "map": 0.132, "obs": 0, "own": 0.264, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 4, "blocklist_de": 2}, "lo": 0.483, "se": 0.553, "ts": 0.500, "map": 1.000, "obs": 8, "own": 0.574, "comp": {"cins": -1.0344, "dshield": 1.0122, "crowdsec": -4.0234, "vulncheck": 2.9913, "blocklist_de": 2.4477}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.187, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 5}, "blocklist_de": {"bots": 2}}, "oid": "ORG-JMDC1-RIPE", "org": "Unitary enterprise A1", "pdb": null, "pfx": 385, "reg": "2007-04-13", "rir": "ripencc", "s24": 972, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 370688, "abuse": "abuse@a1.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01637237221256}, {"a": 42831, "h": "UKSERVERS-AS", "n": "UK Dedicated Servers", "t": "Hosting & VPS", "w": 10, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2025-11368": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.3142, "hi": 5.34, "lo": 0.69, "ips": 2, "mean": 2.55, "above": false}, "shodan": {"n": 4, "p": 0.3256, "hi": 4.81, "lo": 1.03, "ips": 4, "mean": 2.63, "above": false}, "dshield": {"n": 1, "p": 0.1176, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "crowdsec": {"n": 3, "p": 0.1209, "hi": 3.65, "lo": 0.64, "ips": 3, "mean": 1.88, "above": false}, "vulncheck": {"n": 5, "p": 0.8350, "hi": 8.60, "lo": 2.14, "ips": 5, "mean": 4.91, "above": true}}, "h2": [["2026-10-05", 1.196, 0.009, 0, false], ["2026-10-12", 1.589, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 0.136, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 3, "vulncheck": 5, "blocklist_de": 0}, "lo": 1.589, "se": 0.509, "ts": 0.455, "map": 3.057, "obs": 11, "own": 0.607, "comp": {"cins": 6.1948, "dshield": 0.3835, "crowdsec": -0.7476, "vulncheck": 2.8903, "blocklist_de": -6.2099}, "mass": 7.2, "listed": false}}, "abq": false, "bot": 0.861, "det": {"shodan": {"compromised": 3, "doublepulsar": 1}, "vulncheck": {"botnet_node": 5}}, "oid": "ORG-UDSL2-RIPE", "org": "UK Dedicated Servers Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.ukservers.com"}, "pfx": 255, "reg": "2007-04-24", "rir": "ripencc", "s24": 423, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 108288, "abuse": "abuse@ukservers.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00284835816592}, {"a": 42832, "h": "PPHU-VOIP-PARTNERS", "n": "PPHU 'VOIP PARTNERS' Tomasz Filak", "t": "Other", "w": 1, "cc": "PL", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 9.174, 0.011, 0, false], ["2026-10-12", 0.555, 0.012, 0, false]], "sh": false, "uc": 1592.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.555, "se": 1.412, "ts": 1.000, "map": 5.787, "obs": 1, "own": 4.020, "comp": {"cins": -0.0865, "dshield": -0.2035, "crowdsec": 4.1217, "vulncheck": -0.2306, "blocklist_de": -0.4518}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.364, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-PPTF1-RIPE", "org": "PPHU 'VOIP PARTNERS' Tomasz Filak", "pdb": null, "pfx": 5, "reg": "2007-04-24", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@etop.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025454593866}, {"a": 42837, "h": "extraline", "n": "Extra Line LLC", "t": "Other", "w": 0, "cc": "KG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.403, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.200, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ELL8-RIPE", "org": "Extra Line LLC", "pdb": null, "pfx": 20, "reg": "2021-04-23", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00134884844157}, {"a": 42842, "h": "HELIOS-TV-AS", "n": "PJSC \"Vimpelcom\"", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.6440, "hi": 7.72, "lo": 1.36, "ips": 4, "mean": 3.98, "above": false}}, "h2": [["2026-10-12", 10.722, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.722, "se": 0.800, "ts": 1.000, "map": 35.195, "obs": 3, "own": 20.157, "comp": {"cins": -0.3995, "dshield": 11.2591, "crowdsec": -3.255, "vulncheck": -0.6033, "blocklist_de": -2.0468}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.465, "det": null, "oid": "ORG-ES15-RIPE", "org": "PJSC \"Vimpelcom\"", "pdb": null, "pfx": 2, "reg": "2007-04-25", "rir": "ripencc", "s24": 9, "sib": 32, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "abuse-b2b@beeline.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00234398713395}, {"a": 42846, "h": "guzelhosting", "n": "GNET Internet Telekomunikasyon A.S.", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 1, "p": 0.1516, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.254, 0.011, 0, false], ["2026-10-12", 0.267, 0.012, 0, false]], "sh": false, "uc": 512.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 0.252, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.267, "se": 1.272, "ts": 1.000, "map": 2.157, "obs": 1, "own": 0.485, "comp": {"cins": -0.1305, "dshield": -0.3013, "crowdsec": 3.5886, "vulncheck": -0.3142, "blocklist_de": -0.6801}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.989, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GITA5-RIPE", "org": "GNET Internet Telekomunikasyon A.S.", "pdb": null, "pfx": 45, "reg": "2020-03-11", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": "abuse@guzel.net.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057988722025}, {"a": 42868, "h": "NiobeBilisimHizmetleri", "n": "Niobe Bilisim Teknolojileri", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.551, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NB14-RIPE", "org": "Niobe Bilisim Ltd. Sti.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.niobeweb.net"}, "pfx": 20, "reg": "2007-04-27", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@trdns.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002823096694}, {"a": 42908, "h": "CZ-NORDICTELECOMREGIONAL", "n": "Nordic Telecom", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": 51.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.863, "ts": null, "map": 0.142, "obs": 0, "own": 0.733, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.548, "ts": null, "map": 0.065, "obs": 0, "own": 0.141, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.230, "det": null, "oid": "ORG-STAN1-RIPE", "org": "O2 Czech Republic, a.s.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.nordictelecom.cz/"}, "pfx": 35, "reg": "2007-05-09", "rir": "ripencc", "s24": 716, "sib": 15, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 183296, "abuse": "abuse@o2.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086289524585}, {"a": 42910, "h": "PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI", "n": "PremierDC Veri Merkezi A.S. - Istanbul", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7230, "hi": 7.82, "lo": 1.68, "ips": 4, "mean": 4.27, "above": false}}, "h2": [["2026-10-05", 0.181, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.221, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.070, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.654, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-HIHL1-RIPE", "org": "PremierDC Veri Merkezi Anonim Sirketi", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.premierdc.com.tr"}, "pfx": 80, "reg": "2007-05-09", "rir": "ripencc", "s24": 80, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "abuse@sh.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045536790785}, {"a": 42926, "h": "RADORE", "n": "Radore Veri Merkezi Hizmetleri", "t": "Transit & backbone", "w": 3, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0682, "hi": 3.26, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "crowdsec": {"n": 2, "p": 0.1525, "hi": 4.02, "lo": 0.52, "ips": 2, "mean": 1.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1571, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.339, 0.206, 0, false], ["2026-10-12", 0.352, 0.215, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.215, "se": 1.417, "ts": 1.000, "map": 1.624, "obs": 1, "own": 6.794, "comp": {"urlhaus": -0.2238, "threatfox": -0.2302, "phishing_db": 2.5655}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.352, "se": 0.872, "ts": 1.000, "map": 1.329, "obs": 2, "own": 4.301, "comp": {"cins": -0.3604, "dshield": -0.7567, "crowdsec": 5.2211, "vulncheck": -0.5754, "blocklist_de": -1.8508}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.727, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RHTH1-RIPE", "org": "Radore Veri Merkezi Hizmetleri A.S.", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://radore.com"}, "pfx": 213, "reg": "2007-05-10", "rir": "ripencc", "s24": 213, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54528, "abuse": "abuse@radore.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00061877369315}, {"a": 42927, "h": "S-NET-AS", "n": "S-NET Sp. z o.o.", "t": "Transit & backbone", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1508, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 2.206, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.182, "obs": 0, "own": 1.338, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.455, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-SA635-RIPE", "org": "S-NET Sp. z o.o.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.s-net.pl"}, "pfx": 34, "reg": "2007-05-10", "rir": "ripencc", "s24": 57, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "noc@s-net.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00054744232452}, {"a": 42960, "h": "VH-GLOBAL", "n": "VH-GLOBAL", "t": "Other", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"shodan": {"n": 6, "p": 0.9143, "hi": 9.49, "lo": 2.63, "ips": 6, "mean": 5.61, "above": true}, "urlhaus": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2493, "hi": 4.81, "lo": 0.62, "ips": 2, "mean": 2.29, "above": false}, "threatfox": {"n": 1, "p": 0.1913, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.146, 1.648, 0, false], ["2026-10-12", 0.575, 1.720, 0, false]], "sh": false, "uc": 983.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 1.720, "se": 1.187, "ts": 0.500, "map": 8.451, "obs": 2, "own": 8.786, "comp": {"urlhaus": 3.2337, "threatfox": 1.2678, "phishing_db": -0.741}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.575, "se": 0.893, "ts": 1.000, "map": 2.257, "obs": 2, "own": 1.318, "comp": {"cins": -0.3353, "dshield": -0.7112, "crowdsec": 5.5348, "vulncheck": -0.5558, "blocklist_de": -1.725}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.786, "det": {"shodan": {"malware": 1, "compromised": 5}, "threatfox": {"family:VShell": 1}}, "oid": "ORG-VGL5-AP-APNIC", "org": "VH Global Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.vh-global.net"}, "pfx": 116, "reg": "2019-05-21", "rir": "apnic", "s24": 116, "sib": 0, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 29696, "abuse": "abuse@vh-global.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00105081491516}, {"a": 42961, "h": "GPRS-AS", "n": "Zain KW", "t": "Broadband & mobile", "w": 13, "cc": "KW", "cf": null, "cs": {"c": {"web_exploit": 3, "ssh_bruteforce": 4, "web_bruteforce": 1, "mail_bruteforce": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2024-12847": 2}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.0563, "hi": 3.08, "lo": 0.40, "ips": 2, "mean": 1.47, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 1.23, "lo": 0.22, "ips": 3, "mean": 0.64, "above": false}, "dshield": {"n": 1, "p": 0.0073, "hi": 2.03, "lo": 0.15, "ips": 1, "mean": 0.86, "above": false}, "urlhaus": {"n": 1, "p": 0.1175, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.21, "lo": 0.26, "ips": 4, "mean": 0.66, "above": false}, "blocklist_de": {"n": 6, "p": 0.0808, "hi": 3.25, "lo": 0.90, "ips": 6, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.260, 0.092, 0, false], ["2026-10-12", 0.656, 0.102, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.102, "se": 1.354, "ts": 1.000, "map": 0.666, "obs": 1, "own": 1.961, "comp": {"urlhaus": 2.5488, "threatfox": -0.4463, "phishing_db": -0.8828}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 6}, "lo": 0.656, "se": 0.462, "ts": 0.462, "map": 1.161, "obs": 13, "own": 1.793, "comp": {"cins": 3.4381, "dshield": -1.2098, "crowdsec": -4.649, "vulncheck": -0.9451, "blocklist_de": 4.9085}, "mass": 15.9, "listed": false}}, "abq": false, "bot": 0.100, "det": {"shodan": {"c2": 3}, "blocklist_de": {"bots": 4, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MTC1-RIPE", "org": "Mobile Telecommunications Company K.S.C.P.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "100-200Gbps", "pol": "Selective", "web": "http://kw.zain.com"}, "pfx": 194, "reg": "2007-05-15", "rir": "ripencc", "s24": 2472, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1303808, "abuse": "abuse@kw.zain.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03281754124503}, {"a": 43009, "h": "INFOBIP-AS", "n": "INFOBIP", "t": "Enterprise, edu & gov", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 801.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 2.840, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 2.909, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.927, "det": null, "oid": "ORG-IL492-RIPE", "org": "Infobip Limited", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.infobip.com"}, "pfx": 39, "reg": "2007-05-23", "rir": "ripencc", "s24": 39, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@infobip.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00047768671938}, {"a": 43132, "h": "KBT-AS", "n": "PJSC Rostelecom", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-27771": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 1.018, 0.011, 0, false], ["2026-10-12", 1.101, 0.012, 0, false]], "sh": false, "uc": 1198.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.101, "se": 0.925, "ts": 0.500, "map": 4.572, "obs": 2, "own": 7.328, "comp": {"cins": -0.3285, "dshield": -0.6986, "crowdsec": 1.4328, "vulncheck": -0.5502, "blocklist_de": 3.0582}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.463, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-JR8-RIPE", "org": "PJSC Rostelecom", "pdb": null, "pfx": 4, "reg": "2007-06-12", "rir": "ripencc", "s24": 56, "sib": 120, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "abuse@rt.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43139, "h": "MAXIMUMA-AS", "n": "Maximum-Net", "t": "Broadband & mobile", "w": 7, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1146, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "dshield": {"n": 1, "p": 0.1737, "hi": 4.47, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.0997, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "vulncheck": {"n": 2, "p": 0.3849, "hi": 5.95, "lo": 0.77, "ips": 3, "mean": 2.83, "above": false}, "blocklist_de": {"n": 2, "p": 0.3475, "hi": 5.62, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}}, "h2": [["2026-10-05", 0.425, 0.011, 0, false], ["2026-10-12", 3.026, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.998, "ts": null, "map": 0.183, "obs": 0, "own": 1.313, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 2}, "lo": 3.026, "se": 0.595, "ts": 0.333, "map": 6.718, "obs": 6, "own": 10.500, "comp": {"cins": -0.8452, "dshield": 1.5689, "crowdsec": -2.8187, "vulncheck": 1.5542, "blocklist_de": 3.8394}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.203, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"bots": 2}}, "oid": "ORG-ML441-RIPE", "org": "Maximum-Net LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Tbps", "pol": "Open", "web": "http://maximuma.net"}, "pfx": 13, "reg": "2007-06-13", "rir": "ripencc", "s24": 112, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29184, "abuse": "abuse@maximuma.net.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00450855134496}, {"a": 43180, "h": "TRUNKNETWORKS-AS", "n": "Trunk Networks", "t": "Hosting & VPS", "w": 9, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 4, "web_exploit": 5, "bad_crawling": 3, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 1, "web_bruteforce": 4, "cve:CVE-2021-3129": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2023-23752": 2, "cve:CVE-2026-60137": 2}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 4, "p": 0.7474, "hi": 8.12, "lo": 1.75, "ips": 6, "mean": 4.43, "above": false}, "threatfox": {"n": 2, "p": 0.4183, "hi": 6.25, "lo": 0.81, "ips": 4, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 3.952, 0.381, 0, false], ["2026-10-12", 4.128, 2.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 2.031, "se": 1.162, "ts": 1.000, "map": 9.684, "obs": 2, "own": 3.736, "comp": {"urlhaus": -0.2937, "threatfox": 4.7049, "phishing_db": -0.5146}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.128, "se": 0.670, "ts": 1.000, "map": 10.684, "obs": 4, "own": 2.114, "comp": {"cins": -0.6129, "dshield": -1.1707, "crowdsec": 9.3592, "vulncheck": -0.7143, "blocklist_de": -3.0988}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"c2": 1}, "threatfox": {"family:pupy": 1, "family:VShell": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 1}}, "oid": "ORG-TNL61-RIPE", "org": "Trunk Networks LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://trunk-networks.net/"}, "pfx": 35, "reg": "2007-06-20", "rir": "ripencc", "s24": 48, "sib": 0, "tor": 1, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "abuse@trunk-networks.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051080775512}, {"a": 43256, "h": "KIN-AS", "n": "Global Broadband Solution", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1054.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.332, "det": null, "oid": "ORG-SA91-RIPE", "org": "Global Broadband Solution Inc", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Selective", "web": "http://www.gbs.cd"}, "pfx": 20, "reg": "2007-07-04", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "noc@corp.gbs.cd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010135854708}, {"a": 43260, "h": "AS43260", "n": "DGN Teknoloji", "t": "Other", "w": 2, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 6, "p": 0.9307, "hi": 10.00, "lo": 2.78, "ips": 6, "mean": 5.91, "above": true}, "crowdsec": {"n": 1, "p": 0.1175, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "phishing_db": {"n": 1, "p": 0.1811, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.179, 0.318, 0, false], ["2026-10-12", 0.183, 0.326, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.326, "se": 1.473, "ts": 1.000, "map": 2.823, "obs": 1, "own": 3.312, "comp": {"urlhaus": -0.1604, "threatfox": -0.1826, "phishing_db": 3.0068}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.183, "se": 1.216, "ts": 1.000, "map": 1.329, "obs": 1, "own": 0.840, "comp": {"cins": -0.1529, "dshield": -0.3495, "crowdsec": 3.3263, "vulncheck": -0.3506, "blocklist_de": -0.7954}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"compromised": 6}}, "oid": "ORG-DTBY1-RIPE", "org": "DGN TEKNOLOJI A.S.", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.dgnteknoloji.com"}, "pfx": 86, "reg": "2007-07-04", "rir": "ripencc", "s24": 86, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 22016, "abuse": "abuse@dgn.net.tr", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0003642858059}, {"a": 43270, "h": "IT-TELECOM-AS", "n": "Ryabikov Ivan", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 9375, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.489, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RI76-RIPE", "org": "Ryabikov Ivan", "pdb": null, "pfx": 4, "reg": "2009-08-10", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "info@safecity.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43289, "h": "TRABIA", "n": "Trabia", "t": "Broadband & mobile", "w": 12, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 1, "web_exploit": 10, "bad_crawling": 7, "proxy_or_vpn": 7, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 11, "home_connection": 6, "mail_bruteforce": 2, "cve:CVE-2017-9841": 4, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 3, "cve:CVE-2021-41773": 4, "cve:CVE-2025-55182": 1}, "n": 12}, "ev": {"crowdsec": {"n": 6, "p": 0.9434, "hi": 10.50, "lo": 2.91, "ips": 12, "mean": 6.21, "above": true}}, "h2": [["2026-10-05", 13.351, 0.011, 1, false], ["2026-10-12", 7.547, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.547, "se": 0.571, "ts": 1.000, "map": 16.422, "obs": 6, "own": 25.320, "comp": {"cins": -0.8775, "dshield": -1.5311, "crowdsec": 11.7631, "vulncheck": -0.7971, "blocklist_de": -4.3651}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.784, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ITS10-RIPE", "org": "Trabia SRL", "pdb": {"t": "Content", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.trabia.com"}, "pfx": 14, "reg": "2007-07-09", "rir": "ripencc", "s24": 48, "sib": 1, "tor": 5, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "abuse@trabia.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00050211805875}, {"a": 43320, "h": "ASTRATELKOM-AS", "n": "VKTelekom", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PIM4-RIPE", "org": "Pushkar Inna Mykolaivna", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://astratelcom.net"}, "pfx": 2, "reg": "2007-07-12", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@astra.od.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43350, "h": "NFORCE", "n": "NFOrce Internet Services :: 43350", "t": "Broadband & mobile", "w": 8, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 5, "ssh_bruteforce": 3, "web_bruteforce": 6, "mail_bruteforce": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2020-17496": 1, "cve:CVE-2023-28121": 1, "cve:CVE-2023-50164": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1648, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "dshield": {"n": 1, "p": 0.1563, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 5, "p": 0.6908, "hi": 6.90, "lo": 1.72, "ips": 7, "mean": 3.94, "above": false}, "threatfox": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 4.180, 0.010, 0, false], ["2026-10-12", 2.644, 0.213, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.213, "se": 1.419, "ts": 1.000, "map": 1.599, "obs": 1, "own": 4.752, "comp": {"urlhaus": -0.2051, "threatfox": 2.7039, "phishing_db": -0.4032}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.644, "se": 0.540, "ts": 0.714, "map": 5.429, "obs": 7, "own": 8.393, "comp": {"cins": 2.8184, "dshield": 0.8005, "crowdsec": 5.7691, "vulncheck": -0.8451, "blocklist_de": -5.4573}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.796, "det": {"threatfox": {"family:SectopRAT": 1}}, "oid": "ORG-NE3-RIPE", "org": "NForce Entertainment B.V.", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.nforce.com"}, "pfx": 90, "reg": "2007-07-18", "rir": "ripencc", "s24": 197, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51456, "abuse": "abuse@nforce.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00537113645}, {"a": 43357, "h": "OWL", "n": "Owl Limited", "t": "Broadband & mobile", "w": 11, "cc": "VU", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 6, "bad_crawling": 6, "first_seen_30d": 1, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-0282": 1, "cve:CVE-2018-13379": 2, "cve:CVE-2021-42013": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2025-22457": 2}, "n": 7}, "ev": {"dshield": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 3, "p": 0.6009, "hi": 7.25, "lo": 1.28, "ips": 7, "mean": 3.74, "above": false}, "blocklist_de": {"n": 2, "p": 0.4047, "hi": 6.13, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 21.164, 0.011, 1, false], ["2026-10-12", 15.062, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 1.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 15.062, "se": 0.576, "ts": 0.500, "map": 33.113, "obs": 6, "own": 51.014, "comp": {"cins": -0.9414, "dshield": 1.2775, "crowdsec": 2.2414, "vulncheck": -0.8119, "blocklist_de": 3.128}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.716, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-OL194-RIPE", "org": "Owl Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://owl.net/"}, "pfx": 26, "reg": "2018-05-29", "rir": "ripencc", "s24": 26, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@owl.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00312198608182}, {"a": 43359, "h": "tarhely", "n": "Tarhely.Eu", "t": "Hosting & VPS", "w": 0, "cc": "HU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.799, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TSK2-RIPE", "org": "Tarhely.Eu Szolgaltato Kft.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://tarhely.eu"}, "pfx": 8, "reg": "2017-02-09", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@tarhely.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010904528448}, {"a": 43391, "h": "NETDIREKT-AS", "n": "Netdirekt A.S.", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1217, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 0.209, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.804, "ts": null, "map": 0.156, "obs": 0, "own": 0.062, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.806, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TBTL1-RIPE", "org": "NETDIREKT BILISIM DANISMANLIK ILETISIM HIZMETLERI SANAYI VE TICARET AS", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.netdirekt.com.tr"}, "pfx": 100, "reg": "2007-07-24", "rir": "ripencc", "s24": 100, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 41728, "abuse": "abuse@netdirekt.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00138578640665}, {"a": 43395, "h": "Ertebatat-Doorbord-Fars", "n": "Pooya Parto Qeshm Cooperative", "t": "Other", "w": 2, "cc": "IR", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4032, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-12", 1.029, 0.012, 0, false]], "sh": false, "uc": 6012.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.029, "se": 0.921, "ts": 1.000, "map": 4.267, "obs": 2, "own": 2.497, "comp": {"cins": -0.3081, "dshield": 7.8794, "crowdsec": -2.6064, "vulncheck": -0.5327, "blocklist_de": -1.5877}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.657, "det": null, "oid": "ORG-PPQC1-RIPE", "org": "Pooya Parto Qeshm Cooperative Company", "pdb": null, "pfx": 43, "reg": "2017-01-17", "rir": "ripencc", "s24": 56, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025995679995}, {"a": 43400, "h": "SV3-AS", "n": "NEO-TELEKOM Ltd", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1622, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1834, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.538, 0.011, 0, false], ["2026-10-12", 1.611, 0.012, 0, false]], "sh": false, "uc": 1114.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.611, "se": 0.946, "ts": 0.500, "map": 7.012, "obs": 2, "own": 11.265, "comp": {"cins": -0.3075, "dshield": -0.6594, "crowdsec": 1.6452, "vulncheck": -0.5322, "blocklist_de": 3.195}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.491, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-TS72-RIPE", "org": "NEO-TELEKOM Ltd", "pdb": null, "pfx": 3, "reg": "2007-07-26", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "noc@neotele.com.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43444, "h": "BNS-AS", "n": "Fast Servers (Pty) Ltd", "t": "Hosting & VPS", "w": 161, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 67, "web_exploit": 152, "bad_crawling": 13, "web_bruteforce": 158, "cve:CVE-2019-18935": 4, "cve:CVE-2021-41773": 5, "cve:CVE-2022-39290": 5, "cve:CVE-2026-60137": 54, "cve:CVE-2026-63030": 98}, "n": 159}, "ev": {"crowdsec": {"n": 7, "p": 0.9809, "hi": 12.03, "lo": 3.64, "ips": 159, "mean": 7.32, "above": true}, "blocklist_de": {"n": 2, "p": 0.3985, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 19.014, 0.011, 1, false], ["2026-10-12", 19.225, 0.012, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 2}, "lo": 19.225, "se": 0.502, "ts": 0.778, "map": 37.092, "obs": 9, "own": 7.255, "comp": {"cins": -1.2824, "dshield": -1.9761, "crowdsec": 8.4649, "vulncheck": -0.871, "blocklist_de": 0.6716}, "mass": 7.2, "listed": false}}, "abq": false, "bot": 0.715, "det": {"blocklist_de": {"bots": 1, "apache": 1}}, "oid": "ORG-FAST11-RIPE", "org": "Fast Servers (Pty) Ltd", "pdb": null, "pfx": 21, "reg": "2018-10-19", "rir": "ripencc", "s24": 35, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "info@finegroupservers.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00097673206808}, {"a": 43463, "h": "BST-LT", "n": "INFOCOM UK LTD", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 1.000, "det": null, "oid": "ORG-IUL9-RIPE", "org": "INFOCOM UK LTD", "pdb": null, "pfx": 9, "reg": "2007-08-03", "rir": "ripencc", "s24": 12, "sib": 1, "tor": 0, "w24": 0, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43507, "h": "RETE-AS", "n": "RETE internet", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.142, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-RIS11-RIPE", "org": "RETE internet, s.r.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.rete.cz"}, "pfx": 2, "reg": "2007-08-14", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002600133422}, {"a": 43513, "h": "NANO-AS", "n": "Nano IT", "t": "Transit & backbone", "w": 9, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1567, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "shodan": {"n": 1, "p": 0.0565, "hi": 3.10, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "dshield": {"n": 1, "p": 0.1465, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 3, "p": 0.2671, "hi": 4.67, "lo": 0.82, "ips": 4, "mean": 2.41, "above": false}, "phishing_db": {"n": 2, "p": 0.3465, "hi": 5.61, "lo": 0.73, "ips": 3, "mean": 2.67, "above": false}}, "h2": [["2026-10-05", 1.721, 0.697, 0, false], ["2026-10-12", 1.385, 0.715, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.715, "se": 1.137, "ts": 1.000, "map": 3.066, "obs": 2, "own": 11.516, "comp": {"urlhaus": -0.4556, "threatfox": -0.3463, "phishing_db": 3.5483}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.385, "se": 0.604, "ts": 0.600, "map": 3.160, "obs": 5, "own": 9.975, "comp": {"cins": 3.3316, "dshield": 1.4726, "crowdsec": 2.8964, "vulncheck": -0.7969, "blocklist_de": -4.3594}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.691, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SNI2-RIPE", "org": "Sia Nano IT", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.nano.lv"}, "pfx": 52, "reg": "2007-08-14", "rir": "ripencc", "s24": 249, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 71936, "abuse": "abuse@nano.lv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00156409610061}, {"a": 43515, "h": "YOUTUBE", "n": "Google LLC AS43515", "t": "Hosting & VPS", "w": 180, "cc": "IE", "cf": {"rb": "hi", "wb": "hi", "rep": 0.42, "waf": 0.37}, "cs": {"c": {"http_flood": 81, "data_centre": 164, "web_exploit": 171, "bad_crawling": 160, "proxy_or_vpn": 4, "first_seen_30d": 157, "ssh_bruteforce": 3, "web_bruteforce": 158, "home_connection": 2, "cve:CVE-2025-55182": 167}, "n": 174}, "ev": {"shodan": {"n": 20, "p": 0.9387, "hi": 6.04, "lo": 2.93, "ips": 20, "mean": 4.37, "above": true}, "dshield": {"n": 1, "p": 0.0191, "hi": 2.42, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}, "crowdsec": {"n": 163, "p": 1.0000, "hi": 32.34, "lo": 25.01, "ips": 174, "mean": 28.58, "above": true}, "vulncheck": {"n": 1, "p": 0.0205, "hi": 2.45, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}, "phishing_db": {"n": 4, "p": 0.3401, "hi": 4.89, "lo": 1.05, "ips": 4, "mean": 2.67, "above": false}, "blocklist_de": {"n": 1, "p": 0.0016, "hi": 1.63, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}}, "h2": [["2026-10-05", 10.277, 0.396, 2, false], ["2026-10-12", 7.681, 0.407, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 0.407, "se": 0.991, "ts": 1.000, "map": 1.204, "obs": 4, "own": 0.517, "comp": {"urlhaus": -1.0198, "threatfox": -0.4739, "phishing_db": 3.3059}, "mass": 3.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 163, "vulncheck": 1, "blocklist_de": 1}, "lo": 7.681, "se": 0.355, "ts": 0.982, "map": 11.503, "obs": 166, "own": 2.245, "comp": {"cins": -3.863, "dshield": -3.1547, "crowdsec": 27.5015, "vulncheck": -0.9512, "blocklist_de": -15.6964}, "mass": 113.0, "listed": false}}, "abq": false, "bot": 0.812, "det": {"shodan": {"c2": 4, "compromised": 15, "doublepulsar": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-GIL4-RIPE", "org": "Google Ireland Limited", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Restrictive", "web": "http://www.google.com"}, "pfx": 100, "reg": "2007-08-15", "rir": "ripencc", "s24": 1783, "sib": 0, "tor": 0, "w24": 168, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 463872, "abuse": "ripe-contact@google.com", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.17293}, {"a": 43541, "h": "VSHOSTING", "n": "VSHosting s.r.o.", "t": "Hosting & VPS", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1435, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "vulncheck": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.170, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 0.231, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.170, "se": 1.224, "ts": 1.000, "map": 1.211, "obs": 1, "own": 0.278, "comp": {"cins": -0.1096, "dshield": -0.2553, "crowdsec": -1.0111, "vulncheck": 3.533, "blocklist_de": -0.5719}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.988, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-VS21-RIPE", "org": "VSHosting s.r.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.vshosting.cz"}, "pfx": 18, "reg": "2007-08-20", "rir": "ripencc", "s24": 67, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": "abuse@vshosting.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0015540210246}, {"a": 43581, "h": "ZTVCORP-AS", "n": "ZTV CORP LLC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.723, 0.011, 0, false], ["2026-10-12", 4.075, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.075, "se": 1.003, "ts": 0.500, "map": 19.743, "obs": 2, "own": 11.703, "comp": {"cins": -0.2577, "dshield": -0.5638, "crowdsec": 2.1624, "vulncheck": -0.4843, "blocklist_de": 3.5198}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.485, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-ZCL8-RIPE", "org": "ZTV CORP LLC", "pdb": null, "pfx": 10, "reg": "2020-09-03", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@ztv.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43641, "h": "Sollutium-NL", "n": "SOLLUTIUM EU Sp z.o.o.", "t": "Other", "w": 51, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 10, "data_centre": 7, "web_exploit": 12, "bad_crawling": 10, "proxy_or_vpn": 2, "first_seen_30d": 9, "ssh_bruteforce": 1, "web_bruteforce": 10, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2020-5902": 3, "cve:CVE-2021-3129": 2, "cve:CVE-2018-13379": 2, "cve:CVE-2021-41773": 2, "cve:CVE-2024-28000": 2}, "n": 12}, "ev": {"shodan": {"n": 3, "p": 0.4551, "hi": 5.98, "lo": 1.05, "ips": 3, "mean": 3.08, "above": false}, "urlhaus": {"n": 3, "p": 0.6386, "hi": 7.66, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}, "crowdsec": {"n": 10, "p": 0.9965, "hi": 12.39, "lo": 4.50, "ips": 12, "mean": 8.03, "above": true}, "threatfox": {"n": 4, "p": 0.8044, "hi": 8.96, "lo": 1.93, "ips": 4, "mean": 4.90, "above": true}, "vulncheck": {"n": 7, "p": 0.9826, "hi": 12.25, "lo": 3.71, "ips": 23, "mean": 7.46, "above": true}, "phishing_db": {"n": 1, "p": 0.1707, "hi": 4.44, "lo": 0.33, "ips": 8, "mean": 1.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 11.110, 13.019, 1, false], ["2026-10-12", 7.677, 14.993, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 4, "phishing_db": 1}, "lo": 14.993, "se": 0.825, "ts": 0.500, "map": 38.319, "obs": 8, "own": 34.279, "comp": {"urlhaus": 4.694, "threatfox": 1.177, "phishing_db": -0.5989}, "mass": 6.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 10, "vulncheck": 7, "blocklist_de": 1}, "lo": 7.677, "se": 0.446, "ts": 0.556, "map": 13.359, "obs": 18, "own": 7.523, "comp": {"cins": -1.6327, "dshield": -2.2849, "crowdsec": 9.7381, "vulncheck": 2.9236, "blocklist_de": -4.7582}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.728, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:PureRAT": 1, "family:Tsundere": 1, "family:Coinminer": 1, "family:OtterCookie": 1}, "vulncheck": {"botnet_node": 23}, "blocklist_de": {"mail": 1}}, "oid": "ORG-SESZ2-RIPE", "org": "SOLLUTIUM EU Sp z.o.o.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://sollutium.com/"}, "pfx": 127, "reg": "2007-09-05", "rir": "ripencc", "s24": 139, "sib": 0, "tor": 2, "w24": 23, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.8961]], "ipv4": 35584, "abuse": "abuse@sollutium.com", "score": 0.8961, "groups": ["vulncheck", "abusech"], "sensors": ["crowdsec"], "traffic": 0.00383278529814}, {"a": 43647, "h": "AS-SERVERCORE-UZ", "n": "\"SERVERCORE CIS\" FE LLC", "t": "Hosting & VPS", "w": 0, "cc": "UZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5339, "hi": 6.62, "lo": 1.17, "ips": 3, "mean": 3.42, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.221, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.070, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.770, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-CFL8-RIPE", "org": "\"SERVERCORE CIS\" FE LLC", "pdb": null, "pfx": 61, "reg": "2019-12-12", "rir": "ripencc", "s24": 80, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32512, "abuse": "abuse@servercore.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004367894704}, {"a": 43668, "h": "BIGNET-AS", "n": "AS43668 LLC", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 1.421, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.177, "det": null, "oid": "ORG-LA1817-RIPE", "org": "\"AS43668\" LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://as43668.net"}, "pfx": 8, "reg": "2007-09-10", "rir": "ripencc", "s24": 11, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43700, "h": "CO-AS", "n": "Consilium Optimum", "t": "Broadband & mobile", "w": 13, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 4, "p": 0.7970, "hi": 8.84, "lo": 1.90, "ips": 13, "mean": 4.83, "above": true}}, "h2": [["2026-10-05", 1.206, 0.011, 0, false], ["2026-10-12", 1.540, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 1.540, "se": 0.703, "ts": 1.000, "map": 4.067, "obs": 4, "own": 6.618, "comp": {"cins": -0.3528, "dshield": -0.7431, "crowdsec": -2.9297, "vulncheck": 8.6352, "blocklist_de": -1.8129}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.190, "det": {"vulncheck": {"botnet_node": 13}}, "oid": "ORG-UCO1-RIPE", "org": "UAB Consilium Optimum", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.fastlink.lt"}, "pfx": 10, "reg": "2007-09-14", "rir": "ripencc", "s24": 68, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 17408, "abuse": "info@fastlink.lt", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0010921457525}, {"a": 43732, "h": "TBI-AS", "n": "TBI BANK EAD", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-TA291-RIPE", "org": "TBI BANK EAD", "pdb": null, "pfx": 2, "reg": "2007-09-20", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@evolink.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43733, "h": "Viva-Armenia", "n": "Viva Armenia AS43733", "t": "Transit & backbone", "w": 1, "cc": "AM", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.1104, "hi": 3.65, "lo": 0.47, "ips": 2, "mean": 1.74, "above": false}, "crowdsec": {"n": 1, "p": 0.0222, "hi": 2.49, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}}, "h2": [["2026-10-05", 0.074, 0.010, 0, false], ["2026-10-12", 0.076, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.921, "ts": null, "map": 0.163, "obs": 0, "own": 1.345, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.076, "se": 1.114, "ts": 1.000, "map": 0.454, "obs": 1, "own": 1.547, "comp": {"cins": -0.204, "dshield": -0.4565, "crowdsec": 2.745, "vulncheck": -0.4225, "blocklist_de": -1.0581}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.056, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"mail": 1}}, "oid": "ORG-KC7-RIPE", "org": "Viva Armenia CJSC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.viva.am"}, "pfx": 21, "reg": "2007-09-20", "rir": "ripencc", "s24": 340, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 159744, "abuse": "abuse@viva.am", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00701058537085}, {"a": 43743, "h": "KRUIZUA-AS", "n": "Kruiz LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.150, "det": null, "oid": "ORG-KL35-RIPE", "org": "Kruiz LLC", "pdb": null, "pfx": 2, "reg": "2007-09-21", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43752, "h": "SARNET", "n": "Ministry of Science and Technology Development and Higher Education", "t": "Other", "w": 0, "cc": "BA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.172, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SA534-RIPE", "org": "Ministry of Science and Technology Development and Higher Education", "pdb": null, "pfx": 3, "reg": "2007-09-21", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002112356748}, {"a": 43754, "h": "ASIATECH", "n": "Asiatech", "t": "Other", "w": 5, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.0893, "hi": 3.53, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}, "shodan": {"n": 7, "p": 0.4231, "hi": 4.80, "lo": 1.45, "ips": 7, "mean": 2.92, "above": false}, "crowdsec": {"n": 2, "p": 0.0042, "hi": 1.99, "lo": 0.26, "ips": 2, "mean": 0.95, "above": false}, "vulncheck": {"n": 2, "p": 0.1998, "hi": 4.41, "lo": 0.57, "ips": 2, "mean": 2.10, "above": false}}, "h2": [["2026-10-05", 1.207, 0.009, 0, false], ["2026-10-12", 0.346, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.853, "ts": null, "map": 0.137, "obs": 0, "own": 0.282, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.346, "se": 0.625, "ts": 0.400, "map": 0.812, "obs": 5, "own": 0.470, "comp": {"cins": 3.5848, "dshield": -1.3786, "crowdsec": 0.962, "vulncheck": 1.8229, "blocklist_de": -3.8061}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.631, "det": {"shodan": {"compromised": 6, "doublepulsar": 1}, "vulncheck": {"c2_server": 2}}, "oid": "ORG-AI34-RIPE", "org": "Asiatech Data Transmission company", "pdb": null, "pfx": 317, "reg": "2007-09-24", "rir": "ripencc", "s24": 814, "sib": 6, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 526592, "abuse": "abuse@asiatech.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0042463893642}, {"a": 43764, "h": "SEVLUSH-AS", "n": "Sevlush", "t": "Other", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.314, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 0.698, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.314, "se": 1.298, "ts": 1.000, "map": 2.655, "obs": 1, "own": 1.735, "comp": {"cins": -0.1216, "dshield": 4.5406, "crowdsec": -1.1159, "vulncheck": -0.2986, "blocklist_de": -0.6342}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-EA1541-RIPE", "org": "LLC \"Electron-sevlush\"", "pdb": null, "pfx": 2, "reg": "2007-09-25", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "noc@sevlush.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039723126921}, {"a": 43766, "h": "MTC-KSA-AS", "n": "Zain KSA", "t": "Broadband & mobile", "w": 5, "cc": "SA", "cf": {"rb": "", "wb": "hi", "rep": 0.81, "waf": 0.59}, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.2906, "hi": 4.82, "lo": 0.85, "ips": 3, "mean": 2.49, "above": false}, "crowdsec": {"n": 1, "p": 0.0001, "hi": 1.19, "lo": 0.09, "ips": 1, "mean": 0.50, "above": false}, "blocklist_de": {"n": 1, "p": 0.0101, "hi": 2.15, "lo": 0.16, "ips": 1, "mean": 0.91, "above": false}}, "h2": [["2026-10-05", 0.087, 0.008, 0, false], ["2026-10-12", 0.340, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.828, "ts": null, "map": 0.126, "obs": 0, "own": 0.621, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.340, "se": 0.595, "ts": 0.600, "map": 0.762, "obs": 5, "own": 1.186, "comp": {"cins": -0.9392, "dshield": 7.0641, "crowdsec": -3.4364, "vulncheck": -0.8115, "blocklist_de": -0.7555}, "mass": 4.8, "listed": false}}, "abq": true, "bot": 0.095, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-MK8-RIPE", "org": "Mobile Telecommunication Company Saudi Arabia Joint-Stock company", "pdb": {"t": "NSP", "sc": "Middle East", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.sa.zain.com"}, "pfx": 640, "reg": "2007-09-25", "rir": "ripencc", "s24": 1127, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 674816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.109062}, {"a": 43927, "h": "HOSTERION", "n": "HOSTERION", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.189, "obs": 0, "own": 0.092, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.939, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ES311-RIPE", "org": "HOSTERION SRL", "pdb": {"t": null, "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://hosterion.com"}, "pfx": 27, "reg": "2018-05-07", "rir": "ripencc", "s24": 48, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": "abuse@elvsoft.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020181240477}, {"a": 43969, "h": "PRINODE", "n": "PRINODE", "t": "Other", "w": 2, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "threatfox": {"n": 1, "p": 0.1969, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.258, 0.454, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.454, "se": 1.540, "ts": 1.000, "map": 4.568, "obs": 1, "own": 5.469, "comp": {"urlhaus": -0.1015, "threatfox": 3.4796, "phishing_db": -0.2327}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.258, "se": 1.283, "ts": 1.000, "map": 2.048, "obs": 1, "own": 1.382, "comp": {"cins": -0.0917, "dshield": -0.2153, "crowdsec": -0.8528, "vulncheck": 3.7494, "blocklist_de": -0.479}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.909, "det": {"shodan": {"doublepulsar": 1}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-PA1397-RIPE", "org": "Prinode AB", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://prinode.com"}, "pfx": 24, "reg": "2016-12-09", "rir": "ripencc", "s24": 33, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@prinode.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 43994, "h": "SMARTNET-AS", "n": "SMARTNET", "t": "Transit & backbone", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 347.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 2.148, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 1.257, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.178, "det": null, "oid": "ORG-ST81-RIPE", "org": "SMARTNET TOO", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.smartnet.kz"}, "pfx": 63, "reg": "2007-10-31", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057486566123}, {"a": 44034, "h": "hi3g", "n": "Hi3G Access AB", "t": "Broadband & mobile", "w": 10, "cc": "SE", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 3}, "n": 4}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.82, "lo": 0.15, "ips": 3, "mean": 0.43, "above": false}, "dshield": {"n": 4, "p": 0.0437, "hi": 2.93, "lo": 0.63, "ips": 4, "mean": 1.60, "above": false}, "urlhaus": {"n": 1, "p": 0.0851, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.68, "lo": 0.12, "ips": 4, "mean": 0.35, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.21, "lo": 0.16, "ips": 3, "mean": 0.57, "above": false}}, "h2": [["2026-10-05", 0.134, 0.071, 0, false], ["2026-10-12", 0.216, 0.079, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.079, "se": 1.339, "ts": 1.000, "map": 0.491, "obs": 1, "own": 1.472, "comp": {"urlhaus": 2.2985, "threatfox": -0.4633, "phishing_db": -0.921}, "mass": 3.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.216, "se": 0.502, "ts": 0.444, "map": 0.412, "obs": 9, "own": 0.641, "comp": {"cins": -1.496, "dshield": 6.0925, "crowdsec": -2.3741, "vulncheck": -0.8967, "blocklist_de": -0.8177}, "mass": 9.1, "listed": false}}, "abq": true, "bot": 0.067, "det": {"shodan": {"malware": 2, "compromised": 1}, "blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-HAA1-RIPE", "org": "Hi3G Access AB", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.tre.se"}, "pfx": 10, "reg": "2007-11-07", "rir": "ripencc", "s24": 3936, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1007616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03522640987927}, {"a": 44050, "h": "PIN-AS", "n": "PIN", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0621, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "vulncheck": {"n": 1, "p": 0.1510, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.078, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.949, "ts": null, "map": 0.171, "obs": 0, "own": 1.068, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.078, "se": 1.136, "ts": 1.000, "map": 0.465, "obs": 1, "own": 0.817, "comp": {"cins": -0.1441, "dshield": -0.3308, "crowdsec": -1.3089, "vulncheck": 3.163, "blocklist_de": -0.7503}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.822, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-PINL1-RIPE", "org": "Petersburg Internet Network ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.pinspb.ru"}, "pfx": 21, "reg": "2007-11-09", "rir": "ripencc", "s24": 231, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 62208, "abuse": "abuse@pindc.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44051, "h": "FORNEX-AS", "n": "Fornex Hosting - Germany", "t": "Hosting & VPS", "w": 7, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5325, "hi": 6.61, "lo": 1.16, "ips": 3, "mean": 3.41, "above": false}, "dshield": {"n": 1, "p": 0.1804, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "threatfox": {"n": 2, "p": 0.4149, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "vulncheck": {"n": 4, "p": 0.7934, "hi": 8.78, "lo": 1.89, "ips": 4, "mean": 4.80, "above": true}}, "h2": [["2026-10-05", 0.009, 1.437, 0, false], ["2026-10-12", 1.992, 1.435, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.435, "se": 1.152, "ts": 1.000, "map": 6.535, "obs": 2, "own": 2.573, "comp": {"urlhaus": -0.3303, "threatfox": 4.3875, "phishing_db": -0.5538}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 1.992, "se": 0.648, "ts": 0.800, "map": 4.810, "obs": 5, "own": 0.982, "comp": {"cins": -0.4815, "dshield": 2.8607, "crowdsec": -3.7975, "vulncheck": 6.8369, "blocklist_de": -2.4542}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.626, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:AdaptixC2": 2}, "vulncheck": {"c2_server": 3, "botnet_node": 1}}, "oid": "ORG-FHS3-RIPE", "org": "Fornex Hosting S.L.", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://fornex.com"}, "pfx": 82, "reg": "2016-12-01", "rir": "ripencc", "s24": 81, "sib": 4, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 21760, "abuse": "abuse@fornex.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0022914973554}, {"a": 44056, "h": "TRYTECH-AS", "n": "Trytek LLC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1765, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.168, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.006, "ts": null, "map": 0.184, "obs": 0, "own": 0.547, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.168, "se": 1.205, "ts": 1.000, "map": 1.198, "obs": 1, "own": 0.755, "comp": {"cins": -0.1584, "dshield": 4.3452, "crowdsec": -1.4295, "vulncheck": -0.3592, "blocklist_de": -0.824}, "mass": 0.7, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-TL849-RIPE", "org": "Trytek LLC", "pdb": null, "pfx": 44, "reg": "2007-11-12", "rir": "ripencc", "s24": 99, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 41216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013099199652}, {"a": 44112, "h": "SWEB-AS", "n": "SpaceWeb Ltd", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1592, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 2, "p": 0.3462, "hi": 5.61, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}, "blocklist_de": {"n": 1, "p": 0.1781, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.257, 0.011, 0, false], ["2026-10-12", 2.796, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 0.656, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.796, "se": 0.766, "ts": 0.667, "map": 8.671, "obs": 3, "own": 4.973, "comp": {"cins": -0.4917, "dshield": -0.9817, "crowdsec": 3.6745, "vulncheck": -0.6584, "blocklist_de": 2.011}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.954, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SW40-RIPE", "org": "SpaceWeb Ltd", "pdb": null, "pfx": 32, "reg": "2007-11-19", "rir": "ripencc", "s24": 46, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "abuse@sweb.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006064652594}, {"a": 44128, "h": "INTERNET-PRO-AS", "n": "Internet-Pro LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5603, "hi": 6.86, "lo": 1.21, "ips": 3, "mean": 3.54, "above": false}}, "h2": [["2026-10-05", 0.186, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 0.616, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.179, "obs": 0, "own": 0.232, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.888, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-IL319-RIPE", "org": "Internet-Pro LLC", "pdb": null, "pfx": 35, "reg": "2007-11-21", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": "abuse@netangels.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44133, "h": "IPAX-AS", "n": "IPAX Internet Services", "t": "Broadband & mobile", "w": 1, "cc": "AT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2023-22515": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1622, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 2.798, 0.011, 0, false], ["2026-10-12", 0.313, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.313, "se": 1.297, "ts": 1.000, "map": 2.646, "obs": 1, "own": 4.724, "comp": {"cins": -0.1212, "dshield": -0.281, "crowdsec": 3.6992, "vulncheck": -0.2979, "blocklist_de": -0.6321}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.465, "det": null, "oid": "ORG-ABHO1-RIPE", "org": "IPAX GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.ipax.at/"}, "pfx": 15, "reg": "2009-02-03", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@ipax.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00120855099196}, {"a": 44136, "h": "ASODERLAND", "n": "Oderland", "t": "Hosting & VPS", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.147, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.961, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-OWA2-RIPE", "org": "ODERLAND Webbhotell AB", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.oderland.com"}, "pfx": 4, "reg": "2007-11-21", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@oderland.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010798650512}, {"a": 44143, "h": "A1SERBIA-AS", "n": "A1 Srbija d.o.o.", "t": "Other", "w": 2, "cc": "RS", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1789, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1607, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 1.655, 0.011, 0, false], ["2026-10-12", 0.769, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 0.564, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.769, "se": 0.908, "ts": 0.500, "map": 3.108, "obs": 2, "own": 1.819, "comp": {"cins": -0.3492, "dshield": 3.4228, "crowdsec": -2.9038, "vulncheck": -0.5668, "blocklist_de": 2.9245}, "mass": 1.6, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TD12-RIPE", "org": "A1 Srbija d.o.o. Beograd", "pdb": {"t": null, "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://a1.rs"}, "pfx": 15, "reg": "2007-11-23", "rir": "ripencc", "s24": 88, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0151775800515}, {"a": 44208, "h": "Farahoosh", "n": "Farahoosh Dena PLC", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": true, "uc": 543.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 0.574, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.166, "obs": 0, "own": 0.198, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.671, "det": null, "oid": "ORG-FD5-RIPE", "org": "Farahoosh Dena PLC", "pdb": null, "pfx": 42, "reg": "2008-07-17", "rir": "ripencc", "s24": 82, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001190385234}, {"a": 44217, "h": "IQNETWORKS", "n": "IQ Networks for Data and Internet Services Ltd", "t": "Broadband & mobile", "w": 6, "cc": "IQ", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.3309, "hi": 5.48, "lo": 0.71, "ips": 4, "mean": 2.61, "above": false}, "blocklist_de": {"n": 4, "p": 0.7842, "hi": 8.64, "lo": 1.86, "ips": 5, "mean": 4.72, "above": false}}, "h2": [["2026-10-05", 3.559, 0.011, 0, false], ["2026-10-12", 8.443, 0.012, 0, false]], "sh": false, "uc": 2832, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 8.443, "se": 0.573, "ts": 0.667, "map": 18.222, "obs": 6, "own": 28.090, "comp": {"cins": -1.0739, "dshield": -1.7608, "crowdsec": -1.6326, "vulncheck": -0.8383, "blocklist_de": 9.6019}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.251, "det": {"blocklist_de": {"imap": 2, "mail": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-IN20-RIPE", "org": "IQ Networks for Data and Internet Services Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://iq.group/#/"}, "pfx": 62, "reg": "2007-12-05", "rir": "ripencc", "s24": 56, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22016, "abuse": "abuse@iq.email", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00230608261026}, {"a": 44234, "h": "GAYA-AS", "n": "Gaya, s.r.o.", "t": "Other", "w": 0, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GS320-RIPE", "org": "Gaya, s.r.o.", "pdb": null, "pfx": 7, "reg": "2007-12-07", "rir": "ripencc", "s24": 13, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "abuse@gaya.sk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003443574861}, {"a": 44244, "h": "IranCell-AS", "n": "Iran Cell Service and Communication Company", "t": "Other", "w": 1, "cc": "IR", "cf": {"rb": "hi", "wb": "", "rep": 0.41, "waf": 0.59}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0002, "hi": 1.32, "lo": 0.10, "ips": 1, "mean": 0.56, "above": false}}, "h2": [["2026-10-05", 0.011, 0.006, 0, false], ["2026-10-12", 0.011, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.723, "ts": null, "map": 0.078, "obs": 0, "own": 0.140, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.011, "se": 0.969, "ts": 1.000, "map": 0.051, "obs": 1, "own": 0.031, "comp": {"cins": -0.3163, "dshield": 3.5716, "crowdsec": -2.6668, "vulncheck": -0.5399, "blocklist_de": -1.6292}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.653, "det": null, "oid": "ORG-ICSA1-RIPE", "org": "Iran Cell Service and Communication Company", "pdb": null, "pfx": 394, "reg": "2007-12-11", "rir": "ripencc", "s24": 4812, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3360000, "abuse": "abuse@mtnirancell.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.17909}, {"a": 44259, "h": "ULTAHOST-AP-AS", "n": "Ultahost", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 9, "p": 0.9985, "hi": 15.06, "lo": 5.20, "ips": 9, "mean": 9.59, "above": true}, "crowdsec": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "threatfox": {"n": 1, "p": 0.1978, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.124, 0.524, 0, false], ["2026-10-12", 8.064, 0.541, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.541, "se": 1.583, "ts": 1.000, "map": 5.926, "obs": 1, "own": 2.775, "comp": {"urlhaus": -0.0804, "threatfox": 3.6766, "phishing_db": -0.1907}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 8.064, "se": 0.699, "ts": 0.500, "map": 21.786, "obs": 4, "own": 4.365, "comp": {"cins": -0.5317, "dshield": -1.046, "crowdsec": 3.2339, "vulncheck": 1.0615, "blocklist_de": 1.7573}, "mass": 2.5, "listed": false}}, "abq": true, "bot": 0.617, "det": {"shodan": {"compromised": 9}, "threatfox": {"family:PureRAT": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-UI46-RIPE", "org": "Ultahost, Inc.", "pdb": {"t": null, "sc": null, "tr": null, "pol": "Open", "web": "https://ultahost.com/"}, "pfx": 20, "reg": "2007-12-13", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 5120, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00095741484907}, {"a": 44267, "h": "ENPLUS-TELECOM", "n": "Irkutskenergosvyaz", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 1.839, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.839, "se": 0.981, "ts": 1.000, "map": 8.132, "obs": 2, "own": 13.771, "comp": {"cins": -0.1628, "dshield": -0.3706, "crowdsec": -1.4661, "vulncheck": 6.3354, "blocklist_de": -0.8465}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.476, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-RL173-RIPE", "org": "EN+ TELECOM LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "No", "web": "https://www.iren.ru/"}, "pfx": 13, "reg": "2007-12-14", "rir": "ripencc", "s24": 15, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "info@regiontelekom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44274, "h": "CINER_YAYIN_HOLDING", "n": "CINER YAYIN HOLDING A.S.", "t": "Other", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 49218.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 78.899, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.142, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-CYHA1-RIPE", "org": "CINER YAYIN HOLDING A.S.", "pdb": null, "pfx": 1, "reg": "2007-12-14", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44318, "h": "UA-COLUMBUS-CHG", "n": "Lanet Network AS44318", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.833, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.288, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KP127-RIPE", "org": "KOLUMBUS PE", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.lanet.ua"}, "pfx": 3, "reg": "2007-12-21", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "noc@columbus.in.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44382, "h": "WhiteLabel", "n": "White Label Services", "t": "Hosting & VPS", "w": 32, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 2, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 6, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2021-0027": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26295": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "urlhaus": {"n": 2, "p": 0.4223, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}, "crowdsec": {"n": 4, "p": 0.7962, "hi": 8.83, "lo": 1.90, "ips": 7, "mean": 4.82, "above": true}, "threatfox": {"n": 9, "p": 0.9989, "hi": 15.67, "lo": 5.41, "ips": 23, "mean": 9.98, "above": true}}, "h2": [["2026-10-05", 54.073, 117.315, 1, false], ["2026-10-12", 12.388, 117.872, 1, false]], "sh": true, "uc": 2176.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 2, "threatfox": 9, "phishing_db": 0}, "lo": 117.872, "se": 0.747, "ts": 0.818, "map": 271.998, "obs": 11, "own": 87.526, "comp": {"urlhaus": 3.5947, "threatfox": 4.688, "phishing_db": -1.0507}, "mass": 4.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.388, "se": 0.685, "ts": 1.000, "map": 33.214, "obs": 4, "own": 6.560, "comp": {"cins": -0.5629, "dshield": -1.0948, "crowdsec": 10.1024, "vulncheck": -0.6931, "blocklist_de": -2.8549}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.745, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Remcos": 20, "family:AsyncRAT": 3}}, "oid": "ORG-FA1303-RIPE", "org": "Fiba Cloud Operation Company, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://whitelabelservices.us"}, "pfx": 14, "reg": "2023-12-18", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 5, "w24": 10, "drop": 3, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.1060]], "ipv4": 3584, "abuse": "info@whitelabelservices.us", "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00080624713265}, {"a": 44386, "h": "OZON-AS", "n": "LLC Internet Solutions", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.882, "det": null, "oid": "ORG-LIS21-RIPE", "org": "LLC Internet Solutions", "pdb": null, "pfx": 9, "reg": "2008-01-14", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "noc@ozon.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44391, "h": "ESD-AS", "n": "Elektrosvyaz", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3324, "hi": 5.49, "lo": 0.71, "ips": 2, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 4.549, 0.011, 0, false], ["2026-10-12", 1.038, 0.012, 0, false]], "sh": false, "uc": 475.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.630, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.038, "se": 0.921, "ts": 1.000, "map": 4.304, "obs": 2, "own": 2.519, "comp": {"cins": -0.3054, "dshield": -0.6555, "crowdsec": 5.9185, "vulncheck": -0.5303, "blocklist_de": -1.5741}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.597, "det": null, "oid": "ORG-LE7-RIPE", "org": "JSC Elektrosvyaz", "pdb": {"t": null, "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://ellcom.ru/"}, "pfx": 55, "reg": "2008-01-16", "rir": "ripencc", "s24": 55, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "ripenotify@ellcom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0019723478852}, {"a": 44395, "h": "ORG-UL31-RIPE", "n": "UCOM AS44395", "t": "Broadband & mobile", "w": 14, "cc": "AM", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 7, "bad_crawling": 3, "proxy_or_vpn": 4, "ssh_bruteforce": 3, "web_bruteforce": 6, "home_connection": 8, "mail_bruteforce": 1, "router_or_botnet": 7, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 3}, "n": 9}, "ev": {"shodan": {"n": 1, "p": 0.0365, "hi": 2.78, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}, "urlhaus": {"n": 3, "p": 0.6267, "hi": 7.52, "lo": 1.33, "ips": 3, "mean": 3.88, "above": false}, "crowdsec": {"n": 7, "p": 0.7920, "hi": 6.99, "lo": 2.12, "ips": 9, "mean": 4.26, "above": false}, "vulncheck": {"n": 1, "p": 0.1337, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.0870, "hi": 3.50, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 2.072, 3.249, 0, false], ["2026-10-12", 1.989, 3.575, 0, false]], "sh": false, "uc": 72, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 3.575, "se": 0.989, "ts": 1.000, "map": 12.562, "obs": 3, "own": 28.840, "comp": {"urlhaus": 5.7461, "threatfox": -0.5255, "phishing_db": -1.0636}, "mass": 5.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.989, "se": 0.508, "ts": 0.778, "map": 3.840, "obs": 9, "own": 5.935, "comp": {"cins": -1.263, "dshield": -1.9572, "crowdsec": 8.7296, "vulncheck": -0.1049, "blocklist_de": -2.6654}, "mass": 7.1, "listed": false}}, "abq": false, "bot": 0.154, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-UL31-RIPE", "org": "Ucom CJSC", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.ucom.am"}, "pfx": 270, "reg": "2008-01-15", "rir": "ripencc", "s24": 331, "sib": 4, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 102400, "abuse": "abuse@ucom.am", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01302680801881}, {"a": 44454, "h": "CSMNP-AS", "n": "Czestochowska Spoldzielnia Mieszkaniowa Nasza Praca", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.942, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CSMP1-RIPE", "org": "Czestochowska Spoldzielnia Mieszkaniowa \"Nasza Praca\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://tvk.csmnp.com.pl"}, "pfx": 3, "reg": "2008-01-23", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "abuse@csmnp.com.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44486, "h": "SYNLINQ", "n": "SYNLINQ", "t": "Transit & backbone", "w": 17, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2}, "n": 2}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 19.21, "lo": 8.56, "ips": 16, "mean": 13.44, "above": true}, "crowdsec": {"n": 1, "p": 0.0924, "hi": 3.57, "lo": 0.27, "ips": 2, "mean": 1.50, "above": false}, "phishing_db": {"n": 5, "p": 0.8967, "hi": 9.91, "lo": 2.46, "ips": 14, "mean": 5.66, "above": true}, "blocklist_de": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 1.803, 4.903, 0, false], ["2026-10-12", 0.584, 4.983, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 4.983, "se": 0.883, "ts": 1.000, "map": 13.459, "obs": 5, "own": 45.104, "comp": {"urlhaus": -0.8528, "threatfox": -0.4478, "phishing_db": 5.5264}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.584, "se": 0.895, "ts": 0.500, "map": 2.300, "obs": 2, "own": 7.469, "comp": {"cins": -0.363, "dshield": -0.7615, "crowdsec": 1.0934, "vulncheck": -0.5774, "blocklist_de": 2.8352}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.784, "det": {"shodan": {"compromised": 13, "doublepulsar": 3}, "blocklist_de": {"bots": 1}}, "oid": "ORG-OH31-RIPE", "org": "Oliver Horscht trading as \"SYNLINQ\"", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://synlinq.de/"}, "pfx": 98, "reg": "2019-04-25", "rir": "ripencc", "s24": 124, "sib": 0, "tor": 1, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.8393]], "ipv4": 32000, "abuse": "abuse@living-bots.net", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": [], "traffic": 0.00200099710545}, {"a": 44489, "h": "Starnet", "n": "STARNET, s.r.o.", "t": "Broadband & mobile", "w": 6, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "proxy_or_vpn": 3, "web_bruteforce": 6, "home_connection": 3, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"crowdsec": {"n": 5, "p": 0.6129, "hi": 6.29, "lo": 1.56, "ips": 6, "mean": 3.59, "above": false}}, "h2": [["2026-10-05", 1.205, 0.010, 0, false], ["2026-10-12", 1.254, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.039, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.254, "se": 0.601, "ts": 1.000, "map": 2.869, "obs": 5, "own": 4.452, "comp": {"cins": -0.8208, "dshield": -1.4593, "crowdsec": 9.6078, "vulncheck": -0.7826, "blocklist_de": -4.0973}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.145, "det": null, "oid": "ORG-SS97-RIPE", "org": "STARNET, s.r.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.starnet.cz"}, "pfx": 26, "reg": "2008-01-28", "rir": "ripencc", "s24": 253, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 77312, "abuse": "ripe@starnet.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0088889315689}, {"a": 44547, "h": "NetundWeb", "n": "NETUNDWEB TELEKOMUNIKASYON", "t": "Broadband & mobile", "w": 21, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 7, "p": 0.9878, "hi": 13.09, "lo": 3.96, "ips": 21, "mean": 7.97, "above": true}}, "h2": [["2026-10-12", 51.120, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 7, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 51.120, "se": 0.545, "ts": 1.000, "map": 106.535, "obs": 7, "own": 163.252, "comp": {"cins": -0.9339, "dshield": 18.6969, "crowdsec": -6.261, "vulncheck": -0.8103, "blocklist_de": -4.6297}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.728, "det": null, "oid": "ORG-NUW1-RIPE", "org": "NETUNDWEB TELEKOMUNIKASYON TICARET LIMITED SIRKETI", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.netweb.com.tr"}, "pfx": 8, "reg": "2022-04-06", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@netweb.com.tr", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00006832272565}, {"a": 44558, "h": "NETONLINE", "n": "Netonline Bilisim Sirketi LTD", "t": "Broadband & mobile", "w": 11, "cc": "TR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 6, "mail_bruteforce": 6}, "n": 7}, "ev": {"urlhaus": {"n": 2, "p": 0.4078, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 3, "p": 0.2660, "hi": 4.66, "lo": 0.82, "ips": 7, "mean": 2.40, "above": false}, "blocklist_de": {"n": 2, "p": 0.2683, "hi": 4.97, "lo": 0.64, "ips": 6, "mean": 2.37, "above": false}}, "h2": [["2026-10-05", 2.160, 1.631, 0, false], ["2026-10-12", 1.460, 1.799, 0, false]], "sh": false, "uc": 343.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 1.799, "se": 1.152, "ts": 1.000, "map": 8.739, "obs": 2, "own": 20.847, "comp": {"urlhaus": 5.2181, "threatfox": -0.4755, "phishing_db": -0.9486}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.460, "se": 0.604, "ts": 0.600, "map": 3.308, "obs": 5, "own": 5.135, "comp": {"cins": -0.9118, "dshield": -1.5734, "crowdsec": 2.5351, "vulncheck": -0.8053, "blocklist_de": 3.3455}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.174, "det": {"blocklist_de": {"imap": 6, "mail": 6}}, "oid": "ORG-NBIM1-RIPE", "org": "Netonline Bilisim Sirketi LTD", "pdb": null, "pfx": 240, "reg": "2008-02-05", "rir": "ripencc", "s24": 250, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 64000, "abuse": "abuse@nethouse.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00310333049286}, {"a": 44559, "h": "ITHOSTLINE", "n": "IT HOSTLINE LTD", "t": "Hosting & VPS", "w": 5, "cc": "CY", "cf": {"rb": "lo", "wb": null, "rep": 2.41, "waf": null}, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 2, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 1.16, "lo": 0.15, "ips": 2, "mean": 0.55, "above": false}, "threatfox": {"n": 1, "p": 0.1101, "hi": 3.78, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "phishing_db": {"n": 2, "p": 0.0918, "hi": 3.47, "lo": 0.45, "ips": 2, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.065, 0.287, 0, false], ["2026-10-12", 0.064, 0.294, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 0.294, "se": 1.049, "ts": 0.667, "map": 0.977, "obs": 3, "own": 0.430, "comp": {"urlhaus": -0.838, "threatfox": 0.7123, "phishing_db": 1.7288}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.064, "se": 0.814, "ts": 1.000, "map": 0.216, "obs": 2, "own": 0.044, "comp": {"cins": -0.4495, "dshield": -0.9118, "crowdsec": 4.1542, "vulncheck": -0.6348, "blocklist_de": -2.2956}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.753, "det": {"threatfox": {"family:Cobalt Strike": 1}}, "oid": "ORG-IHL32-RIPE", "org": "IT HOSTLINE LTD", "pdb": null, "pfx": 1668, "reg": "2023-11-29", "rir": "ripencc", "s24": 1668, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 427008, "abuse": "abuse@ithostline.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00282426709603}, {"a": 44566, "h": "KDS-KabelNet", "n": "KDS-Kabel Net DOO", "t": "Other", "w": 2, "cc": "MK", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 3.448, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.448, "se": 0.771, "ts": 0.667, "map": 10.811, "obs": 3, "own": 6.201, "comp": {"cins": -0.4811, "dshield": -0.9644, "crowdsec": 3.7938, "vulncheck": -0.6527, "blocklist_de": 2.0786}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.226, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-KND1-RIPE", "org": "KDS-Kabel Net DOO", "pdb": null, "pfx": 5, "reg": "2008-02-06", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@kabelnet.com.mk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022384556724}, {"a": 44570, "h": "XTL-18-44570", "n": "Xodo Technology, LLC.", "t": "Transit & backbone", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2023-44982": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 72.971, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.748, "det": {"blocklist_de": {"bots": 1}}, "oid": "XTL-18-ARIN", "org": "Xodo Technology, LLC.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.xodo.net"}, "pfx": 2, "reg": "2025-01-27", "rir": "arin", "s24": 2, "sib": 0, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44578, "h": "ITGLOBALCOM-DMCC", "n": "ITGLOBAL COM DMCC", "t": "Other", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.898, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ICD2-RIPE", "org": "ITGLOBAL COM DMCC", "pdb": null, "pfx": 10, "reg": "2023-11-29", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@itglobal.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019378769022}, {"a": 44589, "h": "NTservers", "n": "DIGITAL NETWORK S.R.L.", "t": "Hosting & VPS", "w": 19, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 6, "web_bruteforce": 11, "cve:CVE-2021-41773": 1, "cve:CVE-2025-30208": 1}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 15, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 18.137, 0.012, 1, false], ["2026-10-12", 147.518, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 147.518, "se": 0.730, "ts": 0.250, "map": 432.159, "obs": 4, "own": 85.357, "comp": {"cins": 4.0878, "dshield": 2.6767, "crowdsec": -0.4069, "vulncheck": -0.6768, "blocklist_de": 1.7816}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.809, "det": {"shodan": {"c2": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-DNS17-RIPE", "org": "DIGITAL NETWORK S.R.L.", "pdb": null, "pfx": 1, "reg": "2017-12-29", "rir": "ripencc", "s24": 1, "sib": 7, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@ntservers.pro", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44592, "h": "SkyLink", "n": "SkyLink Data Center", "t": "Hosting & VPS", "w": 3, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "vulncheck": {"n": 1, "p": 0.1873, "hi": 4.62, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.713, 0.011, 0, false], ["2026-10-12", 0.864, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.245, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.864, "se": 0.933, "ts": 0.500, "map": 3.553, "obs": 2, "own": 0.746, "comp": {"cins": -0.242, "dshield": -0.533, "crowdsec": 2.3294, "vulncheck": 2.3596, "blocklist_de": -1.2524}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.932, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-SDCB3-RIPE", "org": "SkyLink Data Center BV", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.skylink-data-center.nl"}, "pfx": 39, "reg": "2016-05-02", "rir": "ripencc", "s24": 52, "sib": 1, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "abuse@skylink-data-center.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44620, "h": "NETLEN", "n": "Netlen Internet", "t": "Transit & backbone", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3937, "hi": 6.03, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 2.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 2.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.460, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-NET17-RIPE", "org": "Netlen Internet Hizmetleri Ltd. Sti.", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://netlen.com.tr"}, "pfx": 21, "reg": "2022-04-05", "rir": "ripencc", "s24": 21, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@netlen.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00097623975255}, {"a": 44660, "h": "UMKAST", "n": "52Degrees Telecom", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 28.487, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-UML9-RIPE", "org": "Umkast Media LLC", "pdb": null, "pfx": 2, "reg": "2021-04-16", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44679, "h": "BinBox-Global-Services", "n": "INVITE Systems SRL", "t": "Other", "w": 2, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-22965": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3604, "hi": 5.73, "lo": 0.74, "ips": 2, "mean": 2.73, "above": false}}, "h2": [["2026-10-05", 1.334, 0.011, 0, false], ["2026-10-12", 1.422, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.686, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.422, "se": 0.937, "ts": 1.000, "map": 6.050, "obs": 2, "own": 3.547, "comp": {"cins": -0.2899, "dshield": -0.6261, "crowdsec": 6.1214, "vulncheck": -0.5162, "blocklist_de": -1.4956}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.712, "det": null, "oid": "ORG-ANMM3-RIPE", "org": "INVITE Systems SRL", "pdb": null, "pfx": 30, "reg": "2016-04-29", "rir": "ripencc", "s24": 37, "sib": 2, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@invitesys.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00031677370407}, {"a": 44684, "h": "MYTHIC", "n": "Mythic Beasts Ltd", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6014, "hi": 7.26, "lo": 1.28, "ips": 3, "mean": 3.74, "above": false}, "dshield": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 2, "p": 0.4120, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 2.590, 0.011, 0, false], ["2026-10-12", 2.417, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.417, "se": 0.794, "ts": 0.667, "map": 7.594, "obs": 3, "own": 1.572, "comp": {"cins": -0.313, "dshield": 3.587, "crowdsec": -2.6421, "vulncheck": 4.4014, "blocklist_de": -1.6123}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.850, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-MBL5-RIPE", "org": "Mythic Beasts Ltd", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.mythic-beasts.com/"}, "pfx": 7, "reg": "2008-02-22", "rir": "ripencc", "s24": 32, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "support@mythic-beasts.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00120977295723}, {"a": 44709, "h": "CLOUDWEBMANAGE-IL", "n": "KamaTera Israel", "t": "Hosting & VPS", "w": 3, "cc": "IL", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9281, "hi": 9.91, "lo": 2.75, "ips": 6, "mean": 5.86, "above": true}, "urlhaus": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "threatfox": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1788, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.147, 1.944, 0, false], ["2026-10-12", 0.141, 2.018, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 2.018, "se": 1.192, "ts": 0.500, "map": 10.072, "obs": 2, "own": 3.993, "comp": {"urlhaus": 3.308, "threatfox": 1.349, "phishing_db": -0.7211}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.141, "se": 1.201, "ts": 1.000, "map": 0.960, "obs": 1, "own": 0.219, "comp": {"cins": -0.1178, "dshield": -0.2734, "crowdsec": -1.0824, "vulncheck": 3.4402, "blocklist_de": -0.6142}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.743, "det": {"shodan": {"c2": 1, "compromised": 4, "doublepulsar": 1}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-OCCL1-RIPE", "org": "O.M.C. COMPUTERS & COMMUNICATIONS LTD", "pdb": {"t": "Network Services", "sc": "Middle East", "tr": null, "pol": "Open", "web": "https://www.kamatera.com"}, "pfx": 87, "reg": "2008-02-27", "rir": "ripencc", "s24": 91, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23296, "abuse": "abuse@cloudwm.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00078189363161}, {"a": 44714, "h": "SERVUDC", "n": "SERVUDC VERI MERKEZI A.S.", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.717, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OA1292-RIPE", "org": "SERVUDC VERI MERKEZI A.S.", "pdb": null, "pfx": 2, "reg": "2023-11-10", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@komutasavunma.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000520472458}, {"a": 44716, "h": "DHOSTING-NET", "n": "d-hosting", "t": "Hosting & VPS", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0607, "hi": 3.16, "lo": 0.24, "ips": 1, "mean": 1.33, "above": false}}, "h2": [["2026-10-05", 0.108, 0.010, 0, false], ["2026-10-12", 0.112, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.963, "ts": null, "map": 0.175, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.112, "se": 1.155, "ts": 1.000, "map": 0.723, "obs": 1, "own": 0.156, "comp": {"cins": -0.1816, "dshield": -0.4101, "crowdsec": 2.9968, "vulncheck": -0.3928, "blocklist_de": -0.9431}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.601, "det": null, "oid": "ORG-BEN1-RIPE", "org": "D-hosting die Rackspace & Connectivity GmbH", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Gbps", "pol": "No", "web": "https://www.d-hosting.de"}, "pfx": 9, "reg": "2008-02-27", "rir": "ripencc", "s24": 189, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50688, "abuse": "abuse@all.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44735, "h": "SIP-ASN", "n": "Nova hf", "t": "Transit & backbone", "w": 3, "cc": "IS", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0959, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "crowdsec": {"n": 2, "p": 0.2140, "hi": 4.53, "lo": 0.59, "ips": 2, "mean": 2.16, "above": false}, "vulncheck": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 2, "p": 0.3260, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}}, "h2": [["2026-10-05", 1.960, 0.010, 0, false], ["2026-10-12", 2.028, 0.011, 0, false]], "sh": false, "uc": 655.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 1.734, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 2.028, "se": 0.622, "ts": 0.400, "map": 4.799, "obs": 5, "own": 15.223, "comp": {"cins": -0.8018, "dshield": -1.4345, "crowdsec": 0.5812, "vulncheck": 0.454, "blocklist_de": 4.1631}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.226, "det": {"shodan": {"c2": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-NE4-RIPE", "org": "Nova hf", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.nova.is"}, "pfx": 18, "reg": "2010-05-03", "rir": "ripencc", "s24": 147, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 46848, "abuse": "abuse@nova.is", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00454926295086}, {"a": 44803, "h": "WEBDOCK-AS", "n": "Webdock.io ApS", "t": "Other", "w": 1, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 13, "p": 1.0000, "hi": 17.78, "lo": 7.28, "ips": 13, "mean": 12.04, "above": true}, "dshield": {"n": 1, "p": 0.1815, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.188, 0.011, 0, false], ["2026-10-12", 0.199, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.584, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.199, "se": 1.226, "ts": 1.000, "map": 1.464, "obs": 1, "own": 0.930, "comp": {"cins": -0.149, "dshield": 4.3946, "crowdsec": -1.3503, "vulncheck": -0.3446, "blocklist_de": -0.7756}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.743, "det": {"shodan": {"compromised": 13}}, "oid": "ORG-WA586-RIPE", "org": "Webdock.io ApS", "pdb": null, "pfx": 48, "reg": "2023-11-07", "rir": "ripencc", "s24": 76, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 20992, "abuse": "support@webdock.io", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0008024834196}, {"a": 44812, "h": "IPSERVER-RU-NET", "n": "IP Server LLC", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.147, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.692, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ISL73-RIPE", "org": "IP Server LLC", "pdb": null, "pfx": 15, "reg": "2008-03-14", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@ipserver.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 44901, "h": "belcloud", "n": "BelCloud Ltd.", "t": "Hosting & VPS", "w": 5, "cc": "BG", "cf": null, "cs": {"c": {"web_exploit": 2, "first_seen_30d": 3, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-87902": 1}, "n": 3}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 21.02, "lo": 9.37, "ips": 16, "mean": 14.71, "above": true}, "crowdsec": {"n": 3, "p": 0.5190, "hi": 6.49, "lo": 1.14, "ips": 3, "mean": 3.35, "above": false}, "vulncheck": {"n": 2, "p": 0.3980, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 3.189, 0.323, 0, false], ["2026-10-12", 2.956, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 0.226, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.956, "se": 0.633, "ts": 0.600, "map": 7.047, "obs": 5, "own": 1.412, "comp": {"cins": -0.6145, "dshield": -1.1731, "crowdsec": 5.8497, "vulncheck": 2.3909, "blocklist_de": -3.1067}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.939, "det": {"shodan": {"c2": 4, "compromised": 12}, "vulncheck": {"botnet_node": 1, "attack_tooling": 1}}, "oid": "ORG-BL405-RIPE", "org": "Belcloud LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://belcloud.net/"}, "pfx": 73, "reg": "2016-04-18", "rir": "ripencc", "s24": 73, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 18688, "abuse": "abuses@belhost.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00167159320952}, {"a": 44925, "h": "THE-1984-AS", "n": "1984 ehf", "t": "Hosting & VPS", "w": 22, "cc": "IS", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 13, "web_exploit": 11, "bad_crawling": 5, "proxy_or_vpn": 11, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 12, "mail_bruteforce": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2018-20062": 6, "cve:CVE-2021-41773": 4, "cve:CVE-2022-26134": 2, "cve:CVE-2024-28000": 3}, "n": 13}, "ev": {"shodan": {"n": 5, "p": 0.8955, "hi": 9.88, "lo": 2.46, "ips": 5, "mean": 5.64, "above": true}, "urlhaus": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 9, "p": 0.9981, "hi": 14.55, "lo": 5.02, "ips": 13, "mean": 9.26, "above": true}, "threatfox": {"n": 3, "p": 0.6441, "hi": 7.72, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1922, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "phishing_db": {"n": 5, "p": 0.9116, "hi": 10.36, "lo": 2.58, "ips": 5, "mean": 5.91, "above": true}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 21.531, 38.793, 1, false], ["2026-10-12", 25.097, 42.144, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 5}, "lo": 42.144, "se": 0.777, "ts": 0.556, "map": 99.785, "obs": 9, "own": 33.340, "comp": {"urlhaus": 1.5295, "threatfox": 1.6324, "phishing_db": 3.0673}, "mass": 3.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 1}, "lo": 25.097, "se": 0.479, "ts": 0.818, "map": 46.604, "obs": 11, "own": 9.108, "comp": {"cins": -1.3512, "dshield": -2.0416, "crowdsec": 11.9778, "vulncheck": -0.1767, "blocklist_de": -3.1729}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.800, "det": {"shodan": {"c2": 3, "compromised": 2}, "threatfox": {"family:Unknown malware": 3}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-EA356-RIPE", "org": "1984 ehf", "pdb": null, "pfx": 6, "reg": "2008-04-03", "rir": "ripencc", "s24": 30, "sib": 0, "tor": 10, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.9970], ["2026-10-12", 0.8393]], "ipv4": 7680, "abuse": "abuse@1984.is", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00041127428034}, {"a": 44947, "h": "AMWAJ", "n": "AMWAJ", "t": "Enterprise, edu & gov", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.458, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 3.404, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 4.674, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.154, "det": null, "oid": "ORG-AACB4-RIPE", "org": "AMWAJ ALKHYR COMMERCIAL BROKERS CO.", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.amnet.ae"}, "pfx": 14, "reg": "2023-10-30", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000011995524}, {"a": 45007, "h": "VIPNET", "n": "VIPNET PRIM Ltd", "t": "Other", "w": 1, "cc": "BG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2019-12989": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 2.149, 0.011, 0, false], ["2026-10-12", 0.404, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.404, "se": 1.344, "ts": 1.000, "map": 3.728, "obs": 1, "own": 2.491, "comp": {"cins": -0.1059, "dshield": -0.247, "crowdsec": 3.8844, "vulncheck": -0.2695, "blocklist_de": -0.5525}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.193, "det": null, "oid": "ORG-VPL14-RIPE", "org": "VIPNET PRIM Ltd", "pdb": null, "pfx": 11, "reg": "2008-04-18", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027856634364}, {"a": 45045, "h": "GOODNET-AS", "n": "FOP Kazakov Oleksandr Oleksandrovich", "t": "Other", "w": 1, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2023-22527": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.740, "det": null, "oid": "ORG-FKOO1-RIPE", "org": "FOP Kazakov Oleksandr Oleksandrovich", "pdb": null, "pfx": 2, "reg": "2008-04-24", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "info@goodnet.com.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45062, "h": "Netease-Network", "n": "NENET（China)", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.1478, "hi": 3.76, "lo": 0.81, "ips": 4, "mean": 2.06, "above": false}}, "h2": [["2026-10-05", 0.120, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.144, "obs": 0, "own": 0.303, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.556, "ts": null, "map": 0.068, "obs": 0, "own": 0.054, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.820, "det": {"shodan": {"c2": 4}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.netease.com/"}, "pfx": 136, "reg": "2008-02-01", "rir": "apnic", "s24": 670, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 171776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45090, "h": "TENCENT-NET-AP", "n": "Tencent-CN", "t": "Hyperscale cloud", "w": 727, "cc": "CN", "cf": {"rb": "lo", "wb": "lo", "rep": 2.47, "waf": 3.24}, "cs": {"c": {"http_flood": 70, "web_exploit": 85, "bad_crawling": 17, "proxy_or_vpn": 13, "first_seen_30d": 63, "ssh_bruteforce": 289, "web_bruteforce": 61, "mail_bruteforce": 8, "router_or_botnet": 1, "cve:CVE-2017-9841": 28, "cve:CVE-2019-9082": 26, "cve:CVE-2024-6387": 113, "cve:CVE-2018-20062": 27, "cve:CVE-2024-28000": 4}, "n": 368}, "ev": {"cins": {"n": 30, "p": 0.3060, "hi": 3.64, "lo": 2.01, "ips": 30, "mean": 2.77, "above": false}, "shodan": {"n": 2195, "p": 1.0000, "hi": 43.29, "lo": 40.36, "ips": 2195, "mean": 41.81, "above": true}, "dshield": {"n": 3, "p": 0.0000, "hi": 0.55, "lo": 0.10, "ips": 3, "mean": 0.29, "above": false}, "urlhaus": {"n": 10, "p": 0.6216, "hi": 5.25, "lo": 1.91, "ips": 10, "mean": 3.41, "above": false}, "crowdsec": {"n": 362, "p": 1.0000, "hi": 6.07, "lo": 5.10, "ips": 368, "mean": 5.58, "above": true}, "threatfox": {"n": 155, "p": 1.0000, "hi": 37.67, "lo": 28.94, "ips": 156, "mean": 33.19, "above": true}, "vulncheck": {"n": 27, "p": 0.0136, "hi": 2.73, "lo": 1.46, "ips": 28, "mean": 2.05, "above": false}, "phishing_db": {"n": 16, "p": 0.0000, "hi": 1.90, "lo": 0.85, "ips": 16, "mean": 1.33, "above": false}, "blocklist_de": {"n": 178, "p": 1.0000, "hi": 7.51, "lo": 5.87, "ips": 183, "mean": 6.67, "above": true}}, "h2": [["2026-10-05", 2.388, 1.876, 0, false], ["2026-10-12", 3.119, 1.667, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 10, "threatfox": 155, "phishing_db": 16}, "lo": 1.667, "se": 0.785, "ts": 0.856, "map": 3.424, "obs": 181, "own": 2.483, "comp": {"urlhaus": -0.6048, "threatfox": 4.1101, "phishing_db": -0.6484}, "mass": 119.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 30, "dshield": 3, "crowdsec": 362, "vulncheck": 27, "blocklist_de": 178}, "lo": 3.119, "se": 0.353, "ts": 0.603, "map": 4.545, "obs": 600, "own": 1.866, "comp": {"cins": 0.149, "dshield": -3.4031, "crowdsec": 3.9004, "vulncheck": -0.7354, "blocklist_de": 2.9968}, "mass": 605.6, "listed": false}}, "abq": false, "bot": 0.828, "det": {"shodan": {"c2": 75, "malware": 29, "compromised": 2091}, "threatfox": {"family:Chaos": 2, "family:VShell": 7, "family:Jackskid": 3, "family:AdaptixC2": 12, "family:Cobalt Strike": 127}, "vulncheck": {"c2_server": 26, "attack_tooling": 2}, "blocklist_de": {"ftp": 14, "ssh": 160, "bots": 8, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-45090-APNIC", "org": "Shenzhen Tencent Computer Systems Company Limited", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.tencent.com"}, "pfx": 2200, "reg": "2008-02-01", "rir": "apnic", "s24": 24115, "sib": 1, "tor": 0, "w24": 699, "drop": 0, "hist": [["2026-10-05", 0.9999], ["2026-10-12", 0.9999]], "ipv4": 12240640, "abuse": "abuse@tencent.com", "score": 0.9999, "groups": ["sensors", "cloudflare", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.03207129527394}, {"a": 45102, "h": "ALIBABA-CN-NET", "n": "Alibaba", "t": "Hyperscale cloud", "w": 3027, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.62, "waf": 4.13}, "cs": {"c": {"http_flood": 537, "data_centre": 7, "web_exploit": 466, "bad_crawling": 191, "proxy_or_vpn": 67, "first_seen_30d": 35, "ssh_bruteforce": 609, "web_bruteforce": 266, "mail_bruteforce": 25, "router_or_botnet": 2, "cve:CVE-2017-9841": 66, "cve:CVE-2019-9082": 53, "cve:CVE-2025-4396": 50, "cve:CVE-2018-20062": 56, "cve:CVE-2022-39290": 20}, "n": 1110}, "ev": {"cins": {"n": 730, "p": 1.0000, "hi": 76.05, "lo": 67.34, "ips": 1741, "mean": 71.64, "above": true}, "shodan": {"n": 216, "p": 1.0000, "hi": 5.09, "lo": 4.07, "ips": 216, "mean": 4.56, "above": true}, "dshield": {"n": 14, "p": 0.0000, "hi": 1.72, "lo": 0.72, "ips": 14, "mean": 1.18, "above": false}, "urlhaus": {"n": 27, "p": 1.0000, "hi": 12.35, "lo": 6.60, "ips": 27, "mean": 9.29, "above": true}, "crowdsec": {"n": 738, "p": 1.0000, "hi": 13.31, "lo": 11.80, "ips": 1110, "mean": 12.54, "above": true}, "threatfox": {"n": 26, "p": 0.9995, "hi": 8.31, "lo": 4.39, "ips": 26, "mean": 6.22, "above": true}, "vulncheck": {"n": 26, "p": 0.0332, "hi": 2.90, "lo": 1.53, "ips": 27, "mean": 2.17, "above": false}, "phishing_db": {"n": 112, "p": 1.0000, "hi": 11.25, "lo": 8.25, "ips": 114, "mean": 9.70, "above": true}, "blocklist_de": {"n": 90, "p": 0.9766, "hi": 4.40, "lo": 3.12, "ips": 91, "mean": 3.74, "above": true}}, "h2": [["2026-10-05", 10.986, 2.604, 2, false], ["2026-10-12", 11.960, 2.616, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 27, "threatfox": 26, "phishing_db": 112}, "lo": 2.616, "se": 0.766, "ts": 0.679, "map": 5.307, "obs": 165, "own": 3.734, "comp": {"urlhaus": 1.686, "threatfox": -0.0278, "phishing_db": 1.637}, "mass": 161.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 730, "dshield": 14, "crowdsec": 738, "vulncheck": 26, "blocklist_de": 90}, "lo": 11.960, "se": 0.346, "ts": 0.462, "map": 17.735, "obs": 1598, "own": 7.254, "comp": {"cins": 27.2201, "dshield": -3.3777, "crowdsec": -3.5331, "vulncheck": -0.9397, "blocklist_de": -15.1005}, "mass": 2127.2, "listed": true}}, "abq": true, "bot": 0.950, "det": {"shodan": {"c2": 67, "malware": 2, "compromised": 144, "doublepulsar": 3}, "threatfox": {"family:Havoc": 1, "family:AdaptixC2": 3, "family:ValleyRAT": 1, "family:Cobalt Strike": 16, "family:Unknown malware": 4}, "vulncheck": {"c2_server": 23, "attack_tooling": 4}, "blocklist_de": {"ftp": 6, "ssh": 75, "bots": 2, "imap": 5, "mail": 5, "apache": 3, "bruteforcelogin": 3}}, "oid": "@aut-45102-APNIC", "org": "Alibaba (US) Technology Co., Ltd.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "http://alibabagroup.com/"}, "pfx": 1148, "reg": "2008-02-01", "rir": "apnic", "s24": 21788, "sib": 13, "tor": 0, "w24": 1532, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 11071488, "abuse": null, "score": 1.0000, "groups": ["sensors", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.654145}, {"a": 45110, "h": "CBCnet", "n": "Beijing Tian Wei Xin Tong technology corp. limited.", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1501, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 0.623, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.181, "obs": 0, "own": 0.239, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.268, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-45110-APNIC", "org": "Beijing Tian Wei Xin Tong technology corp. limited.", "pdb": null, "pfx": 43, "reg": "2008-02-01", "rir": "apnic", "s24": 58, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011762100454}, {"a": 45117, "h": "INPL-IN-AP", "n": "Ishan Netsol", "t": "Broadband & mobile", "w": 12, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 4, "ssh_bruteforce": 6}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1304, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "shodan": {"n": 1, "p": 0.0207, "hi": 2.46, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}, "dshield": {"n": 1, "p": 0.1157, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}, "crowdsec": {"n": 7, "p": 0.6762, "hi": 6.09, "lo": 1.84, "ips": 8, "mean": 3.71, "above": false}, "vulncheck": {"n": 1, "p": 0.1175, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "phishing_db": {"n": 1, "p": 0.1219, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "blocklist_de": {"n": 2, "p": 0.1850, "hi": 4.29, "lo": 0.56, "ips": 3, "mean": 2.04, "above": false}}, "h2": [["2026-10-05", 3.247, 0.144, 0, false], ["2026-10-12", 2.423, 0.151, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.151, "se": 1.383, "ts": 1.000, "map": 1.030, "obs": 1, "own": 3.094, "comp": {"urlhaus": -0.2846, "threatfox": -0.2679, "phishing_db": 2.2082}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 2}, "lo": 2.423, "se": 0.473, "ts": 0.583, "map": 4.347, "obs": 12, "own": 6.706, "comp": {"cins": 1.6436, "dshield": -0.426, "crowdsec": 3.9147, "vulncheck": -0.3744, "blocklist_de": -1.8947}, "mass": 10.5, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 3}}, "oid": "@aut-45117-APNIC", "org": "Ishan's Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.ishantechnologies.com"}, "pfx": 436, "reg": "2008-02-26", "rir": "apnic", "s24": 436, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 111616, "abuse": "ipadmin@ishanitech.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00838241766732}, {"a": 45177, "h": "DEVOLI-AS-AP", "n": "Devoli", "t": "Transit & backbone", "w": 3, "cc": "NZ", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1584, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "dshield": {"n": 2, "p": 0.3426, "hi": 5.58, "lo": 0.72, "ips": 2, "mean": 2.66, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.693, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.947, "ts": null, "map": 0.171, "obs": 0, "own": 1.505, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.693, "se": 0.737, "ts": 0.667, "map": 2.005, "obs": 3, "own": 6.397, "comp": {"cins": 3.984, "dshield": 6.1011, "crowdsec": -4.3798, "vulncheck": -0.6988, "blocklist_de": -2.9174}, "mass": 2.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-VCL1-AP-APNIC", "org": "Devoli LTD", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://devoli.com"}, "pfx": 91, "reg": "2008-04-07", "rir": "apnic", "s24": 238, "sib": 8, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 83968, "abuse": "noc@devoli.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0133306948125}, {"a": 45178, "h": "ROSHAN-AF", "n": "Telecom Development Company Afghanistan", "t": "Broadband & mobile", "w": 3, "cc": "AF", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3718, "hi": 5.83, "lo": 0.76, "ips": 3, "mean": 2.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 2, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 4.060, 0.012, 0, false]], "sh": false, "uc": 1601.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.060, "se": 0.775, "ts": 0.667, "map": 12.737, "obs": 3, "own": 19.962, "comp": {"cins": -0.4732, "dshield": -0.9514, "crowdsec": 3.8825, "vulncheck": -0.6484, "blocklist_de": 2.1286}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.150, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-TDCA1-AP-APNIC", "org": "Telecom Development Company Afghanistan", "pdb": null, "pfx": 30, "reg": "2008-04-14", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00345731708637}, {"a": 45179, "h": "SITEHOST-AS-AP", "n": "SiteHost", "t": "Hosting & VPS", "w": 2, "cc": "NZ", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 2, "p": 0.3541, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "crowdsec": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 1.120, 0.011, 0, false], ["2026-10-12", 1.195, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 0.246, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.195, "se": 0.931, "ts": 0.500, "map": 5.025, "obs": 2, "own": 1.029, "comp": {"cins": 4.5199, "dshield": -0.6992, "crowdsec": 1.43, "vulncheck": -0.5504, "blocklist_de": -1.6922}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.810, "det": {"shodan": {"compromised": 2}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.sitehost.co.nz"}, "pfx": 14, "reg": "2008-04-15", "rir": "apnic", "s24": 51, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "noc@sitehost.co.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045336915}, {"a": 45184, "h": "DEN-ISP-AS-IN-AP", "n": "Den Digital Entertainment", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1676, "hi": 4.41, "lo": 0.33, "ips": 2, "mean": 1.86, "above": false}}, "h2": [["2026-10-12", 0.217, 0.012, 0, false]], "sh": false, "uc": 291.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.187, "obs": 0, "own": 1.474, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.217, "se": 1.241, "ts": 1.000, "map": 1.653, "obs": 1, "own": 2.890, "comp": {"cins": -0.1568, "dshield": -0.358, "crowdsec": -1.4162, "vulncheck": -0.3568, "blocklist_de": 4.1839}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.132, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-DNL1-AP-APNIC", "org": "DEN Networks Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": null}, "pfx": 71, "reg": "2008-04-18", "rir": "apnic", "s24": 71, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00120599416704}, {"a": 45232, "h": "SISPL-AS-AP", "n": "Spacenet Internet Services", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6009, "hi": 7.25, "lo": 1.28, "ips": 3, "mean": 3.74, "above": false}}, "h2": [["2026-10-12", 4.268, 0.012, 0, false]], "sh": false, "uc": 5123.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 1.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.268, "se": 0.775, "ts": 1.000, "map": 13.478, "obs": 3, "own": 21.099, "comp": {"cins": -0.4378, "dshield": -0.8922, "crowdsec": 8.1904, "vulncheck": -0.6278, "blocklist_de": -2.2378}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.166, "det": null, "oid": "@aut-45232-APNIC", "org": "Spacenet Internet Services Pvt. Ltd.", "pdb": null, "pfx": 26, "reg": "2008-06-16", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45243, "h": "FXWIRELESS-TECH-AS-AP", "n": "F/X Wireless Technology Solutions Pvt. Ltd.", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 2880.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.180, "det": null, "oid": "ORG-FWTS1-AP-APNIC", "org": "F/X Wireless Technology Solutions Pvt Ltd", "pdb": null, "pfx": 8, "reg": "2008-06-27", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "support@fxwirelesstech.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45271, "h": "VIL-AS-AP", "n": "Vodafone Idea Ltd", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 0.64, "waf": 0.55}, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.0964, "hi": 3.51, "lo": 0.46, "ips": 2, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.046, 0.009, 0, false], ["2026-10-12", 0.149, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.861, "ts": null, "map": 0.141, "obs": 0, "own": 0.725, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.149, "se": 0.842, "ts": 1.000, "map": 0.524, "obs": 2, "own": 0.835, "comp": {"cins": -0.4792, "dshield": -0.9613, "crowdsec": -3.783, "vulncheck": -0.6517, "blocklist_de": 6.6235}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.093, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-VIL2-AP-APNIC", "org": "Vodafone Idea Ltd. (VIL)", "pdb": null, "pfx": 415, "reg": "2008-07-18", "rir": "apnic", "s24": 739, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 198656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.123963}, {"a": 45276, "h": "NREACH-AS-AP", "n": "Nreach Net", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.195, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NNL8-AP-APNIC", "org": "NReach Net (Pvt.) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.nreach.net.bd/"}, "pfx": 10, "reg": "2008-07-21", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@nreach.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45284, "h": "WLSNET-AS-AP", "n": "Wireline Solution India Pvt Ltd", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.4089, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 9.481, 0.011, 0, false], ["2026-10-12", 10.341, 0.012, 1, false]], "sh": false, "uc": 1894.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 10.341, "se": 0.684, "ts": 0.500, "map": 27.470, "obs": 4, "own": 42.637, "comp": {"cins": -0.6503, "dshield": -1.2257, "crowdsec": 2.0049, "vulncheck": -0.7287, "blocklist_de": 5.3066}, "mass": 3.1, "listed": false}}, "abq": true, "bot": 0.178, "det": {"blocklist_de": {"bots": 1, "mail": 1}}, "oid": "@aut-45284-APNIC", "org": "Wireline Solution India Pvt Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.wls.net.in"}, "pfx": 20, "reg": "2008-07-24", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00064347192474}, {"a": 45287, "h": "VARNION-AS-ID", "n": "Varnion Technology", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5843, "hi": 7.09, "lo": 1.25, "ips": 3, "mean": 3.66, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.753, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.240, "det": {"shodan": {"c2": 2, "compromised": 1}}, "oid": "@aut-45287-APNIC", "org": "Varnion Technology Semesta, PT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.varnion.net.id"}, "pfx": 53, "reg": "2008-07-28", "rir": "apnic", "s24": 44, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009188457366}, {"a": 45289, "h": "INDOTRANS-AS-ID", "n": "INDOTRANS", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 3, "mail_bruteforce": 3, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6347, "hi": 7.61, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 4.588, 0.011, 0, false], ["2026-10-12", 13.030, 0.013, 1, false]], "sh": false, "uc": 12388.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 13.030, "se": 0.806, "ts": 1.000, "map": 43.627, "obs": 3, "own": 68.310, "comp": {"cins": -0.3864, "dshield": -0.8032, "crowdsec": 8.9345, "vulncheck": -0.5943, "blocklist_de": -1.9813}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.218, "det": null, "oid": "@aut-45289-APNIC", "org": "Indotrans Data, PT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://indotrans.net.id"}, "pfx": 7, "reg": "2008-07-28", "rir": "apnic", "s24": 7, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "noc@indotransdata.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45293, "h": "UT-AS-ID", "n": "Universitas Terbuka", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.293, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-45293-APNIC", "org": "Universitas Terbuka", "pdb": null, "pfx": 2, "reg": "2008-07-28", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@mail.ut.ac.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45298, "h": "INTERLINK-TECH-AS-ID", "n": "INTERLINK TECHNOLOGY", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 1.672, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 0.926, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.761, "det": {"shodan": {"compromised": 1}}, "oid": "@family-32419", "org": "PT INTERLINK TECHNOLOGY", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.interlink.net.id"}, "pfx": 30, "reg": "2008-07-28", "rir": "apnic", "s24": 29, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@interlink.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45302, "h": "DESNET-AS-ID", "n": "DES Teknologi Informasi", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "urlhaus": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.767, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.767, "se": 1.715, "ts": 1.000, "map": 10.207, "obs": 1, "own": 36.035, "comp": {"urlhaus": 4.3341, "threatfox": -0.1366, "phishing_db": -0.2482}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.252, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-45302-APNIC", "org": "PT DES Teknologi Informasi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://desnet.id/"}, "pfx": 19, "reg": "2008-07-28", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45305, "h": "LDP-AS-ID", "n": "Lintas Data Prima", "t": "Broadband & mobile", "w": 9, "cc": "ID", "cf": {"rb": "lo", "wb": null, "rep": 1.87, "waf": null}, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 8, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 7, "cve:CVE-2025-4396": 1}, "n": 8}, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 8, "p": 0.9918, "hi": 12.77, "lo": 4.15, "ips": 8, "mean": 7.96, "above": true}, "phishing_db": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1768, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 12.517, 0.391, 1, false], ["2026-10-12", 13.431, 0.409, 1, false]], "sh": false, "uc": 414.5, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.409, "se": 1.515, "ts": 1.000, "map": 3.900, "obs": 1, "own": 11.412, "comp": {"urlhaus": -0.1276, "threatfox": -0.1538, "phishing_db": 3.2685}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 13.431, "se": 0.501, "ts": 0.889, "map": 25.543, "obs": 9, "own": 39.228, "comp": {"cins": -1.2492, "dshield": -1.9436, "crowdsec": 11.2783, "vulncheck": -0.8664, "blocklist_de": -2.5852}, "mass": 6.9, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-45305-APNIC", "org": "Lintas Data Prima, PT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.ldp.net.id"}, "pfx": 50, "reg": "2008-07-28", "rir": "apnic", "s24": 49, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "abuse@ldp.net.id", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0111396893432}, {"a": 45312, "h": "MLD-ID", "n": "MEDIA LINTAS DATA", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 1.500, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.858, "ts": null, "map": 0.176, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.194, "det": null, "oid": "@aut-45312-APNIC", "org": "PT MEDIA LINTAS DATA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://mld.id/"}, "pfx": 38, "reg": "2008-07-28", "rir": "apnic", "s24": 66, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17920, "abuse": "abuse@mld.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45313, "h": "PEMDA-NAD-AS-ID", "n": "Dinas Perhubungan,komunikasi, informasi dan Telematika -NAD", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.642, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-45313-APNIC", "org": "Dinas Perhubungan,komunikasi, informasi dan Telematika -NAD", "pdb": null, "pfx": 8, "reg": "2008-07-28", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45325, "h": "PC24NET-AS-ID", "n": "PT PC24 Telekomunikasi Indonesia", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.377, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 1.077, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.288, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141142-APNIC", "org": "PT PC24 Telekomunikasi Indonesia", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://pc24telin.com"}, "pfx": 21, "reg": "2008-07-28", "rir": "apnic", "s24": 21, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@pc24.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45326, "h": "BBTS-AS-AP", "n": "Broad Band Telecom Services Ltd (BBTS)", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5709, "hi": 6.96, "lo": 1.23, "ips": 3, "mean": 3.59, "above": false}}, "h2": [["2026-10-12", 2.769, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 1.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.769, "se": 0.764, "ts": 1.000, "map": 8.571, "obs": 3, "own": 13.419, "comp": {"cins": -0.4581, "dshield": -0.9264, "crowdsec": 7.9049, "vulncheck": -0.6398, "blocklist_de": -2.3386}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.381, "det": null, "oid": "ORG-BBTS1-AP-APNIC", "org": "Broad Band Telecom Services Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.bbts.net"}, "pfx": 56, "reg": "2008-07-28", "rir": "apnic", "s24": 43, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": "abuse@bbts.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008827995951}, {"a": 45349, "h": "TFL-AS-AP", "n": "Telecom Fiji AS45349", "t": "Broadband & mobile", "w": 0, "cc": "FJ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.610, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ISTF1-AP-APNIC", "org": "InterNet Services, Telecom Fiji Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Selective", "web": "https://www.telecom.com.fj"}, "pfx": 6, "reg": "2008-08-14", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000001852173}, {"a": 45352, "h": "IPSERVERONE-AS-AP", "n": "IP ServerOne Solutions", "t": "Hosting & VPS", "w": 4, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.4235, "hi": 5.74, "lo": 1.01, "ips": 3, "mean": 2.96, "above": false}, "vulncheck": {"n": 2, "p": 0.3679, "hi": 5.80, "lo": 0.75, "ips": 4, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.102, 0.010, 0, false], ["2026-10-12", 0.279, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 0.183, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.279, "se": 0.897, "ts": 1.000, "map": 1.059, "obs": 2, "own": 0.226, "comp": {"cins": -0.2282, "dshield": -0.5055, "crowdsec": -1.9971, "vulncheck": 5.3633, "blocklist_de": -1.1818}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.373, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 4}}, "oid": "ORG-ISSS1-AP-APNIC", "org": "IP ServerOne Solutions Sdn Bhd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.ipserverone.com"}, "pfx": 164, "reg": "2008-08-15", "rir": "apnic", "s24": 164, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49408, "abuse": "abuse@ipserverone.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00143555834397}, {"a": 45370, "h": "BROADBANDIDC-AS-KR", "n": "BROADBANDIDC", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": {"c": {"web_exploit": 1}, "n": 1}, "ev": {"shodan": {"n": 9, "p": 0.8866, "hi": 7.37, "lo": 2.55, "ips": 9, "mean": 4.69, "above": true}, "crowdsec": {"n": 1, "p": 0.0060, "hi": 1.97, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}}, "h2": [["2026-10-05", 0.055, 0.009, 0, false], ["2026-10-12", 0.057, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.887, "ts": null, "map": 0.151, "obs": 0, "own": 0.815, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.057, "se": 1.086, "ts": 1.000, "map": 0.318, "obs": 1, "own": 0.530, "comp": {"cins": -0.2215, "dshield": -0.4919, "crowdsec": 2.5526, "vulncheck": -0.4439, "blocklist_de": -1.1474}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.951, "det": {"shodan": {"compromised": 9}}, "oid": "@aut-45370-APNIC", "org": "BROADBANDIDC", "pdb": null, "pfx": 80, "reg": "2008-08-19", "rir": "apnic", "s24": 529, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 137984, "abuse": "hostmaster@nic.or.kr", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0008949484964}, {"a": 45382, "h": "EHOSTIDC-AS-KR", "n": "EhostICT", "t": "Hosting & VPS", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2021-43798": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2865, "hi": 5.11, "lo": 0.66, "ips": 2, "mean": 2.44, "above": false}}, "h2": [["2026-10-05", 2.599, 0.011, 0, false], ["2026-10-12", 0.724, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 0.217, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.724, "se": 0.904, "ts": 1.000, "map": 2.896, "obs": 2, "own": 0.590, "comp": {"cins": -0.3237, "dshield": -0.6897, "crowdsec": 5.683, "vulncheck": -0.5462, "blocklist_de": -1.6664}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.300, "det": null, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ehostidc.com/"}, "pfx": 87, "reg": "2008-08-19", "rir": "apnic", "s24": 87, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22272, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004159170666}, {"a": 45413, "h": "SERVENET-AS-TH-AP", "n": "ServeNET Solution Limited Partnership", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.113, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SSLP1-AP-APNIC", "org": "ServeNet Solution Limited Partnership", "pdb": null, "pfx": 7, "reg": "2008-08-22", "rir": "apnic", "s24": 7, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "noc@servenet.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45433, "h": "KISPL-AS-IN", "n": "Kappa Internet Services", "t": "Broadband & mobile", "w": 10, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 8, "mail_bruteforce": 5, "router_or_botnet": 8, "cve:CVE-2022-22947": 2}, "n": 9}, "ev": {"urlhaus": {"n": 1, "p": 0.1971, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 7, "p": 0.9770, "hi": 11.61, "lo": 3.51, "ips": 9, "mean": 7.06, "above": true}}, "h2": [["2026-10-05", 6.938, 0.011, 0, false], ["2026-10-12", 8.981, 0.565, 0, false]], "sh": false, "uc": 23468.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.565, "se": 1.606, "ts": 1.000, "map": 6.352, "obs": 1, "own": 19.889, "comp": {"urlhaus": 4.0985, "threatfox": -0.2183, "phishing_db": -0.4053}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.981, "se": 0.541, "ts": 1.000, "map": 18.502, "obs": 7, "own": 28.477, "comp": {"cins": -0.9959, "dshield": -1.673, "crowdsec": 12.7225, "vulncheck": -0.8234, "blocklist_de": -4.9187}, "mass": 5.1, "listed": false}}, "abq": true, "bot": 0.289, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-45433-APNIC", "org": "Kappa Internet Services Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.kappa.net.in"}, "pfx": 50, "reg": "2008-09-15", "rir": "apnic", "s24": 50, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 45458, "h": "SBN-AWN-AS-02-AP", "n": "Advanced Wireless Network Co. Ltd.(Enterprise/NIX)", "t": "Broadband & mobile", "w": 10, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 6, "web_bruteforce": 4, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.0915, "hi": 3.56, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}, "shodan": {"n": 7, "p": 0.4442, "hi": 4.89, "lo": 1.48, "ips": 7, "mean": 2.98, "above": false}, "dshield": {"n": 1, "p": 0.0732, "hi": 3.33, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "crowdsec": {"n": 8, "p": 0.4169, "hi": 4.66, "lo": 1.51, "ips": 8, "mean": 2.90, "above": false}, "blocklist_de": {"n": 4, "p": 0.3514, "hi": 4.96, "lo": 1.07, "ips": 4, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 1.255, 0.009, 0, false], ["2026-10-12", 1.852, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.855, "ts": null, "map": 0.138, "obs": 0, "own": 0.708, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.852, "se": 0.454, "ts": 0.571, "map": 3.204, "obs": 14, "own": 4.937, "comp": {"cins": 0.9688, "dshield": -0.9858, "crowdsec": 2.2592, "vulncheck": -0.9363, "blocklist_de": 1.2522}, "mass": 14.0, "listed": false}}, "abq": false, "bot": 0.416, "det": {"shodan": {"compromised": 4, "doublepulsar": 3}, "blocklist_de": {"ssh": 4}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.ais.co.th"}, "pfx": 706, "reg": "2008-10-01", "rir": "apnic", "s24": 790, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 315392, "abuse": "abuseIPv4@ais.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00986426196948}, {"a": 45528, "h": "TIKONAIN-AS", "n": "Tikona Digital Networks", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.0026, "hi": 1.74, "lo": 0.13, "ips": 1, "mean": 0.73, "above": false}, "dshield": {"n": 1, "p": 0.0715, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "crowdsec": {"n": 5, "p": 0.0917, "hi": 3.34, "lo": 0.83, "ips": 5, "mean": 1.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.0827, "hi": 3.38, "lo": 0.44, "ips": 2, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.549, 0.009, 0, false], ["2026-10-12", 0.865, 0.010, 0, false]], "sh": false, "uc": 83.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.854, "ts": null, "map": 0.138, "obs": 0, "own": 0.702, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.865, "se": 0.518, "ts": 0.625, "map": 1.678, "obs": 8, "own": 2.598, "comp": {"cins": -1.3213, "dshield": 0.2829, "crowdsec": 3.429, "vulncheck": -0.8762, "blocklist_de": 0.397}, "mass": 7.5, "listed": false}}, "abq": true, "bot": 0.164, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-45528-APNIC", "org": "Tikona Infinet Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Restrictive", "web": "http://www.tikona.in"}, "pfx": 837, "reg": "2008-11-21", "rir": "apnic", "s24": 807, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 229376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00152633636766}, {"a": 45536, "h": "READYLINK-AS-AP", "n": "Readylink Internet", "t": "Broadband & mobile", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 4, "mail_bruteforce": 4, "router_or_botnet": 2}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "dshield": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 4, "p": 0.7850, "hi": 8.65, "lo": 1.86, "ips": 4, "mean": 4.72, "above": false}, "blocklist_de": {"n": 2, "p": 0.4075, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 15.418, 0.011, 1, false], ["2026-10-12", 27.815, 0.012, 1, false]], "sh": false, "uc": 8487.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 27.815, "se": 0.523, "ts": 0.500, "map": 55.310, "obs": 8, "own": 84.925, "comp": {"cins": 2.577, "dshield": 0.5166, "crowdsec": 2.0906, "vulncheck": -0.8627, "blocklist_de": 1.0852}, "mass": 6.7, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-45536-APNIC", "org": "Readylink Internet Services Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.readylink.in"}, "pfx": 23, "reg": "2008-11-26", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "admin@readylink.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00108161486847}, {"a": 45538, "h": "ODSJSC-AS-VN", "n": "Online Data Services", "t": "Broadband & mobile", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 8, "p": 0.9917, "hi": 12.75, "lo": 4.15, "ips": 8, "mean": 7.95, "above": true}, "crowdsec": {"n": 2, "p": 0.3219, "hi": 5.41, "lo": 0.70, "ips": 2, "mean": 2.58, "above": false}, "blocklist_de": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 2.016, 0.491, 0, false], ["2026-10-12", 2.161, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 1.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.161, "se": 0.760, "ts": 0.667, "map": 6.626, "obs": 3, "own": 10.387, "comp": {"cins": -0.5047, "dshield": -1.0029, "crowdsec": 3.5293, "vulncheck": -0.6652, "blocklist_de": 1.9282}, "mass": 2.3, "listed": false}}, "abq": true, "bot": 0.898, "det": {"shodan": {"compromised": 8}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-55305-APNIC", "org": "ODS Joint Stock Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Selective", "web": "https://www.ods.vn"}, "pfx": 70, "reg": "2008-11-26", "rir": "apnic", "s24": 62, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23552, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0000560010801}, {"a": 45542, "h": "VNU-AS-VN", "n": "VietNam National University Ha Noi", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4006, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 3.051, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.371, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-45542-APNIC", "org": "VietNam National University Ha Noi", "pdb": null, "pfx": 14, "reg": "2008-11-26", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002007535754}, {"a": 45543, "h": "SCTV-AS-VN", "n": "Saigontourist Cable Television Company Limited", "t": "Broadband & mobile", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.0936, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "crowdsec": {"n": 1, "p": 0.0011, "hi": 1.56, "lo": 0.12, "ips": 1, "mean": 0.66, "above": false}, "blocklist_de": {"n": 1, "p": 0.0273, "hi": 2.60, "lo": 0.19, "ips": 1, "mean": 1.10, "above": false}}, "h2": [["2026-10-12", 0.264, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.858, "ts": null, "map": 0.139, "obs": 0, "own": 0.715, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.264, "se": 0.721, "ts": 0.333, "map": 0.743, "obs": 3, "own": 1.168, "comp": {"cins": 3.776, "dshield": -1.2563, "crowdsec": -1.5677, "vulncheck": -0.7365, "blocklist_de": 0.881}, "mass": 3.2, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-45543-APNIC", "org": "SaiGon Tourist cable Televition Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.sctv.com.vn"}, "pfx": 62, "reg": "2008-11-26", "rir": "apnic", "s24": 768, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 376832, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00919721083974}, {"a": 45544, "h": "SUPERDATA-AS-VN", "n": "SUPERDATA", "t": "Other", "w": 4, "cc": "VN", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2022-39290": 1}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.3477, "hi": 5.62, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "crowdsec": {"n": 4, "p": 0.7355, "hi": 7.97, "lo": 1.71, "ips": 4, "mean": 4.35, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 5.079, 0.011, 0, false], ["2026-10-12", 5.372, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.372, "se": 0.612, "ts": 0.800, "map": 12.531, "obs": 5, "own": 7.095, "comp": {"cins": -0.7983, "dshield": -1.43, "crowdsec": 6.8276, "vulncheck": -0.7765, "blocklist_de": 0.0991}, "mass": 3.9, "listed": false}}, "abq": true, "bot": 0.958, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-45544-APNIC", "org": "SUPERDATA-VN", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://superdata.vn"}, "pfx": 89, "reg": "2008-11-26", "rir": "apnic", "s24": 56, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017248066948}, {"a": 45552, "h": "METASERV-VN", "n": "METASERV COMPANY LIMITED", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.807, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-45552-APNIC", "org": "METASERV COMPANY LIMITED", "pdb": null, "pfx": 4, "reg": "2008-11-26", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45582, "h": "VAINAVIINDUSTRIESLTD-IN", "n": "DVPL", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 2.091, 0.509, 0, false], ["2026-10-12", 0.236, 0.546, 0, false]], "sh": false, "uc": 704.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.546, "se": 1.596, "ts": 1.000, "map": 6.020, "obs": 1, "own": 18.692, "comp": {"urlhaus": 4.0696, "threatfox": -0.2266, "phishing_db": -0.4217}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.236, "se": 1.252, "ts": 1.000, "map": 1.835, "obs": 1, "own": 3.214, "comp": {"cins": -0.1379, "dshield": -0.3174, "crowdsec": 3.5011, "vulncheck": -0.3267, "blocklist_de": -0.7184}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.129, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-45582-APNIC", "org": "VAINAVI INDUSTIES LTD, INTERNET SERVICE PROVIDER, INDIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.dvpl.in"}, "pfx": 57, "reg": "2008-12-19", "rir": "apnic", "s24": 56, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "noc@vilcom.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00243635128947}, {"a": 45588, "h": "BTCL-ISP-AS", "n": "Bangladesh Telecommunication Company Limited(BTCL)", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0866, "hi": 3.50, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "crowdsec": {"n": 1, "p": 0.0701, "hi": 3.29, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}}, "h2": [["2026-10-05", 0.117, 0.010, 0, false], ["2026-10-12", 0.122, 0.011, 0, false]], "sh": false, "uc": 460.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 1.176, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.122, "se": 1.164, "ts": 1.000, "map": 0.797, "obs": 1, "own": 1.354, "comp": {"cins": -0.1769, "dshield": -0.4004, "crowdsec": 3.0493, "vulncheck": -0.3863, "blocklist_de": -0.9194}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.228, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BTTB1-AP-APNIC", "org": "Bangladesh Telegraph & Telephone Board", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.btcl.com.bd"}, "pfx": 112, "reg": "2008-12-29", "rir": "apnic", "s24": 167, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00374737713264}, {"a": 45609, "h": "BHARTI-MOBILITY-AS-AP", "n": "Bharti Airtel Ltd. AS for GPRS Service", "t": "Broadband & mobile", "w": 30, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 0.71, "waf": 0.53}, "cs": null, "ev": {"dshield": {"n": 13, "p": 0.0078, "hi": 2.52, "lo": 1.03, "ips": 13, "mean": 1.71, "above": false}, "blocklist_de": {"n": 17, "p": 0.0000, "hi": 1.66, "lo": 0.76, "ips": 17, "mean": 1.18, "above": false}}, "h2": [["2026-10-05", 0.208, 0.004, 0, false], ["2026-10-12", 0.320, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.663, "ts": null, "map": 0.050, "obs": 0, "own": 0.227, "comp": null, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 13, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 17}, "lo": 0.320, "se": 0.407, "ts": 0.567, "map": 0.509, "obs": 30, "own": 0.786, "comp": {"cins": -3.0311, "dshield": 6.0675, "crowdsec": -11.988, "vulncheck": -0.9852, "blocklist_de": 10.6545}, "mass": 37.8, "listed": false}}, "abq": true, "bot": 0.082, "det": {"blocklist_de": {"bots": 12, "apache": 5, "bruteforcelogin": 5}}, "oid": "ORG-BAL1-AP-APNIC", "org": "Bharti Airtel Limited", "pdb": null, "pfx": 2082, "reg": "2009-01-29", "rir": "apnic", "s24": 13359, "sib": 5, "tor": 0, "w24": 30, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3599616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 1.211922}, {"a": 45634, "h": "SPARKSTATION-SG-AP", "n": "Sparkstation Pte Ltd", "t": "Hosting & VPS", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.120, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.928, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SPL22-AP-APNIC", "org": "Sparkstation Pte Ltd", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.sparkstation.net"}, "pfx": 34, "reg": "2009-02-19", "rir": "apnic", "s24": 28, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "noc@sparkstation.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00144037885225}, {"a": 45650, "h": "VIANET-NP", "n": "Vianet Communications Nepal", "t": "Broadband & mobile", "w": 3, "cc": "NP", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3440, "hi": 5.59, "lo": 0.73, "ips": 2, "mean": 2.66, "above": false}, "crowdsec": {"n": 2, "p": 0.3263, "hi": 5.44, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.1726, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 2.133, 0.011, 0, false], ["2026-10-12", 2.264, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 1.539, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.264, "se": 0.761, "ts": 0.667, "map": 6.929, "obs": 3, "own": 10.861, "comp": {"cins": -0.5026, "dshield": -0.9994, "crowdsec": 3.5534, "vulncheck": -0.6641, "blocklist_de": 1.942}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-VCPL1-AP-APNIC", "org": "VIA NET COMMUNICATION PUBLIC LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "http://vianet.com.np"}, "pfx": 55, "reg": "2009-03-11", "rir": "apnic", "s24": 59, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27392, "abuse": "abuse@vianet.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00934328024784}, {"a": 45669, "h": "JPL-PK-AS-PK", "n": "Mobilink", "t": "Transit & backbone", "w": 3, "cc": "PK", "cf": {"rb": "hi", "wb": "hi", "rep": 1.02, "waf": 0.89}, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.2150, "hi": 4.32, "lo": 0.76, "ips": 3, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 0.139, 0.009, 0, false], ["2026-10-12", 0.288, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.860, "ts": null, "map": 0.140, "obs": 0, "own": 1.029, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.288, "se": 0.721, "ts": 1.000, "map": 0.818, "obs": 3, "own": 2.608, "comp": {"cins": -0.7076, "dshield": -1.3073, "crowdsec": -5.1287, "vulncheck": -0.7489, "blocklist_de": 9.0853}, "mass": 3.4, "listed": false}}, "abq": true, "bot": 0.087, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://jazz.com.pk/"}, "pfx": 622, "reg": "2009-03-31", "rir": "apnic", "s24": 742, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 291840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.071622}, {"a": 45671, "h": "AS45671-NET-AU", "n": "Servers Australia AS45671", "t": "Hosting & VPS", "w": 2, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0240, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "blocklist_de": {"n": 2, "p": 0.1955, "hi": 4.38, "lo": 0.57, "ips": 2, "mean": 2.09, "above": false}}, "h2": [["2026-10-05", 0.209, 0.009, 0, false], ["2026-10-12", 0.241, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.158, "obs": 0, "own": 0.137, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.241, "se": 0.860, "ts": 1.000, "map": 0.882, "obs": 2, "own": 0.179, "comp": {"cins": -0.4495, "dshield": -0.912, "crowdsec": -3.5902, "vulncheck": -0.6348, "blocklist_de": 6.855}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.897, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-SAPL7-AP-APNIC", "org": "Servers Australia Pty. Ltd", "pdb": {"t": "NSP", "sc": "Australia", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.serversaustralia.com.au"}, "pfx": 176, "reg": "2009-04-01", "rir": "apnic", "s24": 409, "sib": 9, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 117760, "abuse": "abuse@as45671.net.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008048773845}, {"a": 45700, "h": "IDNIC-STARLINK-AS-ID", "n": "PT Starlink Services Indonesia", "t": "Broadband & mobile", "w": 9, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 5, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 4, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 4}, "n": 8}, "ev": {"crowdsec": {"n": 4, "p": 0.6946, "hi": 7.50, "lo": 1.61, "ips": 8, "mean": 4.10, "above": false}, "blocklist_de": {"n": 1, "p": 0.1627, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 9.211, 0.011, 0, false], ["2026-10-12", 3.748, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.419, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.748, "se": 0.609, "ts": 0.800, "map": 8.677, "obs": 5, "own": 13.436, "comp": {"cins": -0.8155, "dshield": -1.4524, "crowdsec": 6.6095, "vulncheck": -0.7812, "blocklist_de": -0.006}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.096, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-45700-APNIC", "org": "PT Starlink Services Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.spacex.com"}, "pfx": 53, "reg": "2009-04-06", "rir": "apnic", "s24": 83, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22272, "abuse": "abuse-admin@spacex.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0422264604146}, {"a": 45701, "h": "PIMAM-ID", "n": "GlobalXtreme", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1849, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "blocklist_de": {"n": 1, "p": 0.1717, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-12", 2.201, 0.012, 0, false]], "sh": false, "uc": 1146.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 1.527, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.201, "se": 0.760, "ts": 0.333, "map": 6.746, "obs": 3, "own": 10.573, "comp": {"cins": -0.5055, "dshield": 2.7647, "crowdsec": -0.2144, "vulncheck": -0.6656, "blocklist_de": 1.9234}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"bots": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.globalxtreme.net"}, "pfx": 61, "reg": "2009-04-06", "rir": "apnic", "s24": 61, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": "abuse@globalxtreme.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0061356050514}, {"a": 45705, "h": "PPTIK-UGM-AS-ID", "n": "Universitas Gadjah Mada", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 5.847, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.180, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-45705-APNIC", "org": "Universitas Gadjah Mada", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Selective", "web": "http://www.ugm.ac.id"}, "pfx": 10, "reg": "2009-04-06", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005112097166}, {"a": 45725, "h": "KINGS-AS-ID", "n": "Kings Network Indonesia", "t": "Hosting & VPS", "w": 7, "cc": "ID", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 5, "p": 0.9111, "hi": 10.34, "lo": 2.57, "ips": 7, "mean": 5.90, "above": true}}, "h2": [["2026-10-05", 2.380, 0.011, 0, false], ["2026-10-12", 4.146, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.272, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 5, "blocklist_de": 0}, "lo": 4.146, "se": 0.655, "ts": 1.000, "map": 10.053, "obs": 5, "own": 2.067, "comp": {"cins": -0.3936, "dshield": -0.8159, "crowdsec": -3.2148, "vulncheck": 10.1433, "blocklist_de": -2.0175}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.417, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "@aut-45725-APNIC", "org": "Kings Network Indonesia, PT", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.kings.net.id"}, "pfx": 31, "reg": "2009-04-06", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 7936, "abuse": "abuse@idnic.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": null}, {"a": 45731, "h": "ARDH-AS-ID", "n": "PT Ardh Global Indonesia", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2022-26134": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3992, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 2.504, 0.011, 0, false], ["2026-10-12", 0.449, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.449, "se": 1.366, "ts": 1.000, "map": 4.316, "obs": 1, "own": 2.917, "comp": {"cins": -0.0994, "dshield": -0.2325, "crowdsec": 3.9635, "vulncheck": -0.2568, "blocklist_de": -0.5188}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.738, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-45731-APNIC", "org": "ARDH GLOBAL INDONESIA, PT", "pdb": null, "pfx": 11, "reg": "2009-04-06", "rir": "apnic", "s24": 17, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45753, "h": "NETSEC-HK", "n": "Simcentric Solutions Limited", "t": "Hosting & VPS", "w": 84, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 2, "ssh_bruteforce": 3, "home_connection": 1}, "n": 4}, "ev": {"shodan": {"n": 35, "p": 1.0000, "hi": 24.74, "lo": 14.25, "ips": 35, "mean": 19.19, "above": true}, "crowdsec": {"n": 4, "p": 0.2506, "hi": 4.38, "lo": 0.94, "ips": 4, "mean": 2.39, "above": false}, "threatfox": {"n": 3, "p": 0.6050, "hi": 7.29, "lo": 1.29, "ips": 4, "mean": 3.76, "above": false}, "phishing_db": {"n": 31, "p": 1.0000, "hi": 34.85, "lo": 19.41, "ips": 72, "mean": 26.66, "above": true}, "blocklist_de": {"n": 7, "p": 0.9276, "hi": 9.13, "lo": 2.77, "ips": 7, "mean": 5.56, "above": true}}, "h2": [["2026-10-05", 0.592, 13.716, 1, false], ["2026-10-12", 2.945, 12.891, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 31}, "lo": 12.891, "se": 0.721, "ts": 0.912, "map": 25.899, "obs": 34, "own": 9.003, "comp": {"urlhaus": -2.2405, "threatfox": 0.1116, "phishing_db": 7.0093}, "mass": 13.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 7}, "lo": 2.945, "se": 0.476, "ts": 0.636, "map": 5.367, "obs": 11, "own": 1.052, "comp": {"cins": -1.8122, "dshield": -2.4222, "crowdsec": -2.7527, "vulncheck": -0.9254, "blocklist_de": 10.9863}, "mass": 12.2, "listed": false}}, "abq": false, "bot": 0.871, "det": {"shodan": {"c2": 10, "compromised": 25}, "threatfox": {"family:Cobalt Strike": 4}, "blocklist_de": {"ssh": 7}}, "oid": "ORG-NASS1-AP-APNIC", "org": "Netsec Limited", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.simcentric.com/en/"}, "pfx": 435, "reg": "2011-06-29", "rir": "apnic", "s24": 410, "sib": 0, "tor": 0, "w24": 41, "drop": 0, "hist": [["2026-10-05", 0.9970], ["2026-10-12", 0.8393]], "ipv4": 166912, "abuse": "abuse@netsec.com", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": ["blocklist_de"], "traffic": 0.00290077452162}, {"a": 45758, "h": "AWN-CO-LTD-AS-AP", "n": "TripleT Broadband(AIS|3BB)", "t": "Broadband & mobile", "w": 37, "cc": "TH", "cf": {"rb": "", "wb": "", "rep": 2.30, "waf": 0.80}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 10, "web_bruteforce": 7, "home_connection": 10, "mail_bruteforce": 6, "router_or_botnet": 2}, "n": 11}, "ev": {"cins": {"n": 6, "p": 0.4853, "hi": 5.25, "lo": 1.46, "ips": 6, "mean": 3.10, "above": false}, "shodan": {"n": 3, "p": 0.0000, "hi": 1.06, "lo": 0.19, "ips": 3, "mean": 0.54, "above": false}, "dshield": {"n": 13, "p": 0.9711, "hi": 7.94, "lo": 3.25, "ips": 13, "mean": 5.38, "above": true}, "crowdsec": {"n": 10, "p": 0.0002, "hi": 1.91, "lo": 0.69, "ips": 11, "mean": 1.24, "above": false}, "blocklist_de": {"n": 11, "p": 0.4002, "hi": 4.35, "lo": 1.66, "ips": 11, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 0.899, 0.007, 0, false], ["2026-10-12", 1.745, 0.008, 0, false]], "sh": false, "uc": 79.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.755, "ts": null, "map": 0.093, "obs": 0, "own": 0.425, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 6, "dshield": 13, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 11}, "lo": 1.745, "se": 0.392, "ts": 0.325, "map": 2.754, "obs": 40, "own": 4.237, "comp": {"cins": 5.6767, "dshield": 4.6173, "crowdsec": -6.4304, "vulncheck": -0.9904, "blocklist_de": -0.4664}, "mass": 45.3, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Mirai": 3}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 1, "ssh": 2, "bots": 2, "imap": 3, "mail": 6}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.3bb.co.th"}, "pfx": 34, "reg": "2009-04-24", "rir": "apnic", "s24": 2971, "sib": 0, "tor": 0, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 940800, "abuse": "abuseIPv4@ais.co.th", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.114028}, {"a": 45766, "h": "TRIANGLESERVICES", "n": "Triangle Services Limited", "t": "Broadband & mobile", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 3, "router_or_botnet": 4, "cve:CVE-2021-26084": 1}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.7707, "hi": 8.44, "lo": 1.82, "ips": 5, "mean": 4.61, "above": false}}, "h2": [["2026-10-05", 8.051, 0.011, 0, false], ["2026-10-12", 5.914, 0.012, 0, false]], "sh": false, "uc": 2246.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.914, "se": 0.674, "ts": 1.000, "map": 15.524, "obs": 4, "own": 24.087, "comp": {"cins": -0.5963, "dshield": -1.1458, "crowdsec": 9.6034, "vulncheck": -0.7075, "blocklist_de": -3.0178}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.214, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-TS7-AP-APNIC", "org": "Triangle Services", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.triangle.com.bd"}, "pfx": 53, "reg": "2009-05-05", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": "abuse@triangle.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00271057979487}, {"a": 45769, "h": "DVOIS-IN", "n": "D-VoiS Communications", "t": "Broadband & mobile", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1637, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "dshield": {"n": 1, "p": 0.1550, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 2, "p": 0.1598, "hi": 4.08, "lo": 0.53, "ips": 2, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1561, "hi": 4.29, "lo": 0.32, "ips": 2, "mean": 1.81, "above": false}, "blocklist_de": {"n": 1, "p": 0.1203, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-12", 1.983, 0.011, 0, false]], "sh": false, "uc": 95.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.958, "ts": null, "map": 0.174, "obs": 0, "own": 1.109, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.983, "se": 0.582, "ts": 0.333, "map": 4.352, "obs": 6, "own": 6.773, "comp": {"cins": 3.1402, "dshield": 1.2101, "crowdsec": -0.79, "vulncheck": 0.2111, "blocklist_de": -0.9071}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.114, "det": {"vulncheck": {"c2_server": 2}, "blocklist_de": {"bots": 1}}, "oid": "@aut-45769-APNIC", "org": "D-Vois Broadband Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.dvois.com"}, "pfx": 205, "reg": "2009-05-06", "rir": "apnic", "s24": 204, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 52736, "abuse": "abuse@i-on.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00642284439729}, {"a": 45773, "h": "HECPERN-AS-PK", "n": "Pakistan Education & Research Network", "t": "Broadband & mobile", "w": 9, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 6, "web_bruteforce": 4, "home_connection": 7, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.1904, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 1, "p": 0.1584, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 9, "p": 0.9974, "hi": 13.96, "lo": 4.82, "ips": 9, "mean": 8.89, "above": true}, "blocklist_de": {"n": 3, "p": 0.6134, "hi": 7.38, "lo": 1.30, "ips": 3, "mean": 3.81, "above": false}}, "h2": [["2026-10-05", 20.170, 0.011, 1, false], ["2026-10-12", 24.431, 0.012, 1, false]], "sh": false, "uc": 764.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 1.619, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 3}, "lo": 24.431, "se": 0.457, "ts": 0.692, "map": 43.543, "obs": 13, "own": 66.687, "comp": {"cins": 1.4683, "dshield": -2.3644, "crowdsec": 6.5382, "vulncheck": -0.9192, "blocklist_de": 0.4445}, "mass": 11.3, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "apache": 1}}, "oid": "ORG-HA2-AP-APNIC", "org": "HEC", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.pern.edu.pk"}, "pfx": 51, "reg": "2009-05-11", "rir": "apnic", "s24": 47, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@hec.gov.pk", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00242438645933}, {"a": 45815, "h": "HOSTCOIN-AS-IN-AP", "n": "ESDS Software Solution", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3618, "hi": 5.74, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 0.252, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.192, "obs": 0, "own": 0.095, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.902, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-45815-APNIC", "org": "ESDS Software Solution Limited.", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.esds.co.in/"}, "pfx": 45, "reg": "2009-06-24", "rir": "apnic", "s24": 45, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": "abuse@esds.co.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 45820, "h": "TTSL-MEISISP", "n": "Tata Teleservices", "t": "Hosting & VPS", "w": 22, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 13, "web_exploit": 9, "bad_crawling": 1, "proxy_or_vpn": 6, "ssh_bruteforce": 10, "web_bruteforce": 13, "mail_bruteforce": 3, "cve:CVE-2024-28000": 3}, "n": 21}, "ev": {"shodan": {"n": 12, "p": 0.0155, "hi": 2.66, "lo": 1.05, "ips": 12, "mean": 1.78, "above": false}, "dshield": {"n": 1, "p": 0.0036, "hi": 1.83, "lo": 0.14, "ips": 1, "mean": 0.77, "above": false}, "crowdsec": {"n": 21, "p": 0.1622, "hi": 3.41, "lo": 1.68, "ips": 21, "mean": 2.48, "above": false}, "blocklist_de": {"n": 4, "p": 0.0053, "hi": 2.20, "lo": 0.47, "ips": 4, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.884, 0.007, 0, false], ["2026-10-12", 0.884, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.756, "ts": null, "map": 0.093, "obs": 0, "own": 0.066, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 21, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.884, "se": 0.411, "ts": 0.808, "map": 1.413, "obs": 26, "own": 0.278, "comp": {"cins": -2.5224, "dshield": -1.8044, "crowdsec": 10.5876, "vulncheck": -0.9664, "blocklist_de": -3.5548}, "mass": 23.2, "listed": false}}, "abq": true, "bot": 0.203, "det": {"shodan": {"malware": 1, "compromised": 11}, "blocklist_de": {"ssh": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-TD1-AP-APNIC", "org": "TTSL-ISP DIVISION", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.tatatelebusiness.com/"}, "pfx": 1095, "reg": "2009-06-26", "rir": "apnic", "s24": 2957, "sib": 5, "tor": 0, "w24": 22, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 842496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02412228061101}, {"a": 45839, "h": "SHINJIRU-MY-AS-AP", "n": "Shinjiru Technology", "t": "Hosting & VPS", "w": 99, "cc": "MY", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 6, "web_exploit": 18, "bad_crawling": 19, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 20, "web_bruteforce": 2, "mail_bruteforce": 3, "router_or_botnet": 1}, "n": 21}, "ev": {"shodan": {"n": 5, "p": 0.8402, "hi": 8.69, "lo": 2.16, "ips": 5, "mean": 4.96, "above": true}, "crowdsec": {"n": 4, "p": 0.6715, "hi": 7.26, "lo": 1.56, "ips": 21, "mean": 3.97, "above": false}, "phishing_db": {"n": 18, "p": 1.0000, "hi": 25.47, "lo": 11.87, "ips": 78, "mean": 18.13, "above": true}}, "h2": [["2026-10-05", 1.142, 27.592, 1, false], ["2026-10-12", 2.160, 26.022, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 18}, "lo": 26.022, "se": 0.721, "ts": 1.000, "map": 54.173, "obs": 18, "own": 18.252, "comp": {"urlhaus": -1.7188, "threatfox": -0.5391, "phishing_db": 7.8763}, "mass": 6.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.160, "se": 0.662, "ts": 1.000, "map": 5.530, "obs": 4, "own": 1.096, "comp": {"cins": -0.6427, "dshield": -1.2146, "crowdsec": 8.9301, "vulncheck": -0.7259, "blocklist_de": -3.2432}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.848, "det": {"shodan": {"compromised": 4, "doublepulsar": 1}}, "oid": "ORG-STSB2-AP-APNIC", "org": "Shinjiru Technology Sdn Bhd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.shinjiru.com.my"}, "pfx": 37, "reg": "2009-07-07", "rir": "apnic", "s24": 98, "sib": 1, "tor": 0, "w24": 20, "drop": 20, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.8393]], "ipv4": 25344, "abuse": "abuse@shinjiru.com.my", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": [], "traffic": 0.00130537893223}, {"a": 45855, "h": "ASIATECH-NET-AS-AP", "n": "AsiaTech Telecom Limited", "t": "Broadband & mobile", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.9874, "hi": 13.01, "lo": 3.94, "ips": 7, "mean": 7.92, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.429, "det": {"shodan": {"compromised": 7}}, "oid": "ORG-ATL11-AP-APNIC", "org": "AsiaTech Telecom Limited", "pdb": null, "pfx": 2, "reg": "2009-07-24", "rir": "apnic", "s24": 5, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1280, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 45899, "h": "VNPT-AS-VN", "n": "VNPT", "t": "Broadband & mobile", "w": 236, "cc": "VN", "cf": {"rb": "", "wb": "", "rep": 1.82, "waf": 1.30}, "cs": {"c": {"http_flood": 28, "web_exploit": 35, "bad_crawling": 7, "proxy_or_vpn": 34, "first_seen_30d": 2, "ssh_bruteforce": 58, "web_bruteforce": 41, "home_connection": 79, "mail_bruteforce": 18, "router_or_botnet": 23, "cve:CVE-2017-9841": 3, "cve:CVE-2024-6387": 4, "cve:CVE-2018-20062": 3, "cve:CVE-2024-28000": 8, "cve:CVE-2026-63030": 3}, "n": 92}, "ev": {"cins": {"n": 17, "p": 0.0000, "hi": 1.87, "lo": 0.85, "ips": 18, "mean": 1.32, "above": false}, "shodan": {"n": 50, "p": 0.0000, "hi": 0.98, "lo": 0.62, "ips": 50, "mean": 0.79, "above": false}, "dshield": {"n": 36, "p": 0.0154, "hi": 2.78, "lo": 1.61, "ips": 36, "mean": 2.16, "above": false}, "urlhaus": {"n": 4, "p": 0.0125, "hi": 2.43, "lo": 0.52, "ips": 4, "mean": 1.33, "above": false}, "crowdsec": {"n": 86, "p": 0.0000, "hi": 1.28, "lo": 0.90, "ips": 92, "mean": 1.08, "above": false}, "threatfox": {"n": 4, "p": 0.0002, "hi": 1.64, "lo": 0.35, "ips": 4, "mean": 0.90, "above": false}, "vulncheck": {"n": 8, "p": 0.0000, "hi": 0.87, "lo": 0.28, "ips": 8, "mean": 0.54, "above": false}, "phishing_db": {"n": 4, "p": 0.0000, "hi": 0.59, "lo": 0.13, "ips": 4, "mean": 0.32, "above": false}, "blocklist_de": {"n": 88, "p": 0.1455, "hi": 3.18, "lo": 2.25, "ips": 90, "mean": 2.70, "above": false}}, "h2": [["2026-10-05", 0.555, 0.211, 0, false], ["2026-10-12", 1.107, 0.218, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 4, "threatfox": 4, "phishing_db": 4}, "lo": 0.218, "se": 0.943, "ts": 0.333, "map": 0.554, "obs": 12, "own": 1.630, "comp": {"urlhaus": 1.5113, "threatfox": 0.0147, "phishing_db": -0.4913}, "mass": 27.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 17, "dshield": 36, "crowdsec": 86, "vulncheck": 8, "blocklist_de": 88}, "lo": 1.107, "se": 0.362, "ts": 0.374, "map": 1.635, "obs": 235, "own": 2.518, "comp": {"cins": 1.3252, "dshield": 0.4883, "crowdsec": -4.2486, "vulncheck": -0.8268, "blocklist_de": 5.1472}, "mass": 270.5, "listed": false}}, "abq": true, "bot": 0.239, "det": {"shodan": {"c2": 2, "compromised": 48}, "threatfox": {"family:Chaos": 1, "family:Cobalt Strike": 2, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 6, "attack_tooling": 1}, "blocklist_de": {"ftp": 2, "ssh": 20, "bots": 62, "imap": 3, "mail": 4, "apache": 2, "bruteforcelogin": 2}}, "oid": "@aut-7643-APNIC", "org": "Vietnam Posts and Telecommunications (VNPT)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.vnpt.vn"}, "pfx": 3411, "reg": "2009-08-28", "rir": "apnic", "s24": 29857, "sib": 2, "tor": 0, "w24": 224, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15607296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.3785}, {"a": 45903, "h": "CMCTELECOM-VN", "n": "CMC Telecom", "t": "Broadband & mobile", "w": 15, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 2, "proxy_or_vpn": 8, "first_seen_30d": 1, "ssh_bruteforce": 13, "web_bruteforce": 1, "home_connection": 10, "router_or_botnet": 6, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 14}, "ev": {"shodan": {"n": 8, "p": 0.9285, "hi": 8.57, "lo": 2.79, "ips": 8, "mean": 5.35, "above": true}, "crowdsec": {"n": 13, "p": 0.9982, "hi": 11.17, "lo": 4.57, "ips": 14, "mean": 7.57, "above": true}, "blocklist_de": {"n": 5, "p": 0.7806, "hi": 7.83, "lo": 1.95, "ips": 5, "mean": 4.47, "above": false}}, "h2": [["2026-10-05", 5.713, 0.010, 0, false], ["2026-10-12", 5.463, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 0.964, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 5}, "lo": 5.463, "se": 0.430, "ts": 0.722, "map": 9.263, "obs": 18, "own": 14.220, "comp": {"cins": -2.1402, "dshield": -2.6435, "crowdsec": 7.2441, "vulncheck": -0.9473, "blocklist_de": 2.1066}, "mass": 16.4, "listed": false}}, "abq": true, "bot": 0.313, "det": {"shodan": {"compromised": 8}, "blocklist_de": {"ssh": 5}}, "oid": "@family-53558", "org": "CMC Telecom Infrastructure Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://cmctelecom.vn"}, "pfx": 354, "reg": "2009-08-28", "rir": "apnic", "s24": 320, "sib": 4, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 187136, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00478982618982}, {"a": 45916, "h": "GTPL-AS-AP", "n": "Gujarat Telelink", "t": "Broadband & mobile", "w": 23, "cc": "IN", "cf": {"rb": "lo", "wb": null, "rep": 1.73, "waf": null}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 3, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 3}, "n": 7}, "ev": {"cins": {"n": 2, "p": 0.3341, "hi": 5.51, "lo": 0.72, "ips": 2, "mean": 2.62, "above": false}, "shodan": {"n": 3, "p": 0.2416, "hi": 4.50, "lo": 0.79, "ips": 3, "mean": 2.32, "above": false}, "dshield": {"n": 3, "p": 0.5262, "hi": 6.55, "lo": 1.16, "ips": 3, "mean": 3.38, "above": false}, "urlhaus": {"n": 4, "p": 0.7992, "hi": 8.88, "lo": 1.91, "ips": 4, "mean": 4.85, "above": true}, "crowdsec": {"n": 5, "p": 0.4945, "hi": 5.53, "lo": 1.37, "ips": 7, "mean": 3.16, "above": false}, "vulncheck": {"n": 1, "p": 0.1324, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 7, "p": 0.9433, "hi": 9.64, "lo": 2.92, "ips": 7, "mean": 5.87, "above": true}}, "h2": [["2026-10-05", 5.785, 5.443, 0, false], ["2026-10-12", 5.863, 6.000, 0, false]], "sh": false, "uc": 241.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 4, "threatfox": 0, "phishing_db": 0}, "lo": 6.000, "se": 0.904, "ts": 1.000, "map": 17.813, "obs": 4, "own": 40.160, "comp": {"urlhaus": 6.1615, "threatfox": -0.5453, "phishing_db": -1.1101}, "mass": 7.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 7}, "lo": 5.863, "se": 0.433, "ts": 0.389, "map": 10.020, "obs": 18, "own": 15.377, "comp": {"cins": 2.8082, "dshield": 0.996, "crowdsec": -4.5265, "vulncheck": -0.6412, "blocklist_de": 5.0618}, "mass": 18.8, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 1, "mail": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "@aut-45916-APNIC", "org": "Gujarat Telelink Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.gtpl.net"}, "pfx": 339, "reg": "2010-01-25", "rir": "apnic", "s24": 339, "sib": 0, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 86784, "abuse": "abuse.report@gtpl.net", "score": 0.1060, "groups": ["abusech"], "sensors": ["blocklist_de"], "traffic": 0.02752300353054}, {"a": 45974, "h": "NHN-AS-KR", "n": "NHN Cloud", "t": "Hosting & VPS", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 8, "p": 0.8982, "hi": 7.94, "lo": 2.58, "ips": 8, "mean": 4.95, "above": true}}, "h2": [["2026-10-05", 0.006, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.912, "ts": null, "map": 0.160, "obs": 0, "own": 0.141, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.628, "ts": null, "map": 0.091, "obs": 0, "own": 0.027, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.326, "det": {"shodan": {"compromised": 8}}, "oid": "@aut-152291-APNIC", "org": "NHNCLOUD", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.nhncloud.com"}, "pfx": 369, "reg": "2009-11-10", "rir": "apnic", "s24": 383, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 135680, "abuse": "hostmaster@nic.or.kr", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0018487149086}, {"a": 45996, "h": "DAOU-AS-KR", "n": "DAOU TECHNOLOGY", "t": "Transit & backbone", "w": 3, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1017, "hi": 3.68, "lo": 0.28, "ips": 1, "mean": 1.55, "above": false}, "shodan": {"n": 1, "p": 0.0052, "hi": 1.93, "lo": 0.14, "ips": 1, "mean": 0.81, "above": false}, "crowdsec": {"n": 2, "p": 0.0096, "hi": 2.23, "lo": 0.29, "ips": 2, "mean": 1.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.0341, "hi": 2.74, "lo": 0.20, "ips": 1, "mean": 1.15, "above": false}}, "h2": [["2026-10-05", 0.131, 0.009, 0, false], ["2026-10-12", 0.434, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.867, "ts": null, "map": 0.143, "obs": 0, "own": 1.059, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.434, "se": 0.649, "ts": 0.500, "map": 1.070, "obs": 4, "own": 3.398, "comp": {"cins": 3.4376, "dshield": -1.4678, "crowdsec": 0.3547, "vulncheck": -0.7844, "blocklist_de": -0.0786}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.492, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-45996-APNIC", "org": "DAOU TECHNOLOGY", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.daou.co.kr/"}, "pfx": 101, "reg": "2009-11-10", "rir": "apnic", "s24": 685, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 194304, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006523414352}, {"a": 46015, "h": "EXABYTES-AS-AP", "n": "Exabytes Network Malaysia", "t": "Hosting & VPS", "w": 3, "cc": "MY", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 22.21, "lo": 9.90, "ips": 16, "mean": 15.54, "above": true}, "crowdsec": {"n": 1, "p": 0.1525, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "phishing_db": {"n": 2, "p": 0.4089, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 1.218, 2.304, 0, false], ["2026-10-12", 0.271, 2.353, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 2.353, "se": 1.163, "ts": 1.000, "map": 11.343, "obs": 2, "own": 4.309, "comp": {"urlhaus": -0.3132, "threatfox": -0.2835, "phishing_db": 4.6516}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.271, "se": 1.274, "ts": 1.000, "map": 2.193, "obs": 1, "own": 0.494, "comp": {"cins": -0.1298, "dshield": -0.2997, "crowdsec": 3.5975, "vulncheck": -0.3129, "blocklist_de": -0.6762}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.885, "det": {"shodan": {"c2": 8, "compromised": 7, "doublepulsar": 1}}, "oid": "ORG-EBNS1-AP-APNIC", "org": "Exa Bytes Network Sdn.Bhd.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.exabytes.my"}, "pfx": 24, "reg": "2009-11-12", "rir": "apnic", "s24": 44, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 14080, "abuse": "noc-abuse@mschosting.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00047601960017}, {"a": 46019, "h": "UNIBRAW-AS-ID", "n": "Universitas Brawijaya", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 5.847, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.134, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-46019-APNIC", "org": "Universitas Brawijaya", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.ub.ac.id"}, "pfx": 9, "reg": "2009-11-12", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46023, "h": "QUANTUMNET-AS-ID", "n": "Quantum Tera Network", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 12.413, 0.011, 1, false], ["2026-10-12", 0.335, 0.012, 0, false]], "sh": false, "uc": 1536.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.335, "se": 1.309, "ts": 1.000, "map": 2.896, "obs": 1, "own": 5.197, "comp": {"cins": -0.1172, "dshield": -0.2721, "crowdsec": 3.7479, "vulncheck": -0.2906, "blocklist_de": -0.6111}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.314, "det": null, "oid": "@aut-46023-APNIC", "org": "PT Quantum Tera Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.quantum.net.id"}, "pfx": 52, "reg": "2009-11-12", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0012169109018}, {"a": 46026, "h": "BBT-AS-ID", "n": "BATAM BINTAN TELEKOMUNIKASI, PT", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 1.372, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.211, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-46026-APNIC", "org": "BATAM BINTAN TELEKOMUNIKASI, PT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.bbt.co.id"}, "pfx": 14, "reg": "2009-11-12", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46050, "h": "JOGJACAMP-AS-ID", "n": "PT JC Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.813, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-46050-APNIC", "org": "PT JC Indonesia", "pdb": null, "pfx": 6, "reg": "2009-11-12", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "hostmaster@jogjacamp.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46054, "h": "WLAN-AS-ID", "n": "Wahana Lintas Nusa Persada", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.012, 0.887, 0, false]], "sh": false, "uc": 2880.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.887, "se": 1.784, "ts": 1.000, "map": 12.743, "obs": 1, "own": 50.146, "comp": {"urlhaus": 4.4321, "threatfox": -0.0933, "phishing_db": -0.1677}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.130, "det": null, "oid": "@aut-46054-APNIC", "org": "PT Wahana Lintas Nusa Persada", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://wlan.net.id"}, "pfx": 9, "reg": "2009-11-12", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46055, "h": "ROKA-AS-ID", "n": "ROKA LANE ASIA", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.722, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-46055-APNIC", "org": "PT ROKA LANE ASIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.roka.co.id"}, "pfx": 3, "reg": "2009-11-12", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46261, "h": "QUICKPACKET", "n": "QuickPacket", "t": "Transit & backbone", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.2082, "hi": 4.48, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}}, "h2": [["2026-10-05", 0.332, 0.009, 0, false], ["2026-10-12", 0.126, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.859, "ts": null, "map": 0.140, "obs": 0, "own": 1.021, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.126, "se": 0.834, "ts": 1.000, "map": 0.438, "obs": 2, "own": 1.416, "comp": {"cins": -0.4172, "dshield": 7.1106, "crowdsec": -3.3749, "vulncheck": -0.6149, "blocklist_de": -2.1349}, "mass": 1.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "QUICK-11-ARIN", "org": "QuickPacket, LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://quickpacket.com"}, "pfx": 381, "reg": "2008-07-28", "rir": "arin", "s24": 751, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 195072, "abuse": "abuse@quickpacket.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00791060229597}, {"a": 46370, "h": "GRANDWEB", "n": "Grand Web Solutions, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.000, "det": null, "oid": "GWS-24-ARIN", "org": "Grand Web Solutions, Inc.", "pdb": null, "pfx": 6, "reg": "2008-08-27", "rir": "arin", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@grandwebsolutions.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46375, "h": "AS-SONICTELECOM", "n": "Sonic Telecom (Sonic.net, Inc.)", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.0003, "hi": 1.79, "lo": 0.50, "ips": 6, "mean": 1.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.0001, "hi": 1.24, "lo": 0.09, "ips": 1, "mean": 0.52, "above": false}}, "h2": [["2026-10-05", 0.043, 0.007, 0, false], ["2026-10-12", 0.019, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.764, "ts": null, "map": 0.097, "obs": 0, "own": 0.446, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.019, "se": 1.004, "ts": 1.000, "map": 0.092, "obs": 1, "own": 0.152, "comp": {"cins": -0.3123, "dshield": -0.6684, "crowdsec": -2.637, "vulncheck": -0.5364, "blocklist_de": 3.1637}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.168, "det": {"shodan": {"compromised": 6}, "blocklist_de": {"bots": 1}}, "oid": "SONIC-24-ARIN", "org": "Sonic Telecom LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.sonic.com"}, "pfx": 75, "reg": "2008-08-29", "rir": "arin", "s24": 2630, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 820992, "abuse": "abuse@sonic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02619876252144}, {"a": 46475, "h": "LIMESTONENETWORKS", "n": "Limestone Networks", "t": "Hosting & VPS", "w": 127, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 59, "data_centre": 8, "web_exploit": 98, "bad_crawling": 13, "proxy_or_vpn": 7, "ssh_bruteforce": 1, "web_bruteforce": 105, "home_connection": 4, "mail_bruteforce": 2, "cve:CVE-2019-18935": 5, "cve:CVE-2022-39290": 9, "cve:CVE-2025-32355": 4, "cve:CVE-2026-60137": 25, "cve:CVE-2026-63030": 46}, "n": 111}, "ev": {"shodan": {"n": 8, "p": 0.8088, "hi": 6.82, "lo": 2.22, "ips": 8, "mean": 4.25, "above": true}, "dshield": {"n": 4, "p": 0.6588, "hi": 7.14, "lo": 1.54, "ips": 5, "mean": 3.90, "above": false}, "crowdsec": {"n": 25, "p": 1.0000, "hi": 14.61, "lo": 7.62, "ips": 111, "mean": 10.88, "above": true}, "vulncheck": {"n": 6, "p": 0.9069, "hi": 9.29, "lo": 2.58, "ips": 6, "mean": 5.49, "above": true}, "phishing_db": {"n": 2, "p": 0.2743, "hi": 5.01, "lo": 0.65, "ips": 2, "mean": 2.39, "above": false}, "blocklist_de": {"n": 7, "p": 0.8977, "hi": 8.43, "lo": 2.55, "ips": 8, "mean": 5.13, "above": true}}, "h2": [["2026-10-05", 8.609, 0.411, 0, false], ["2026-10-12", 7.011, 0.423, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.423, "se": 1.135, "ts": 1.000, "map": 1.748, "obs": 2, "own": 0.741, "comp": {"urlhaus": -0.5306, "threatfox": -0.3719, "phishing_db": 3.0869}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 25, "vulncheck": 6, "blocklist_de": 7}, "lo": 7.011, "se": 0.387, "ts": 0.595, "map": 11.071, "obs": 42, "own": 2.162, "comp": {"cins": -2.8706, "dshield": 0.2033, "crowdsec": 7.9739, "vulncheck": 0.1547, "blocklist_de": -1.6633}, "mass": 31.9, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"c2": 8}, "vulncheck": {"botnet_node": 4, "attack_tooling": 2}, "blocklist_de": {"bots": 3, "apache": 5}}, "oid": "LIMES-2-ARIN", "org": "Limestone Networks, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.limestonenetworks.com"}, "pfx": 313, "reg": "2008-09-29", "rir": "arin", "s24": 523, "sib": 0, "tor": 0, "w24": 37, "drop": 0, "hist": [["2026-10-05", 0.8538], ["2026-10-12", 0.9970]], "ipv4": 170752, "abuse": "abuse@limestonenetworks.com", "score": 0.9970, "groups": ["sensors", "vulncheck", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.01709213411656}, {"a": 46562, "h": "PERFORMIVE", "n": "Performive", "t": "Transit & backbone", "w": 28, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 3, "web_exploit": 17, "bad_crawling": 1, "proxy_or_vpn": 8, "ssh_bruteforce": 17, "web_bruteforce": 19, "home_connection": 1, "mail_bruteforce": 4, "cve:CVE-2012-3153": 1, "cve:CVE-2015-9415": 1, "cve:CVE-2021-24931": 1, "cve:CVE-2022-39290": 7, "cve:CVE-2025-22457": 11}, "n": 20}, "ev": {"shodan": {"n": 3, "p": 0.1769, "hi": 4.06, "lo": 0.72, "ips": 3, "mean": 2.09, "above": false}, "urlhaus": {"n": 3, "p": 0.6208, "hi": 7.46, "lo": 1.31, "ips": 6, "mean": 3.85, "above": false}, "crowdsec": {"n": 16, "p": 0.9996, "hi": 11.40, "lo": 5.08, "ips": 20, "mean": 7.97, "above": true}, "phishing_db": {"n": 2, "p": 0.2984, "hi": 5.21, "lo": 0.68, "ips": 2, "mean": 2.48, "above": false}}, "h2": [["2026-10-05", 4.820, 3.993, 0, false], ["2026-10-12", 3.112, 4.260, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 2}, "lo": 4.260, "se": 0.903, "ts": 0.600, "map": 12.307, "obs": 5, "own": 40.676, "comp": {"urlhaus": 4.7609, "threatfox": -0.5385, "phishing_db": -0.086}, "mass": 6.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 16, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.112, "se": 0.438, "ts": 1.000, "map": 5.255, "obs": 16, "own": 16.415, "comp": {"cins": -1.8309, "dshield": -2.4357, "crowdsec": 16.8553, "vulncheck": -0.9268, "blocklist_de": -8.6091}, "mass": 12.4, "listed": false}}, "abq": false, "bot": 0.960, "det": {"shodan": {"compromised": 3}}, "oid": "TSSL-2-ARIN", "org": "Performive LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://performive.com/"}, "pfx": 236, "reg": "2008-10-16", "rir": "arin", "s24": 426, "sib": 7, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 119552, "abuse": "abuse@performive.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 46606, "h": "UNIFIEDLAYER-AS-1", "n": "Endurance International Group, Inc", "t": "Hosting & VPS", "w": 104, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 15, "data_centre": 21, "web_exploit": 18, "bad_crawling": 2, "proxy_or_vpn": 12, "first_seen_30d": 1, "ssh_bruteforce": 15, "web_bruteforce": 17, "mail_bruteforce": 7, "router_or_botnet": 1, "cve:CVE-2026-8181": 14, "cve:CVE-2024-28000": 2, "cve:CVE-2026-41940": 1}, "n": 22}, "ev": {"cins": {"n": 2, "p": 0.1133, "hi": 3.67, "lo": 0.48, "ips": 2, "mean": 1.75, "above": false}, "shodan": {"n": 3, "p": 0.0005, "hi": 1.68, "lo": 0.30, "ips": 3, "mean": 0.87, "above": false}, "urlhaus": {"n": 1, "p": 0.1392, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "crowdsec": {"n": 17, "p": 0.6152, "hi": 4.65, "lo": 2.12, "ips": 22, "mean": 3.28, "above": false}, "phishing_db": {"n": 68, "p": 1.0000, "hi": 45.59, "lo": 30.64, "ips": 78, "mean": 37.80, "above": true}, "blocklist_de": {"n": 5, "p": 0.1550, "hi": 3.74, "lo": 0.93, "ips": 5, "mean": 2.14, "above": false}}, "h2": [["2026-10-05", 1.773, 7.240, 0, false], ["2026-10-12", 1.543, 7.240, 0, false]], "sh": false, "uc": 105, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 68}, "lo": 7.240, "se": 0.731, "ts": 0.986, "map": 14.463, "obs": 69, "own": 5.178, "comp": {"urlhaus": -1.9719, "threatfox": -0.5817, "phishing_db": 6.8514}, "mass": 32.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.543, "se": 0.415, "ts": 0.708, "map": 2.535, "obs": 24, "own": 0.498, "comp": {"cins": 1.9497, "dshield": -2.8765, "crowdsec": 6.0647, "vulncheck": -0.9676, "blocklist_de": -1.8462}, "mass": 23.7, "listed": false}}, "abq": false, "bot": 0.989, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "BLUEH-2-ARIN", "org": "Unified Layer", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Open", "web": "http://www.endurance.com"}, "pfx": 242, "reg": "2008-10-24", "rir": "arin", "s24": 1689, "sib": 0, "tor": 0, "w24": 88, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 782848, "abuse": "abuse@bluehost.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 46636, "h": "NATCOWEB", "n": "NatCoWeb Corp.", "t": "Other", "w": 0, "cc": "US", "cf": {"rb": "hi", "wb": "", "rep": 0.34, "waf": 0.45}, "cs": null, "ev": {"shodan": {"n": 19, "p": 1.0000, "hi": 24.57, "lo": 11.68, "ips": 19, "mean": 17.63, "above": true}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 0.611, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.864, "ts": null, "map": 0.178, "obs": 0, "own": 0.228, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.847, "det": {"shodan": {"compromised": 19}}, "oid": "NATCO-8-ARIN", "org": "NatCoWeb Corp.", "pdb": null, "pfx": 21, "reg": "2008-10-31", "rir": "arin", "s24": 63, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23552, "abuse": "abuse@natcoweb.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.21248}, {"a": 46664, "h": "VDI-NETWORK", "n": "VolumeDrive", "t": "Transit & backbone", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 2.428, 0.706, 0, false], ["2026-10-12", 0.011, 0.746, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.746, "se": 1.704, "ts": 1.000, "map": 9.777, "obs": 1, "own": 48.319, "comp": {"urlhaus": 4.3142, "threatfox": -0.1446, "phishing_db": -0.2634}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 2.345, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.845, "det": null, "oid": "VOLUM-2-ARIN", "org": "VolumeDrive", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Open", "web": "http://volumedrive.com"}, "pfx": 18, "reg": "2008-11-07", "rir": "arin", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "noc@vdinetwork.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46687, "h": "MAXXSOUTH-BROADBAND", "n": "BCI Mississippi Broadband", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0241, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "blocklist_de": {"n": 1, "p": 0.0877, "hi": 3.51, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 0.076, 0.010, 0, false], ["2026-10-12", 0.267, 0.011, 0, false]], "sh": false, "uc": 97.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.923, "ts": null, "map": 0.164, "obs": 0, "own": 0.957, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.267, "se": 0.863, "ts": 0.500, "map": 0.985, "obs": 2, "own": 1.570, "comp": {"cins": -0.4066, "dshield": -0.8386, "crowdsec": 0.6771, "vulncheck": -0.608, "blocklist_de": 2.5543}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "BMB-15-ARIN", "org": "BCI Mississippi Broadband,LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "200-300Gbps", "pol": "Open", "web": "http://maxxsouth.com"}, "pfx": 292, "reg": "2008-11-11", "rir": "arin", "s24": 328, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 156416, "abuse": "abuse@maxxsouth.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46805, "h": "AS-46805", "n": "CACHED", "t": "Other", "w": 2, "cc": "SC", "cf": null, "cs": {"c": {"web_exploit": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3767, "hi": 5.87, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}}, "h2": [["2026-10-05", 1.695, 0.011, 0, false], ["2026-10-12", 1.811, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.729, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.811, "se": 0.951, "ts": 1.000, "map": 7.920, "obs": 2, "own": 4.651, "comp": {"cins": -0.2778, "dshield": -0.6028, "crowdsec": 6.2821, "vulncheck": -0.5045, "blocklist_de": -1.434}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-AL993-RIPE", "org": "Angelnet Limited", "pdb": null, "pfx": 27, "reg": "2012-11-21", "rir": "ripencc", "s24": 27, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": "noc1@interconnects.us", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46824, "h": "NAMECRANE", "n": "NameCrane LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.985, "det": {"shodan": {"compromised": 1}}, "oid": "NL-802-ARIN", "org": "NameCrane LLC", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://namecrane.com"}, "pfx": 4, "reg": "2023-09-12", "rir": "arin", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46841, "h": "FORKNETWORKING", "n": "Fork Networking, LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-44228": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.236, 0.011, 0, false], ["2026-10-12", 0.244, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 0.636, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.244, "se": 1.257, "ts": 1.000, "map": 1.912, "obs": 1, "own": 1.228, "comp": {"cins": -0.136, "dshield": -0.3133, "crowdsec": 3.5232, "vulncheck": -0.3235, "blocklist_de": -0.7087}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.499, "det": null, "oid": "FORKN-ARIN", "org": "Fork Networking, LLC", "pdb": null, "pfx": 13, "reg": "2009-03-31", "rir": "arin", "s24": 53, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21504, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46844, "h": "SHARKTECH", "n": "Sharktech", "t": "Hosting & VPS", "w": 41, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 8, "p": 0.9880, "hi": 11.98, "lo": 3.90, "ips": 24, "mean": 7.47, "above": true}, "shodan": {"n": 11, "p": 0.9772, "hi": 8.93, "lo": 3.40, "ips": 11, "mean": 5.89, "above": true}, "crowdsec": {"n": 1, "p": 0.0081, "hi": 2.07, "lo": 0.16, "ips": 1, "mean": 0.87, "above": false}, "vulncheck": {"n": 5, "p": 0.8207, "hi": 8.38, "lo": 2.08, "ips": 15, "mean": 4.78, "above": true}, "phishing_db": {"n": 1, "p": 0.1151, "hi": 3.83, "lo": 0.29, "ips": 2, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 1.957, 0.135, 0, false], ["2026-10-12", 2.775, 0.143, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.143, "se": 1.378, "ts": 1.000, "map": 0.960, "obs": 1, "own": 0.447, "comp": {"urlhaus": -0.2947, "threatfox": -0.2736, "phishing_db": 2.1538}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 0, "crowdsec": 1, "vulncheck": 5, "blocklist_de": 0}, "lo": 2.775, "se": 0.479, "ts": 0.571, "map": 5.117, "obs": 14, "own": 1.007, "comp": {"cins": 21.7048, "dshield": -2.5163, "crowdsec": -8.2394, "vulncheck": 1.1655, "blocklist_de": -9.0884}, "mass": 13.8, "listed": false}}, "abq": false, "bot": 0.713, "det": {"shodan": {"compromised": 11}, "vulncheck": {"botnet_node": 15}}, "oid": "SHARK-7-ARIN", "org": "Sharktech", "pdb": {"t": "Network Services", "sc": "Global", "tr": null, "pol": "Open", "web": "https://sharktech.net"}, "pfx": 413, "reg": "2009-03-31", "rir": "arin", "s24": 486, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8435]], "ipv4": 124672, "abuse": "abuse@sharktech.net", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["cins"], "traffic": 0.00966829700572}, {"a": 46883, "h": "BCCTV", "n": "Bay Country Communications, Inc.", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.532, 0.011, 0, false], ["2026-10-12", 0.539, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.539, "se": 1.418, "ts": 1.000, "map": 5.493, "obs": 1, "own": 3.972, "comp": {"cins": -0.06, "dshield": -0.143, "crowdsec": -0.5667, "vulncheck": 4.1812, "blocklist_de": -0.3143}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "BAYCO-1-ARIN", "org": "Bay Country Communications, Inc.", "pdb": null, "pfx": 4, "reg": "2010-05-14", "rir": "arin", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@bcctv.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 46887, "h": "ZAYO-CCF-AS46887", "n": "Crown Castle", "t": "Transit & backbone", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0000, "hi": 0.81, "lo": 0.11, "ips": 2, "mean": 0.39, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.50, "lo": 0.04, "ips": 1, "mean": 0.21, "above": false}, "vulncheck": {"n": 1, "p": 0.0030, "hi": 1.78, "lo": 0.13, "ips": 1, "mean": 0.75, "above": false}}, "h2": [["2026-10-05", 0.031, 0.007, 0, false], ["2026-10-12", 0.030, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.751, "ts": null, "map": 0.091, "obs": 0, "own": 0.588, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.030, "se": 0.816, "ts": 0.500, "map": 0.099, "obs": 2, "own": 0.326, "comp": {"cins": -0.3957, "dshield": -0.8195, "crowdsec": 0.7801, "vulncheck": 1.5406, "blocklist_de": -2.0277}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.176, "det": {"shodan": {"malware": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ZAYOB-ARIN", "org": "Zayo Bandwidth", "pdb": {"t": "NSP", "sc": "North America", "tr": null, "pol": "Restrictive", "web": "https://www.crowncastle.com/"}, "pfx": 795, "reg": "2009-04-13", "rir": "arin", "s24": 3176, "sib": 46, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1347072, "abuse": "abuse@zayo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02179337102188}, {"a": 46997, "h": "NATOLAB", "n": "Black Mesa Corporation", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-31324": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1971, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 2, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 3.512, 0.011, 0, false], ["2026-10-12", 9.617, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.617, "se": 0.799, "ts": 0.333, "map": 31.827, "obs": 3, "own": 18.279, "comp": {"cins": 4.2841, "dshield": 3.0416, "crowdsec": 0.3917, "vulncheck": -0.6276, "blocklist_de": -2.2358}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "NRL-25-ARIN", "org": "Black Mesa Corporation", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://internet.nat.moe"}, "pfx": 14, "reg": "2020-05-04", "rir": "arin", "s24": 11, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01283911171515}, {"a": 47007, "h": "AS4-COLOAM", "n": "Colocation America AS47007", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.4974, "hi": 6.31, "lo": 1.11, "ips": 3, "mean": 3.26, "above": false}, "crowdsec": {"n": 1, "p": 0.0126, "hi": 2.23, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}, "phishing_db": {"n": 1, "p": 0.1237, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 0.196, 0.146, 0, false], ["2026-10-12", 0.580, 0.154, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.154, "se": 1.384, "ts": 1.000, "map": 1.050, "obs": 1, "own": 0.487, "comp": {"urlhaus": -0.2818, "threatfox": -0.2663, "phishing_db": 2.2233}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.580, "se": 0.648, "ts": 0.750, "map": 1.442, "obs": 4, "own": 0.286, "comp": {"cins": -0.7104, "dshield": 8.6513, "crowdsec": -1.8614, "vulncheck": -0.7498, "blocklist_de": -3.5703}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.644, "det": null, "oid": "CAC-89-ARIN", "org": "Colocation America Corporation", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.colocationamerica.com"}, "pfx": 395, "reg": "2017-01-27", "rir": "arin", "s24": 423, "sib": 4, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 110336, "abuse": "Abuse@colocationamerica.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00464979216418}, {"a": 47046, "h": "WADSWORTH-CITYLINK", "n": "CityLink", "t": "Other", "w": 10, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 10, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.410, 0.011, 0, false], ["2026-10-12", 0.410, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.410, "se": 1.361, "ts": 1.000, "map": 3.766, "obs": 1, "own": 2.637, "comp": {"cins": -0.0719, "dshield": -0.1702, "crowdsec": -0.6744, "vulncheck": 4.012, "blocklist_de": -0.3758}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.151, "det": {"vulncheck": {"botnet_node": 10}}, "oid": "CW-772-ARIN", "org": "CityLink", "pdb": null, "pfx": 3, "reg": "2023-02-28", "rir": "arin", "s24": 14, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47139, "h": "INDIGO-TAJIKISTAN-AS", "n": "INDIGO TAJIKISTAN", "t": "Transit & backbone", "w": 1, "cc": "TJ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.416, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 2.712, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.416, "se": 1.349, "ts": 1.000, "map": 3.869, "obs": 1, "own": 14.391, "comp": {"cins": -0.1047, "dshield": 4.6328, "crowdsec": -0.9678, "vulncheck": -0.2672, "blocklist_de": -0.5464}, "mass": 0.5, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-CIT3-RIPE", "org": "CJSC INDIGO TAJIKISTAN", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Selective", "web": "http://tcell.tj"}, "pfx": 20, "reg": "2008-05-02", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00148274619739}, {"a": 47147, "h": "AS-ANX", "n": "ANX", "t": "Transit & backbone", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 3.197, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 3.632, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.688, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AIG10-RIPE", "org": "Anexia Cloud Solutions GmbH", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.anexia.com/"}, "pfx": 3, "reg": "2017-04-24", "rir": "ripencc", "s24": 6, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@anexia.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47169, "h": "HPC-MVM-AS", "n": "Pro-M Zrt.", "t": "Transit & backbone", "w": 6, "cc": "HU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1555, "hi": 4.28, "lo": 0.32, "ips": 4, "mean": 1.80, "above": false}, "blocklist_de": {"n": 2, "p": 0.2913, "hi": 5.15, "lo": 0.67, "ips": 2, "mean": 2.46, "above": false}}, "h2": [["2026-10-05", 1.027, 0.010, 0, false], ["2026-10-12", 0.665, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.570, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.665, "se": 0.761, "ts": 0.667, "map": 1.992, "obs": 3, "own": 6.471, "comp": {"cins": -0.5064, "dshield": -1.0056, "crowdsec": -3.9558, "vulncheck": 1.1387, "blocklist_de": 6.4121}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.157, "det": {"vulncheck": {"botnet_node": 4}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-HPCL1-RIPE", "org": "Pro-M Zrt.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.pro-m.hu/"}, "pfx": 36, "reg": "2008-05-08", "rir": "ripencc", "s24": 207, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 53504, "abuse": "abuse@pro-m.hu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00053515640858}, {"a": 47172, "h": "Greenhost", "n": "Greenhost", "t": "Hosting & VPS", "w": 37, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 36, "web_exploit": 37, "bad_crawling": 34, "proxy_or_vpn": 19, "ssh_bruteforce": 23, "web_bruteforce": 37, "mail_bruteforce": 22, "cve:CVE-2017-9841": 9, "cve:CVE-2023-50164": 16, "cve:CVE-2024-28000": 6, "cve:CVE-2024-48914": 5, "cve:CVE-2025-54236": 14}, "n": 37}, "ev": {"crowdsec": {"n": 1, "p": 0.1573, "hi": 4.30, "lo": 0.32, "ips": 37, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.273, 0.011, 0, false], ["2026-10-12", 0.289, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.260, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.289, "se": 1.285, "ts": 1.000, "map": 2.395, "obs": 1, "own": 0.542, "comp": {"cins": -0.1258, "dshield": -0.2909, "crowdsec": 3.6453, "vulncheck": -0.3059, "blocklist_de": -0.6555}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.806, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-MJVS1-RIPE", "org": "Greenhost BV", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://greenhost.net"}, "pfx": 31, "reg": "2008-05-09", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": "abuse@greenhost.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001416162605}, {"a": 47195, "h": "GAMEFORGE-AS", "n": "Gameforge 4D GmbH", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.137, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.155, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-GF78-RIPE", "org": "Gameforge 4D GmbH", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.gameforge.com"}, "pfx": 11, "reg": "2008-05-14", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@as47195.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47196, "h": "Garant-Park-Internet", "n": "Garant-Park-Internet LLC", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.4128, "hi": 6.20, "lo": 0.81, "ips": 4, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.010, 2.839, 0, false], ["2026-10-12", 0.011, 2.893, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 2.893, "se": 1.171, "ts": 1.000, "map": 14.395, "obs": 2, "own": 14.121, "comp": {"urlhaus": -0.2913, "threatfox": -0.2717, "phishing_db": 4.8561}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.679, "det": null, "oid": "ORG-GL395-RIPE", "org": "Garant-Park-Internet LLC", "pdb": null, "pfx": 44, "reg": "2008-05-14", "rir": "ripencc", "s24": 32, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "info@invs.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47215, "h": "FILOO-ASN", "n": "Filoo GmbH", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1435, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.029, "ts": null, "map": 0.188, "obs": 0, "own": 2.125, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.856, "ts": null, "map": 0.175, "obs": 0, "own": 1.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.618, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DIG4-RIPE", "org": "dogado GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.filoo.de/"}, "pfx": 15, "reg": "2008-05-16", "rir": "ripencc", "s24": 67, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "abuse@dogado.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47232, "h": "ISPAlliance", "n": "ISP Alliance", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 590.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 1.684, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 0.801, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.160, "det": null, "oid": "ORG-GSA22-RIPE", "org": "ISP Alliance a.s.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.ispalliance.cz"}, "pfx": 10, "reg": "2008-05-21", "rir": "ripencc", "s24": 39, "sib": 16, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@ispalliance.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009367760282}, {"a": 47242, "h": "HOST-SPA", "n": "Host.it S.p.A.", "t": "Hosting & VPS", "w": 1, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5928, "hi": 7.17, "lo": 1.26, "ips": 3, "mean": 3.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1816, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.277, 0.011, 0, false], ["2026-10-12", 0.310, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.262, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.310, "se": 1.297, "ts": 1.000, "map": 2.618, "obs": 1, "own": 0.597, "comp": {"cins": -0.1337, "dshield": -0.3082, "crowdsec": -1.2198, "vulncheck": -0.3196, "blocklist_de": 4.3375}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.876, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-CES3-RIPE", "org": "Host SpA", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://host.it"}, "pfx": 38, "reg": "2008-05-22", "rir": "ripencc", "s24": 38, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "ripe@host.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004484415005}, {"a": 47253, "h": "AS-BNETSET", "n": "BCI Telecommunication & Advanced Technology Company", "t": "Broadband & mobile", "w": 4, "cc": "PS", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 4, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.172, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 1.500, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.172, "se": 1.226, "ts": 1.000, "map": 1.225, "obs": 1, "own": 2.210, "comp": {"cins": -0.1092, "dshield": -0.2545, "crowdsec": -1.0077, "vulncheck": 3.5376, "blocklist_de": -0.5699}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.252, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-BTAT1-RIPE", "org": "BCI Telecommunication & Advanced Technology Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Restrictive", "web": "http://bnet.ps"}, "pfx": 66, "reg": "2008-05-26", "rir": "ripencc", "s24": 66, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 21504, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049488343405}, {"a": 47264, "h": "LDEX", "n": "LDeX Connect", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1332, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.423, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.166, "obs": 0, "own": 0.541, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.354, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IHL12-RIPE", "org": "Iomart Managed Services Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.ldexconnect.co.uk"}, "pfx": 34, "reg": "2008-05-27", "rir": "ripencc", "s24": 82, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26112, "abuse": "abuse@iomart.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47283, "h": "ZEUS-UA-AS", "n": "ZeusNet", "t": "Broadband & mobile", "w": 2, "cc": "UA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 9.022, 0.011, 0, false], ["2026-10-12", 1.655, 0.012, 0, false]], "sh": false, "uc": 748.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.655, "se": 0.948, "ts": 1.000, "map": 7.238, "obs": 2, "own": 11.637, "comp": {"cins": -0.3339, "dshield": -0.7085, "crowdsec": -2.7944, "vulncheck": -0.5546, "blocklist_de": 7.7645}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.178, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-FKDO1-RIPE", "org": "FOP Koval Dmitro Orestovich", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://zeusnet.ua"}, "pfx": 6, "reg": "2008-05-28", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "abuse@zeus.poltava.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046252192515}, {"a": 47331, "h": "TTNET", "n": "TTNet A.S.", "t": "Broadband & mobile", "w": 2, "cc": "TR", "cf": {"rb": "", "wb": "", "rep": 7.76, "waf": 1.45}, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1301, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "shodan": {"n": 18, "p": 1.0000, "hi": 13.77, "lo": 6.42, "ips": 18, "mean": 9.80, "above": true}, "blocklist_de": {"n": 1, "p": 0.0657, "hi": 3.23, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}}, "h2": [["2026-10-05", 0.200, 0.009, 0, false], ["2026-10-12", 0.230, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.156, "obs": 0, "own": 0.869, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.230, "se": 0.859, "ts": 0.500, "map": 0.843, "obs": 2, "own": 1.345, "comp": {"cins": 4.2357, "dshield": -0.9291, "crowdsec": -3.6572, "vulncheck": -0.6408, "blocklist_de": 2.2142}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 18}, "blocklist_de": {"bots": 1}}, "oid": "ORG-TA300-RIPE", "org": "TTNet A.S.", "pdb": null, "pfx": 31, "reg": "2008-06-03", "rir": "ripencc", "s24": 439, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 112384, "abuse": "abuse@turktelekom.com.tr", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.098262}, {"a": 47377, "h": "Orange_Belgium_SA", "n": "Orange Belgium SA", "t": "Broadband & mobile", "w": 6, "cc": "BE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 4, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"dshield": {"n": 1, "p": 0.0017, "hi": 1.64, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.89, "lo": 0.19, "ips": 4, "mean": 0.48, "above": false}, "blocklist_de": {"n": 2, "p": 0.0001, "hi": 1.32, "lo": 0.17, "ips": 2, "mean": 0.63, "above": false}}, "h2": [["2026-10-05", 0.170, 0.006, 0, false], ["2026-10-12", 0.184, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.744, "ts": null, "map": 0.088, "obs": 0, "own": 0.397, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.184, "se": 0.536, "ts": 0.571, "map": 0.371, "obs": 7, "own": 0.577, "comp": {"cins": -1.2836, "dshield": 0.3718, "crowdsec": 1.5221, "vulncheck": -0.8712, "blocklist_de": 0.6626}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.111, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-MA1-RIPE", "org": "Orange Belgium SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.orange.be"}, "pfx": 86, "reg": "2008-06-10", "rir": "ripencc", "s24": 3506, "sib": 4, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1367296, "abuse": "abuse@orange.be", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04792512079124}, {"a": 47394, "h": "ASC-AL-AS", "n": "Albanian Satellite Communications", "t": "Broadband & mobile", "w": 1, "cc": "AL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1413, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 0.130, 0.010, 0, false], ["2026-10-12", 0.144, 0.011, 0, false]], "sh": false, "uc": 2720.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.984, "ts": null, "map": 0.180, "obs": 0, "own": 1.236, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.144, "se": 1.186, "ts": 1.000, "map": 0.986, "obs": 1, "own": 1.691, "comp": {"cins": -0.1834, "dshield": -0.4138, "crowdsec": -1.6364, "vulncheck": -0.3952, "blocklist_de": 4.0084}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.272, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SCS24-RIPE", "org": "\"Albanian Satellite Communications\" sh.p.k.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.tring.al"}, "pfx": 66, "reg": "2008-06-12", "rir": "ripencc", "s24": 140, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 64512, "abuse": "abuse@corp.tring.al", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013211427275}, {"a": 47402, "h": "MULTIMEDIA-AS", "n": "Multimedia BG EOOD", "t": "Other", "w": 1, "cc": "BG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 1.165, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.165, "se": 0.928, "ts": 0.500, "map": 4.873, "obs": 2, "own": 2.859, "comp": {"cins": -0.3254, "dshield": -0.6928, "crowdsec": 1.4644, "vulncheck": -0.5476, "blocklist_de": 3.0787}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.180, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-MMBG1-RIPE", "org": "Multimedia BG EOOD", "pdb": null, "pfx": 8, "reg": "2008-06-12", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001569544912}, {"a": 47433, "h": "SIBSET-KEM-AS", "n": "Sibirskie Seti Ltd.", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 2.759, 0.011, 0, false], ["2026-10-12", 3.022, 0.012, 0, false]], "sh": false, "uc": 3619.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.805, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.022, "se": 0.983, "ts": 0.500, "map": 14.043, "obs": 2, "own": 8.298, "comp": {"cins": -0.2739, "dshield": -0.5953, "crowdsec": 1.9918, "vulncheck": -0.5007, "blocklist_de": 3.4139}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.488, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CNL7-RIPE", "org": "Sibirskie Seti Ltd.", "pdb": null, "pfx": 4, "reg": "2008-06-19", "rir": "ripencc", "s24": 15, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "abuse@sibset-team.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47438, "h": "PSKOVLINE-AS", "n": "Pskovline", "t": "Broadband & mobile", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.3793, "hi": 5.90, "lo": 0.77, "ips": 6, "mean": 2.81, "above": false}}, "h2": [["2026-10-12", 0.340, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 1.264, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.340, "se": 0.905, "ts": 1.000, "map": 1.302, "obs": 2, "own": 2.182, "comp": {"cins": -0.2211, "dshield": -0.4913, "crowdsec": -1.9412, "vulncheck": 5.457, "blocklist_de": -1.1457}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.545, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-PL55-RIPE", "org": "Pskovline Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.pskovline.ru"}, "pfx": 10, "reg": "2008-06-19", "rir": "ripencc", "s24": 129, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 33024, "abuse": "info@pskovline.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004679803282}, {"a": 47447, "h": "TTM", "n": "23M GmbH", "t": "Hosting & VPS", "w": 7, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "web_bruteforce": 1, "home_connection": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.6326, "hi": 6.90, "lo": 1.48, "ips": 4, "mean": 3.77, "above": false}, "crowdsec": {"n": 2, "p": 0.2076, "hi": 4.48, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}, "threatfox": {"n": 3, "p": 0.6315, "hi": 7.58, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1660, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "phishing_db": {"n": 2, "p": 0.3749, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.889, 3.901, 0, false], ["2026-10-12", 0.754, 3.885, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 2}, "lo": 3.885, "se": 0.892, "ts": 0.600, "map": 10.531, "obs": 5, "own": 3.898, "comp": {"urlhaus": -0.8309, "threatfox": 3.0583, "phishing_db": 1.7532}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.754, "se": 0.757, "ts": 0.667, "map": 2.262, "obs": 3, "own": 0.459, "comp": {"cins": -0.4329, "dshield": -0.8838, "crowdsec": 4.3471, "vulncheck": 1.3925, "blocklist_de": -2.2131}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.913, "det": {"shodan": {"compromised": 3, "doublepulsar": 1}, "threatfox": {"family:Remcos": 1, "family:PureRAT": 1, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-AA446-RIPE", "org": "23M GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://23m.com"}, "pfx": 42, "reg": "2008-06-20", "rir": "ripencc", "s24": 153, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 39168, "abuse": "abuse@23M.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011997896502}, {"a": 47485, "h": "STARNET-AS", "n": "Starnet LTD", "t": "Other", "w": 2, "cc": "LV", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 5.238, 0.011, 0, false], ["2026-10-12", 4.887, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.887, "se": 1.042, "ts": 1.000, "map": 24.402, "obs": 2, "own": 15.278, "comp": {"cins": -0.1312, "dshield": -0.3028, "crowdsec": -1.1987, "vulncheck": 6.9048, "blocklist_de": -0.6838}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-SL813-RIPE", "org": "Starnet LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.starnet.lv"}, "pfx": 1, "reg": "2008-06-25", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "info@starnet.lv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015570609986}, {"a": 47516, "h": "DEHOST", "n": "DEHOST", "t": "Hosting & VPS", "w": 13, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 5, "p": 0.9143, "hi": 10.45, "lo": 2.60, "ips": 13, "mean": 5.96, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 22.988, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 22.988, "se": 0.622, "ts": 1.000, "map": 54.359, "obs": 5, "own": 10.676, "comp": {"cins": -0.6987, "dshield": 15.4285, "crowdsec": -5.0806, "vulncheck": -0.7459, "blocklist_de": -3.5141}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.912, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-DIVB3-RIPE", "org": "DEHOST INTERNET VE BILISIM TEKNOLOJILERI SANAYI TICARET LIMITED SIRKETI", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://dehost.com.tr"}, "pfx": 11, "reg": "2023-09-07", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "info@dehost.com.tr", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00031378424095}, {"a": 47524, "h": "AS-TURKSAT", "n": "TURKSAT", "t": "Broadband & mobile", "w": 5, "cc": "TR", "cf": {"rb": "", "wb": "hi", "rep": 3.13, "waf": 1.15}, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0191, "hi": 2.42, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 1.10, "lo": 0.14, "ips": 2, "mean": 0.52, "above": false}, "phishing_db": {"n": 1, "p": 0.0241, "hi": 2.54, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "blocklist_de": {"n": 1, "p": 0.0016, "hi": 1.63, "lo": 0.12, "ips": 1, "mean": 0.69, "above": false}}, "h2": [["2026-10-05", 0.328, 0.066, 0, false], ["2026-10-12", 0.167, 0.070, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.070, "se": 1.340, "ts": 1.000, "map": 0.409, "obs": 1, "own": 1.314, "comp": {"urlhaus": -0.4377, "threatfox": -0.3395, "phishing_db": 1.5086}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.167, "se": 0.638, "ts": 0.500, "map": 0.405, "obs": 4, "own": 0.633, "comp": {"cins": -0.8171, "dshield": 1.6576, "crowdsec": 0.4458, "vulncheck": -0.7816, "blocklist_de": -0.0153}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.133, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TUHV1-RIPE", "org": "Turksat Uydu Haberlesme Kablo TV ve Isletme A.S.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.turksat.com.tr/"}, "pfx": 796, "reg": "2008-07-02", "rir": "ripencc", "s24": 1783, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 464384, "abuse": "abuse@turksat.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.055865}, {"a": 47544, "h": "IQPL-AS", "n": "IQ PL", "t": "Hosting & VPS", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7375, "hi": 7.99, "lo": 1.72, "ips": 4, "mean": 4.37, "above": false}}, "h2": [["2026-10-05", 0.208, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 0.230, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.076, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-IQPL1-RIPE", "org": "IQ PL Sp. z o.o.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://iq.pl"}, "pfx": 12, "reg": "2008-07-03", "rir": "ripencc", "s24": 68, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "abuse@iq.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009119571396}, {"a": 47583, "h": "AS-HOSTINGER", "n": "Hostinger International", "t": "Hosting & VPS", "w": 170, "cc": "CY", "cf": {"rb": "hi", "wb": "", "rep": 0.84, "waf": 2.37}, "cs": {"c": {"http_flood": 15, "data_centre": 14, "web_exploit": 19, "bad_crawling": 4, "proxy_or_vpn": 2, "first_seen_30d": 4, "ssh_bruteforce": 4, "web_bruteforce": 9, "mail_bruteforce": 1, "cve:CVE-2026-4020": 4, "cve:CVE-2021-43798": 1, "cve:CVE-2025-55182": 5, "cve:CVE-2026-60137": 8, "cve:CVE-2026-63030": 5}, "n": 22}, "ev": {"cins": {"n": 2, "p": 0.0040, "hi": 1.98, "lo": 0.26, "ips": 2, "mean": 0.94, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.76, "lo": 0.16, "ips": 4, "mean": 0.42, "above": false}, "dshield": {"n": 3, "p": 0.0038, "hi": 2.05, "lo": 0.36, "ips": 3, "mean": 1.06, "above": false}, "crowdsec": {"n": 22, "p": 0.0002, "hi": 2.13, "lo": 1.07, "ips": 22, "mean": 1.56, "above": false}, "threatfox": {"n": 1, "p": 0.0295, "hi": 2.65, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "vulncheck": {"n": 53, "p": 1.0000, "hi": 17.97, "lo": 11.47, "ips": 53, "mean": 14.57, "above": true}, "phishing_db": {"n": 51, "p": 1.0000, "hi": 18.29, "lo": 11.57, "ips": 64, "mean": 14.77, "above": true}, "blocklist_de": {"n": 25, "p": 0.9052, "hi": 5.35, "lo": 2.79, "ips": 25, "mean": 3.98, "above": true}}, "h2": [["2026-10-05", 1.142, 1.923, 0, false], ["2026-10-12", 1.592, 1.907, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 51}, "lo": 1.907, "se": 0.785, "ts": 0.981, "map": 3.917, "obs": 52, "own": 1.517, "comp": {"urlhaus": -2.6175, "threatfox": -0.4577, "phishing_db": 6.0666}, "mass": 28.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 22, "vulncheck": 53, "blocklist_de": 25}, "lo": 1.592, "se": 0.376, "ts": 0.505, "map": 2.461, "obs": 105, "own": 0.483, "comp": {"cins": -1.4432, "dshield": -2.1032, "crowdsec": -4.1593, "vulncheck": 3.6617, "blocklist_de": 6.3383}, "mass": 70.3, "listed": false}}, "abq": false, "bot": 0.626, "det": {"shodan": {"c2": 1, "compromised": 3}, "threatfox": {"family:Remcos": 1}, "vulncheck": {"c2_server": 32, "botnet_node": 7, "attack_tooling": 11, "other_infrastructure": 3}, "blocklist_de": {"ftp": 22, "ssh": 1, "mail": 1, "apache": 1}}, "oid": "ORG-ARTA1-RIPE", "org": "Hostinger International Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.hostinger.com/"}, "pfx": 3758, "reg": "2011-04-04", "rir": "ripencc", "s24": 5160, "sib": 1, "tor": 0, "w24": 156, "drop": 0, "hist": [["2026-10-05", 0.8443], ["2026-10-12", 0.8651]], "ipv4": 2034944, "abuse": "abuse@hostinger.com", "score": 0.8651, "groups": ["vulncheck", "phishing"], "sensors": ["blocklist_de"], "traffic": 0.086861}, {"a": 47585, "h": "YIGITHOSTING", "n": "YIGITHOSTING", "t": "Hosting & VPS", "w": 5, "cc": "TR", "cf": null, "cs": {"c": {"data_centre": 3, "ssh_bruteforce": 5}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 27.480, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.923, "det": {"blocklist_de": {"ssh": 5}}, "oid": "ORG-YHBE2-RIPE", "org": "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi", "pdb": null, "pfx": 1, "reg": "2023-09-04", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@yigithosting.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47586, "h": "Business-Svyaz", "n": "Dmitriy V. Kozmenko", "t": "Transit & backbone", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.190, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 2.215, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.190, "se": 1.239, "ts": 1.000, "map": 1.386, "obs": 1, "own": 5.103, "comp": {"cins": -0.1049, "dshield": -0.245, "crowdsec": -0.9701, "vulncheck": 3.5876, "blocklist_de": -0.5478}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-DVK2-RIPE", "org": "Dmitriy V. Kozmenko", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://bisv.ru"}, "pfx": 13, "reg": "2008-07-17", "rir": "ripencc", "s24": 56, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": "abuse@bisv.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090695599995}, {"a": 47588, "h": "TELCOMMUNICATIONS-AS", "n": "TEL COMMUNICATIONS L.L.C.", "t": "Other", "w": 0, "cc": "AL", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 4.35}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.383, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.985, "det": null, "oid": "ORG-TCL76-RIPE", "org": "TEL COMMUNICATIONS L.L.C.", "pdb": null, "pfx": 16, "reg": "2008-07-17", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@telcommunications.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00688111840142}, {"a": 47589, "h": "KTC3G", "n": "STC Kuwait", "t": "Broadband & mobile", "w": 4, "cc": "KW", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0008, "hi": 1.50, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}, "blocklist_de": {"n": 4, "p": 0.3401, "hi": 4.89, "lo": 1.05, "ips": 4, "mean": 2.67, "above": false}}, "h2": [["2026-10-12", 0.557, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.853, "ts": null, "map": 0.137, "obs": 0, "own": 0.700, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.557, "se": 0.598, "ts": 0.800, "map": 1.259, "obs": 5, "own": 1.956, "comp": {"cins": -1.0766, "dshield": -1.7637, "crowdsec": -4.2721, "vulncheck": -0.8388, "blocklist_de": 9.5755}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.094, "det": {"blocklist_de": {"ssh": 1, "bots": 3}}, "oid": "ORG-KTCA1-RIPE", "org": "Kuwait Telecommunications Company K.S.C.C.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.stc.com.kw"}, "pfx": 284, "reg": "2008-07-17", "rir": "ripencc", "s24": 813, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 521216, "abuse": "abuse@viva.com.kw", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02309476513419}, {"a": 47616, "h": "CERTH", "n": "Center for Research and Technology Hellas (CERTH)", "t": "Other", "w": 0, "cc": "GR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0544, "hi": 3.07, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.680, "ts": null, "map": 0.110, "obs": 0, "own": 0.101, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.365, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CA930-RIPE", "org": "Center for Research and Technology Hellas (CERTH)", "pdb": null, "pfx": 1, "reg": "2008-07-23", "rir": "ripencc", "s24": 256, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": "abuse@certh.gr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000444594204}, {"a": 47648, "h": "NOREST-SERVICES", "n": "NOREST SERVICES", "t": "Broadband & mobile", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 1.372, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.244, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NSS32-RIPE", "org": "NOREST SERVICES SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.norest-telecom.fr"}, "pfx": 4, "reg": "2018-01-05", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@norest-telecom.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47674, "h": "NETSOLUTIONS", "n": "Net Solutions Macau", "t": "Transit & backbone", "w": 20, "cc": "MO", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3636, "hi": 5.76, "lo": 0.75, "ips": 3, "mean": 2.74, "above": false}, "phishing_db": {"n": 6, "p": 0.9638, "hi": 11.64, "lo": 3.23, "ips": 17, "mean": 6.88, "above": true}}, "h2": [["2026-10-05", 8.500, 18.773, 1, false], ["2026-10-12", 1.484, 18.783, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 6}, "lo": 18.783, "se": 0.825, "ts": 1.000, "map": 47.795, "obs": 6, "own": 150.591, "comp": {"urlhaus": -0.8542, "threatfox": -0.448, "phishing_db": 6.7954}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.484, "se": 0.940, "ts": 1.000, "map": 6.345, "obs": 2, "own": 20.659, "comp": {"cins": -0.2878, "dshield": -0.622, "crowdsec": 6.1498, "vulncheck": -0.5141, "blocklist_de": -1.4847}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.821, "det": null, "oid": "ORG-NSCL3-RIPE", "org": "Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Tbps", "pol": "Open", "web": "https://blazingfast.io"}, "pfx": 35, "reg": "2019-05-28", "rir": "ripencc", "s24": 35, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 8960, "abuse": "abuse@netsolutions.asia", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.0000130470656}, {"a": 47692, "h": "NESSUS", "n": "Nessus GmbH", "t": "Hosting & VPS", "w": 1, "cc": "AT", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1694, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.008, 0.246, 0, false], ["2026-10-12", 0.008, 0.258, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.258, "se": 1.439, "ts": 1.000, "map": 2.053, "obs": 1, "own": 0.926, "comp": {"urlhaus": -0.1957, "threatfox": -0.2103, "phishing_db": 2.7514}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.754, "ts": null, "map": 0.138, "obs": 0, "own": 0.050, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-NIDG1-RIPE", "org": "Nessus GmbH", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.nessus.at"}, "pfx": 79, "reg": "2008-08-01", "rir": "ripencc", "s24": 146, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 40704, "abuse": "abuse@nessus.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00186149813408}, {"a": 47720, "h": "CIX-AS", "n": "Cork Internet Exchange", "t": "Transit & backbone", "w": 0, "cc": "IE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 2.172, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.179, "obs": 0, "own": 1.290, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.523, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-CL59-RIPE", "org": "Cork Internet Exchange Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.cloudcix.com"}, "pfx": 13, "reg": "2008-08-07", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": "noc@cix.ie", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011337233337}, {"a": 47735, "h": "NOWIRE-AS", "n": "NOWIRE s.r.l.", "t": "Other", "w": 6, "cc": "IT", "cf": null, "cs": {"c": {"web_bruteforce": 6, "mail_bruteforce": 5, "router_or_botnet": 5}, "n": 6}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 6, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": 100390.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.476, "det": null, "oid": "ORG-NS345-RIPE", "org": "NOWIRE s.r.l.", "pdb": null, "pfx": 3, "reg": "2008-08-12", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47764, "h": "VK-AS", "n": "Mail.Ru Group", "t": "Hosting & VPS", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.2104, "hi": 4.15, "lo": 0.89, "ips": 4, "mean": 2.27, "above": false}, "vulncheck": {"n": 1, "p": 0.1000, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 0.005, 0.120, 0, false], ["2026-10-12", 0.042, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.882, "ts": null, "map": 0.149, "obs": 0, "own": 0.123, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.042, "se": 1.083, "ts": 1.000, "map": 0.228, "obs": 1, "own": 0.050, "comp": {"cins": -0.1715, "dshield": -0.3891, "crowdsec": -1.5389, "vulncheck": 2.906, "blocklist_de": -0.8915}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.701, "det": {"shodan": {"malware": 1, "compromised": 3}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-LLCN4-RIPE", "org": "LLC VK", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Tbps", "pol": "Open", "web": "https://vk.company/en/"}, "pfx": 99, "reg": "2008-08-15", "rir": "ripencc", "s24": 565, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 151808, "abuse": "abuse@corp.mail.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00107798426505}, {"a": 47810, "h": "Proservice", "n": "Proservice LLC", "t": "Other", "w": 4, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2020-5902": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6312, "hi": 7.57, "lo": 1.33, "ips": 4, "mean": 3.91, "above": false}}, "h2": [["2026-10-05", 27.650, 0.011, 1, false], ["2026-10-12", 10.607, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.607, "se": 0.800, "ts": 1.000, "map": 34.864, "obs": 3, "own": 19.974, "comp": {"cins": -0.3961, "dshield": -0.8202, "crowdsec": 8.7921, "vulncheck": -0.601, "blocklist_de": -2.0297}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.625, "det": null, "oid": "ORG-PL315-RIPE", "org": "Proservice LLC", "pdb": null, "pfx": 6, "reg": "2008-08-25", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "abuse@proservice.ge", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016471593216}, {"a": 47881, "h": "MNNEWS-AS", "n": "One Crna Gora DOO", "t": "Other", "w": 1, "cc": "ME", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": 1660.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 3.051, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.232, "det": null, "oid": "ORG-PG25-RIPE", "org": "One Crna Gora DOO", "pdb": null, "pfx": 1, "reg": "2008-09-10", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011582264974}, {"a": 47890, "h": "UNMANAGED-DEDICATED-SERVERS", "n": "UNMANAGED LTD", "t": "Hosting & VPS", "w": 137, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 43, "data_centre": 38, "web_exploit": 53, "bad_crawling": 26, "proxy_or_vpn": 3, "ssh_bruteforce": 65, "web_bruteforce": 46, "home_connection": 2, "mail_bruteforce": 49, "cve:CVE-2017-9841": 9, "cve:CVE-2024-4577": 6, "cve:CVE-2024-6387": 18, "cve:CVE-2017-16894": 7, "cve:CVE-2019-17050": 7}, "n": 126}, "ev": {"cins": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 2, "p": 0.3910, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "dshield": {"n": 6, "p": 0.9646, "hi": 11.70, "lo": 3.25, "ips": 21, "mean": 6.91, "above": true}, "urlhaus": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}, "crowdsec": {"n": 7, "p": 0.9836, "hi": 12.39, "lo": 3.75, "ips": 126, "mean": 7.54, "above": true}, "threatfox": {"n": 2, "p": 0.4208, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1942, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 6, "p": 0.9626, "hi": 11.56, "lo": 3.21, "ips": 42, "mean": 6.83, "above": true}}, "h2": [["2026-10-05", 62.253, 79.691, 1, false], ["2026-10-12", 84.227, 56.894, 1, false]], "sh": true, "uc": 25730.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 2, "phishing_db": 1}, "lo": 56.894, "se": 0.840, "ts": 0.500, "map": 157.212, "obs": 6, "own": 51.310, "comp": {"urlhaus": 6.3357, "threatfox": 0.6942, "phishing_db": -0.3462}, "mass": 4.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 6}, "lo": 84.227, "se": 0.416, "ts": 0.350, "map": 140.212, "obs": 20, "own": 27.241, "comp": {"cins": 0.3838, "dshield": 5.0605, "crowdsec": -1.6255, "vulncheck": -0.9525, "blocklist_de": 3.4706}, "mass": 17.7, "listed": false}}, "abq": false, "bot": 0.959, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:AdaptixC2": 2}, "blocklist_de": {"sip": 2, "ssh": 21, "bots": 1, "imap": 5, "mail": 15, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-UMNG1-RIPE", "org": "UNMANAGED LTD", "pdb": null, "pfx": 23, "reg": "2020-07-27", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 1, "w24": 7, "drop": 7, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.0719]], "ipv4": 5888, "abuse": "abuse@unmanaged.uk", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.00118848722823}, {"a": 47895, "h": "R-LINE-AS", "n": "Erline", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 1.255, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.255, "se": 0.952, "ts": 0.500, "map": 5.389, "obs": 2, "own": 8.908, "comp": {"cins": -0.2267, "dshield": 3.9981, "crowdsec": -1.9854, "vulncheck": 2.4663, "blocklist_de": -1.1743}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-LA640-RIPE", "org": "LTD \"Erline\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://r-line.ru"}, "pfx": 10, "reg": "2008-09-11", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00133284715795}, {"a": 47909, "h": "BAIKAL-AS", "n": "Baikal-Telecom Ltd.", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.479, 0.011, 0, false], ["2026-10-12", 3.050, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.050, "se": 1.002, "ts": 0.500, "map": 14.304, "obs": 2, "own": 23.852, "comp": {"cins": -0.1897, "dshield": -0.427, "crowdsec": 2.905, "vulncheck": 2.7508, "blocklist_de": -0.9848}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-BTL58-RIPE", "org": "BAIKAL TELECOM LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://baikal-telecom.ru"}, "pfx": 12, "reg": "2008-09-15", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@baikal-telecom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 47913, "h": "MIS-AS", "n": "Moshonkin Ilia Sergeevich", "t": "Other", "w": 6, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2022-39290": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5621, "hi": 6.88, "lo": 1.21, "ips": 3, "mean": 3.55, "above": false}, "phishing_db": {"n": 2, "p": 0.4076, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 7.184, 2.165, 0, false], ["2026-10-12", 4.380, 2.209, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 2.209, "se": 1.161, "ts": 1.000, "map": 10.627, "obs": 2, "own": 10.565, "comp": {"urlhaus": -0.3194, "threatfox": -0.2868, "phishing_db": 4.5957}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.380, "se": 0.672, "ts": 0.750, "map": 11.438, "obs": 4, "own": 6.503, "comp": {"cins": -0.6499, "dshield": -1.2251, "crowdsec": 5.4183, "vulncheck": -0.7286, "blocklist_de": 1.0158}, "mass": 3.1, "listed": false}}, "abq": true, "bot": 0.972, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-MIS58-RIPE", "org": "Moshonkin Ilia Sergeevich", "pdb": null, "pfx": 16, "reg": "2023-07-31", "rir": "ripencc", "s24": 48, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00122943653525}, {"a": 47949, "h": "GSNETCZ", "n": "gsnet.cz", "t": "Broadband & mobile", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.012, 0.887, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.887, "se": 1.784, "ts": 1.000, "map": 12.743, "obs": 1, "own": 50.146, "comp": {"urlhaus": 4.4321, "threatfox": -0.0933, "phishing_db": -0.1677}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.401, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NOLS1-RIPE", "org": "gsnet.cz s.r.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.gsnet.cz"}, "pfx": 1, "reg": "2008-09-19", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "info@net-online.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000655082546}, {"a": 47987, "h": "DELTAHOST-KYIV", "n": "Zemlyaniy Dmitro Leonidovich", "t": "Hosting & VPS", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1561, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 0.247, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.188, "obs": 0, "own": 0.090, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.632, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FZDL2-RIPE", "org": "Zemlyaniy Dmitro Leonidovich", "pdb": null, "pfx": 11, "reg": "2023-10-16", "rir": "ripencc", "s24": 50, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": "abuse@deltahost.com.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48011, "h": "DigiTurunc", "n": "DigiTurunc", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1656, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "dshield": {"n": 1, "p": 0.1901, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.294, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.262, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.294, "se": 1.287, "ts": 1.000, "map": 2.449, "obs": 1, "own": 0.555, "comp": {"cins": -0.1253, "dshield": 4.5208, "crowdsec": -1.1477, "vulncheck": -0.3051, "blocklist_de": -0.6532}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.227, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TSBV1-RIPE", "org": "Turunc Smart Bilgisayar Teknoloji Ve Dis Ticaret Limited Sirketi", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.digiturunc.com"}, "pfx": 38, "reg": "2018-04-12", "rir": "ripencc", "s24": 38, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "abuse@digiturunc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00134033325837}, {"a": 48014, "h": "AlbHost", "n": "Albanian Hosting SH.P.K.", "t": "Hosting & VPS", "w": 1, "cc": "AL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1957, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.443, 0.575, 0, false], ["2026-10-12", 0.011, 0.597, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.597, "se": 1.612, "ts": 1.000, "map": 6.960, "obs": 1, "own": 3.305, "comp": {"urlhaus": -0.0756, "threatfox": -0.1005, "phishing_db": 3.7425}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.552, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AHS27-RIPE", "org": "Albanian Hosting SH.P.K.", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.albahost.net"}, "pfx": 16, "reg": "2023-07-28", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@albahost.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009007147394}, {"a": 48031, "h": "XServerCloud", "n": "Ivanov Vitaliy Sergeevich", "t": "Hosting & VPS", "w": 7, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0095, "hi": 2.12, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "phishing_db": {"n": 2, "p": 0.2616, "hi": 4.91, "lo": 0.64, "ips": 6, "mean": 2.34, "above": false}, "blocklist_de": {"n": 1, "p": 0.0456, "hi": 2.93, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}}, "h2": [["2026-10-05", 0.052, 0.380, 0, false], ["2026-10-12", 0.057, 0.393, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.393, "se": 1.135, "ts": 1.000, "map": 1.622, "obs": 2, "own": 0.692, "comp": {"urlhaus": -0.5413, "threatfox": -0.3752, "phishing_db": 3.0265}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.057, "se": 1.088, "ts": 1.000, "map": 0.321, "obs": 1, "own": 0.068, "comp": {"cins": -0.2429, "dshield": -0.5347, "crowdsec": -2.1121, "vulncheck": -0.4684, "blocklist_de": 3.6167}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.821, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-IVS6-RIPE", "org": "Ivanov Vitaliy Sergeevich", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://xserver.cloud"}, "pfx": 562, "reg": "2008-10-02", "rir": "ripencc", "s24": 577, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 147712, "abuse": "abuse@xserver.cloud", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00259782630893}, {"a": 48040, "h": "FORNEX-SE-AS", "n": "Fornex Hosting - Sweden", "t": "Hosting & VPS", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.288, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 0.132, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.607, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FHS3-RIPE", "org": "Fornex Hosting S.L.", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://fornex.com"}, "pfx": 23, "reg": "2016-03-11", "rir": "ripencc", "s24": 23, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@fornex.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005973196094}, {"a": 48078, "h": "DAGOMYS-AS", "n": "Dagomys Telecom", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 1, "p": 0.1957, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 2.282, 0.011, 0, false], ["2026-10-12", 5.545, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 5.545, "se": 0.802, "ts": 0.333, "map": 18.150, "obs": 3, "own": 28.985, "comp": {"cins": -0.3478, "dshield": 3.4292, "crowdsec": 1.2424, "vulncheck": 1.7558, "blocklist_de": -1.7874}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-DTL25-RIPE", "org": "Dagomys Telecom LLC", "pdb": null, "pfx": 18, "reg": "2008-10-09", "rir": "ripencc", "s24": 15, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": "abuse@dtel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075059801355}, {"a": 48090, "h": "DMZHOST", "n": "TECHOFF SRV LIMITED", "t": "Hosting & VPS", "w": 155, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 1.80, "waf": 15.28}, "cs": {"c": {"http_flood": 117, "data_centre": 8, "web_exploit": 115, "bad_crawling": 111, "proxy_or_vpn": 1, "ssh_bruteforce": 95, "web_bruteforce": 121, "home_connection": 22, "mail_bruteforce": 18, "cve:CVE-2017-9841": 52, "cve:CVE-2021-3129": 27, "cve:CVE-2018-20062": 29, "cve:CVE-2019-11510": 21, "cve:CVE-2022-22947": 15}, "n": 150}, "ev": {"shodan": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "dshield": {"n": 3, "p": 0.6461, "hi": 7.74, "lo": 1.36, "ips": 17, "mean": 3.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 3, "p": 0.6419, "hi": 7.69, "lo": 1.36, "ips": 150, "mean": 3.97, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 3, "p": 0.6462, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}, "blocklist_de": {"n": 3, "p": 0.6451, "hi": 7.73, "lo": 1.36, "ips": 63, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 171.588, 15.370, 1, false], ["2026-10-12", 242.439, 15.610, 1, false]], "sh": true, "uc": 107291.7, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 15.610, "se": 1.330, "ts": 0.500, "map": 109.458, "obs": 2, "own": 41.999, "comp": {"urlhaus": 4.0825, "threatfox": 2.6536, "phishing_db": -0.4145}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 3}, "lo": 242.439, "se": 0.480, "ts": 0.250, "map": 452.447, "obs": 12, "own": 88.172, "comp": {"cins": -1.3235, "dshield": 4.8648, "crowdsec": -1.0992, "vulncheck": 1.288, "blocklist_de": 3.7782}, "mass": 7.5, "listed": false}}, "abq": true, "bot": 0.752, "det": {"shodan": {"c2": 2}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 2, "attack_tooling": 1}, "blocklist_de": {"ftp": 1, "sip": 1, "ssh": 15, "bots": 5, "imap": 1, "mail": 1, "apache": 40, "bruteforcelogin": 32}}, "oid": "ORG-TSL73-RIPE", "org": "TECHOFF SRV LIMITED", "pdb": null, "pfx": 3, "reg": "2019-09-05", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 3, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.130678}, {"a": 48096, "h": "ITGRAD", "n": "Enterprise Cloud Ltd.", "t": "Hosting & VPS", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "shodan": {"n": 1, "p": 0.1123, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "crowdsec": {"n": 3, "p": 0.4483, "hi": 5.93, "lo": 1.04, "ips": 3, "mean": 3.06, "above": false}, "blocklist_de": {"n": 1, "p": 0.1499, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 1.877, 0.011, 0, false], ["2026-10-12", 2.988, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 0.201, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.988, "se": 0.610, "ts": 0.600, "map": 6.882, "obs": 5, "own": 1.361, "comp": {"cins": 3.3095, "dshield": -1.5423, "crowdsec": 2.792, "vulncheck": -0.7993, "blocklist_de": -0.4372}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.738, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"sip": 1}}, "oid": "ORG-ECL28-RIPE", "org": "Enterprise Cloud Ltd.", "pdb": null, "pfx": 126, "reg": "2008-10-13", "rir": "ripencc", "s24": 116, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42240, "abuse": "abuse@mws.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004558590526}, {"a": 48147, "h": "AminIDC", "n": "Amin IDC", "t": "Hosting & VPS", "w": 2, "cc": "IR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1926, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 2, "p": 0.3749, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1830, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 1.716, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.716, "se": 0.951, "ts": 0.500, "map": 7.526, "obs": 2, "own": 1.545, "comp": {"cins": 4.5015, "dshield": -0.7148, "crowdsec": -2.8188, "vulncheck": -0.5574, "blocklist_de": 3.0015}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.726, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"mail": 1}}, "oid": "ORG-APEA3-RIPE", "org": "Asre Pardazeshe Ettelaate Amin Institute", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Restrictive", "web": "https://www.aminidc.com"}, "pfx": 35, "reg": "2016-03-09", "rir": "ripencc", "s24": 35, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@aminidc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008670910245}, {"a": 48149, "h": "ITKM-AS", "n": "Ivanteevskie telecommunicacii Ltd", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "vulncheck": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.154, 0.011, 0, false], ["2026-10-12", 0.917, 0.012, 0, false]], "sh": false, "uc": 1155.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.917, "se": 0.936, "ts": 0.500, "map": 3.804, "obs": 2, "own": 6.273, "comp": {"cins": -0.2394, "dshield": -0.5278, "crowdsec": 2.3581, "vulncheck": 2.3777, "blocklist_de": -1.2388}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.452, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ITL37-RIPE", "org": "Ivanteevskie telecommunicacii Ltd", "pdb": null, "pfx": 5, "reg": "2008-10-20", "rir": "ripencc", "s24": 48, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "abuse@itkm.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48161, "h": "NG-AS", "n": "NextGen Communications SRL", "t": "Broadband & mobile", "w": 2, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0006, "hi": 1.59, "lo": 0.21, "ips": 2, "mean": 0.76, "above": false}}, "h2": [["2026-10-05", 0.247, 0.008, 0, false], ["2026-10-12", 0.091, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.829, "ts": null, "map": 0.127, "obs": 0, "own": 0.624, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.091, "se": 0.824, "ts": 1.000, "map": 0.311, "obs": 2, "own": 0.494, "comp": {"cins": -0.4313, "dshield": -0.8811, "crowdsec": 4.3656, "vulncheck": -0.6238, "blocklist_de": -2.2053}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NCS10-RIPE", "org": "NEXTGEN COMMUNICATIONS SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://www.next-gen.ro/"}, "pfx": 371, "reg": "2008-10-21", "rir": "ripencc", "s24": 1110, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 300800, "abuse": "abuse@next-gen.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00199330658082}, {"a": 48176, "h": "OOOSET-AS", "n": "OOO SET", "t": "Transit & backbone", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1688, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1696, "hi": 4.43, "lo": 0.33, "ips": 5, "mean": 1.87, "above": false}}, "h2": [["2026-10-12", 0.407, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 1.775, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.407, "se": 0.900, "ts": 0.500, "map": 1.571, "obs": 2, "own": 5.234, "comp": {"cins": -0.2756, "dshield": 3.7618, "crowdsec": -2.3632, "vulncheck": 2.1449, "blocklist_de": -1.4228}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.453, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.zelenaya.net"}, "pfx": 32, "reg": "2008-10-22", "rir": "ripencc", "s24": 135, "sib": 95, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 40960, "abuse": "abuse@mtu.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007976007116}, {"a": 48190, "h": "T2-EKATERINBURG-AS", "n": "T2 Ekaterinburg", "t": "Other", "w": 5, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 5, "p": 0.8951, "hi": 9.87, "lo": 2.45, "ips": 5, "mean": 5.63, "above": true}}, "h2": [["2026-10-12", 2.520, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.993, "ts": null, "map": 0.182, "obs": 0, "own": 0.519, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.520, "se": 0.605, "ts": 1.000, "map": 5.794, "obs": 5, "own": 3.283, "comp": {"cins": -0.7978, "dshield": 14.3138, "crowdsec": -5.6013, "vulncheck": -0.7763, "blocklist_de": -3.9879}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.384, "det": null, "oid": "ORG-MCC1-RIPE", "org": "T2 Mobile LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://ekt.t2.ru/"}, "pfx": 5, "reg": "2008-10-23", "rir": "ripencc", "s24": 121, "sib": 8, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 30976, "abuse": "abuse_ripe@t2.ru", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.0043195143607}, {"a": 48198, "h": "AVTOTRANS-EURO-AS", "n": "AVTOTRANS-EURO LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.997, "det": null, "oid": "ORG-AL748-RIPE", "org": "AVTOTRANS-EURO LLC", "pdb": null, "pfx": 2, "reg": "2017-08-15", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000685208433}, {"a": 48207, "h": "GLBBULUTTEKNOLOJISI-AS", "n": "GLB Bulut Teknolojisi Limited Sirketi", "t": "Other", "w": 5, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2}, "n": 4}, "ev": {"shodan": {"n": 5, "p": 0.8843, "hi": 9.59, "lo": 2.38, "ips": 5, "mean": 5.47, "above": true}, "crowdsec": {"n": 3, "p": 0.5674, "hi": 6.93, "lo": 1.22, "ips": 4, "mean": 3.57, "above": false}, "vulncheck": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 2, "p": 0.3916, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}}, "h2": [["2026-10-05", 3.677, 0.011, 0, false], ["2026-10-12", 7.983, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 0.659, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 2}, "lo": 7.983, "se": 0.587, "ts": 0.500, "map": 17.681, "obs": 6, "own": 10.032, "comp": {"cins": -0.8841, "dshield": -1.5393, "crowdsec": 2.8162, "vulncheck": 0.3229, "blocklist_de": 3.5505}, "mass": 4.4, "listed": false}}, "abq": true, "bot": 0.507, "det": {"shodan": {"malware": 1, "compromised": 4}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-GBTL1-RIPE", "org": "GLB Bulut Teknolojisi Limited Sirketi", "pdb": null, "pfx": 45, "reg": "2023-07-21", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 11520, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00024705969041}, {"a": 48219, "h": "ThreeData-AS", "n": "3DATA LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3896, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.371, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.719, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-LA705-RIPE", "org": "3DATA LLC", "pdb": null, "pfx": 24, "reg": "2014-12-11", "rir": "ripencc", "s24": 24, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "admin@ith.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48254, "h": "TWENTYI", "n": "20i", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.6128, "hi": 7.38, "lo": 1.30, "ips": 3, "mean": 3.80, "above": false}, "crowdsec": {"n": 2, "p": 0.3817, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}, "phishing_db": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 1.869, 0.506, 0, false], ["2026-10-12", 1.975, 0.528, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.528, "se": 1.574, "ts": 1.000, "map": 5.708, "obs": 1, "own": 2.644, "comp": {"urlhaus": -0.0925, "threatfox": -0.119, "phishing_db": 3.5795}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.975, "se": 0.956, "ts": 1.000, "map": 8.756, "obs": 2, "own": 1.792, "comp": {"cins": -0.2733, "dshield": -0.5942, "crowdsec": 6.3421, "vulncheck": -0.5001, "blocklist_de": -1.4111}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.988, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-LA982-RIPE", "org": "20i Limited", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.20i.com/"}, "pfx": 24, "reg": "2018-09-20", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@20i.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00070047384822}, {"a": 48275, "h": "TSMS-ABKHAZIA-AS", "n": "Republican Unitary Enterprise \"Abkhazsvyaz\"", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 10156.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.404, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TSOT1-RIPE", "org": "Republican Unitary Enterprise \"Abkhazsvyaz\"", "pdb": null, "pfx": 4, "reg": "2008-10-31", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002482389936}, {"a": 48282, "h": "VDSINA-AS", "n": "Hosting technology LTD", "t": "Hosting & VPS", "w": 37, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 11, "data_centre": 19, "web_exploit": 17, "bad_crawling": 9, "proxy_or_vpn": 15, "web_bruteforce": 15, "router_or_botnet": 1, "cve:CVE-2025-4396": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2022-39290": 2, "cve:CVE-2024-28000": 2, "cve:CVE-2026-21859": 1}, "n": 19}, "ev": {"shodan": {"n": 1, "p": 0.0857, "hi": 3.49, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "crowdsec": {"n": 18, "p": 1.0000, "hi": 18.42, "lo": 8.59, "ips": 19, "mean": 13.11, "above": true}, "threatfox": {"n": 3, "p": 0.6298, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}, "vulncheck": {"n": 6, "p": 0.9513, "hi": 10.88, "lo": 3.02, "ips": 6, "mean": 6.43, "above": true}, "phishing_db": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 14, "p": 1.0000, "hi": 18.53, "lo": 7.83, "ips": 17, "mean": 12.70, "above": true}}, "h2": [["2026-10-05", 24.907, 4.356, 1, false], ["2026-10-12", 22.790, 2.591, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 1}, "lo": 2.591, "se": 0.940, "ts": 0.750, "map": 7.700, "obs": 4, "own": 2.917, "comp": {"urlhaus": -0.7062, "threatfox": 3.6705, "phishing_db": 0.7032}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 18, "vulncheck": 6, "blocklist_de": 14}, "lo": 22.790, "se": 0.389, "ts": 0.474, "map": 35.402, "obs": 38, "own": 6.894, "comp": {"cins": -2.9041, "dshield": -3.0482, "crowdsec": 2.0119, "vulncheck": 0.1182, "blocklist_de": 8.7827}, "mass": 32.9, "listed": false}}, "abq": false, "bot": 0.930, "det": {"shodan": {"c2": 1}, "threatfox": {"family:BianLian": 1, "family:AdaptixC2": 2}, "vulncheck": {"c2_server": 4, "botnet_node": 2}, "blocklist_de": {"bots": 17}}, "oid": "ORG-HTL17-RIPE", "org": "Hosting technology LTD", "pdb": null, "pfx": 169, "reg": "2008-11-03", "rir": "ripencc", "s24": 169, "sib": 1, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.8493]], "ipv4": 43264, "abuse": "abuse@vdsina.ru", "score": 0.8493, "groups": ["sensors", "vulncheck"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00263481486345}, {"a": 48287, "h": "RU-CENTER", "n": "RU-CENTER AS48287", "t": "Hosting & VPS", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1163, "hi": 3.85, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}, "urlhaus": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 3, "p": 0.6115, "hi": 7.36, "lo": 1.30, "ips": 3, "mean": 3.80, "above": false}}, "h2": [["2026-10-05", 0.152, 5.380, 0, false], ["2026-10-12", 0.009, 5.530, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 3}, "lo": 5.530, "se": 0.949, "ts": 0.750, "map": 17.305, "obs": 4, "own": 6.343, "comp": {"urlhaus": 2.3365, "threatfox": -0.4609, "phishing_db": 2.6016}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.793, "ts": null, "map": 0.152, "obs": 0, "own": 0.059, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"c2": 1}}, "oid": "ORG-JR15-RIPE", "org": "JSC \"RU-CENTER\"", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Selective", "web": "https://www.nic.ru/"}, "pfx": 40, "reg": "2008-11-04", "rir": "ripencc", "s24": 109, "sib": 10, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39168, "abuse": "abuse@nic.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48293, "h": "UNIONTEL-RU-AS", "n": "Uniontel", "t": "Transit & backbone", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 2.668, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.324, "se": 1.319, "ts": 1.000, "map": 2.743, "obs": 1, "own": 10.442, "comp": {"cins": -0.0821, "dshield": -0.1935, "crowdsec": -0.7665, "vulncheck": 3.8738, "blocklist_de": -0.4289}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-UZ2-RIPE", "org": "Uniontel Ltd", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.iflat.ru"}, "pfx": 5, "reg": "2008-11-05", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "ripe@union-tel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48314, "h": "IP-PROJECTS", "n": "IP-Projects GmbH & Co. KG", "t": "Transit & backbone", "w": 7, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 2}, "n": 3}, "ev": {"shodan": {"n": 7, "p": 0.9558, "hi": 10.17, "lo": 3.08, "ips": 7, "mean": 6.19, "above": true}, "urlhaus": {"n": 2, "p": 0.4147, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "crowdsec": {"n": 2, "p": 0.2249, "hi": 4.62, "lo": 0.60, "ips": 3, "mean": 2.20, "above": false}, "vulncheck": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "phishing_db": {"n": 1, "p": 0.1711, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 2.226, 1.546, 0, false], ["2026-10-12", 0.833, 4.652, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 1}, "lo": 4.652, "se": 1.024, "ts": 0.667, "map": 17.490, "obs": 3, "own": 57.927, "comp": {"urlhaus": 4.9641, "threatfox": -0.4841, "phishing_db": 0.0078}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.833, "se": 0.759, "ts": 0.667, "map": 2.498, "obs": 3, "own": 8.089, "comp": {"cins": -0.4286, "dshield": -0.8764, "crowdsec": 4.3973, "vulncheck": 1.4088, "blocklist_de": -2.1918}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.839, "det": {"shodan": {"c2": 1, "compromised": 6}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-MSST1-RIPE", "org": "Michael Sebastian Schinzel trading as IP-Projects GmbH & Co. KG", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.ip-projects.de/"}, "pfx": 120, "reg": "2020-05-19", "rir": "ripencc", "s24": 137, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 35584, "abuse": "abuse@ip-projects.de", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0031736862087}, {"a": 48323, "h": "NEIRONSYSTEMS-NET", "n": "PP Neiron Systems", "t": "Other", "w": 4, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2026-8181": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 3, "mean": 2.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.982, 0.011, 0, false], ["2026-10-12", 5.282, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.282, "se": 0.782, "ts": 0.667, "map": 16.826, "obs": 3, "own": 9.650, "comp": {"cins": -0.4599, "dshield": -0.9294, "crowdsec": 4.0337, "vulncheck": -0.6409, "blocklist_de": 2.2131}, "mass": 2.1, "listed": false}}, "abq": true, "bot": 0.278, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-NSYS1-RIPE", "org": "PP Neiron Systems", "pdb": null, "pfx": 11, "reg": "2008-11-12", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081574305642}, {"a": 48324, "h": "DE-WEBGO", "n": "webgo GmbH", "t": "Broadband & mobile", "w": 5, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 3, "cve:CVE-2024-27956": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.3918, "hi": 6.01, "lo": 0.78, "ips": 5, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 5.765, 0.011, 0, false], ["2026-10-12", 6.275, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.275, "se": 0.786, "ts": 0.667, "map": 20.142, "obs": 3, "own": 31.568, "comp": {"cins": -0.4514, "dshield": -0.9151, "crowdsec": 4.1315, "vulncheck": -0.6359, "blocklist_de": 2.2674}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.996, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-WE2-RIPE", "org": "webgo GmbH", "pdb": null, "pfx": 5, "reg": "2016-03-03", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@webgo.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48327, "h": "Ray-AS", "n": "Ray-Svyaz Ltd", "t": "Other", "w": 9, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4088, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "vulncheck": {"n": 1, "p": 0.1899, "hi": 4.65, "lo": 0.35, "ips": 6, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 4.341, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 4.341, "se": 0.691, "ts": 0.500, "map": 11.623, "obs": 4, "own": 6.686, "comp": {"cins": -0.5628, "dshield": 6.1787, "crowdsec": -4.3027, "vulncheck": 0.9726, "blocklist_de": 1.5609}, "mass": 2.6, "listed": false}}, "abq": true, "bot": 0.459, "det": {"vulncheck": {"botnet_node": 6}, "blocklist_de": {"bots": 1}}, "oid": "ORG-LPN1-RIPE", "org": "Ray-Svyaz Ltd.", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "http://mycentra.ru"}, "pfx": 7, "reg": "2008-11-12", "rir": "ripencc", "s24": 40, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068726115535}, {"a": 48330, "h": "GIGANET-UA-AS", "n": "Sinev Maksim Viktorovich", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.3959, "hi": 6.04, "lo": 0.79, "ips": 2, "mean": 2.88, "above": false}, "vulncheck": {"n": 1, "p": 0.1818, "hi": 4.56, "lo": 0.34, "ips": 2, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.162, 0.011, 0, false], ["2026-10-12", 1.379, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.021, "ts": null, "map": 0.187, "obs": 0, "own": 0.583, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.379, "se": 0.769, "ts": 0.667, "map": 4.219, "obs": 3, "own": 2.461, "comp": {"cins": -0.4088, "dshield": 7.1672, "crowdsec": -3.3184, "vulncheck": 1.4866, "blocklist_de": -2.0933}, "mass": 1.9, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-FSMV1-RIPE", "org": "Sinev Maksim Viktorovich", "pdb": null, "pfx": 80, "reg": "2008-11-12", "rir": "ripencc", "s24": 77, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005054123025}, {"a": 48348, "h": "cloudbuilders", "n": "cloudbuilders", "t": "Hosting & VPS", "w": 1, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 1, "p": 0.1516, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.254, 0.011, 0, false], ["2026-10-12", 0.267, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 0.252, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.267, "se": 1.272, "ts": 1.000, "map": 2.157, "obs": 1, "own": 0.485, "comp": {"cins": -0.1305, "dshield": -0.3013, "crowdsec": 3.5886, "vulncheck": -0.3142, "blocklist_de": -0.6801}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.809, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CBS14-RIPE", "org": "Cloud Builders SA", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.interdominios.com"}, "pfx": 35, "reg": "2015-03-24", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "abuse@interdominios.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48434, "h": "Tebyan", "n": "Tebyan-e-Noor Cultural-Artistic Institute", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.377, 0.011, 0, false], ["2026-10-12", 0.394, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.394, "se": 1.339, "ts": 1.000, "map": 3.608, "obs": 1, "own": 2.405, "comp": {"cins": -0.1073, "dshield": -0.2502, "crowdsec": 3.8668, "vulncheck": -0.2723, "blocklist_de": -0.56}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.415, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TCI2-RIPE", "org": "Tebyan-e-Noor Cultural-Artistic Institute", "pdb": null, "pfx": 25, "reg": "2008-11-26", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "abuse@tebyanidc.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000286574223}, {"a": 48447, "h": "Sectigo", "n": "Sectigo Limited", "t": "Other", "w": 0, "cc": "GB", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.54}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.999, "det": null, "oid": "ORG-SL842-RIPE", "org": "Sectigo Limited", "pdb": null, "pfx": 4, "reg": "2008-11-27", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "noc@sectigo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00047225129194}, {"a": 48479, "h": "KUBAN-TELECOM-AS", "n": "KUBAN-TELECOM Ltd.", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6388, "hi": 7.66, "lo": 1.35, "ips": 4, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 1.405, 0.011, 0, false], ["2026-10-12", 2.555, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 2.555, "se": 0.802, "ts": 1.000, "map": 8.096, "obs": 3, "own": 13.327, "comp": {"cins": -0.2538, "dshield": -0.5563, "crowdsec": -2.1969, "vulncheck": 7.8044, "blocklist_de": -1.3124}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.505, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-KL75-RIPE", "org": "KUBAN-TELECOM Ltd.", "pdb": null, "pfx": 24, "reg": "2008-12-01", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@kubtel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48500, "h": "IRPNET-AS", "n": "Irpinia Net-Com SRL", "t": "Broadband & mobile", "w": 1, "cc": "IT", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-12", 0.235, 0.012, 0, false]], "sh": false, "uc": 964, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 1.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.235, "se": 1.253, "ts": 1.000, "map": 1.829, "obs": 1, "own": 3.212, "comp": {"cins": -0.1517, "dshield": -0.347, "crowdsec": -1.373, "vulncheck": -0.3488, "blocklist_de": 4.2179}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.218, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-INS15-RIPE", "org": "Irpinia Net-Com SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.irpinianetcom.it"}, "pfx": 7, "reg": "2008-12-03", "rir": "ripencc", "s24": 62, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000217004792}, {"a": 48503, "h": "TELE2-KZ", "n": "Tele2 Kazakhstan", "t": "Transit & backbone", "w": 5, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0490, "hi": 2.98, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "dshield": {"n": 3, "p": 0.5482, "hi": 6.75, "lo": 1.19, "ips": 3, "mean": 3.48, "above": false}, "blocklist_de": {"n": 2, "p": 0.2551, "hi": 4.86, "lo": 0.63, "ips": 2, "mean": 2.32, "above": false}}, "h2": [["2026-10-05", 0.089, 0.010, 0, false], ["2026-10-12", 1.325, 0.011, 0, false]], "sh": false, "uc": 146, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.936, "ts": null, "map": 0.168, "obs": 0, "own": 1.437, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.325, "se": 0.603, "ts": 0.600, "map": 3.040, "obs": 5, "own": 9.584, "comp": {"cins": -0.9223, "dshield": 7.1738, "crowdsec": -6.207, "vulncheck": -0.8077, "blocklist_de": 3.2686}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.116, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-MTL59-RIPE", "org": "Mobile Telecom-Service LLP", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.tele2.kz"}, "pfx": 423, "reg": "2008-12-04", "rir": "ripencc", "s24": 276, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 146944, "abuse": "abuse@tele2.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01430828421351}, {"a": 48506, "h": "METICAL-AS", "n": "Metical SRL", "t": "Broadband & mobile", "w": 16, "cc": "MD", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4176, "hi": 6.24, "lo": 0.81, "ips": 16, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 4.140, 0.011, 0, false], ["2026-10-12", 1.741, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.741, "se": 0.979, "ts": 1.000, "map": 7.702, "obs": 2, "own": 13.038, "comp": {"cins": -0.1644, "dshield": -0.3741, "crowdsec": -1.4796, "vulncheck": 6.3082, "blocklist_de": -0.8549}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.217, "det": {"vulncheck": {"botnet_node": 16}}, "oid": "ORG-MS432-RIPE", "org": "Metical SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://flynet.md"}, "pfx": 19, "reg": "2008-12-04", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001716990366}, {"a": 48515, "h": "PRAKTIKA-AS", "n": "Praktika Ltd.", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.246, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.246, "se": 1.275, "ts": 1.000, "map": 1.922, "obs": 1, "own": 1.293, "comp": {"cins": -0.0938, "dshield": -0.2201, "crowdsec": -0.8717, "vulncheck": 3.7227, "blocklist_de": -0.49}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.467, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-PL68-RIPE", "org": "Praktika Ltd.", "pdb": null, "pfx": 2, "reg": "2008-12-05", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "admin@udomlya.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48524, "h": "INTERRA-AS", "n": "INTERRA telecommunications", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0401, "hi": 2.84, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "blocklist_de": {"n": 1, "p": 0.1065, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.312, 0.010, 0, false], ["2026-10-12", 0.332, 0.011, 0, false]], "sh": false, "uc": 212.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.169, "obs": 0, "own": 1.040, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.332, "se": 0.871, "ts": 0.500, "map": 1.240, "obs": 2, "own": 1.979, "comp": {"cins": -0.3946, "dshield": -0.8177, "crowdsec": 0.7899, "vulncheck": -0.6, "blocklist_de": 2.6313}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.449, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LA171-RIPE", "org": "INTERRA telecommunications group, Ltd.", "pdb": null, "pfx": 30, "reg": "2008-12-05", "rir": "ripencc", "s24": 252, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 66560, "abuse": "noc@interra.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00074142713645}, {"a": 48551, "h": "Sindad", "n": "Sindad Network Technology PJSC", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7763, "hi": 8.52, "lo": 1.83, "ips": 4, "mean": 4.65, "above": false}, "dshield": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1830, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 3.545, 0.012, 0, false]], "sh": false, "uc": 770.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.694, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.545, "se": 0.772, "ts": 0.333, "map": 11.125, "obs": 3, "own": 6.380, "comp": {"cins": -0.4813, "dshield": 2.8617, "crowdsec": -0.0022, "vulncheck": -0.6528, "blocklist_de": 2.0774}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.899, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SNTL8-RIPE", "org": "Sindad Network Technology PJSC", "pdb": null, "pfx": 35, "reg": "2015-02-03", "rir": "ripencc", "s24": 35, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@sindad.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000254421399}, {"a": 48574, "h": "ASN-CZ-PLANET-A-48574", "n": "T-Mobile Czech Republic a.s.", "t": "Broadband & mobile", "w": 1, "cc": "CZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.442, 0.011, 0, false], ["2026-10-12", 1.545, 0.012, 0, false]], "sh": false, "uc": 1909.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.545, "se": 0.943, "ts": 0.500, "map": 6.677, "obs": 2, "own": 10.724, "comp": {"cins": -0.3099, "dshield": -0.6638, "crowdsec": 1.6209, "vulncheck": -0.5343, "blocklist_de": 3.1795}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.233, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RA2-RIPE", "org": "T-Mobile Czech Republic a.s.", "pdb": null, "pfx": 3, "reg": "2008-12-11", "rir": "ripencc", "s24": 36, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@t-mobile.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003758423428}, {"a": 48586, "h": "BAIKAL-IX-AS", "n": "BAIKAL-IX", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 16.363, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.538, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-LA1006-RIPE", "org": "LLC Zero Kilometer", "pdb": {"t": null, "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://baikal-ix.ru"}, "pfx": 1, "reg": "2016-03-01", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48589, "h": "TIGER", "n": "TIger Network AS48589", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 0.623, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.181, "obs": 0, "own": 0.239, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.377, "det": null, "oid": "ORG-TNL41-RIPE", "org": "Tiger Network Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.imtiger.net"}, "pfx": 11, "reg": "2008-12-15", "rir": "ripencc", "s24": 58, "sib": 1, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007689646378}, {"a": 48635, "h": "CLDIN-NL", "n": "CLDIN", "t": "Hosting & VPS", "w": 4, "cc": "NL", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.5767, "hi": 6.04, "lo": 1.50, "ips": 5, "mean": 3.45, "above": false}, "crowdsec": {"n": 1, "p": 0.0212, "hi": 2.47, "lo": 0.18, "ips": 1, "mean": 1.04, "above": false}, "vulncheck": {"n": 3, "p": 0.5267, "hi": 6.56, "lo": 1.16, "ips": 3, "mean": 3.38, "above": false}}, "h2": [["2026-10-05", 0.532, 0.010, 0, false], ["2026-10-12", 0.422, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.919, "ts": null, "map": 0.162, "obs": 0, "own": 0.145, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.422, "se": 0.686, "ts": 0.750, "map": 1.081, "obs": 4, "own": 0.222, "comp": {"cins": -0.4654, "dshield": -0.9385, "crowdsec": 0.1387, "vulncheck": 5.1112, "blocklist_de": -2.3746}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.893, "det": {"shodan": {"c2": 4, "compromised": 1}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}}, "oid": "ORG-SCB10-RIPE", "org": "Your Hosting B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://cldin.eu/"}, "pfx": 72, "reg": "2008-12-19", "rir": "ripencc", "s24": 347, "sib": 7, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 92672, "abuse": "abuse@sohosted.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004811529025}, {"a": 48642, "h": "FOR-AS", "n": "K Telecom Ldt.", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1430, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "dshield": {"n": 1, "p": 0.1302, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 2, "p": 0.0749, "hi": 3.29, "lo": 0.43, "ips": 2, "mean": 1.57, "above": false}, "blocklist_de": {"n": 1, "p": 0.0843, "hi": 3.47, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 1.072, 0.010, 0, false], ["2026-10-12", 1.104, 0.011, 0, false]], "sh": false, "uc": 153.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.920, "ts": null, "map": 0.162, "obs": 0, "own": 0.943, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.104, "se": 0.603, "ts": 0.400, "map": 2.505, "obs": 5, "own": 3.894, "comp": {"cins": 3.1936, "dshield": 1.2818, "crowdsec": -0.5923, "vulncheck": -0.8116, "blocklist_de": -0.7595}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.451, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-JSC13-RIPE", "org": "Joint stock company \"For\"", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.k-telecom.org"}, "pfx": 39, "reg": "2008-12-22", "rir": "ripencc", "s24": 343, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 89344, "abuse": "abuse_contact@mail.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00177417413635}, {"a": 48678, "h": "TR-PENTECH-AS", "n": "PENDC", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5957, "hi": 7.20, "lo": 1.27, "ips": 3, "mean": 3.71, "above": false}, "dshield": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.303, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.264, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.303, "se": 1.292, "ts": 1.000, "map": 2.548, "obs": 1, "own": 0.578, "comp": {"cins": -0.1235, "dshield": 4.5304, "crowdsec": -1.1322, "vulncheck": -0.302, "blocklist_de": -0.6439}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.549, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-PBTS1-RIPE", "org": "Pentech Bilisim Teknolojileri Sanayi Ve Ticaret Limited Sirketi", "pdb": {"t": "Content", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.pendc.com"}, "pfx": 36, "reg": "2020-12-31", "rir": "ripencc", "s24": 36, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@pendc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002376055352}, {"a": 48683, "h": "BI-LINK-AS", "n": "Bilink", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2062, "hi": 4.46, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 0.455, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.718, "ts": null, "map": 0.124, "obs": 0, "own": 0.121, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.218, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-BL86-RIPE", "org": "Bilink LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://bilink.ua"}, "pfx": 2, "reg": "2009-11-04", "rir": "ripencc", "s24": 192, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 49152, "abuse": "abuse@bilink.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00043203504972}, {"a": 48693, "h": "NTSERVICE-AS", "n": "Rices Privately owned enterprise", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.629, "det": null, "oid": "ORG-RPOE1-RIPE", "org": "Rices Privately owned enterprise", "pdb": null, "pfx": 10, "reg": "2016-02-25", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@ntup.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48715, "h": "SEFROYEKPARDAZENG-AS", "n": "Sefroyek Pardaz Engineering PJSC", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 4, "p": 0.7470, "hi": 8.11, "lo": 1.75, "ips": 4, "mean": 4.43, "above": false}, "crowdsec": {"n": 2, "p": 0.3249, "hi": 5.43, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}}, "h2": [["2026-10-05", 3.534, 0.011, 0, false], ["2026-10-12", 2.260, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 0.618, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.260, "se": 0.762, "ts": 0.667, "map": 6.924, "obs": 3, "own": 3.977, "comp": {"cins": 4.1272, "dshield": -1.011, "crowdsec": 3.4739, "vulncheck": -0.6678, "blocklist_de": -2.5937}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.516, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SPEC3-RIPE", "org": "Sefroyek Pardaz Engineering PJSC", "pdb": null, "pfx": 70, "reg": "2016-10-11", "rir": "ripencc", "s24": 60, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": "ripe-abuse@0-1.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022224921871}, {"a": 48716, "h": "PSKZ-ALA", "n": "PS Internet Company Network", "t": "Enterprise, edu & gov", "w": 6, "cc": "KZ", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"shodan": {"n": 15, "p": 1.0000, "hi": 19.17, "lo": 8.33, "ips": 15, "mean": 13.28, "above": true}, "urlhaus": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.4806, "hi": 6.18, "lo": 1.09, "ips": 3, "mean": 3.19, "above": false}, "threatfox": {"n": 1, "p": 0.1926, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1576, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.329, 1.895, 0, false], ["2026-10-12", 2.379, 1.952, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 1.952, "se": 1.191, "ts": 0.500, "map": 9.690, "obs": 2, "own": 41.989, "comp": {"urlhaus": 3.2919, "threatfox": 1.3309, "phishing_db": -0.7255}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.379, "se": 0.664, "ts": 0.750, "map": 6.036, "obs": 4, "own": 34.104, "comp": {"cins": -0.6804, "dshield": -1.2689, "crowdsec": 5.0542, "vulncheck": -0.7396, "blocklist_de": 0.826}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.681, "det": {"shodan": {"compromised": 15}, "threatfox": {"family:Evilginx": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-PICL3-RIPE", "org": "PS Internet Company LLP", "pdb": {"t": "Enterprise", "sc": null, "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.ps.kz"}, "pfx": 125, "reg": "2009-01-19", "rir": "ripencc", "s24": 96, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 47104, "abuse": "abuse@ps.kz", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00088224954923}, {"a": 48721, "h": "FLYSERVERS-ENDCLIENTS", "n": "Flyservers S.A.", "t": "Hosting & VPS", "w": 16, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 10, "data_centre": 5, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 13, "web_bruteforce": 1, "mail_bruteforce": 2, "cve:CVE-2019-8318": 1, "cve:CVE-2022-22947": 1}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 7, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 15, "mean": 2.98, "above": false}, "threatfox": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 114.106, 0.911, 1, false], ["2026-10-12", 39.810, 0.938, 1, false]], "sh": false, "uc": 14843.8, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.938, "se": 1.811, "ts": 1.000, "map": 14.132, "obs": 1, "own": 8.844, "comp": {"urlhaus": -0.0195, "threatfox": 4.3458, "phishing_db": -0.0516}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 39.810, "se": 0.846, "ts": 0.667, "map": 143.948, "obs": 3, "own": 28.856, "comp": {"cins": 4.439, "dshield": -0.767, "crowdsec": 5.1503, "vulncheck": -0.5796, "blocklist_de": -1.8795}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.759, "det": {"threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-FS255-RIPE", "org": "Flyservers S.A.", "pdb": null, "pfx": 2, "reg": "2009-01-19", "rir": "ripencc", "s24": 2, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@flyservers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001161043078}, {"a": 48725, "h": "CLINK-AS", "n": "Agrosvyaz-M Ltd", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.458, 0.011, 0, false], ["2026-10-12", 3.175, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.175, "se": 0.987, "ts": 0.500, "map": 14.884, "obs": 2, "own": 8.799, "comp": {"cins": -0.2711, "dshield": -0.59, "crowdsec": 2.0209, "vulncheck": -0.498, "blocklist_de": 3.4321}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-AML5-RIPE", "org": "Agrosvyaz-M Ltd", "pdb": null, "pfx": 3, "reg": "2009-01-19", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48753, "h": "AVAHOHST", "n": "AVA HOST SRL", "t": "Hosting & VPS", "w": 15, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2020-11738": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 5, "p": 0.9009, "hi": 10.03, "lo": 2.49, "ips": 5, "mean": 5.73, "above": true}, "threatfox": {"n": 6, "p": 0.9661, "hi": 11.81, "lo": 3.28, "ips": 8, "mean": 6.98, "above": true}, "vulncheck": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 17.368, 30.333, 1, false], ["2026-10-12", 29.085, 29.782, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 6, "phishing_db": 0}, "lo": 29.782, "se": 0.819, "ts": 1.000, "map": 75.432, "obs": 6, "own": 25.478, "comp": {"urlhaus": -0.7299, "threatfox": 7.5122, "phishing_db": -0.8329}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 1}, "lo": 29.085, "se": 0.532, "ts": 0.625, "map": 58.082, "obs": 8, "own": 11.397, "comp": {"cins": 2.8595, "dshield": -1.7825, "crowdsec": 5.997, "vulncheck": 0.0579, "blocklist_de": -1.6764}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.847, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Hook": 3, "family:PureRAT": 4, "family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AHS23-RIPE", "org": "AVA HOST SRL", "pdb": null, "pfx": 18, "reg": "2023-07-12", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 4608, "abuse": "info@ava-host.com", "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00050375782905}, {"a": 48803, "h": "MEDIATEKNIK", "n": "Mediateknik i Varberg AB", "t": "Other", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1312, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.015, "ts": null, "map": 0.186, "obs": 0, "own": 0.568, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.825, "ts": null, "map": 0.164, "obs": 0, "own": 0.194, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MIVA2-RIPE", "org": "Mediateknik i Varberg AB", "pdb": null, "pfx": 15, "reg": "2009-02-10", "rir": "ripencc", "s24": 85, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": "abuse@ipdg.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00052796117096}, {"a": 48823, "h": "AS48823", "n": "Hosting.de GmbH", "t": "Hosting & VPS", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2020-5902": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.386, 0.011, 0, false], ["2026-10-12", 0.415, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.415, "se": 1.349, "ts": 1.000, "map": 3.857, "obs": 1, "own": 0.900, "comp": {"cins": -0.1043, "dshield": -0.2436, "crowdsec": 3.9028, "vulncheck": -0.2666, "blocklist_de": -0.5446}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.762, "det": null, "oid": "ORG-GA187-RIPE", "org": "Hosting.de GmbH", "pdb": null, "pfx": 4, "reg": "2009-02-13", "rir": "ripencc", "s24": 20, "sib": 4, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@hosting.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48832, "h": "Zain-Jo", "n": "Linkdotnet-Jordan", "t": "Broadband & mobile", "w": 8, "cc": "JO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1195, "hi": 3.88, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "shodan": {"n": 1, "p": 0.0127, "hi": 2.24, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}, "urlhaus": {"n": 1, "p": 0.1785, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 2, "p": 0.0259, "hi": 2.63, "lo": 0.34, "ips": 2, "mean": 1.25, "above": false}, "blocklist_de": {"n": 5, "p": 0.6711, "hi": 6.73, "lo": 1.67, "ips": 5, "mean": 3.84, "above": false}}, "h2": [["2026-10-05", 0.683, 0.009, 0, false], ["2026-10-12", 1.621, 0.224, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.224, "se": 1.427, "ts": 1.000, "map": 1.770, "obs": 1, "own": 5.083, "comp": {"urlhaus": 3.2954, "threatfox": -0.3739, "phishing_db": -0.7246}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.621, "se": 0.518, "ts": 0.625, "map": 3.207, "obs": 8, "own": 4.949, "comp": {"cins": 1.9114, "dshield": -2.2009, "crowdsec": -4.5989, "vulncheck": -0.9003, "blocklist_de": 8.3476}, "mass": 9.3, "listed": false}}, "abq": true, "bot": 0.194, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 3, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-LA9-RIPE", "org": "Jordanian mobile phone services Ltd", "pdb": {"t": "NSP", "sc": "Middle East", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.jo.zain.com"}, "pfx": 328, "reg": "2009-02-16", "rir": "ripencc", "s24": 524, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 215808, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0281059784859}, {"a": 48847, "h": "Connect", "n": "WAVES", "t": "Broadband & mobile", "w": 1, "cc": "LB", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1747, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1866, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 4.112, 0.471, 0, false], ["2026-10-12", 1.932, 0.012, 0, false]], "sh": false, "uc": 2370.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 1.809, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.932, "se": 0.956, "ts": 0.500, "map": 8.535, "obs": 2, "own": 13.729, "comp": {"cins": -0.2979, "dshield": -0.6413, "crowdsec": 1.7431, "vulncheck": -0.5235, "blocklist_de": 3.2574}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.190, "det": {"shodan": {"c2": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-WS33-RIPE", "org": "WAVES S.A.L", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://connect.net.lb/"}, "pfx": 16, "reg": "2014-12-09", "rir": "ripencc", "s24": 27, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000944814717}, {"a": 48854, "h": "team-blue-denmark", "n": "team.blue DK", "t": "Hosting & VPS", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2021, "hi": 4.43, "lo": 0.58, "ips": 2, "mean": 2.11, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.174, "obs": 0, "own": 0.173, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.715, "ts": null, "map": 0.123, "obs": 0, "own": 0.041, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.968, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ZA59-RIPE", "org": "team.blue Denmark A/S", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://dkcareers.team.blue/pages/brands"}, "pfx": 47, "reg": "2009-02-18", "rir": "ripencc", "s24": 197, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00116730717467}, {"a": 48874, "h": "HOSTMAZE", "n": "HOSTMAZE", "t": "Hosting & VPS", "w": 19, "cc": "RO", "cf": null, "cs": {"c": {"data_centre": 6}, "n": 6}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 6, "mean": 1.97, "above": false}, "threatfox": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 11, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1981, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 6.056, 8.832, 0, false], ["2026-10-12", 0.781, 8.859, 0, false]], "sh": false, "uc": 23906.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 8.859, "se": 1.243, "ts": 0.500, "map": 53.597, "obs": 2, "own": 19.390, "comp": {"urlhaus": -0.1761, "threatfox": 2.8941, "phishing_db": 2.8897}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 2.459, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.963, "det": {"threatfox": {"family:Potassium": 11}}, "oid": "ORG-HIS13-RIPE", "org": "HOSTMAZE INC SRL-D", "pdb": null, "pfx": 5, "reg": "2016-10-07", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48881, "h": "DATANODE", "n": "DataNode DC SRL", "t": "Other", "w": 2, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.351, 0.547, 0, false], ["2026-10-12", 0.348, 0.567, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.567, "se": 1.596, "ts": 1.000, "map": 6.410, "obs": 1, "own": 7.852, "comp": {"urlhaus": -0.0825, "threatfox": -0.1082, "phishing_db": 3.6748}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.348, "se": 1.332, "ts": 1.000, "map": 3.043, "obs": 1, "own": 2.100, "comp": {"cins": -0.0787, "dshield": -0.1858, "crowdsec": -0.7362, "vulncheck": 3.9187, "blocklist_de": -0.4114}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.924, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-DDS25-RIPE", "org": "DataNode DC SRL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://example.com"}, "pfx": 9, "reg": "2009-02-23", "rir": "ripencc", "s24": 19, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@datanode.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012563842608}, {"a": 48887, "h": "SOMONCOM-AS", "n": "CJSC INDIGO TAJIKISTAN", "t": "Other", "w": 2, "cc": "TJ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.437, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.437, "se": 1.360, "ts": 1.000, "map": 4.163, "obs": 1, "own": 2.805, "comp": {"cins": -0.1014, "dshield": 4.6506, "crowdsec": -0.9391, "vulncheck": -0.2609, "blocklist_de": -0.5295}, "mass": 0.5, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-CIT3-RIPE", "org": "CJSC INDIGO TAJIKISTAN", "pdb": null, "pfx": 20, "reg": "2009-02-24", "rir": "ripencc", "s24": 18, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00083653162115}, {"a": 48894, "h": "OPTIMUS-AS", "n": "Optimus IT d.o.o.", "t": "Other", "w": 0, "cc": "SI", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6257, "hi": 7.51, "lo": 1.32, "ips": 3, "mean": 3.88, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.805, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 0.457, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.741, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-OPT3-RIPE", "org": "Optimus IT d.o.o.", "pdb": null, "pfx": 14, "reg": "2009-02-25", "rir": "ripencc", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "abuse@optimus.si", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028433018904}, {"a": 48896, "h": "DHOSTING-AS", "n": "dhosting.pl Sp. z o.o.", "t": "Hosting & VPS", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 1, "proxy_or_vpn": 3, "first_seen_30d": 1, "web_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 3, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 2.417, 0.011, 0, false], ["2026-10-12", 2.564, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.564, "se": 0.972, "ts": 1.000, "map": 11.735, "obs": 2, "own": 2.407, "comp": {"cins": -0.2602, "dshield": -0.5688, "crowdsec": 6.5171, "vulncheck": -0.4869, "blocklist_de": -1.3449}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-DH8-RIPE", "org": "dhosting.pl Sp. z o.o.", "pdb": null, "pfx": 9, "reg": "2009-02-25", "rir": "ripencc", "s24": 17, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@dhosting.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033032930892}, {"a": 48900, "h": "InfoDataCenter", "n": "Info Data Center Ltd.", "t": "Hosting & VPS", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.856, "det": null, "oid": "ORG-IDCL1-RIPE", "org": "Info Data Center Ltd.", "pdb": null, "pfx": 3, "reg": "2009-02-25", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@datacenter.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 48925, "h": "VIBEGAMES", "n": "VibeGAMES B.V.", "t": "Hosting & VPS", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.296, 0.011, 0, false], ["2026-10-12", 0.303, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.264, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.303, "se": 1.292, "ts": 1.000, "map": 2.548, "obs": 1, "own": 0.578, "comp": {"cins": -0.1235, "dshield": 4.5304, "crowdsec": -1.1322, "vulncheck": -0.302, "blocklist_de": -0.6439}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-VB148-RIPE", "org": "VibeGAMES B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://vibegames.com"}, "pfx": 36, "reg": "2023-03-01", "rir": "ripencc", "s24": 36, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "support@vibegames.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090539654611}, {"a": 48955, "h": "IRM-AS", "n": "Internet Resources Management SRL", "t": "Other", "w": 1, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1365, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 1.928, 0.011, 0, false], ["2026-10-12", 0.222, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.613, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.222, "se": 1.243, "ts": 1.000, "map": 1.701, "obs": 1, "own": 1.086, "comp": {"cins": -0.1414, "dshield": -0.3249, "crowdsec": 3.4599, "vulncheck": -0.3324, "blocklist_de": -0.7364}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-IRMS1-RIPE", "org": "Internet Resources Management SRL", "pdb": null, "pfx": 44, "reg": "2009-03-05", "rir": "ripencc", "s24": 62, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": "abuse@irm.srl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00223999701534}, {"a": 48964, "h": "ENTERRA-as", "n": "Enterra", "t": "Transit & backbone", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.445, 0.012, 0, false]], "sh": false, "uc": 1246.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 2.735, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.445, "se": 1.365, "ts": 1.000, "map": 4.270, "obs": 1, "own": 16.060, "comp": {"cins": -0.1096, "dshield": -0.2553, "crowdsec": -1.0111, "vulncheck": -0.2766, "blocklist_de": 4.4978}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.213, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-PDEA1-RIPE", "org": "Private Enterprise \"Enterra\"", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://enterra.dp.ua"}, "pfx": 16, "reg": "2009-03-12", "rir": "ripencc", "s24": 19, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@datasfera.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030791389509}, {"a": 49010, "h": "HERNING-KOMMUNE-AS", "n": "Herning Kommune", "t": "Other", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3802, "hi": 5.90, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.328, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"doublepulsar": 2}}, "oid": "ORG-HK22-RIPE", "org": "Herning Kommune", "pdb": null, "pfx": 10, "reg": "2009-03-24", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@herning.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040689941737}, {"a": 49020, "h": "FiberSkynet-asn", "n": "FiberSkynet", "t": "Broadband & mobile", "w": 0, "cc": "LB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 1652.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 1.327, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.161, "det": null, "oid": "ORG-EATA4-RIPE", "org": "Elie Achkar trading as FiberSkynet", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://fiberskynet.net/"}, "pfx": 13, "reg": "2016-02-16", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003935984976}, {"a": 49040, "h": "KiG-Unisat-TV", "n": "K and G UNISAT -TV LLC", "t": "Other", "w": 1, "cc": "BG", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.011, 0.627, 0, false], ["2026-10-12", 0.011, 0.670, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.670, "se": 1.661, "ts": 1.000, "map": 8.212, "obs": 1, "own": 10.927, "comp": {"urlhaus": 4.2305, "threatfox": -0.1758, "phishing_db": -0.3229}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.345, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-KADU1-RIPE", "org": "K and G UNISAT -TV LLC", "pdb": null, "pfx": 28, "reg": "2009-03-31", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "info@unisat.tv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015976322388}, {"a": 49100, "h": "IR-THR-PTE", "n": "Pishgaman Toseeh Ertebatat Company (Private Joint Stock)", "t": "Other", "w": 4, "cc": "IR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1060, "hi": 3.73, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "urlhaus": {"n": 1, "p": 0.1792, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.0072, "hi": 2.03, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.1605, "hi": 4.09, "lo": 0.53, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.258, 0.009, 0, false], ["2026-10-12", 0.565, 0.228, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.228, "se": 1.430, "ts": 1.000, "map": 1.812, "obs": 1, "own": 2.098, "comp": {"urlhaus": 3.3121, "threatfox": -0.3717, "phishing_db": -0.72}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.565, "se": 0.650, "ts": 0.500, "map": 1.404, "obs": 4, "own": 0.801, "comp": {"cins": -0.8037, "dshield": 1.7001, "crowdsec": -2.5339, "vulncheck": -0.778, "blocklist_de": 4.1483}, "mass": 4.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-PTEC8-RIPE", "org": "Pishgaman Toseeh Ertebatat Company (Private Joint Stock)", "pdb": null, "pfx": 88, "reg": "2009-04-14", "rir": "ripencc", "s24": 504, "sib": 8, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 220928, "abuse": "abuse@pishgaman.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00299316606375}, {"a": 49106, "h": "OPTICOM-AS", "n": "Opticom Group", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1563, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.269, 0.011, 0, false], ["2026-10-12", 1.432, 0.012, 0, false]], "sh": false, "uc": 732.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.432, "se": 0.939, "ts": 0.500, "map": 6.102, "obs": 2, "own": 9.795, "comp": {"cins": -0.3143, "dshield": -0.6721, "crowdsec": 1.5761, "vulncheck": -0.5381, "blocklist_de": 3.1507}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.458, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-DSS5-RIPE", "org": "Opticom Group AO", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.opticom.net"}, "pfx": 7, "reg": "2009-04-14", "rir": "ripencc", "s24": 40, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": "abuse@opticom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49107, "h": "TELKO-AS", "n": "\"Telko\" CJSC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.092, 0.011, 0, false], ["2026-10-12", 0.513, 0.012, 0, false]], "sh": false, "uc": 2734.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 3.557, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.531, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-JA111-RIPE", "org": "\"Telko\" CJSC", "pdb": null, "pfx": 7, "reg": "2009-04-14", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49120, "h": "GORSET-AS", "n": "Gorset", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1846, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.216, 0.011, 0, false], ["2026-10-12", 0.772, 0.012, 0, false]], "sh": false, "uc": 811.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.772, "se": 0.933, "ts": 0.500, "map": 3.181, "obs": 2, "own": 5.265, "comp": {"cins": -0.2652, "dshield": -0.5786, "crowdsec": -2.2845, "vulncheck": 2.2086, "blocklist_de": 3.4705}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.448, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-GL55-RIPE", "org": "Gorset Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://gorcom.ru/"}, "pfx": 7, "reg": "2009-04-15", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": "abuse@gorcom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49183, "h": "BEREZHANY-AS", "n": "Galichina Telekommunication", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.254, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-GT20-RIPE", "org": "\"Galichina Telekommunication\" LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.galcom.net.ua"}, "pfx": 26, "reg": "2009-04-23", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@galcom.net.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086835660378}, {"a": 49223, "h": "EVEREST-AS", "n": "\"Everest\" Broadcasting Company", "t": "Broadband & mobile", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0394, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "dshield": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-12", 0.080, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.967, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.080, "se": 1.119, "ts": 1.000, "map": 0.482, "obs": 1, "own": 0.809, "comp": {"cins": -0.202, "dshield": 4.1214, "crowdsec": -1.7881, "vulncheck": -0.4199, "blocklist_de": -1.0479}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.201, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BCL14-RIPE", "org": "EVEREST TV AND RADIO COMPANY LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.everest.vn.ua/"}, "pfx": 89, "reg": "2009-05-01", "rir": "ripencc", "s24": 317, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 101888, "abuse": "abuse@everest.vn.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00293838859149}, {"a": 49232, "h": "RACKFISH", "n": "Rackfish AB", "t": "Hosting & VPS", "w": 3, "cc": "SE", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1966, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.458, 0.011, 0, false], ["2026-10-12", 0.460, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.460, "se": 1.385, "ts": 1.000, "map": 4.441, "obs": 1, "own": 1.097, "comp": {"cins": -0.0667, "dshield": -0.1582, "crowdsec": -0.6271, "vulncheck": 4.0853, "blocklist_de": -0.3487}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.490, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-RA306-RIPE", "org": "Rackfish AB", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.rackfish.com/"}, "pfx": 4, "reg": "2009-05-01", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@rackfish.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49254, "h": "ALTERNET-AS", "n": "Alternet Ltd", "t": "Other", "w": 2, "cc": "GE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 5.141, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.141, "se": 1.021, "ts": 1.000, "map": 25.709, "obs": 2, "own": 15.299, "comp": {"cins": -0.2678, "dshield": -0.5836, "crowdsec": -2.3041, "vulncheck": -0.4946, "blocklist_de": 8.2907}, "mass": 1.2, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-AL125-RIPE", "org": "Alternet Ltd", "pdb": null, "pfx": 2, "reg": "2009-05-07", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000037723608}, {"a": 49273, "h": "COSCOM-AS", "n": "Ucell", "t": "Other", "w": 3, "cc": "UZ", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.3986, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1684, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.916, 0.011, 0, false], ["2026-10-12", 1.987, 0.012, 0, false]], "sh": false, "uc": 798.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 0.598, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.987, "se": 0.758, "ts": 0.667, "map": 6.056, "obs": 3, "own": 3.473, "comp": {"cins": -0.5124, "dshield": 6.4899, "crowdsec": -3.9932, "vulncheck": -0.6691, "blocklist_de": 1.8795}, "mass": 2.4, "listed": false}}, "abq": true, "bot": 0.114, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-FECL1-RIPE", "org": "COSCOM Liability Limited Company", "pdb": null, "pfx": 69, "reg": "2009-05-08", "rir": "ripencc", "s24": 69, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0143170056096}, {"a": 49280, "h": "Saifullin-AS", "n": "Ruslan Saifullin", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.535, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-RS426-RIPE", "org": "Ruslan Saifullin", "pdb": null, "pfx": 1, "reg": "2022-01-20", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49293, "h": "ALLIANCE-AS", "n": "Digital Tehnology Ltd", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 3, "p": 0.6457, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 0.011, 49.184, 1, false], ["2026-10-12", 0.011, 26.775, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 26.775, "se": 1.011, "ts": 1.000, "map": 106.094, "obs": 3, "own": 90.523, "comp": {"urlhaus": 7.7603, "threatfox": -0.4895, "phishing_db": -0.9803}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.371, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.589, "det": null, "oid": "ORG-LT18-RIPE", "org": "Digital Tehnology Ltd", "pdb": null, "pfx": 9, "reg": "2009-06-18", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "noc@a-tc.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49345, "h": "AzLink-AS", "n": "BEEONLINE OJSC", "t": "Other", "w": 2, "cc": "AZ", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.4061, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 4.771, 0.011, 0, false], ["2026-10-12", 5.265, 0.012, 0, false]], "sh": false, "uc": 2250, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.265, "se": 0.783, "ts": 0.667, "map": 16.787, "obs": 3, "own": 9.631, "comp": {"cins": -0.4961, "dshield": -0.9889, "crowdsec": -0.1325, "vulncheck": -0.6607, "blocklist_de": 6.4925}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.149, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-BO86-RIPE", "org": "BEEONLINE OJSC", "pdb": null, "pfx": 18, "reg": "2022-01-19", "rir": "ripencc", "s24": 24, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@beeonline.az", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00069271929496}, {"a": 49392, "h": "ASBAXETN", "n": "LLC Baxet", "t": "Other", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"threatfox": {"n": 2, "p": 0.4208, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "phishing_db": {"n": 3, "p": 0.6397, "hi": 7.67, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 14.330, 1, false], ["2026-10-12", 0.405, 19.822, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 3}, "lo": 19.822, "se": 0.857, "ts": 0.600, "map": 54.132, "obs": 5, "own": 48.367, "comp": {"urlhaus": -0.6821, "threatfox": 2.3987, "phishing_db": 3.9011}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.405, "se": 1.346, "ts": 1.000, "map": 3.741, "obs": 1, "own": 2.508, "comp": {"cins": -0.1161, "dshield": -0.2696, "crowdsec": -1.0675, "vulncheck": -0.2886, "blocklist_de": 4.4547}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.755, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Cobalt Strike": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-LB12-RIPE", "org": "LLC Baxet", "pdb": null, "pfx": 16, "reg": "2019-01-18", "rir": "ripencc", "s24": 23, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "noc@baxet.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49418, "h": "AS-NETSHIELD", "n": "netshield", "t": "Transit & backbone", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.094, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 3.270, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.813, "det": null, "oid": "ORG-NL628-RIPE", "org": "NETSHIELD LTD", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://netshield.ltd"}, "pfx": 8, "reg": "2023-12-29", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@netshield.ltd", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49424, "h": "NEWLINESOLUTIONS-AS", "n": "New Line Solutions LLC", "t": "Other", "w": 1, "cc": "UZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.925, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-NLSL1-RIPE", "org": "New Line Solutions LLC", "pdb": null, "pfx": 4, "reg": "2022-02-03", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "support@hostmaster.uz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000028099418}, {"a": 49434, "h": "FBWNETWORKS", "n": "FBW Networks", "t": "Transit & backbone", "w": 10, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2024-4577": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 8, "mean": 1.88, "above": false}, "threatfox": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1936, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 1.976, 0.491, 0, false], ["2026-10-12", 4.015, 0.508, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.508, "se": 1.567, "ts": 1.000, "map": 5.403, "obs": 1, "own": 23.081, "comp": {"urlhaus": -0.0877, "threatfox": 3.6064, "phishing_db": -0.2056}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 4.015, "se": 0.798, "ts": 0.333, "map": 12.896, "obs": 3, "own": 42.007, "comp": {"cins": 4.3846, "dshield": -0.8115, "crowdsec": 0.823, "vulncheck": 1.5597, "blocklist_de": -2.0051}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.902, "det": {"threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-FNS23-RIPE", "org": "FBW NETWORKS SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://as49434.net"}, "pfx": 21, "reg": "2016-09-23", "rir": "ripencc", "s24": 24, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": "abuse@fiberway.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011305269859}, {"a": 49447, "h": "NICEIT", "n": "Nice IT Services Group Inc.", "t": "Other", "w": 4, "cc": "DM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2019-19781": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "phishing_db": {"n": 1, "p": 0.1983, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 6.829, 10.064, 1, false], ["2026-10-12", 7.398, 0.846, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.846, "se": 1.750, "ts": 1.000, "map": 12.040, "obs": 1, "own": 17.558, "comp": {"urlhaus": -0.0331, "threatfox": -0.0481, "phishing_db": 4.1957}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.947, "det": {"shodan": {"c2": 2}, "threatfox": {"family:Sliver": 1}}, "oid": "ORG-NISG8-RIPE", "org": "Nice IT Services Group Inc.", "pdb": null, "pfx": 3, "reg": "2019-04-23", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@as49447.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49453, "h": "GLOBALLAYER", "n": "Global Layer BV", "t": "Hosting & VPS", "w": 38, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 31, "data_centre": 18, "web_exploit": 33, "bad_crawling": 28, "proxy_or_vpn": 10, "ssh_bruteforce": 2, "web_bruteforce": 32, "mail_bruteforce": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2025-29927": 9, "cve:CVE-2025-55182": 16, "cve:CVE-2026-56290": 1, "cve:CVE-2026-63030": 1}, "n": 34}, "ev": {"shodan": {"n": 1, "p": 0.1280, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "dshield": {"n": 1, "p": 0.1784, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 7, "p": 0.9639, "hi": 10.61, "lo": 3.21, "ips": 34, "mean": 6.46, "above": true}, "threatfox": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 2, "p": 0.3922, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1599, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 11.346, 0.293, 1, false], ["2026-10-12", 8.341, 0.305, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.305, "se": 1.465, "ts": 1.000, "map": 2.581, "obs": 1, "own": 1.171, "comp": {"urlhaus": -0.1538, "threatfox": 3.0536, "phishing_db": -0.3253}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 2, "blocklist_de": 1}, "lo": 8.341, "se": 0.486, "ts": 0.636, "map": 15.286, "obs": 11, "own": 3.000, "comp": {"cins": -1.3361, "dshield": 0.2486, "crowdsec": 7.7461, "vulncheck": 0.5482, "blocklist_de": -3.0862}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.857, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"apache": 1}}, "oid": "ORG-SB293-RIPE", "org": "Global Layer B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://global-layer.com"}, "pfx": 89, "reg": "2016-02-09", "rir": "ripencc", "s24": 90, "sib": 2, "tor": 0, "w24": 10, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": "abuse@global-layer.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0031474626784}, {"a": 49468, "h": "MAGHOST_RO", "n": "MAGIT'ST srl", "t": "Hosting & VPS", "w": 1, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3869, "hi": 5.96, "lo": 0.77, "ips": 2, "mean": 2.84, "above": false}, "crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.011, 0.477, 0, false], ["2026-10-12", 0.360, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 0.281, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.360, "se": 1.323, "ts": 1.000, "map": 3.207, "obs": 1, "own": 0.738, "comp": {"cins": -0.1126, "dshield": -0.2619, "crowdsec": 3.8031, "vulncheck": -0.2822, "blocklist_de": -0.5873}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.817, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Unknown malware": 1}}, "oid": "ORG-MS610-RIPE", "org": "MAGIT'ST SRL", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://maghost.com"}, "pfx": 26, "reg": "2009-06-15", "rir": "ripencc", "s24": 26, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@maghost.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030076804251}, {"a": 49485, "h": "HAHOSTING", "n": "High Availability Hosting", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.351, 0.011, 0, false], ["2026-10-12", 0.348, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.348, "se": 1.332, "ts": 1.000, "map": 3.043, "obs": 1, "own": 0.731, "comp": {"cins": -0.0787, "dshield": -0.1858, "crowdsec": -0.7362, "vulncheck": 3.9187, "blocklist_de": -0.4114}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.941, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-HAHL1-RIPE", "org": "High Availability Hosting Limited", "pdb": {"t": null, "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.hahosting.com"}, "pfx": 19, "reg": "2009-06-17", "rir": "ripencc", "s24": 19, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49505, "h": "SELECTEL", "n": "Selectel Ltd.", "t": "Hosting & VPS", "w": 34, "cc": "RU", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"shodan": {"n": 8, "p": 0.2927, "hi": 4.18, "lo": 1.36, "ips": 8, "mean": 2.60, "above": false}, "crowdsec": {"n": 4, "p": 0.0067, "hi": 2.26, "lo": 0.49, "ips": 4, "mean": 1.23, "above": false}, "threatfox": {"n": 1, "p": 0.1328, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "vulncheck": {"n": 19, "p": 1.0000, "hi": 17.39, "lo": 8.27, "ips": 27, "mean": 12.47, "above": true}, "phishing_db": {"n": 1, "p": 0.0525, "hi": 3.04, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "blocklist_de": {"n": 2, "p": 0.0372, "hi": 2.82, "lo": 0.37, "ips": 2, "mean": 1.34, "above": false}}, "h2": [["2026-10-05", 0.567, 0.223, 0, false], ["2026-10-12", 0.955, 0.229, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.229, "se": 1.142, "ts": 0.500, "map": 0.924, "obs": 2, "own": 0.414, "comp": {"urlhaus": -0.6006, "threatfox": 1.1732, "phishing_db": 0.974}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 19, "blocklist_de": 2}, "lo": 0.955, "se": 0.446, "ts": 0.760, "map": 1.646, "obs": 25, "own": 0.326, "comp": {"cins": -1.6525, "dshield": -2.3007, "crowdsec": -1.5884, "vulncheck": 9.3181, "blocklist_de": -1.8847}, "mass": 10.6, "listed": false}}, "abq": false, "bot": 0.910, "det": {"shodan": {"compromised": 8}, "threatfox": {"family:AdaptixC2": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 25, "attack_tooling": 1}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-SL223-RIPE", "org": "JSC Selectel", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.selectel.com"}, "pfx": 662, "reg": "2009-06-18", "rir": "ripencc", "s24": 1150, "sib": 4, "tor": 0, "w24": 24, "drop": 8, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 571136, "abuse": "abuse@selectel.ru", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00380753993051}, {"a": 49556, "h": "webdade", "n": "webdade", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1523, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.630, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.184, "obs": 0, "own": 0.246, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.372, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WPL11-RIPE", "org": "Web Dadeh Paydar Co (Ltd)", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://webdade.com"}, "pfx": 55, "reg": "2023-02-13", "rir": "ripencc", "s24": 55, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@webdade.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00180258596415}, {"a": 49581, "h": "TUBE-HOSTING", "n": "Tube-Hosting", "t": "Hosting & VPS", "w": 8, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 4, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1648, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 4, "p": 0.7606, "hi": 8.29, "lo": 1.79, "ips": 5, "mean": 4.53, "above": false}, "vulncheck": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "phishing_db": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.3957, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 11.597, 0.427, 1, false], ["2026-10-12", 11.370, 0.444, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.444, "se": 1.533, "ts": 1.000, "map": 4.422, "obs": 1, "own": 2.010, "comp": {"urlhaus": -0.1156, "threatfox": -0.1424, "phishing_db": 3.3709}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 2}, "lo": 11.370, "se": 0.555, "ts": 0.571, "map": 23.902, "obs": 7, "own": 4.706, "comp": {"cins": -1.0018, "dshield": -1.6798, "crowdsec": 4.4001, "vulncheck": 0.1638, "blocklist_de": 2.6853}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.813, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-FZTA2-RIPE", "org": "Ferdinand Zink trading as Tube-Hosting", "pdb": {"t": "NSP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://tube-hosting.com/"}, "pfx": 39, "reg": "2022-03-07", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@as49581.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00224240308213}, {"a": 49583, "h": "Kom_lan_ltd-AS", "n": "Kom lan Ltd", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 1.189, 0.011, 0, false], ["2026-10-12", 0.264, 0.012, 0, false]], "sh": false, "uc": 1220.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 0.656, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.264, "se": 1.270, "ts": 1.000, "map": 2.123, "obs": 1, "own": 1.370, "comp": {"cins": -0.1313, "dshield": -0.3029, "crowdsec": 3.5799, "vulncheck": -0.3154, "blocklist_de": -0.684}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.491, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-KLL2-RIPE", "org": "Kom lan Ltd", "pdb": null, "pfx": 5, "reg": "2009-07-08", "rir": "ripencc", "s24": 46, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49602, "h": "Krena", "n": "Private Limited Liability Company \"KRENA\"", "t": "Other", "w": 3, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6451, "hi": 7.73, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 22.216, 0.011, 1, false], ["2026-10-12", 8.323, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 8.323, "se": 0.830, "ts": 1.000, "map": 27.609, "obs": 3, "own": 16.655, "comp": {"cins": -0.2182, "dshield": -0.4854, "crowdsec": -1.9181, "vulncheck": 8.4645, "blocklist_de": -1.1309}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.142, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-UK12-RIPE", "org": "Private Limited Liability Company \"KRENA\"", "pdb": null, "pfx": 2, "reg": "2009-07-10", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "info@micronet.lt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000037181947}, {"a": 49605, "h": "DTS-AS", "n": "IVO by D.t.s. S.r.l.", "t": "Broadband & mobile", "w": 11, "cc": "IT", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "blocklist_de": {"n": 10, "p": 0.9996, "hi": 16.33, "lo": 5.94, "ips": 10, "mean": 10.59, "above": true}}, "h2": [["2026-10-05", 17.700, 0.011, 1, false], ["2026-10-12", 37.997, 0.012, 1, false]], "sh": false, "uc": 2181, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 10}, "lo": 37.997, "se": 0.462, "ts": 0.833, "map": 67.629, "obs": 12, "own": 103.243, "comp": {"cins": -1.9223, "dshield": -2.5003, "crowdsec": -6.604, "vulncheck": -0.9334, "blocklist_de": 17.5677}, "mass": 13.4, "listed": false}}, "abq": false, "bot": 0.197, "det": {"blocklist_de": {"imap": 10, "mail": 10}}, "oid": "ORG-DTS5-RIPE", "org": "Digital Telecommunication Services S.r.l.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.ivo.it"}, "pfx": 5, "reg": "2009-07-13", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@dtssi.it", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00016141561125}, {"a": 49628, "h": "SKYTEL-AS", "n": "SKYTEL", "t": "Transit & backbone", "w": 5, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 3, "p": 0.6328, "hi": 7.59, "lo": 1.34, "ips": 4, "mean": 3.92, "above": false}}, "h2": [["2026-10-12", 2.831, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 2.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 0}, "lo": 2.831, "se": 0.705, "ts": 0.750, "map": 7.599, "obs": 4, "own": 24.861, "comp": {"cins": -0.3935, "dshield": -0.8157, "crowdsec": 0.8005, "vulncheck": 5.8474, "blocklist_de": -2.0169}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.153, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-LS285-RIPE", "org": "LLC Skytel", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://about.skytel.ge/"}, "pfx": 49, "reg": "2016-09-20", "rir": "ripencc", "s24": 41, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": "abuse@skytel.ge", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00159700342464}, {"a": 49635, "h": "CLOUDING", "n": "CLOUDING", "t": "Broadband & mobile", "w": 10, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 2, "home_connection": 7}, "n": 8}, "ev": {"crowdsec": {"n": 2, "p": 0.2745, "hi": 5.02, "lo": 0.65, "ips": 8, "mean": 2.39, "above": false}, "phishing_db": {"n": 2, "p": 0.3924, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 1.391, 1.352, 0, false], ["2026-10-12", 0.673, 1.385, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.385, "se": 1.147, "ts": 1.000, "map": 6.306, "obs": 2, "own": 15.965, "comp": {"urlhaus": -0.3722, "threatfox": -0.3122, "phishing_db": 4.152}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.673, "se": 0.900, "ts": 1.000, "map": 2.659, "obs": 2, "own": 4.246, "comp": {"cins": -0.3277, "dshield": -0.697, "crowdsec": 5.6323, "vulncheck": -0.5495, "blocklist_de": -1.6864}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.928, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-CNS38-RIPE", "org": "CLOUDI NEXTGEN SL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://clouding.io"}, "pfx": 97, "reg": "2009-07-17", "rir": "ripencc", "s24": 96, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": "abuse@clouding.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001861953903}, {"a": 49645, "h": "SOFT-EXPERT-AS", "n": "Soft Expert SRL", "t": "Other", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.938, "det": null, "oid": "ORG-SES47-RIPE", "org": "Soft Expert SRL", "pdb": null, "pfx": 7, "reg": "2009-07-20", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49683, "h": "MASSIVEGRID", "n": "MASSIVEGRID LTD", "t": "Other", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7693, "hi": 8.42, "lo": 1.81, "ips": 4, "mean": 4.60, "above": false}, "crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.266, 0.011, 0, false], ["2026-10-12", 2.505, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.672, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.505, "se": 0.786, "ts": 0.333, "map": 7.897, "obs": 3, "own": 4.622, "comp": {"cins": -0.4076, "dshield": -0.8402, "crowdsec": 0.6682, "vulncheck": 1.4916, "blocklist_de": 2.5482}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.617, "det": {"shodan": {"c2": 1, "compromised": 2, "doublepulsar": 1}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ML403-RIPE", "org": "MASSIVEGRID LTD", "pdb": null, "pfx": 41, "reg": "2016-09-19", "rir": "ripencc", "s24": 41, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "abuse@massivegrid.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000000460512}, {"a": 49711, "h": "FLYNET", "n": "Flynet", "t": "Broadband & mobile", "w": 2, "cc": "BY", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4176, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 1.741, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.741, "se": 0.979, "ts": 1.000, "map": 7.702, "obs": 2, "own": 13.038, "comp": {"cins": -0.1644, "dshield": -0.3741, "crowdsec": -1.4796, "vulncheck": 6.3082, "blocklist_de": -0.8549}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-FL59-RIPE", "org": "Flynet Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Selective", "web": "http://flynet.by"}, "pfx": 10, "reg": "2009-08-26", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@flynet.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008338773376}, {"a": 49718, "h": "NTS-REAL-AS", "n": "Nizhnevolzhskie Telecommunication Networks Real", "t": "Broadband & mobile", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "vulncheck": {"n": 3, "p": 0.6219, "hi": 7.47, "lo": 1.32, "ips": 4, "mean": 3.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-12", 2.704, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 1.469, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 1}, "lo": 2.704, "se": 0.648, "ts": 0.600, "map": 6.598, "obs": 5, "own": 10.496, "comp": {"cins": -0.5736, "dshield": 2.5015, "crowdsec": -4.3669, "vulncheck": 4.2259, "blocklist_de": 1.4935}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.433, "det": {"vulncheck": {"botnet_node": 4}, "blocklist_de": {"mail": 1, "apache": 1}}, "oid": "ORG-NTNR2-RIPE", "org": "Nizhnevolzhskie Telecommunication Networks Real LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://real.su"}, "pfx": 25, "reg": "2009-08-27", "rir": "ripencc", "s24": 72, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 34816, "abuse": "noc@real.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00053848046945}, {"a": 49720, "h": "GIGACLOUD-AS", "n": "Gigacloud", "t": "Hosting & VPS", "w": 2, "cc": "UA", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1747, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "phishing_db": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.695, 0.485, 0, false], ["2026-10-12", 0.353, 0.506, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.506, "se": 1.564, "ts": 1.000, "map": 5.374, "obs": 1, "own": 2.476, "comp": {"urlhaus": -0.0978, "threatfox": -0.1245, "phishing_db": 3.5302}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.353, "se": 1.319, "ts": 1.000, "map": 3.122, "obs": 1, "own": 0.718, "comp": {"cins": -0.1138, "dshield": -0.2646, "crowdsec": 3.7886, "vulncheck": -0.2844, "blocklist_de": -0.5936}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.895, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LA1019-RIPE", "org": "Gigacloud LLC", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://gigacloud.ua"}, "pfx": 26, "reg": "2016-09-16", "rir": "ripencc", "s24": 27, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": "support@gigacloud.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037796226684}, {"a": 49732, "h": "TYVASVIAZINFORM-AS", "n": "Joint Stock Company Tyvasviazinform", "t": "Other", "w": 13, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 13, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.324, "se": 1.319, "ts": 1.000, "map": 2.743, "obs": 1, "own": 1.881, "comp": {"cins": -0.0821, "dshield": -0.1935, "crowdsec": -0.7665, "vulncheck": 3.8738, "blocklist_de": -0.4289}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.459, "det": {"vulncheck": {"botnet_node": 13}}, "oid": "ORG-JSCT10-RIPE", "org": "Joint Stock Company Tyvasviazinform", "pdb": null, "pfx": 9, "reg": "2009-08-31", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "ripe@tuva.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49767, "h": "INTERNETPB-AS", "n": "O2 Czech Republic, a.s.", "t": "Other", "w": 3, "cc": "CZ", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.401, 0.011, 0, false], ["2026-10-12", 0.435, 0.012, 0, false]], "sh": false, "uc": 1015.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.435, "se": 1.360, "ts": 1.000, "map": 4.121, "obs": 1, "own": 2.784, "comp": {"cins": -0.1113, "dshield": -0.2591, "crowdsec": -1.0261, "vulncheck": -0.2798, "blocklist_de": 4.4863}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.146, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-STAN1-RIPE", "org": "O2 Czech Republic, a.s.", "pdb": null, "pfx": 2, "reg": "2009-09-08", "rir": "ripencc", "s24": 20, "sib": 15, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@o2.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011745215845}, {"a": 49770, "h": "INTERNETPORT-AS", "n": "Internetport Sweden AB", "t": "Broadband & mobile", "w": 4, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2020-5902": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2021-41773": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.2719, "hi": 4.99, "lo": 0.65, "ips": 3, "mean": 2.38, "above": false}, "blocklist_de": {"n": 1, "p": 0.1568, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.363, 0.011, 0, false], ["2026-10-12", 1.469, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.007, "ts": null, "map": 0.184, "obs": 0, "own": 1.360, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.469, "se": 0.751, "ts": 0.667, "map": 4.382, "obs": 3, "own": 6.871, "comp": {"cins": -0.525, "dshield": -1.0353, "crowdsec": 3.307, "vulncheck": -0.6753, "blocklist_de": 1.7999}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.399, "det": {"blocklist_de": {"mail": 1, "apache": 1}}, "oid": "ORG-SSA89-RIPE", "org": "Internetport Sweden AB", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Tbps", "pol": "Open", "web": "http://www.internetport.se"}, "pfx": 47, "reg": "2009-09-08", "rir": "ripencc", "s24": 98, "sib": 0, "tor": 4, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": "abuse@internetport.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00106389439308}, {"a": 49791, "h": "AS-3HCLOUD", "n": "3HCLOUD", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.8627, "hi": 9.11, "lo": 2.26, "ips": 5, "mean": 5.20, "above": true}, "crowdsec": {"n": 2, "p": 0.3074, "hi": 5.28, "lo": 0.69, "ips": 2, "mean": 2.52, "above": false}, "vulncheck": {"n": 2, "p": 0.3983, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "phishing_db": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.3734, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.797, 0.335, 0, false], ["2026-10-12", 4.486, 0.349, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.349, "se": 1.486, "ts": 1.000, "map": 3.132, "obs": 1, "own": 1.409, "comp": {"urlhaus": -0.1495, "threatfox": -0.1734, "phishing_db": 3.0907}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 2}, "lo": 4.486, "se": 0.597, "ts": 0.333, "map": 10.132, "obs": 6, "own": 2.017, "comp": {"cins": -0.8241, "dshield": -1.4635, "crowdsec": 0.3839, "vulncheck": 1.6167, "blocklist_de": 3.9963}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.583, "det": {"shodan": {"compromised": 5}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-NL413-RIPE", "org": "Newserverlife LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://3hcloud.com"}, "pfx": 49, "reg": "2020-05-08", "rir": "ripencc", "s24": 72, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 18432, "abuse": "abuse@3hcloud.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00121126632632}, {"a": 49800, "h": "GNC-ALFA", "n": "GNC-Alfa CJSC", "t": "Broadband & mobile", "w": 8, "cc": "AM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1656, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "dshield": {"n": 1, "p": 0.1573, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 3, "p": 0.3371, "hi": 5.13, "lo": 0.90, "ips": 3, "mean": 2.65, "above": false}, "vulncheck": {"n": 4, "p": 0.7622, "hi": 8.32, "lo": 1.79, "ips": 4, "mean": 4.54, "above": false}}, "h2": [["2026-10-05", 1.641, 0.010, 0, false], ["2026-10-12", 2.562, 0.011, 0, false]], "sh": false, "uc": 123, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 1.129, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 4, "blocklist_de": 0}, "lo": 2.562, "se": 0.531, "ts": 0.444, "map": 5.122, "obs": 9, "own": 7.984, "comp": {"cins": 2.9675, "dshield": 0.9856, "crowdsec": 1.2636, "vulncheck": 2.952, "blocklist_de": -5.1415}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.189, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-GC21-RIPE", "org": "GNC-Alfa CJSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.ovio.am"}, "pfx": 14, "reg": "2009-09-14", "rir": "ripencc", "s24": 192, "sib": 2, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52224, "abuse": "abuse@gnc.am", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00510487806799}, {"a": 49821, "h": "BAZA-AS", "n": "Electrica", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.221, 0.011, 0, false], ["2026-10-12", 0.215, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 1.634, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.215, "se": 1.256, "ts": 1.000, "map": 1.631, "obs": 1, "own": 2.976, "comp": {"cins": -0.0994, "dshield": -0.2325, "crowdsec": -0.921, "vulncheck": 3.6544, "blocklist_de": -0.5189}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-BL301-RIPE", "org": "BAZA.NET LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://baza.net"}, "pfx": 10, "reg": "2009-09-24", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": "noc@baza.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038645013715}, {"a": 49835, "h": "GUIFINET-AS", "n": "Fundació Guifi.net", "t": "Enterprise, edu & gov", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 3.191, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 3.912, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.191, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FPPA1-RIPE", "org": "Fundacio Privada per a la Xarxa Lliure, Oberta i Neutral, guifi.net", "pdb": {"t": "Non-Profit", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://fundacio.guifi.net"}, "pfx": 21, "reg": "2009-09-28", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@guifi.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49870, "h": "AS49870-BV", "n": "Alsycon AS49870", "t": "Broadband & mobile", "w": 40, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 3, "web_exploit": 16, "bad_crawling": 6, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 18, "web_bruteforce": 9, "home_connection": 13, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2018-13379": 5, "cve:CVE-2024-55591": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2025-57819": 2}, "n": 27}, "ev": {"cins": {"n": 3, "p": 0.6390, "hi": 7.66, "lo": 1.35, "ips": 10, "mean": 3.95, "above": false}, "dshield": {"n": 4, "p": 0.8073, "hi": 9.01, "lo": 1.94, "ips": 6, "mean": 4.92, "above": true}, "urlhaus": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "crowdsec": {"n": 7, "p": 0.9823, "hi": 12.21, "lo": 3.70, "ips": 27, "mean": 7.43, "above": true}, "threatfox": {"n": 2, "p": 0.4202, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1924, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.4026, "hi": 6.11, "lo": 0.79, "ips": 4, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 51.206, 14.784, 1, false], ["2026-10-12", 52.324, 9.407, 1, false]], "sh": false, "uc": 17382.8, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 9.407, "se": 1.039, "ts": 0.667, "map": 35.761, "obs": 3, "own": 84.888, "comp": {"urlhaus": 3.1691, "threatfox": 2.7914, "phishing_db": -0.7575}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 4, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 2}, "lo": 52.324, "se": 0.434, "ts": 0.412, "map": 89.986, "obs": 17, "own": 137.526, "comp": {"cins": 6.6836, "dshield": 3.4899, "crowdsec": 0.4346, "vulncheck": -0.5367, "blocklist_de": -4.1781}, "mass": 14.4, "listed": false}}, "abq": false, "bot": 0.800, "det": {"threatfox": {"family:PureRAT": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"sip": 3, "ssh": 1}}, "oid": "ORG-AB247-RIPE", "org": "Alsycon B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.as49870.net"}, "pfx": 23, "reg": "2019-11-14", "rir": "ripencc", "s24": 29, "sib": 2, "tor": 0, "w24": 9, "drop": 1, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 8704, "abuse": "abuse@as49870.net", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield"], "traffic": 0.0000150181625}, {"a": 49889, "h": "CRYSTAL-AS", "n": "Crystal Telecom Ltd", "t": "Broadband & mobile", "w": 3, "cc": "UA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.252, 0.011, 0, false], ["2026-10-12", 0.246, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.246, "se": 1.275, "ts": 1.000, "map": 1.922, "obs": 1, "own": 3.534, "comp": {"cins": -0.0938, "dshield": -0.2201, "crowdsec": -0.8717, "vulncheck": 3.7227, "blocklist_de": -0.49}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.221, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-CL123-RIPE", "org": "Crystal Telecom Ltd", "pdb": null, "pfx": 30, "reg": "2009-10-05", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@utelecom.com.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00202673120037}, {"a": 49895, "h": "DCENTER-AS", "n": "DCENTER.PL", "t": "Transit & backbone", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.869, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 2.614, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-DSZO13-RIPE", "org": "dcenter.pl sp. z o.o.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.dcenter.pl"}, "pfx": 16, "reg": "2009-10-05", "rir": "ripencc", "s24": 14, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse-ripe@dcenter.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49915, "h": "MEGAPORT", "n": "Megaport Global Access", "t": "Transit & backbone", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0994, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.984, "ts": null, "map": 0.180, "obs": 0, "own": 1.758, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.760, "ts": null, "map": 0.140, "obs": 0, "own": 0.809, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.811, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ML394-RIPE", "org": "Megaport (UK) Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.megaport.com"}, "pfx": 87, "reg": "2016-08-02", "rir": "ripencc", "s24": 140, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35840, "abuse": "abuse@megaport.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000952134183}, {"a": 49924, "h": "Netfree", "n": "Netfree", "t": "Other", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1450.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.345, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.369, "det": null, "oid": "ORG-NS537-RIPE", "org": "NETFREE S.R.L.S.", "pdb": {"t": null, "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.netfree.it"}, "pfx": 3, "reg": "2009-10-13", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49941, "h": "EUROTUX", "n": "Eurotux Informatica SA", "t": "Other", "w": 0, "cc": "PT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.859, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-EIS28-RIPE", "org": "Eurotux Informatica SA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://eurotux.com"}, "pfx": 7, "reg": "2009-10-14", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@eurotux.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000091228672}, {"a": 49963, "h": "BELRTS-AS", "n": "Regional TeleSystem Ltd", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4183, "hi": 6.25, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 1.932, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.932, "se": 0.984, "ts": 1.000, "map": 8.617, "obs": 2, "own": 5.342, "comp": {"cins": -0.1611, "dshield": -0.367, "crowdsec": -1.4516, "vulncheck": 6.3647, "blocklist_de": -0.8376}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.444, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-RT8-RIPE", "org": "Regional TeleSystem Ltd", "pdb": null, "pfx": 5, "reg": "2009-10-19", "rir": "ripencc", "s24": 14, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 49981, "h": "WorldStream", "n": "Worldstream BV", "t": "Hosting & VPS", "w": 48, "cc": "NL", "cf": {"rb": "hi", "wb": "hi", "rep": 1.23, "waf": 1.08}, "cs": {"c": {"http_flood": 10, "data_centre": 9, "web_exploit": 11, "bad_crawling": 5, "proxy_or_vpn": 4, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 10, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2025-4396": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2025-55182": 3}, "n": 13}, "ev": {"cins": {"n": 1, "p": 0.1512, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "shodan": {"n": 11, "p": 0.9958, "hi": 11.30, "lo": 4.30, "ips": 11, "mean": 7.45, "above": true}, "dshield": {"n": 2, "p": 0.3278, "hi": 5.45, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}, "crowdsec": {"n": 13, "p": 0.9988, "hi": 11.74, "lo": 4.81, "ips": 13, "mean": 7.95, "above": true}, "vulncheck": {"n": 16, "p": 1.0000, "hi": 21.13, "lo": 9.42, "ips": 26, "mean": 14.78, "above": true}, "phishing_db": {"n": 2, "p": 0.3360, "hi": 5.52, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "blocklist_de": {"n": 3, "p": 0.4494, "hi": 5.93, "lo": 1.05, "ips": 5, "mean": 3.06, "above": false}}, "h2": [["2026-10-05", 9.721, 0.629, 0, false], ["2026-10-12", 7.639, 0.647, 0, false]], "sh": false, "uc": 234.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.647, "se": 1.136, "ts": 1.000, "map": 2.760, "obs": 2, "own": 1.134, "comp": {"urlhaus": -0.4689, "threatfox": -0.3511, "phishing_db": 3.4615}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 13, "vulncheck": 16, "blocklist_de": 3}, "lo": 7.639, "se": 0.406, "ts": 0.457, "map": 12.450, "obs": 35, "own": 2.436, "comp": {"cins": 0.1435, "dshield": -0.3664, "crowdsec": 4.5071, "vulncheck": 3.8526, "blocklist_de": -4.2214}, "mass": 19.7, "listed": false}}, "abq": false, "bot": 0.454, "det": {"shodan": {"compromised": 11}, "vulncheck": {"c2_server": 2, "botnet_node": 24}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1, "apache": 3}}, "oid": "ORG-WA106-RIPE", "org": "WorldStream B.V.", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.worldstream.com"}, "pfx": 112, "reg": "2009-10-21", "rir": "ripencc", "s24": 286, "sib": 9, "tor": 0, "w24": 34, "drop": 0, "hist": [["2026-10-05", 0.9962], ["2026-10-12", 0.8435]], "ipv4": 74496, "abuse": "abuse@worldstream.nl", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["crowdsec"], "traffic": 0.059447}, {"a": 50049, "h": "RSL-AS-AP", "n": "RedSwitches EU", "t": "Hosting & VPS", "w": 5, "cc": "AU", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5603, "hi": 6.86, "lo": 1.21, "ips": 3, "mean": 3.54, "above": false}, "crowdsec": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "vulncheck": {"n": 2, "p": 0.4020, "hi": 6.10, "lo": 0.79, "ips": 4, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 1.582, 0.011, 0, false], ["2026-10-12", 1.380, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 0.236, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.380, "se": 0.782, "ts": 0.667, "map": 4.260, "obs": 3, "own": 0.881, "comp": {"cins": -0.3331, "dshield": -0.707, "crowdsec": 1.3873, "vulncheck": 4.2096, "blocklist_de": -1.7137}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.276, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1, "botnet_node": 3}}, "oid": "ORG-RPL19-AP-APNIC", "org": "RedSwitches Pty LTD.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://redswitches.com"}, "pfx": 59, "reg": "2009-11-02", "rir": "apnic", "s24": 61, "sib": 3, "tor": 1, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": "abuse@redswitches.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00417357216701}, {"a": 50053, "h": "VDSKA-AS", "n": "Anton Levin", "t": "Other", "w": 9, "cc": "KG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1}, "n": 3}, "ev": {"shodan": {"n": 10, "p": 0.9980, "hi": 13.34, "lo": 4.85, "ips": 10, "mean": 8.65, "above": true}, "crowdsec": {"n": 2, "p": 0.2363, "hi": 4.71, "lo": 0.61, "ips": 3, "mean": 2.24, "above": false}, "vulncheck": {"n": 3, "p": 0.6026, "hi": 7.27, "lo": 1.28, "ips": 3, "mean": 3.75, "above": false}, "blocklist_de": {"n": 3, "p": 0.5566, "hi": 6.82, "lo": 1.20, "ips": 3, "mean": 3.52, "above": false}}, "h2": [["2026-10-05", 1.084, 0.253, 0, false], ["2026-10-12", 3.906, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.990, "ts": null, "map": 0.181, "obs": 0, "own": 0.512, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 3}, "lo": 3.906, "se": 0.548, "ts": 0.375, "map": 7.970, "obs": 8, "own": 4.538, "comp": {"cins": -1.0673, "dshield": -1.7535, "crowdsec": -1.5833, "vulncheck": 1.9351, "blocklist_de": 5.9383}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.540, "det": {"shodan": {"c2": 1, "compromised": 9}, "threatfox": {"family:Havoc": 1}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-AL1057-RIPE", "org": "Anton Levin", "pdb": null, "pfx": 126, "reg": "2023-03-27", "rir": "ripencc", "s24": 127, "sib": 1, "tor": 1, "w24": 8, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 32512, "abuse": "support@vdska.online", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0013145671872}, {"a": 50132, "h": "WRG-AS", "n": "3nt solutions LLP", "t": "Other", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2024-4577": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 5.153, 0.011, 0, false], ["2026-10-12", 5.536, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 16.699, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SL320-RIPE", "org": "3nt solutions LLP", "pdb": null, "pfx": 6, "reg": "2021-12-30", "rir": "ripencc", "s24": 6, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@3nt.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003182889598}, {"a": 50158, "h": "CONNECT-LLC-AS", "n": "Connect LLC", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.820, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.820, "se": 1.527, "ts": 1.000, "map": 10.128, "obs": 1, "own": 7.925, "comp": {"cins": -0.0417, "dshield": -0.1001, "crowdsec": -0.3969, "vulncheck": 4.4661, "blocklist_de": -0.2185}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.437, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-CL128-RIPE", "org": "Connect LLC", "pdb": null, "pfx": 4, "reg": "2009-11-24", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50181, "h": "GAX-KABELSZAT", "n": "KabelszatNet-2002. Musoreloszto es Kereskedelmi Kft.", "t": "Other", "w": 0, "cc": "HU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1199, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 0.541, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.800, "ts": null, "map": 0.155, "obs": 0, "own": 0.174, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.130, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KMEK1-RIPE", "org": "KabelszatNet-2002. Musoreloszto es Kereskedelmi Kft.", "pdb": null, "pfx": 16, "reg": "2009-11-26", "rir": "ripencc", "s24": 103, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00060775956367}, {"a": 50186, "h": "PRONET-AS", "n": "Pronet Telekom Ltd", "t": "Broadband & mobile", "w": 2, "cc": "BG", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3701, "hi": 5.82, "lo": 0.76, "ips": 2, "mean": 2.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 3.644, 0.011, 0, false], ["2026-10-12", 3.965, 0.012, 0, false]], "sh": false, "uc": 1814.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.965, "se": 0.774, "ts": 0.667, "map": 12.367, "obs": 3, "own": 19.382, "comp": {"cins": -0.4746, "dshield": -0.9537, "crowdsec": 3.8666, "vulncheck": -0.6491, "blocklist_de": 2.1196}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.213, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-PTL13-RIPE", "org": "Pronet Telekom Ltd", "pdb": null, "pfx": 32, "reg": "2009-11-26", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "noc@ipacct.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015471203527}, {"a": 50219, "h": "VT-255-50219", "n": "Valence Technology Co.", "t": "Other", "w": 11, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 5, "bad_crawling": 2, "ssh_bruteforce": 6, "cve:CVE-2019-8318": 1, "cve:CVE-2024-4577": 2}, "n": 6}, "ev": {"cins": {"n": 4, "p": 0.8144, "hi": 9.14, "lo": 1.97, "ips": 9, "mean": 4.99, "above": true}, "crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 6, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 89.672, 0.011, 1, false], ["2026-10-12", 103.361, 0.013, 1, false]], "sh": false, "uc": 4980.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 103.361, "se": 0.590, "ts": 0.667, "map": 231.063, "obs": 6, "own": 130.018, "comp": {"cins": 15.2797, "dshield": -1.6722, "crowdsec": -1.0325, "vulncheck": -0.8233, "blocklist_de": -4.9154}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.864, "det": {"blocklist_de": {"ssh": 2}}, "oid": "VT-255-ARIN", "org": "Valence Technology Co.", "pdb": null, "pfx": 4, "reg": "2024-03-26", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@valence.nl", "score": 0.0012, "groups": [], "sensors": ["cins"], "traffic": null}, {"a": 50223, "h": "Alfa", "n": "Alfa Telecom", "t": "Broadband & mobile", "w": 1, "cc": "KG", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1790, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 0.285, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.285, "se": 1.284, "ts": 1.000, "map": 2.354, "obs": 1, "own": 4.188, "comp": {"cins": -0.139, "dshield": -0.3197, "crowdsec": -1.2652, "vulncheck": -0.3284, "blocklist_de": 4.3022}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ATC4-RIPE", "org": "Alfa Telecom CJSC", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.megacom.kg"}, "pfx": 39, "reg": "2009-12-03", "rir": "ripencc", "s24": 44, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "abuse@megacom.kg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00585498518592}, {"a": 50245, "h": "SERVEREL-AS", "n": "Serverel Inc.", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 1.27, "waf": 1.11}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1211, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "crowdsec": {"n": 1, "p": 0.1069, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.159, 0.011, 0, false], ["2026-10-12", 0.166, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 0.208, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.166, "se": 1.203, "ts": 1.000, "map": 1.175, "obs": 1, "own": 0.258, "comp": {"cins": -0.1586, "dshield": -0.3617, "crowdsec": 3.2599, "vulncheck": -0.3595, "blocklist_de": -0.8249}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.438, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SI191-RIPE", "org": "Serverel Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "http://serverel.com"}, "pfx": 14, "reg": "2009-12-09", "rir": "ripencc", "s24": 101, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "abuse@serverel.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.057726}, {"a": 50266, "h": "Odido", "n": "Odido", "t": "Broadband & mobile", "w": 10, "cc": "NL", "cf": {"rb": "hi", "wb": "hi", "rep": 1.15, "waf": 1.01}, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2020-5902": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.29, "lo": 0.02, "ips": 1, "mean": 0.12, "above": false}, "dshield": {"n": 4, "p": 0.0013, "hi": 1.90, "lo": 0.41, "ips": 4, "mean": 1.04, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 0.46, "lo": 0.10, "ips": 4, "mean": 0.25, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 1.07, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.55, "lo": 0.04, "ips": 1, "mean": 0.23, "above": false}}, "h2": [["2026-10-05", 0.058, 0.029, 0, false], ["2026-10-12", 0.120, 0.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.031, "se": 1.328, "ts": 1.000, "map": 0.164, "obs": 1, "own": 0.578, "comp": {"urlhaus": -0.6423, "threatfox": -0.4033, "phishing_db": 0.8611}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.120, "se": 0.502, "ts": 0.444, "map": 0.224, "obs": 9, "own": 0.349, "comp": {"cins": -1.4703, "dshield": 6.245, "crowdsec": -0.1328, "vulncheck": -0.894, "blocklist_de": -3.8501}, "mass": 8.9, "listed": false}}, "abq": false, "bot": 0.148, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-PJB2-RIPE", "org": "Odido Netherlands B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.odido.nl/"}, "pfx": 41, "reg": "2009-12-11", "rir": "ripencc", "s24": 7059, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2200320, "abuse": "abuse@odido.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.063487}, {"a": 50297, "h": "Infium", "n": "Infium", "t": "Other", "w": 6, "cc": "LT", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "vulncheck": {"n": 4, "p": 0.8121, "hi": 9.10, "lo": 1.96, "ips": 4, "mean": 4.97, "above": true}, "phishing_db": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 12.985, 0.626, 1, false], ["2026-10-12", 11.322, 0.651, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.651, "se": 1.639, "ts": 1.000, "map": 7.937, "obs": 1, "own": 10.065, "comp": {"urlhaus": -0.0649, "threatfox": -0.0881, "phishing_db": 3.8507}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 4, "blocklist_de": 0}, "lo": 11.322, "se": 0.659, "ts": 0.800, "map": 27.931, "obs": 5, "own": 16.351, "comp": {"cins": -0.4205, "dshield": -0.8626, "crowdsec": 0.5473, "vulncheck": 7.611, "blocklist_de": -2.1517}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.763, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-IU17-RIPE", "org": "Infium, UAB", "pdb": null, "pfx": 9, "reg": "2009-12-15", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 3072, "abuse": "abusemail@infiumhost.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0000079014595}, {"a": 50304, "h": "BLIX", "n": "Blix Solutions AS", "t": "Transit & backbone", "w": 13, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 3, "web_exploit": 6, "bad_crawling": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 5, "web_bruteforce": 7, "mail_bruteforce": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2019-8318": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-13379": 2, "cve:CVE-2018-20062": 2}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "dshield": {"n": 3, "p": 0.5926, "hi": 7.17, "lo": 1.26, "ips": 3, "mean": 3.70, "above": false}, "crowdsec": {"n": 6, "p": 0.8670, "hi": 8.45, "lo": 2.34, "ips": 8, "mean": 5.00, "above": true}, "blocklist_de": {"n": 4, "p": 0.7282, "hi": 7.88, "lo": 1.70, "ips": 4, "mean": 4.30, "above": false}}, "h2": [["2026-10-05", 4.691, 0.010, 0, false], ["2026-10-12", 8.978, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 1.721, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 4}, "lo": 8.978, "se": 0.451, "ts": 0.429, "map": 15.794, "obs": 14, "own": 49.238, "comp": {"cins": 1.1103, "dshield": 2.3427, "crowdsec": -0.202, "vulncheck": -0.9318, "blocklist_de": 1.8342}, "mass": 13.2, "listed": false}}, "abq": false, "bot": 0.780, "det": {"blocklist_de": {"ssh": 1, "bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-BLIX1-RIPE", "org": "Blix Solutions AS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "https://www.blix.com"}, "pfx": 84, "reg": "2009-12-16", "rir": "ripencc", "s24": 151, "sib": 0, "tor": 1, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44032, "abuse": "abuse@blixsolutions.no", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00314121770465}, {"a": 50340, "h": "SELECTEL-MSK", "n": "Selectel MSK", "t": "Hosting & VPS", "w": 30, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 1}, "n": 4}, "ev": {"shodan": {"n": 16, "p": 0.9764, "hi": 7.41, "lo": 3.31, "ips": 16, "mean": 5.19, "above": true}, "dshield": {"n": 2, "p": 0.1498, "hi": 4.00, "lo": 0.52, "ips": 2, "mean": 1.90, "above": false}, "crowdsec": {"n": 4, "p": 0.0107, "hi": 2.39, "lo": 0.51, "ips": 4, "mean": 1.30, "above": false}, "vulncheck": {"n": 19, "p": 1.0000, "hi": 17.88, "lo": 8.50, "ips": 23, "mean": 12.83, "above": true}, "blocklist_de": {"n": 3, "p": 0.1170, "hi": 3.62, "lo": 0.64, "ips": 3, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.669, 0.008, 0, false], ["2026-10-12", 1.308, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.832, "ts": null, "map": 0.128, "obs": 0, "own": 0.098, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 19, "blocklist_de": 3}, "lo": 1.308, "se": 0.435, "ts": 0.679, "map": 2.222, "obs": 28, "own": 0.438, "comp": {"cins": -1.892, "dshield": 0.7547, "crowdsec": -3.299, "vulncheck": 7.4171, "blocklist_de": -0.7889}, "mass": 13.2, "listed": false}}, "abq": false, "bot": 0.866, "det": {"shodan": {"c2": 8, "compromised": 8}, "vulncheck": {"c2_server": 3, "botnet_node": 19, "attack_tooling": 1}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-SL223-RIPE", "org": "JSC Selectel", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.selectel.com"}, "pfx": 549, "reg": "2017-10-16", "rir": "ripencc", "s24": 1066, "sib": 4, "tor": 0, "w24": 25, "drop": 3, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.8435]], "ipv4": 387584, "abuse": "abuse@selectel.ru", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.0041958715645}, {"a": 50360, "h": "TAMATIYA-AS", "n": "4vendeta", "t": "Broadband & mobile", "w": 39, "cc": "BG", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 4, "web_exploit": 2, "bad_crawling": 3, "ssh_bruteforce": 6, "web_bruteforce": 3, "home_connection": 6, "cve:CVE-2009-1558": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-13379": 2, "cve:CVE-2021-41773": 1}, "n": 12}, "ev": {"cins": {"n": 7, "p": 0.9875, "hi": 13.03, "lo": 3.94, "ips": 27, "mean": 7.93, "above": true}, "dshield": {"n": 7, "p": 0.9873, "hi": 12.99, "lo": 3.93, "ips": 26, "mean": 7.91, "above": true}, "crowdsec": {"n": 6, "p": 0.9569, "hi": 11.19, "lo": 3.10, "ips": 12, "mean": 6.61, "above": true}, "phishing_db": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 4, "p": 0.8032, "hi": 8.94, "lo": 1.92, "ips": 4, "mean": 4.88, "above": true}}, "h2": [["2026-10-05", 86.096, 0.522, 1, false], ["2026-10-12", 123.513, 0.543, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.543, "se": 1.582, "ts": 1.000, "map": 5.963, "obs": 1, "own": 17.965, "comp": {"urlhaus": -0.0887, "threatfox": -0.1149, "phishing_db": 3.6154}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 7, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 4}, "lo": 123.513, "se": 0.404, "ts": 0.292, "map": 201.208, "obs": 24, "own": 306.345, "comp": {"cins": 12.8644, "dshield": 4.1761, "crowdsec": -5.293, "vulncheck": -0.9691, "blocklist_de": -4.0804}, "mass": 24.3, "listed": false}}, "abq": false, "bot": 0.323, "det": {"blocklist_de": {"ssh": 1, "apache": 3}}, "oid": "ORG-IPTL2-RIPE", "org": "Tamatiya EOOD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://4vendeta.com"}, "pfx": 22, "reg": "2014-11-06", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 5632, "abuse": "noc@4vendeta.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": 0.00004702536371}, {"a": 50436, "h": "TC-CIN", "n": "PŸUR - CIN", "t": "Broadband & mobile", "w": 1, "cc": "DE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.0809, "hi": 3.43, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}}, "h2": [["2026-10-05", 0.779, 0.010, 0, false], ["2026-10-12", 0.078, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.916, "ts": null, "map": 0.161, "obs": 0, "own": 0.929, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.078, "se": 1.118, "ts": 1.000, "map": 0.471, "obs": 1, "own": 0.792, "comp": {"cins": -0.2223, "dshield": -0.4937, "crowdsec": -1.9507, "vulncheck": -0.445, "blocklist_de": 3.7515}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BBG1-RIPE", "org": "Tele Columbus AG", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "https://www.pyur.com"}, "pfx": 49, "reg": "2022-06-24", "rir": "ripencc", "s24": 359, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 116992, "abuse": "abuse@mip-platform.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0110510986638}, {"a": 50463, "h": "TRIPLEC-ASN", "n": "Triple C Cloud Computing", "t": "Broadband & mobile", "w": 6, "cc": "IL", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "home_connection": 6, "mail_bruteforce": 5, "router_or_botnet": 1}, "n": 6}, "ev": {"crowdsec": {"n": 6, "p": 0.8724, "hi": 8.55, "lo": 2.37, "ips": 6, "mean": 5.05, "above": true}, "blocklist_de": {"n": 3, "p": 0.5440, "hi": 6.71, "lo": 1.18, "ips": 3, "mean": 3.46, "above": false}}, "h2": [["2026-10-05", 3.287, 0.010, 0, false], ["2026-10-12", 5.275, 0.011, 0, false]], "sh": false, "uc": 1204.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 1.224, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.275, "se": 0.502, "ts": 0.667, "map": 10.071, "obs": 9, "own": 15.505, "comp": {"cins": -1.3926, "dshield": -2.0798, "crowdsec": 4.8541, "vulncheck": -0.8851, "blocklist_de": 3.2067}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.429, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-TCCL1-RIPE", "org": "Triple C Cloud Computing Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.ccc.co.il/en/"}, "pfx": 79, "reg": "2010-01-21", "rir": "ripencc", "s24": 145, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 56064, "abuse": "abuse@ccc.co.il", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00095024193446}, {"a": 50474, "h": "O2SWITCH", "n": "O2SWITCH", "t": "Hosting & VPS", "w": 4, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7821, "hi": 8.60, "lo": 1.85, "ips": 4, "mean": 4.70, "above": false}}, "h2": [["2026-10-05", 10.500, 0.011, 1, false], ["2026-10-12", 7.659, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.659, "se": 0.678, "ts": 1.000, "map": 20.232, "obs": 4, "own": 3.999, "comp": {"cins": -0.5846, "dshield": -1.128, "crowdsec": 9.7769, "vulncheck": -0.7026, "blocklist_de": -2.9608}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.989, "det": null, "oid": "ORG-OS50-RIPE", "org": "O2SWITCH SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.o2switch.fr"}, "pfx": 11, "reg": "2010-01-22", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@o2switch.fr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00185001856754}, {"a": 50477, "h": "SV-EN-AS", "n": "Svyaz-Energo Ltd.", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1806, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.192, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.577, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.192, "se": 1.222, "ts": 1.000, "map": 1.409, "obs": 1, "own": 0.893, "comp": {"cins": -0.1508, "dshield": 4.385, "crowdsec": -1.3656, "vulncheck": -0.3475, "blocklist_de": -0.7849}, "mass": 0.7, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-SL255-RIPE", "org": "Svyaz-Energo Ltd.", "pdb": null, "pfx": 29, "reg": "2010-01-25", "rir": "ripencc", "s24": 80, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006892687494}, {"a": 50482, "h": "KAZAKHTELECOM-AS", "n": "JSC Kazakhtelecom", "t": "Broadband & mobile", "w": 4, "cc": "KZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "router_or_botnet": 2}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.4979, "hi": 5.86, "lo": 1.26, "ips": 4, "mean": 3.20, "above": false}, "blocklist_de": {"n": 1, "p": 0.1182, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}}, "h2": [["2026-10-05", 1.091, 0.010, 0, false], ["2026-10-12", 1.579, 0.011, 0, false]], "sh": false, "uc": 69.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.173, "obs": 0, "own": 1.098, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.579, "se": 0.604, "ts": 0.800, "map": 3.627, "obs": 5, "own": 5.628, "comp": {"cins": -0.8569, "dshield": -1.5053, "crowdsec": 6.0945, "vulncheck": -0.792, "blocklist_de": -0.258}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.353, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-KDNA1-RIPE", "org": "JSC Kazakhtelecom", "pdb": null, "pfx": 44, "reg": "2010-01-26", "rir": "ripencc", "s24": 211, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 206336, "abuse": "abuse@telecom.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036909182828}, {"a": 50498, "h": "LIPETSK-AS", "n": "JSC \"ER-Telecom Holding\" Lipetsk branch", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1431, "hi": 3.94, "lo": 0.51, "ips": 2, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.326, 0.010, 0, false], ["2026-10-12", 0.338, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.951, "ts": null, "map": 0.172, "obs": 0, "own": 1.077, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.338, "se": 0.871, "ts": 1.000, "map": 1.266, "obs": 2, "own": 2.018, "comp": {"cins": -0.3627, "dshield": -0.7608, "crowdsec": 5.1927, "vulncheck": -0.5771, "blocklist_de": -1.8623}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 65, "reg": "2010-01-29", "rir": "ripencc", "s24": 225, "sib": 121, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 99328, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008144894989}, {"a": 50509, "h": "TRANSROUTE", "n": "Transroute Telecom main AS", "t": "Broadband & mobile", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.947, "det": null, "oid": "ORG-TA1419-RIPE", "org": "Transroute Telecom LTD", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "http://transroute.net"}, "pfx": 4, "reg": "2019-10-22", "rir": "ripencc", "s24": 5, "sib": 1, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@transroute.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50540, "h": "DT-EU-SOUTHEAST-2A", "n": "DT Iletisim Hizmetleri A.S.", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.942, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DIHA4-RIPE", "org": "DT Iletisim Hizmetleri A.S.", "pdb": null, "pfx": 5, "reg": "2022-08-05", "rir": "ripencc", "s24": 5, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50542, "h": "VORONEZH-AS", "n": "JSC \"ER-Telecom Holding\" Voronezh branch", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.3947, "hi": 5.53, "lo": 0.98, "ips": 3, "mean": 2.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1374, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.898, 0.010, 0, false], ["2026-10-12", 1.563, 0.011, 0, false]], "sh": false, "uc": 292.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 1.210, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.563, "se": 0.660, "ts": 0.750, "map": 3.973, "obs": 4, "own": 6.184, "comp": {"cins": -0.7006, "dshield": -1.2975, "crowdsec": 4.8172, "vulncheck": -0.7465, "blocklist_de": 0.7005}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.439, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 47, "reg": "2010-02-08", "rir": "ripencc", "s24": 151, "sib": 121, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 66816, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005572674877}, {"a": 50543, "h": "SARATOV-AS", "n": "JSC \"ER-Telecom Holding\" Saratov branch", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 4, "home_connection": 2, "router_or_botnet": 1, "cve:CVE-2024-6387": 2}, "n": 4}, "ev": {"dshield": {"n": 1, "p": 0.1480, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 4, "p": 0.4543, "hi": 5.58, "lo": 1.20, "ips": 4, "mean": 3.05, "above": false}, "blocklist_de": {"n": 1, "p": 0.1095, "hi": 3.77, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.593, 0.010, 0, false], ["2026-10-12", 1.794, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.946, "ts": null, "map": 0.170, "obs": 0, "own": 1.054, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.794, "se": 0.566, "ts": 0.667, "map": 3.824, "obs": 6, "own": 5.920, "comp": {"cins": -0.9929, "dshield": 1.1286, "crowdsec": 4.4994, "vulncheck": -0.8228, "blocklist_de": -1.0773}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.442, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 67, "reg": "2010-02-08", "rir": "ripencc", "s24": 241, "sib": 121, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 105984, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014245481173}, {"a": 50565, "h": "MuzafferGuler", "n": "Muzaffer Guler", "t": "Other", "w": 4, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.351, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.351, "se": 1.705, "ts": 1.000, "map": 21.964, "obs": 1, "own": 20.517, "comp": {"cins": -0.0302, "dshield": 5.0543, "crowdsec": -0.2892, "vulncheck": -0.0934, "blocklist_de": -0.1585}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.608, "det": null, "oid": "ORG-GMG14-RIPE", "org": "Muzaffer Guler", "pdb": null, "pfx": 1, "reg": "2022-08-05", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50577, "h": "INTELSC-AS", "n": "INTELSC Ltd", "t": "Transit & backbone", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 9.952, 0.011, 0, false], ["2026-10-12", 4.075, 0.012, 0, false]], "sh": false, "uc": 6445.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 3.008, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.075, "se": 1.003, "ts": 0.500, "map": 19.743, "obs": 2, "own": 64.971, "comp": {"cins": -0.2577, "dshield": -0.5638, "crowdsec": 2.1624, "vulncheck": -0.4843, "blocklist_de": 3.5198}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.498, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-IL193-RIPE", "org": "Intelsc Ltd.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.intelsc.ru"}, "pfx": 2, "reg": "2010-02-12", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50581, "h": "UTG", "n": "UTG", "t": "Transit & backbone", "w": 7, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.6193, "hi": 7.44, "lo": 1.31, "ips": 3, "mean": 3.84, "above": false}, "crowdsec": {"n": 1, "p": 0.1243, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "vulncheck": {"n": 2, "p": 0.3966, "hi": 6.05, "lo": 0.79, "ips": 2, "mean": 2.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-12", 5.145, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.021, "ts": null, "map": 0.187, "obs": 0, "own": 2.055, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 1}, "lo": 5.145, "se": 0.561, "ts": 0.429, "map": 10.791, "obs": 7, "own": 34.050, "comp": {"cins": -0.9152, "dshield": 7.2195, "crowdsec": -3.2825, "vulncheck": 1.3618, "blocklist_de": -0.6111}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.227, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-UTGL1-RIPE", "org": "Ukrainian Telecommunication Group LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://utelecom.com.ua"}, "pfx": 76, "reg": "2011-02-25", "rir": "ripencc", "s24": 77, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": "abuse@utelecom.com.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00420399166485}, {"a": 50597, "h": "ScopeSky", "n": "ScopeSky Communications LLC.", "t": "Transit & backbone", "w": 3, "cc": "IQ", "cf": null, "cs": {"c": {"web_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3525, "hi": 5.66, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 3.056, 0.012, 0, false]], "sh": false, "uc": 1878.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 2.358, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.056, "se": 0.768, "ts": 0.667, "map": 9.411, "obs": 3, "own": 29.967, "comp": {"cins": -0.4877, "dshield": -0.9753, "crowdsec": 3.7187, "vulncheck": -0.6563, "blocklist_de": 2.0361}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.203, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SCAI1-RIPE", "org": "ScopeSky for communications, internet and technology services LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.scopesky.com"}, "pfx": 49, "reg": "2010-02-16", "rir": "ripencc", "s24": 42, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": "abuse@scopesky.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001234133456}, {"a": 50599, "h": "DATASPACE", "n": "DATASPACE-PL", "t": "Transit & backbone", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3339, "hi": 5.51, "lo": 0.72, "ips": 3, "mean": 2.62, "above": false}, "blocklist_de": {"n": 1, "p": 0.1747, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.996, 0.011, 0, false], ["2026-10-12", 2.453, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 2.233, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.453, "se": 0.763, "ts": 0.667, "map": 7.505, "obs": 3, "own": 23.898, "comp": {"cins": -0.4987, "dshield": -0.9931, "crowdsec": 3.5965, "vulncheck": -0.6621, "blocklist_de": 1.9666}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.899, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-DP207-RIPE", "org": "DATASPACE P.S.A.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://dataspace.pl"}, "pfx": 27, "reg": "2010-02-16", "rir": "ripencc", "s24": 54, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": "abuse@dataspace.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033796847058}, {"a": 50613, "h": "ThorDC-AS", "n": "Advania Hosting", "t": "Hosting & VPS", "w": 26, "cc": "IS", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 2, "proxy_or_vpn": 6, "ssh_bruteforce": 4, "web_bruteforce": 6, "mail_bruteforce": 1, "cve:CVE-2018-20062": 5, "cve:CVE-2021-41773": 2, "cve:CVE-2021-44228": 1, "cve:CVE-2023-22515": 1, "cve:CVE-2024-28000": 2}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.1407, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "crowdsec": {"n": 3, "p": 0.5224, "hi": 6.52, "lo": 1.15, "ips": 6, "mean": 3.36, "above": false}, "phishing_db": {"n": 1, "p": 0.1841, "hi": 4.58, "lo": 0.34, "ips": 4, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1676, "hi": 4.41, "lo": 0.33, "ips": 16, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 5.101, 0.337, 0, false], ["2026-10-12", 3.116, 0.351, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.351, "se": 1.487, "ts": 1.000, "map": 3.157, "obs": 1, "own": 1.421, "comp": {"urlhaus": -0.1487, "threatfox": -0.1727, "phishing_db": 3.0973}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.116, "se": 0.668, "ts": 0.750, "map": 7.973, "obs": 4, "own": 1.580, "comp": {"cins": -0.667, "dshield": -1.2499, "crowdsec": 5.2125, "vulncheck": -0.7349, "blocklist_de": 0.909}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.865, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 16, "apache": 16}}, "oid": "ORG-SH2-RIPE", "org": "Advania Island ehf", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Restrictive", "web": "https://advania.is/"}, "pfx": 17, "reg": "2010-02-18", "rir": "ripencc", "s24": 71, "sib": 2, "tor": 6, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": "abuse@advania.is", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001789205649}, {"a": 50619, "h": "RAZU", "n": "Visium", "t": "Hosting & VPS", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 5.699, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-VML13-RIPE", "org": "RAZU.MEDIA LLC", "pdb": {"t": "Content", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Selective", "web": "http://visium.tv"}, "pfx": 1, "reg": "2010-02-19", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50625, "h": "KROSOFT-AS", "n": "Krosnienckie Centrum Informatyczne \"Krosoft\"", "t": "Transit & backbone", "w": 2, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1664, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.3971, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 1.483, 0.011, 0, false], ["2026-10-12", 1.621, 0.012, 0, false]], "sh": false, "uc": 570.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 2.420, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.621, "se": 0.947, "ts": 1.000, "map": 7.070, "obs": 2, "own": 23.090, "comp": {"cins": -0.3352, "dshield": -0.7108, "crowdsec": -2.8034, "vulncheck": -0.5556, "blocklist_de": 7.7547}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.145, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-KCI1-RIPE", "org": "Krosnienskie Centrum Informatyczne \"KROSOFT\"", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.krosoft.pl"}, "pfx": 11, "reg": "2010-02-22", "rir": "ripencc", "s24": 37, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00062573084496}, {"a": 50666, "h": "LIGAT", "n": "LigaT Telecom", "t": "Broadband & mobile", "w": 3, "cc": "PT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.571, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.571, "se": 1.432, "ts": 1.000, "map": 5.994, "obs": 1, "own": 11.949, "comp": {"cins": -0.0574, "dshield": -0.1368, "crowdsec": -0.5421, "vulncheck": 4.221, "blocklist_de": -0.3003}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.254, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-LCUL1-RIPE", "org": "LigaT Telecom Sociedade Unipessoal LDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://ligat.pt"}, "pfx": 4, "reg": "2022-08-03", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@ligat.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003373477632}, {"a": 50671, "h": "GOROD-AS", "n": "OOO SET", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.463, "det": {"shodan": {"c2": 1}}, "oid": "ORG-OS57-RIPE", "org": "OOO SET", "pdb": null, "pfx": 9, "reg": "2010-03-05", "rir": "ripencc", "s24": 12, "sib": 9, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@zelenaya.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50673, "h": "Serverius-as", "n": "Serverius", "t": "Hosting & VPS", "w": 7, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 3, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2025-4396": 2, "cve:CVE-2021-23394": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1606, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "shodan": {"n": 4, "p": 0.5444, "hi": 6.19, "lo": 1.33, "ips": 4, "mean": 3.38, "above": false}, "crowdsec": {"n": 4, "p": 0.4788, "hi": 5.74, "lo": 1.23, "ips": 7, "mean": 3.13, "above": false}, "blocklist_de": {"n": 1, "p": 0.1144, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 1.638, 0.010, 0, false], ["2026-10-12", 2.045, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.951, "ts": null, "map": 0.172, "obs": 0, "own": 0.167, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.045, "se": 0.569, "ts": 0.667, "map": 4.413, "obs": 6, "own": 0.871, "comp": {"cins": 2.9586, "dshield": -1.7323, "crowdsec": 3.8915, "vulncheck": -0.8336, "blocklist_de": -1.4061}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.924, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SHB2-RIPE", "org": "Serverius Holding B.V.", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://serverius.net"}, "pfx": 73, "reg": "2010-03-05", "rir": "ripencc", "s24": 224, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 62976, "abuse": "abuse@serverius.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000571750085}, {"a": 50685, "h": "UNITED-NETWORKS-AS", "n": "United Networks Ltd.", "t": "Broadband & mobile", "w": 6, "cc": "BY", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4155, "hi": 6.22, "lo": 0.81, "ips": 6, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 1.500, 0.011, 0, false], ["2026-10-12", 1.365, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.365, "se": 0.966, "ts": 1.000, "map": 5.890, "obs": 2, "own": 9.951, "comp": {"cins": -0.1725, "dshield": -0.3912, "crowdsec": -1.5471, "vulncheck": 6.1743, "blocklist_de": -0.8966}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.220, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-UNL5-RIPE", "org": "United Networks Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://unet.by"}, "pfx": 19, "reg": "2010-03-09", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "admin@unet.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00065659002304}, {"a": 50751, "h": "Chuguev", "n": "Chuguev", "t": "Other", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.491, 0.011, 0, false], ["2026-10-12", 0.538, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.538, "se": 1.405, "ts": 1.000, "map": 5.518, "obs": 1, "own": 3.827, "comp": {"cins": -0.0972, "dshield": -0.2276, "crowdsec": -0.9016, "vulncheck": -0.2525, "blocklist_de": 4.5806}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CHKS2-RIPE", "org": "CHKS LLC", "pdb": null, "pfx": 5, "reg": "2010-03-19", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "support@chuguev.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00067465322208}, {"a": 50810, "h": "Mobinnet-AS", "n": "Mobin Net Communication Company (Private Joint Stock)", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0039, "hi": 1.84, "lo": 0.14, "ips": 1, "mean": 0.78, "above": false}}, "h2": [["2026-10-12", 0.052, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.878, "ts": null, "map": 0.147, "obs": 0, "own": 0.316, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.052, "se": 1.079, "ts": 1.000, "map": 0.290, "obs": 1, "own": 0.177, "comp": {"cins": -0.226, "dshield": -0.501, "crowdsec": 2.5033, "vulncheck": -0.4492, "blocklist_de": -1.1704}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.583, "det": null, "oid": "ORG-MNCC1-RIPE", "org": "Mobin Net Communication Company (Private Joint Stock)", "pdb": null, "pfx": 184, "reg": "2010-03-29", "rir": "ripencc", "s24": 592, "sib": 1, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-12", 0.0012]], "ipv4": 224512, "abuse": "abuse@mobinnet.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00600600746355}, {"a": 50825, "h": "UVT", "n": "UVT Internet", "t": "Broadband & mobile", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 0.926, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UIS8-RIPE", "org": "UVT Internet s.r.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.uvtnet.cz"}, "pfx": 6, "reg": "2010-03-31", "rir": "ripencc", "s24": 29, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": "abuse@uvtnet.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00121221364895}, {"a": 50839, "h": "Netlayer", "n": "Netlayer India Private Limited", "t": "Transit & backbone", "w": 2, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 3.643, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 113.579, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "ORG-CTTA1-RIPE", "org": "Cinzia Tocci trading as Lumanex Srl", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Selective", "web": "https://netlayer.net"}, "pfx": 1, "reg": "2021-05-31", "rir": "ripencc", "s24": 1, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50867, "h": "ORG-LVA15-AS", "n": "HOSTKEY", "t": "Hosting & VPS", "w": 8, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7182, "hi": 7.76, "lo": 1.67, "ips": 4, "mean": 4.24, "above": false}, "vulncheck": {"n": 3, "p": 0.6176, "hi": 7.43, "lo": 1.31, "ips": 3, "mean": 3.83, "above": false}, "phishing_db": {"n": 3, "p": 0.6197, "hi": 7.45, "lo": 1.31, "ips": 5, "mean": 3.84, "above": false}}, "h2": [["2026-10-05", 5.042, 3.280, 0, false], ["2026-10-12", 0.881, 3.205, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 3.205, "se": 1.003, "ts": 1.000, "map": 11.037, "obs": 3, "own": 4.111, "comp": {"urlhaus": -0.537, "threatfox": -0.3739, "phishing_db": 4.9383}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.881, "se": 0.780, "ts": 1.000, "map": 2.652, "obs": 3, "own": 0.556, "comp": {"cins": -0.2887, "dshield": -0.6237, "crowdsec": -2.4618, "vulncheck": 7.2326, "blocklist_de": -1.4892}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 2, "botnet_node": 1}}, "oid": "ORG-HB14-RIPE", "org": "HOSTKEY B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.hostkey.ru"}, "pfx": 88, "reg": "2020-12-30", "rir": "ripencc", "s24": 84, "sib": 1, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33280, "abuse": "abuse@hostkey.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50873, "h": "AS50873", "n": "David Doepelheuer", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.196, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.740, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DD243-RIPE", "org": "David Doepelheuer", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": null}, "pfx": 5, "reg": "2017-09-28", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "abuse@as50873.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50926, "h": "AXARNET-AS", "n": "Axarnet Comunicaciones S.L.", "t": "Hosting & VPS", "w": 19, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 11, "data_centre": 13, "web_exploit": 15, "bad_crawling": 2, "proxy_or_vpn": 12, "first_seen_30d": 3, "ssh_bruteforce": 2, "web_bruteforce": 17, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2026-8181": 3, "cve:CVE-2024-28000": 9}, "n": 18}, "ev": {"cins": {"n": 1, "p": 0.1752, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "shodan": {"n": 2, "p": 0.2595, "hi": 4.89, "lo": 0.64, "ips": 2, "mean": 2.33, "above": false}, "crowdsec": {"n": 16, "p": 1.0000, "hi": 17.92, "lo": 7.99, "ips": 18, "mean": 12.54, "above": true}}, "h2": [["2026-10-05", 11.840, 0.010, 1, false], ["2026-10-12", 10.672, 0.011, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.180, "obs": 0, "own": 0.193, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 16, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.672, "se": 0.432, "ts": 0.941, "map": 17.837, "obs": 17, "own": 3.486, "comp": {"cins": 1.1051, "dshield": -2.4863, "crowdsec": 15.4957, "vulncheck": -0.932, "blocklist_de": -8.9075}, "mass": 13.2, "listed": false}}, "abq": false, "bot": 0.926, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ISS3-RIPE", "org": "AXARNET COMUNICACIONES, S.L.", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://axarnet.es"}, "pfx": 31, "reg": "2010-04-22", "rir": "ripencc", "s24": 134, "sib": 2, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34304, "abuse": "abuse@axarnet.es", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00032804913245}, {"a": 50949, "h": "agronet-ru-as", "n": "Agronet LLC", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 2.647, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.647, "se": 0.994, "ts": 0.500, "map": 12.319, "obs": 2, "own": 7.506, "comp": {"cins": -0.1958, "dshield": 4.1529, "crowdsec": -1.7377, "vulncheck": 2.7013, "blocklist_de": -1.016}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.431, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-AL329-RIPE", "org": "Agronet LLC", "pdb": null, "pfx": 7, "reg": "2010-04-29", "rir": "ripencc", "s24": 12, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@agronet.com.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 50953, "h": "KONFER", "n": "KONFER", "t": "Broadband & mobile", "w": 4, "cc": "SK", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.442, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.442, "se": 1.377, "ts": 1.000, "map": 4.186, "obs": 1, "own": 8.075, "comp": {"cins": -0.0685, "dshield": -0.1625, "crowdsec": -0.644, "vulncheck": 4.0589, "blocklist_de": -0.3584}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.157, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-DKTA1-RIPE", "org": "David Kondicz trading as KONFER networks", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.konfer.sk"}, "pfx": 2, "reg": "2010-04-29", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "admin@konfer.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020131660626}, {"a": 50998, "h": "DSTNY-ULYSSE", "n": "Destiny", "t": "Other", "w": 0, "cc": "BE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.184, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DN490-RIPE", "org": "Dstny BE N.V.", "pdb": null, "pfx": 2, "reg": "2010-05-11", "rir": "ripencc", "s24": 12, "sib": 9, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@dstny.be", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003523323157}, {"a": 51013, "h": "WEBSUPPORT-SRO-SK-AS", "n": "Websupport", "t": "Hosting & VPS", "w": 0, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3722, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.263, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.105, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.972, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-WS58-RIPE", "org": "WebSupport s.r.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.websupport.sk/"}, "pfx": 25, "reg": "2010-05-17", "rir": "ripencc", "s24": 37, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": "abuse@websupport.sk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00054378387168}, {"a": 51032, "h": "NEVOD-AS", "n": "Nevod-Region", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0705, "hi": 3.29, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "blocklist_de": {"n": 1, "p": 0.1324, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.371, 0.010, 0, false], ["2026-10-12", 0.462, 0.011, 0, false]], "sh": false, "uc": 193, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 1.178, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.462, "se": 0.885, "ts": 0.500, "map": 1.785, "obs": 2, "own": 2.851, "comp": {"cins": -0.3759, "dshield": -0.7846, "crowdsec": 0.9686, "vulncheck": -0.5868, "blocklist_de": 2.7519}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.424, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LP174-RIPE", "org": "LLC POWERNET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.powernet.com.ru"}, "pfx": 11, "reg": "2010-05-20", "rir": "ripencc", "s24": 166, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42752, "abuse": "info@powernet.com.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007432472509}, {"a": 51064, "h": "GITD-PL", "n": "Glowny Inspektorat Transportu Drogowego", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.346, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-GITD1-RIPE", "org": "Glowny Inspektorat Transportu Drogowego", "pdb": null, "pfx": 2, "reg": "2010-05-26", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "admin@gitd.gov.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51089, "h": "SNAPSTACK-AS", "n": "SnapStack-HK", "t": "Transit & backbone", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 3.258, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 3.869, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.445, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SNAP4-RIPE", "org": "SnapStack Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "No", "web": "https://snapstack.hk/"}, "pfx": 6, "reg": "2020-04-30", "rir": "ripencc", "s24": 5, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@snapstack.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51095, "h": "E1-EMEA", "n": "EdgeUno MEA", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.848, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-EI79-RIPE", "org": "EdgeUno, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Restrictive", "web": "http://www.edgeuno.com"}, "pfx": 1, "reg": "2020-07-21", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@edgeuno.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51101, "h": "Rewolucja-net", "n": "Rewolucja-Net Marceli Kaczor", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1401.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 1.184, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.171, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-MKTA6-RIPE", "org": "Marceli Kaczo trading as Rewolucja-NET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.rewolucja-net.pl"}, "pfx": 6, "reg": "2010-06-01", "rir": "ripencc", "s24": 17, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004829372847}, {"a": 51124, "h": "ITPLUS-UA-AS", "n": "FOP Dolgiy Andriy Fedorovuch", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.150, "det": null, "oid": "ORG-FDAF1-RIPE", "org": "FOP Dolgiy Andriy Fedorovuch", "pdb": null, "pfx": 2, "reg": "2011-02-21", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "admin@bignet.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51142, "h": "ExpressNetwork", "n": "ExpressNetwork", "t": "Other", "w": 10, "cc": "GE", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6455, "hi": 7.73, "lo": 1.36, "ips": 10, "mean": 3.99, "above": false}}, "h2": [["2026-10-12", 9.592, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 9.592, "se": 0.834, "ts": 1.000, "map": 32.420, "obs": 3, "own": 19.562, "comp": {"cins": -0.2138, "dshield": -0.4764, "crowdsec": -1.8826, "vulncheck": 8.5533, "blocklist_de": -1.1081}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.587, "det": {"vulncheck": {"botnet_node": 10}}, "oid": "ORG-LEN3-RIPE", "org": "LLC Ekspres Netvork", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.enetwork.ge"}, "pfx": 5, "reg": "2017-02-13", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "info@enetwork.ge", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038416911065}, {"a": 51143, "h": "Informatika", "n": "Informatika d.o.o.", "t": "Other", "w": 0, "cc": "SI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.210, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-ID24-RIPE", "org": "Informatika d.o.o.", "pdb": null, "pfx": 1, "reg": "2010-06-08", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003019798046}, {"a": 51155, "h": "TBTELECOM", "n": "Citylink Telecom", "t": "Broadband & mobile", "w": 2, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.435, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.435, "se": 1.360, "ts": 1.000, "map": 4.121, "obs": 1, "own": 7.609, "comp": {"cins": -0.1113, "dshield": -0.2591, "crowdsec": -1.0261, "vulncheck": -0.2798, "blocklist_de": 4.4863}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-TTSZ1-RIPE", "org": "Citylink Telecom Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.citylink.pl/"}, "pfx": 3, "reg": "2010-06-09", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "ripe@tbtelecom.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029846338626}, {"a": 51167, "h": "CONTABO", "n": "Contabo", "t": "Hosting & VPS", "w": 1857, "cc": "DE", "cf": {"rb": "", "wb": "", "rep": 2.88, "waf": 5.47}, "cs": {"c": {"http_flood": 1220, "data_centre": 1352, "web_exploit": 1244, "bad_crawling": 1231, "proxy_or_vpn": 435, "first_seen_30d": 82, "ssh_bruteforce": 144, "web_bruteforce": 231, "home_connection": 5, "mail_bruteforce": 12, "router_or_botnet": 459, "cve:CVE-2017-9841": 71, "cve:CVE-2019-9082": 50, "cve:CVE-2018-20062": 65, "cve:CVE-2024-28000": 19, "cve:CVE-2025-55182": 41}, "n": 1532}, "ev": {"cins": {"n": 18, "p": 1.0000, "hi": 14.08, "lo": 6.56, "ips": 18, "mean": 10.02, "above": true}, "shodan": {"n": 1021, "p": 1.0000, "hi": 194.45, "lo": 175.43, "ips": 1021, "mean": 184.84, "above": true}, "dshield": {"n": 22, "p": 1.0000, "hi": 14.65, "lo": 7.33, "ips": 23, "mean": 10.73, "above": true}, "urlhaus": {"n": 1, "p": 0.1269, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 580, "p": 1.0000, "hi": 93.63, "lo": 81.68, "ips": 1532, "mean": 87.57, "above": true}, "threatfox": {"n": 21, "p": 1.0000, "hi": 22.82, "lo": 11.24, "ips": 22, "mean": 16.60, "above": true}, "vulncheck": {"n": 132, "p": 1.0000, "hi": 72.21, "lo": 54.27, "ips": 151, "mean": 62.97, "above": true}, "phishing_db": {"n": 54, "p": 1.0000, "hi": 33.27, "lo": 21.32, "ips": 55, "mean": 27.01, "above": true}, "blocklist_de": {"n": 83, "p": 1.0000, "hi": 30.45, "lo": 21.25, "ips": 86, "mean": 25.67, "above": true}}, "h2": [["2026-10-05", 30.917, 6.828, 2, false], ["2026-10-12", 32.863, 6.201, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 1, "threatfox": 21, "phishing_db": 54}, "lo": 6.201, "se": 0.736, "ts": 0.711, "map": 12.337, "obs": 76, "own": 4.455, "comp": {"urlhaus": -2.0417, "threatfox": 1.3997, "phishing_db": 4.7808}, "mass": 34.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 18, "dshield": 22, "crowdsec": 580, "vulncheck": 132, "blocklist_de": 83}, "lo": 32.863, "se": 0.343, "ts": 0.695, "map": 48.680, "obs": 835, "own": 9.466, "comp": {"cins": -1.478, "dshield": -2.382, "crowdsec": 16.2184, "vulncheck": 0.4353, "blocklist_de": -7.5148}, "mass": 566.7, "listed": true}}, "abq": false, "bot": 0.714, "det": {"shodan": {"c2": 140, "malware": 8, "compromised": 856, "doublepulsar": 17}, "threatfox": {"family:Havoc": 3, "family:PureRAT": 3, "family:AsyncRAT": 2, "family:AdaptixC2": 2, "family:Unknown malware": 10}, "vulncheck": {"c2_server": 50, "botnet_node": 38, "attack_tooling": 55, "other_infrastructure": 8}, "blocklist_de": {"ftp": 13, "sip": 1, "ssh": 47, "bots": 12, "imap": 5, "mail": 6, "apache": 7, "bruteforcelogin": 6}}, "oid": "ORG-GG22-RIPE", "org": "Contabo GmbH", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.contabo.com"}, "pfx": 568, "reg": "2010-06-11", "rir": "ripencc", "s24": 2120, "sib": 0, "tor": 3, "w24": 780, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 543232, "abuse": "abuse@contabo.de", "score": 1.0000, "groups": ["sensors", "cloudflare", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": 0.113263}, {"a": 51173, "h": "PBB", "n": "Premier Data Networks LTD", "t": "Other", "w": 5, "cc": "IE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 4, "p": 0.8082, "hi": 9.03, "lo": 1.94, "ips": 5, "mean": 4.93, "above": true}}, "h2": [["2026-10-05", 31.195, 0.011, 1, false], ["2026-10-12", 17.622, 0.012, 1, false]], "sh": false, "uc": 8473.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 17.622, "se": 0.692, "ts": 1.000, "map": 47.353, "obs": 4, "own": 26.833, "comp": {"cins": -0.716, "dshield": -1.319, "crowdsec": -5.1742, "vulncheck": -0.7516, "blocklist_de": 13.2122}, "mass": 3.4, "listed": false}}, "abq": true, "bot": 0.132, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "ORG-PCBS1-RIPE", "org": "Premier Data Networks LTD", "pdb": null, "pfx": 13, "reg": "2010-06-14", "rir": "ripencc", "s24": 13, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00003745003572}, {"a": 51177, "h": "THCProjects", "n": "TIPZOR MEDIA SRL", "t": "Other", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.751, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TMS24-RIPE", "org": "TIPZOR MEDIA SRL", "pdb": null, "pfx": 7, "reg": "2016-04-14", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@wehaveservers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009716720229}, {"a": 51200, "h": "DIDI-AS", "n": "Digital Dialogue-Nets", "t": "Transit & backbone", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4075, "hi": 6.15, "lo": 0.80, "ips": 3, "mean": 2.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1786, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 1.898, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 2.324, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 1}, "lo": 1.898, "se": 0.794, "ts": 0.667, "map": 5.946, "obs": 3, "own": 19.711, "comp": {"cins": -0.3422, "dshield": -0.7237, "crowdsec": -2.854, "vulncheck": 4.1267, "blocklist_de": 2.9697}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.482, "det": {"vulncheck": {"botnet_node": 3}, "blocklist_de": {"bots": 1}}, "oid": "ORG-LDD1-RIPE", "org": "LLC Digital Dialogue-Nets", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://di-di.ru"}, "pfx": 42, "reg": "2010-06-18", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@di-di.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075648799765}, {"a": 51202, "h": "NUXOA", "n": "NUXOA GmbH", "t": "Transit & backbone", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 4.898, 0.011, 0, false], ["2026-10-12", 2.105, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 2.668, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.105, "se": 0.960, "ts": 1.000, "map": 9.429, "obs": 2, "own": 30.778, "comp": {"cins": -0.27, "dshield": -0.5878, "crowdsec": 6.3863, "vulncheck": -0.4968, "blocklist_de": -1.3943}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.686, "det": null, "oid": "ORG-DWGT1-RIPE", "org": "NUXOA GmbH", "pdb": {"t": "NSP", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://nuxoa.de"}, "pfx": 22, "reg": "2010-06-21", "rir": "ripencc", "s24": 22, "sib": 1, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "abuse@nuxoa.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51207, "h": "FREEM", "n": "FREEM", "t": "Other", "w": 3, "cc": "FR", "cf": {"rb": "hi", "wb": "hi", "rep": 0.74, "waf": 0.65}, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.0000, "hi": 1.19, "lo": 0.21, "ips": 3, "mean": 0.61, "above": false}}, "h2": [["2026-10-05", 0.002, 0.006, 0, false], ["2026-10-12", 0.052, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.718, "ts": null, "map": 0.075, "obs": 0, "own": 0.136, "comp": null, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.052, "se": 0.695, "ts": 1.000, "map": 0.139, "obs": 3, "own": 0.080, "comp": {"cins": -0.8134, "dshield": -1.4497, "crowdsec": -5.6802, "vulncheck": -0.7806, "blocklist_de": 8.1452}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.062, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-FMS4-RIPE", "org": "Free Mobile SAS", "pdb": null, "pfx": 4, "reg": "2011-12-14", "rir": "ripencc", "s24": 5160, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1583104, "abuse": "abuse@proxad.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.099284}, {"a": 51235, "h": "ADG-AS", "n": "ARAAX DADEH GOSTAR information and communication Development Co (Private Joint Stock)", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3693.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.526, "det": null, "oid": "ORG-ADGI1-RIPE", "org": "ARAAX DADEH GOSTAR information and communication Development Co (Private Joint Stock)", "pdb": null, "pfx": 11, "reg": "2010-06-29", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000197788584}, {"a": 51247, "h": "serveriotechnologijos-AS", "n": "Serverio technologijos", "t": "Hosting & VPS", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 1.849, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.295, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.140, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.534, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-STL179-RIPE", "org": "SkyCore Technologies L.L.C-FZ", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://skystark.net"}, "pfx": 14, "reg": "2018-10-19", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@skystark.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035259722819}, {"a": 51248, "h": "HOST-TELECOM", "n": "Host-Telecom.com", "t": "Hosting & VPS", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1531, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1747, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-12", 0.256, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.256, "se": 1.265, "ts": 1.000, "map": 2.026, "obs": 1, "own": 0.456, "comp": {"cins": -0.1465, "dshield": -0.336, "crowdsec": -1.3294, "vulncheck": -0.3407, "blocklist_de": 4.2521}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.886, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HS41-RIPE", "org": "Host-Telecom.com s.r.o.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.host-telecom.com"}, "pfx": 20, "reg": "2010-06-30", "rir": "ripencc", "s24": 54, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@host-telecom.cz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041713623795}, {"a": 51264, "h": "eVPS", "n": "eVPS", "t": "Hosting & VPS", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.147, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.435, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KEV2-RIPE", "org": "Kutumova Olena", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://evps.cloud"}, "pfx": 17, "reg": "2010-07-05", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@evps.cloud", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51290, "h": "HOSTEAM-AS", "n": "HosTeam", "t": "Hosting & VPS", "w": 2, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2011-3600": 1, "cve:CVE-2013-3827": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 1.982, 0.011, 0, false], ["2026-10-12", 2.105, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.290, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.105, "se": 0.960, "ts": 1.000, "map": 9.429, "obs": 2, "own": 1.931, "comp": {"cins": -0.27, "dshield": -0.5878, "crowdsec": 6.3863, "vulncheck": -0.4968, "blocklist_de": -1.3943}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.932, "det": null, "oid": "ORG-HSTG1-RIPE", "org": "BARTOSZ WASZAK trading as HOSTEAM S.C. TOMASZ GROSZEWSKI BARTOSZ WASZAK LUKASZ GROSZEWSKI", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://hosteam.pl/"}, "pfx": 9, "reg": "2010-07-15", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 3, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@hosteam.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51336, "h": "Gemzo", "n": "Gemzo", "t": "Other", "w": 4, "cc": "PS", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1850, "hi": 4.59, "lo": 0.34, "ips": 4, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.178, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.613, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.178, "se": 1.230, "ts": 1.000, "map": 1.284, "obs": 1, "own": 0.849, "comp": {"cins": -0.1076, "dshield": -0.2508, "crowdsec": -0.9933, "vulncheck": 3.5566, "blocklist_de": -0.5614}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.370, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-GITP1-RIPE", "org": "Gemzo information technology Private Joint-Stock company", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.gemzo.ps"}, "pfx": 25, "reg": "2010-07-27", "rir": "ripencc", "s24": 62, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": "abuse@gemzo.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024429763935}, {"a": 51346, "h": "TOJIKTELECOM-AS", "n": "Tojiktelecom", "t": "Broadband & mobile", "w": 0, "cc": "TJ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 7031.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 1.539, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.224, "det": null, "oid": "ORG-OJSC22-RIPE", "org": "Opened Joint Stock Company \"Tojiktelecom\"", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://tojiktelecom.tj/"}, "pfx": 11, "reg": "2010-07-27", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "info@tojnet.tj", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051159752263}, {"a": 51369, "h": "FIORD-RU-AS", "n": "LLC \"TRC FIORD\"", "t": "Other", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1684, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 3, "p": 0.4156, "hi": 5.68, "lo": 1.00, "ips": 3, "mean": 2.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "blocklist_de": {"n": 2, "p": 0.3320, "hi": 5.49, "lo": 0.71, "ips": 2, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 4.004, 0.010, 0, false], ["2026-10-12", 3.491, 0.011, 0, false]], "sh": false, "uc": 784, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 0.501, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 2}, "lo": 3.491, "se": 0.551, "ts": 0.429, "map": 7.311, "obs": 7, "own": 4.143, "comp": {"cins": -1.0587, "dshield": 0.9453, "crowdsec": 1.1288, "vulncheck": 0.0965, "blocklist_de": 2.2711}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.466, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 2}}, "oid": "ORG-JF1-RIPE", "org": "LLC \"TRC FIORD\"", "pdb": null, "pfx": 20, "reg": "2021-04-12", "rir": "ripencc", "s24": 137, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": "abuse@fiord.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072083187605}, {"a": 51395, "h": "AS-SOFTPLUS", "n": "Datasource AG", "t": "Broadband & mobile", "w": 9, "cc": "CH", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1829, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 2, "p": 0.4000, "hi": 6.08, "lo": 0.79, "ips": 8, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 0.009, 1.644, 0, false], ["2026-10-12", 0.163, 1.679, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.679, "se": 1.152, "ts": 1.000, "map": 7.834, "obs": 2, "own": 19.610, "comp": {"urlhaus": -0.3495, "threatfox": -0.3017, "phishing_db": 4.3359}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.163, "se": 1.219, "ts": 1.000, "map": 1.147, "obs": 1, "own": 2.065, "comp": {"cins": -0.1115, "dshield": -0.2595, "crowdsec": -1.0277, "vulncheck": 3.5111, "blocklist_de": -0.5818}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.811, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-DA327-RIPE", "org": "Datasource AG", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.datasource.ch"}, "pfx": 26, "reg": "2010-08-12", "rir": "ripencc", "s24": 72, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "noc@datasource.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00063189424014}, {"a": 51396, "h": "PFCLOUD", "n": "Pfcloud UG", "t": "Hosting & VPS", "w": 110, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 36, "data_centre": 51, "web_exploit": 52, "bad_crawling": 24, "proxy_or_vpn": 10, "first_seen_30d": 3, "ssh_bruteforce": 62, "web_bruteforce": 23, "home_connection": 3, "mail_bruteforce": 12, "cve:CVE-2017-9841": 13, "cve:CVE-2024-6387": 3, "cve:CVE-2018-20062": 5, "cve:CVE-2021-41773": 4, "cve:CVE-2021-44228": 3}, "n": 86}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "dshield": {"n": 5, "p": 0.9109, "hi": 10.34, "lo": 2.57, "ips": 26, "mean": 5.90, "above": true}, "crowdsec": {"n": 9, "p": 0.9980, "hi": 14.51, "lo": 5.01, "ips": 86, "mean": 9.24, "above": true}, "threatfox": {"n": 4, "p": 0.8129, "hi": 9.11, "lo": 1.96, "ips": 8, "mean": 4.98, "above": true}, "vulncheck": {"n": 1, "p": 0.1920, "hi": 4.67, "lo": 0.35, "ips": 4, "mean": 1.97, "above": false}, "phishing_db": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 3, "p": 0.6249, "hi": 7.50, "lo": 1.32, "ips": 3, "mean": 3.87, "above": false}}, "h2": [["2026-10-05", 29.807, 19.496, 1, false], ["2026-10-12", 52.070, 14.682, 1, false]], "sh": true, "uc": 844.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 1}, "lo": 14.682, "se": 0.863, "ts": 0.800, "map": 39.987, "obs": 5, "own": 13.897, "comp": {"urlhaus": -0.6798, "threatfox": 5.228, "phishing_db": 0.7665}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 3}, "lo": 52.070, "se": 0.423, "ts": 0.474, "map": 87.858, "obs": 19, "own": 17.100, "comp": {"cins": 0.7927, "dshield": 4.7416, "crowdsec": 2.866, "vulncheck": -0.5553, "blocklist_de": -1.9756}, "mass": 15.0, "listed": false}}, "abq": false, "bot": 0.853, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Mirai": 1, "family:Remcos": 1, "family:Tofsee": 5, "family:PureRAT": 1}, "vulncheck": {"botnet_node": 4}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-PU41-RIPE", "org": "Pfcloud UG (haftungsbeschrankt)", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://pfcloud.io"}, "pfx": 31, "reg": "2023-12-08", "rir": "ripencc", "s24": 31, "sib": 1, "tor": 4, "w24": 11, "drop": 11, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.8803]], "ipv4": 7936, "abuse": "abuse@pfcloud.io", "score": 0.8803, "groups": ["sensors", "abusech"], "sensors": ["crowdsec", "dshield"], "traffic": 0.0008762122712}, {"a": 51407, "h": "Mada-AS", "n": "Mada Al-Arab", "t": "Broadband & mobile", "w": 4, "cc": "PS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0214, "hi": 2.47, "lo": 0.19, "ips": 1, "mean": 1.04, "above": false}, "vulncheck": {"n": 4, "p": 0.6917, "hi": 7.47, "lo": 1.61, "ips": 4, "mean": 4.08, "above": false}}, "h2": [["2026-10-05", 0.549, 0.009, 0, false], ["2026-10-12", 0.294, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.903, "ts": null, "map": 0.157, "obs": 0, "own": 0.875, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 0.294, "se": 0.689, "ts": 1.000, "map": 0.755, "obs": 4, "own": 1.231, "comp": {"cins": -0.4088, "dshield": -0.8423, "crowdsec": -3.3181, "vulncheck": 7.7754, "blocklist_de": -2.0931}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.207, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 4}}, "oid": "ORG-MAL7-RIPE", "org": "Mada Al-Arab General Services Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.mada.ps"}, "pfx": 276, "reg": "2010-08-16", "rir": "ripencc", "s24": 430, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 221440, "abuse": "abuse@mada.ps", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00419303229064}, {"a": 51430, "h": "ALTUS", "n": "AltusHost", "t": "Hosting & VPS", "w": 3, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "bad_crawling": 2, "web_bruteforce": 2, "cve:CVE-2019-25246": 1, "cve:CVE-2020-36723": 1, "cve:CVE-2025-13315": 1, "cve:CVE-2026-87902": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2961, "hi": 5.19, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}, "phishing_db": {"n": 1, "p": 0.1823, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.772, 0.335, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.335, "se": 1.478, "ts": 1.000, "map": 2.945, "obs": 1, "own": 1.324, "comp": {"urlhaus": -0.1559, "threatfox": -0.1789, "phishing_db": 3.0411}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.772, "se": 0.907, "ts": 1.000, "map": 3.114, "obs": 2, "own": 0.634, "comp": {"cins": -0.3203, "dshield": -0.6834, "crowdsec": 5.7261, "vulncheck": -0.5433, "blocklist_de": -1.6494}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-AI49-RIPE", "org": "AltusHost B.V.", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.altushost.com"}, "pfx": 55, "reg": "2010-08-20", "rir": "ripencc", "s24": 80, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "abuse@altushost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00170551094498}, {"a": 51431, "h": "IR-AVABARID-AS", "n": "Rasaneh Avabarid Private Joint Stock Company", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.421, 0.011, 0, false], ["2026-10-12", 0.457, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.457, "se": 1.371, "ts": 1.000, "map": 4.431, "obs": 1, "own": 3.011, "comp": {"cins": -0.1078, "dshield": -0.2513, "crowdsec": -0.9952, "vulncheck": -0.2732, "blocklist_de": 4.5098}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.860, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-RAPJ2-RIPE", "org": "Rasaneh Avabarid Private Joint Stock Company", "pdb": null, "pfx": 18, "reg": "2010-08-25", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@avabarid.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000358430913}, {"a": 51447, "h": "ROOTLAYERNET", "n": "RootLayer Web Services LLC", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "home_connection": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.537, 0.659, 0, false], ["2026-10-12", 3.827, 0.686, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.686, "se": 1.657, "ts": 1.000, "map": 8.588, "obs": 1, "own": 11.082, "comp": {"urlhaus": -0.0586, "threatfox": -0.0806, "phishing_db": 3.9158}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.827, "se": 0.998, "ts": 1.000, "map": 18.356, "obs": 2, "own": 10.851, "comp": {"cins": -0.2405, "dshield": -0.5301, "crowdsec": 6.7848, "vulncheck": -0.4658, "blocklist_de": -1.2448}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.952, "det": null, "oid": "ORG-RWSL4-RIPE", "org": "RootLayer Web Services LLC", "pdb": null, "pfx": 10, "reg": "2017-09-25", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51453, "h": "EMERION-AS", "n": "Anexia Cloud Solutions GmbH", "t": "Hosting & VPS", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.714, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-AIG10-RIPE", "org": "Anexia Cloud Solutions GmbH", "pdb": null, "pfx": 2, "reg": "2015-12-30", "rir": "ripencc", "s24": 3, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@anexia.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51468, "h": "ONECOM", "n": "One.com", "t": "Hosting & VPS", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1163, "hi": 3.85, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.000, "ts": null, "map": 0.183, "obs": 0, "own": 0.204, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.793, "ts": null, "map": 0.152, "obs": 0, "own": 0.059, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OA356-RIPE", "org": "One.com A/S", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.one.com"}, "pfx": 18, "reg": "2010-09-01", "rir": "ripencc", "s24": 109, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29440, "abuse": "abuse@one.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00682388532119}, {"a": 51504, "h": "Telset", "n": "AS Telset", "t": "Other", "w": 4, "cc": "EE", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1846, "hi": 4.59, "lo": 0.34, "ips": 4, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.181, 0.011, 0, false], ["2026-10-12", 0.175, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.175, "se": 1.228, "ts": 1.000, "map": 1.253, "obs": 1, "own": 0.828, "comp": {"cins": -0.1084, "dshield": -0.2527, "crowdsec": -1.0006, "vulncheck": 3.5469, "blocklist_de": -0.5657}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.183, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-TL54-RIPE", "org": "AS Telset", "pdb": null, "pfx": 4, "reg": "2010-09-13", "rir": "ripencc", "s24": 64, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "abuse@telset.ee", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042222193167}, {"a": 51511, "h": "TRADE-EXPRESS-AS", "n": "LLC \"Teleradio Company Traide-Express\"", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.340, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.340, "se": 1.327, "ts": 1.000, "map": 2.935, "obs": 1, "own": 2.021, "comp": {"cins": -0.0799, "dshield": -0.1885, "crowdsec": -0.7468, "vulncheck": 3.903, "blocklist_de": -0.4175}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.473, "det": {"vulncheck": {"c2_server": 1}}, "oid": "ORG-LCT6-RIPE", "org": "LLC \"Teleradio Company Traide-Express\"", "pdb": null, "pfx": 5, "reg": "2010-09-14", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51559, "h": "NETINTERNET", "n": "Netinternet", "t": "Broadband & mobile", "w": 10, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 6, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 9}, "ev": {"shodan": {"n": 7, "p": 0.9537, "hi": 10.07, "lo": 3.05, "ips": 7, "mean": 6.13, "above": true}, "crowdsec": {"n": 7, "p": 0.9401, "hi": 9.53, "lo": 2.88, "ips": 9, "mean": 5.80, "above": true}, "phishing_db": {"n": 1, "p": 0.1699, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "blocklist_de": {"n": 2, "p": 0.3284, "hi": 5.46, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}}, "h2": [["2026-10-05", 7.164, 0.249, 0, false], ["2026-10-12", 5.119, 0.260, 0, false]], "sh": false, "uc": 139.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.260, "se": 1.440, "ts": 1.000, "map": 2.079, "obs": 1, "own": 6.072, "comp": {"urlhaus": -0.1942, "threatfox": -0.2092, "phishing_db": 2.7616}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.119, "se": 0.502, "ts": 0.778, "map": 9.683, "obs": 9, "own": 14.910, "comp": {"cins": -1.3421, "dshield": -2.0331, "crowdsec": 7.6667, "vulncheck": -0.8789, "blocklist_de": 0.2514}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.777, "det": {"shodan": {"compromised": 7}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "ORG-NBVT1-RIPE", "org": "Netinternet Bilisim Teknolojileri AS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://netinternet.tr"}, "pfx": 143, "reg": "2010-09-28", "rir": "ripencc", "s24": 143, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 36608, "abuse": "abuse@ni.net.tr", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00082169594615}, {"a": 51579, "h": "CORP-PARTNER-AS", "n": "Korporativniy partner", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.442, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.442, "se": 1.377, "ts": 1.000, "map": 4.186, "obs": 1, "own": 8.075, "comp": {"cins": -0.0685, "dshield": -0.1625, "crowdsec": -0.644, "vulncheck": 4.0589, "blocklist_de": -0.3584}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-KPL6-RIPE", "org": "Korporatvniy partner Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.vshk.ru"}, "pfx": 6, "reg": "2010-10-01", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@vshk.su", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51583, "h": "Ray-AS", "n": "Ray-Svyaz Ltd.", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.381, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.381, "se": 1.348, "ts": 1.000, "map": 3.433, "obs": 1, "own": 2.388, "comp": {"cins": -0.0748, "dshield": -0.177, "crowdsec": -0.7012, "vulncheck": 3.9713, "blocklist_de": -0.3912}, "mass": 0.4, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-LPN1-RIPE", "org": "Ray-Svyaz Ltd.", "pdb": null, "pfx": 16, "reg": "2010-10-04", "rir": "ripencc", "s24": 16, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51590, "h": "ARONET-AS", "n": "PRZEDSIEBIORSTWO HANDLOWOPRODUKCYJNOUSLUGOWE \"ARONET\" ANDRZEJ OLSZEWSKI", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.161, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-PHAO1-RIPE", "org": "PRZEDSIEBIORSTWO HANDLOWOPRODUKCYJNOUSLUGOWE \"ARONET\" ANDRZEJ OLSZEWSKI", "pdb": null, "pfx": 1, "reg": "2010-10-05", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51655, "h": "ILIM-NET", "n": "Ilim Telecom Ltd.", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4204, "hi": 6.27, "lo": 0.81, "ips": 5, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 2.938, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.938, "se": 1.009, "ts": 1.000, "map": 13.754, "obs": 2, "own": 23.395, "comp": {"cins": -0.1474, "dshield": -0.3378, "crowdsec": -1.3365, "vulncheck": 6.6038, "blocklist_de": -0.7672}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.459, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-ITL20-RIPE", "org": "Ilim Telecom Ltd.", "pdb": null, "pfx": 8, "reg": "2010-10-14", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51659, "h": "ASBAXET", "n": "LLC Baxet", "t": "Other", "w": 7, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6314, "hi": 7.57, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}, "phishing_db": {"n": 3, "p": 0.6325, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1786, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.221, 5.176, 0, false], ["2026-10-12", 2.737, 5.223, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 5.223, "se": 1.001, "ts": 1.000, "map": 18.290, "obs": 3, "own": 17.334, "comp": {"urlhaus": -0.4858, "threatfox": -0.3571, "phishing_db": 5.3755}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 1}, "lo": 2.737, "se": 0.711, "ts": 0.750, "map": 7.405, "obs": 4, "own": 4.384, "comp": {"cins": -0.4184, "dshield": -0.8589, "crowdsec": -3.3829, "vulncheck": 5.577, "blocklist_de": 2.479}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.658, "det": {"vulncheck": {"c2_server": 1, "botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-LB12-RIPE", "org": "LLC Baxet", "pdb": null, "pfx": 28, "reg": "2010-10-14", "rir": "ripencc", "s24": 45, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": "noc@baxet.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51713, "h": "WHG-LON", "n": "hosting.com LON1", "t": "Hosting & VPS", "w": 4, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 1, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2026-8181": 2, "cve:CVE-2022-39290": 1, "cve:CVE-2024-28000": 4}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1592, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 3, "p": 0.5656, "hi": 6.91, "lo": 1.22, "ips": 4, "mean": 3.56, "above": false}}, "h2": [["2026-10-05", 2.488, 0.011, 0, false], ["2026-10-12", 2.613, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 0.251, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.613, "se": 0.763, "ts": 1.000, "map": 8.065, "obs": 3, "own": 1.609, "comp": {"cins": -0.4609, "dshield": -0.931, "crowdsec": 7.8667, "vulncheck": -0.6414, "blocklist_de": -2.3522}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.891, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://hosting.com"}, "pfx": 28, "reg": "2023-03-14", "rir": "ripencc", "s24": 46, "sib": 11, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": "abuse@worldhost.group", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072735102244}, {"a": 51722, "h": "AS-PIXOOF", "n": "PIXOOF TEKNOLOJI ANONIM SIRKETI", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.011, 0.542, 0, false], ["2026-10-12", 0.011, 0.756, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.756, "se": 1.709, "ts": 1.000, "map": 9.985, "obs": 1, "own": 5.402, "comp": {"urlhaus": 4.324, "threatfox": -0.1407, "phishing_db": -0.256}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.693, "det": null, "oid": "ORG-PTAS2-RIPE", "org": "PIXOOF TEKNOLOJI ANONIM SIRKETI", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.pixoof.com"}, "pfx": 17, "reg": "2022-04-19", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse@pixoof.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009455807454}, {"a": 51747, "h": "INTERNETBOLAGET", "n": "Internet Vikings International", "t": "Transit & backbone", "w": 1, "cc": "SE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1007, "hi": 3.67, "lo": 0.27, "ips": 1, "mean": 1.55, "above": false}}, "h2": [["2026-10-05", 0.085, 0.010, 0, false], ["2026-10-12", 0.094, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.441, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.094, "se": 1.137, "ts": 1.000, "map": 0.583, "obs": 1, "own": 2.004, "comp": {"cins": -0.2109, "dshield": -0.4705, "crowdsec": -1.8596, "vulncheck": -0.4311, "blocklist_de": 3.8267}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-EA45-RIPE", "org": "Internet Vikings International AB", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://internetvikings.com/"}, "pfx": 148, "reg": "2010-10-29", "rir": "ripencc", "s24": 274, "sib": 24, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72192, "abuse": "abuse@internetvikings.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00185727987219}, {"a": 51765, "h": "CREANOVA-AS", "n": "CreaNova Datacenter", "t": "Hosting & VPS", "w": 8, "cc": "FI", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 6, "bad_crawling": 5, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4396": 3, "cve:CVE-2019-18935": 1, "cve:CVE-2021-41773": 3, "cve:CVE-2024-28000": 2}, "n": 7}, "ev": {"shodan": {"n": 3, "p": 0.5066, "hi": 6.39, "lo": 1.13, "ips": 3, "mean": 3.30, "above": false}, "crowdsec": {"n": 5, "p": 0.8159, "hi": 8.31, "lo": 2.06, "ips": 7, "mean": 4.74, "above": true}, "phishing_db": {"n": 1, "p": 0.1783, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 3.790, 0.291, 0, false], ["2026-10-12", 2.979, 0.304, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.304, "se": 1.463, "ts": 1.000, "map": 2.581, "obs": 1, "own": 1.161, "comp": {"urlhaus": -0.17, "threatfox": -0.1905, "phishing_db": 2.9348}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.979, "se": 0.606, "ts": 1.000, "map": 6.836, "obs": 5, "own": 1.349, "comp": {"cins": -0.7814, "dshield": -1.4076, "crowdsec": 10.1864, "vulncheck": -0.7717, "blocklist_de": -3.9098}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.722, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-OCNH1-RIPE", "org": "Oy Crea Nova Hosting Solution Ltd", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://creanova.org"}, "pfx": 78, "reg": "2010-11-02", "rir": "ripencc", "s24": 100, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": "abuse@creanova.org", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00456038615148}, {"a": 51778, "h": "ASPUREICT", "n": "ASPRONETIC", "t": "Transit & backbone", "w": 0, "cc": "CH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.777, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-PIA48-RIPE", "org": "Pure ICT AG", "pdb": {"t": "NSP", "sc": "Regional", "tr": "0-20Mbps", "pol": "Open", "web": "https://www.pronetic.ch"}, "pfx": 1, "reg": "2019-03-25", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@pureict.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51790, "h": "SIEL", "n": "SIEL", "t": "Hosting & VPS", "w": 0, "cc": "SI", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.113, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.895, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-SIRD1-RIPE", "org": "SIEL, d.o.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.siel.si"}, "pfx": 22, "reg": "2010-11-04", "rir": "ripencc", "s24": 32, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@siel.si", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000635354528}, {"a": 51806, "h": "CYIM", "n": "CYIM", "t": "Other", "w": 5, "cc": "FR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.706, "det": {"vulncheck": {"c2_server": 5}}, "oid": "ORG-SCI1-RIPE", "org": "CYBER IMAGINATION (CYIM) SASAU", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.cyim.com"}, "pfx": 1, "reg": "2010-11-08", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@cyim.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51847, "h": "NEAROUTE", "n": "Nearoute Limited", "t": "Broadband & mobile", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1273, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "dshield": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.169, 0.011, 0, false], ["2026-10-12", 0.177, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.011, "ts": null, "map": 0.185, "obs": 0, "own": 1.386, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.177, "se": 1.212, "ts": 1.000, "map": 1.277, "obs": 1, "own": 2.204, "comp": {"cins": -0.1554, "dshield": 4.361, "crowdsec": -1.4041, "vulncheck": -0.3546, "blocklist_de": -0.8085}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.371, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NL526-RIPE", "org": "Nearoute Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://nearoute.io"}, "pfx": 58, "reg": "2021-11-18", "rir": "ripencc", "s24": 91, "sib": 1, "tor": 0, "w24": 1, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": "abuse@biz.nearoute.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00866094344963}, {"a": 51852, "h": "PLI-AS", "n": "Phase Layer Global Networks", "t": "Hosting & VPS", "w": 75, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 22, "data_centre": 21, "web_exploit": 20, "bad_crawling": 12, "proxy_or_vpn": 9, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 21, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 4, "cve:CVE-2021-3129": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2021-26086": 2, "cve:CVE-2026-63030": 3}, "n": 26}, "ev": {"cins": {"n": 2, "p": 0.3852, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "shodan": {"n": 8, "p": 0.9819, "hi": 11.15, "lo": 3.63, "ips": 8, "mean": 6.95, "above": true}, "dshield": {"n": 6, "p": 0.9539, "hi": 11.02, "lo": 3.06, "ips": 6, "mean": 6.51, "above": true}, "crowdsec": {"n": 22, "p": 1.0000, "hi": 22.98, "lo": 11.50, "ips": 26, "mean": 16.83, "above": true}, "threatfox": {"n": 7, "p": 0.9867, "hi": 12.88, "lo": 3.90, "ips": 10, "mean": 7.83, "above": true}, "phishing_db": {"n": 11, "p": 0.9999, "hi": 17.06, "lo": 6.49, "ips": 30, "mean": 11.24, "above": true}, "blocklist_de": {"n": 3, "p": 0.5488, "hi": 6.75, "lo": 1.19, "ips": 4, "mean": 3.48, "above": false}}, "h2": [["2026-10-05", 34.890, 26.298, 1, false], ["2026-10-12", 22.767, 18.235, 1, false]], "sh": false, "uc": 274.6, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 11}, "lo": 18.235, "se": 0.732, "ts": 0.611, "map": 37.938, "obs": 18, "own": 12.984, "comp": {"urlhaus": -1.7077, "threatfox": 2.5124, "phishing_db": 4.4574}, "mass": 6.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 22, "vulncheck": 0, "blocklist_de": 3}, "lo": 22.767, "se": 0.390, "ts": 0.667, "map": 35.429, "obs": 33, "own": 6.901, "comp": {"cins": 1.4697, "dshield": 2.6406, "crowdsec": 8.566, "vulncheck": -0.9734, "blocklist_de": -6.7417}, "mass": 26.9, "listed": false}}, "abq": false, "bot": 0.823, "det": {"shodan": {"c2": 7, "compromised": 1}, "threatfox": {"family:Havoc": 1, "family:Sliver": 1, "family:Tsundere": 2, "family:Cobalt Strike": 6}, "blocklist_de": {"sip": 1, "ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PLI2-RIPE", "org": "Private Layer INC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.phaselayer.com"}, "pfx": 94, "reg": "2010-11-15", "rir": "ripencc", "s24": 138, "sib": 0, "tor": 9, "w24": 40, "drop": 1, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 35328, "abuse": "abuse@privatelayer.com", "score": 1.0000, "groups": ["sensors", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield"], "traffic": 0.00467254893793}, {"a": 51888, "h": "PILOTSYSTEMS-AS", "n": "Pilot Systems Consulting SARL", "t": "Other", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.958, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PS74-RIPE", "org": "Pilot Systems Consulting SARL", "pdb": null, "pfx": 1, "reg": "2010-11-23", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "administratif@pilotsystems.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51944, "h": "PROMEDIA-IPV-AS", "n": "PROMEDIA NOWICKI WESOŁOWSKI SPÓŁKA JAWNA", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2951.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.166, "det": null, "oid": "ORG-DWTA5-RIPE", "org": "DARIUSZ WESOLOWSKI trading as PROMEDIA NOWICKI WESOLOWSKI Sp.J.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.ipv.net.pl/"}, "pfx": 12, "reg": "2010-12-03", "rir": "ripencc", "s24": 18, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@ipv.net.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 51997, "h": "ASKET-AS", "n": "LLP Asket", "t": "Other", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1608, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.439, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AT48-RIPE", "org": "LLP Asket", "pdb": null, "pfx": 10, "reg": "2010-12-13", "rir": "ripencc", "s24": 44, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "admin@ktv-sk.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017417326983}, {"a": 52000, "h": "MIRhosting", "n": "MIRhosting", "t": "Hosting & VPS", "w": 2, "cc": "NL", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 1.139, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.139, "se": 1.630, "ts": 1.000, "map": 16.742, "obs": 1, "own": 4.940, "comp": {"cins": 5.134, "dshield": -0.11, "crowdsec": -0.4361, "vulncheck": -0.1359, "blocklist_de": -0.2405}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MB213-RIPE", "org": "MIRhosting B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://mirhosting.com"}, "pfx": 2, "reg": "2010-12-13", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@mirhosting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000005526144}, {"a": 52026, "h": "TRUF-AS", "n": "TRUF d.o.o.", "t": "Other", "w": 12, "cc": "RS", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5552, "hi": 6.81, "lo": 1.20, "ips": 3, "mean": 3.51, "above": false}, "vulncheck": {"n": 1, "p": 0.1873, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 6, "p": 0.9573, "hi": 11.22, "lo": 3.11, "ips": 8, "mean": 6.63, "above": true}}, "h2": [["2026-10-05", 11.831, 0.011, 1, false], ["2026-10-12", 17.101, 0.012, 1, false]], "sh": false, "uc": 2764.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 6}, "lo": 17.101, "se": 0.495, "ts": 0.600, "map": 32.263, "obs": 10, "own": 18.118, "comp": {"cins": -1.529, "dshield": -2.1996, "crowdsec": -2.6038, "vulncheck": -0.3007, "blocklist_de": 11.5006}, "mass": 9.3, "listed": false}}, "abq": true, "bot": 0.444, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 7, "mail": 7}}, "oid": "ORG-TD21-RIPE", "org": "TRUF d.o.o.", "pdb": null, "pfx": 50, "reg": "2010-12-17", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27392, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00007954315425}, {"a": 52029, "h": "ASNOVOSEDLY", "n": "Palanet s.r.o.", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.148, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PALA1-RIPE", "org": "Palanet s.r.o.", "pdb": null, "pfx": 9, "reg": "2010-12-17", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011489618405}, {"a": 52048, "h": "RixHost", "n": "SIA RixHost", "t": "Hosting & VPS", "w": 8, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 2, "bad_crawling": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1951, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 3, "mean": 2.87, "above": false}, "threatfox": {"n": 3, "p": 0.6455, "hi": 7.73, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1955, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 9.841, 10.409, 1, false], ["2026-10-12", 6.170, 17.415, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 1}, "lo": 17.415, "se": 0.911, "ts": 0.750, "map": 52.424, "obs": 4, "own": 18.104, "comp": {"urlhaus": -0.5196, "threatfox": 4.8861, "phishing_db": 1.219}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.170, "se": 0.784, "ts": 0.667, "map": 19.798, "obs": 3, "own": 3.950, "comp": {"cins": -0.4221, "dshield": 3.1058, "crowdsec": 4.4733, "vulncheck": -0.6181, "blocklist_de": -2.1597}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.750, "det": {"threatfox": {"family:Remcos": 3}}, "oid": "ORG-SD330-RIPE", "org": "SIA RixHost", "pdb": null, "pfx": 17, "reg": "2010-12-21", "rir": "ripencc", "s24": 17, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse@dataclub.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033130720187}, {"a": 52058, "h": "petrkovice_net", "n": "za200.cz s.r.o.", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.162, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ZS79-RIPE", "org": "za200.cz s.r.o.", "pdb": null, "pfx": 2, "reg": "2010-12-21", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000251946048}, {"a": 52130, "h": "ARTCOMPANYCZ", "n": "Livesport", "t": "Hosting & VPS", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-ASS18-RIPE", "org": "Livesport s.r.o.", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://livesport.eu/"}, "pfx": 2, "reg": "2011-01-05", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@livesport.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0018363135633}, {"a": 52207, "h": "TULA-AS", "n": "JSC \"ER-Telecom Holding\" Tula branch", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2026-53787": 1, "cve:CVE-2026-75650": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.3344, "hi": 5.12, "lo": 0.90, "ips": 3, "mean": 2.64, "above": false}, "blocklist_de": {"n": 1, "p": 0.1234, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 2.216, 0.010, 0, false], ["2026-10-12", 1.244, 0.011, 0, false]], "sh": false, "uc": 289.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 1.126, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.244, "se": 0.657, "ts": 0.750, "map": 3.151, "obs": 4, "own": 4.908, "comp": {"cins": -0.7119, "dshield": -1.3133, "crowdsec": 4.6864, "vulncheck": -0.7503, "blocklist_de": 0.6306}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.429, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 46, "reg": "2011-01-26", "rir": "ripencc", "s24": 194, "sib": 121, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 80128, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00069269806375}, {"a": 52209, "h": "LORDVPSNLNETWORKNL", "n": "LordVPS", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.177, "det": null, "oid": "ORG-AOSP2-RIPE", "org": "Atis Omran Sevin PSJ", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://lordvps.net"}, "pfx": 2, "reg": "2022-12-14", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52210, "h": "ACCURIS-TECHNOLOGIES", "n": "Accuris Technologies Primary", "t": "Broadband & mobile", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 2.240, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.952, "det": {"shodan": {"compromised": 1}}, "oid": "CANAD-111-ARIN", "org": "Accuris Technologies Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": null, "pol": "Open", "web": "https://accurishosting.ca"}, "pfx": 3, "reg": "2024-12-12", "rir": "arin", "s24": 3, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52236, "h": "", "n": "G2K Hosting - Datacenter", "t": "Hosting & VPS", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.886, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-52236-LACNIC", "org": "G2K ARGENTINA S.A.", "pdb": {"t": null, "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.g2khosting.com"}, "pfx": 10, "reg": "2010-04-12", "rir": "lacnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@g2khosting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52251, "h": "", "n": "Alterplan Solutions SRL", "t": "Broadband & mobile", "w": 1, "cc": "AR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1703, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-12", 0.144, 0.011, 0, false]], "sh": false, "uc": 351, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.990, "ts": null, "map": 0.181, "obs": 0, "own": 1.267, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.144, "se": 1.185, "ts": 1.000, "map": 0.983, "obs": 1, "own": 1.682, "comp": {"cins": -0.1677, "dshield": 4.2966, "crowdsec": -1.5073, "vulncheck": -0.3731, "blocklist_de": -0.872}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.249, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-52251-LACNIC", "org": "NORTECH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://nortech.com.ar"}, "pfx": 196, "reg": "2010-05-28", "rir": "lacnic", "s24": 128, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 113920, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051192113679}, {"a": 52286, "h": "", "n": "Columbus Networks Guatemala", "t": "Broadband & mobile", "w": 3, "cc": "GT", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1425, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "phishing_db": {"n": 1, "p": 0.1874, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1743, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.226, 0.373, 0, false], ["2026-10-12", 1.119, 0.389, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.389, "se": 1.506, "ts": 1.000, "map": 3.655, "obs": 1, "own": 10.674, "comp": {"urlhaus": -0.1339, "threatfox": -0.1596, "phishing_db": 3.2158}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.119, "se": 0.926, "ts": 0.500, "map": 4.643, "obs": 2, "own": 7.443, "comp": {"cins": -0.3278, "dshield": -0.6972, "crowdsec": 1.4405, "vulncheck": -0.5496, "blocklist_de": 3.0632}, "mass": 1.5, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-52286-LACNIC", "org": "LIBERTY NETWORKS GUATEMALA, LIMITADA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://cwcbusiness.com/countries/guatemala/"}, "pfx": 50, "reg": "2010-10-13", "rir": "lacnic", "s24": 55, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00060276713875}, {"a": 52307, "h": "", "n": "CORPICO", "t": "Broadband & mobile", "w": 2, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2693, "hi": 4.97, "lo": 0.65, "ips": 2, "mean": 2.37, "above": false}, "blocklist_de": {"n": 1, "p": 0.1560, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.337, 0.011, 0, false], ["2026-10-12", 1.446, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 1.353, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.446, "se": 0.751, "ts": 0.667, "map": 4.303, "obs": 3, "own": 6.747, "comp": {"cins": -0.5259, "dshield": -1.0368, "crowdsec": 3.2972, "vulncheck": -0.6758, "blocklist_de": 1.7942}, "mass": 2.4, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-52307-LACNIC", "org": "CORPICO LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://corpico.com.ar"}, "pfx": 96, "reg": "2010-12-29", "rir": "lacnic", "s24": 100, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26112, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045725001609}, {"a": 52308, "h": "", "n": "AGUAS DEL COLORADO SAPEM", "t": "Hosting & VPS", "w": 50, "cc": "AR", "cf": null, "cs": {"c": {"mail_bruteforce": 44}, "n": 44}, "ev": {"dshield": {"n": 1, "p": 0.1784, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "urlhaus": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1146, "hi": 3.83, "lo": 0.29, "ips": 44, "mean": 1.61, "above": false}, "blocklist_de": {"n": 3, "p": 0.5827, "hi": 7.07, "lo": 1.25, "ips": 25, "mean": 3.65, "above": false}}, "h2": [["2026-10-05", 1.543, 0.432, 0, false], ["2026-10-12", 3.999, 0.464, 0, false]], "sh": false, "uc": 2608.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.464, "se": 1.555, "ts": 1.000, "map": 4.761, "obs": 1, "own": 2.216, "comp": {"urlhaus": 3.938, "threatfox": -0.261, "phishing_db": -0.4904}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.999, "se": 0.611, "ts": 0.600, "map": 9.224, "obs": 5, "own": 1.820, "comp": {"cins": -0.9146, "dshield": 1.3568, "crowdsec": -3.2783, "vulncheck": -0.8059, "blocklist_de": 7.2575}, "mass": 4.6, "listed": false}}, "abq": true, "bot": 0.187, "det": {"blocklist_de": {"bots": 1, "imap": 24, "mail": 24}}, "oid": "@aut-52308-LACNIC", "org": "AGUAS DEL COLORADO SAPEM", "pdb": null, "pfx": 90, "reg": "2011-01-07", "rir": "lacnic", "s24": 90, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058578019416}, {"a": 52323, "h": "", "n": "Colsecor Cooperativa Limitada", "t": "Broadband & mobile", "w": 5, "cc": "AR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2021-43798": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.3825, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}, "crowdsec": {"n": 1, "p": 0.0972, "hi": 3.63, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "blocklist_de": {"n": 1, "p": 0.1499, "hi": 4.22, "lo": 0.32, "ips": 2, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 2.044, 0.011, 0, false], ["2026-10-12", 1.996, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.996, "ts": null, "map": 0.182, "obs": 0, "own": 1.301, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.996, "se": 0.662, "ts": 0.500, "map": 5.098, "obs": 4, "own": 7.930, "comp": {"cins": -0.6922, "dshield": 5.4305, "crowdsec": -1.7248, "vulncheck": -0.7437, "blocklist_de": 0.7527}, "mass": 3.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-269752-LACNIC", "org": "Colsecor Cooperativa Limitada", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.colsecor.com.ar"}, "pfx": 76, "reg": "2011-05-09", "rir": "lacnic", "s24": 116, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31232, "abuse": "abuse@colsecor.com.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00102907070793}, {"a": 52330, "h": "", "n": "S3WIRELESS COLOMBIA S.A", "t": "Hosting & VPS", "w": 0, "cc": "CO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3160.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.127, "det": null, "oid": "@aut-52330-LACNIC", "org": "S3WIRELESS COLOMBIA S.A", "pdb": {"t": "NSP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.s3.com.co"}, "pfx": 11, "reg": "2011-06-20", "rir": "lacnic", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005516523862}, {"a": 52339, "h": "", "n": "Lima Video Cable", "t": "Broadband & mobile", "w": 2, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1834, "hi": 4.58, "lo": 0.34, "ips": 2, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.330, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.330, "se": 1.308, "ts": 1.000, "map": 2.837, "obs": 1, "own": 5.101, "comp": {"cins": -0.1297, "dshield": -0.2995, "crowdsec": -1.1856, "vulncheck": -0.3128, "blocklist_de": 4.3639}, "mass": 0.6, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-52339-LACNIC", "org": "Lima Video Cable S.A. (Cabletel)", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Selective", "web": "http://www.cabletel.net.ar"}, "pfx": 18, "reg": "2011-08-15", "rir": "lacnic", "s24": 34, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52341, "h": "", "n": "WOM", "t": "Broadband & mobile", "w": 4, "cc": "CL", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 3, "p": 0.5848, "hi": 7.09, "lo": 1.25, "ips": 3, "mean": 3.66, "above": false}}, "h2": [["2026-10-05", 2.784, 0.011, 0, false], ["2026-10-12", 2.982, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 1.402, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.982, "se": 0.668, "ts": 0.750, "map": 7.663, "obs": 4, "own": 11.908, "comp": {"cins": -0.7653, "dshield": 1.8253, "crowdsec": -5.4344, "vulncheck": -0.7669, "blocklist_de": 8.5713}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.110, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "@aut-52341-LACNIC", "org": "WOM SpA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": null, "pol": "Selective", "web": "https://www.wom.cl/"}, "pfx": 67, "reg": "2011-08-19", "rir": "lacnic", "s24": 87, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03575594896128}, {"a": 52349, "h": "", "n": "Young S.A.", "t": "Broadband & mobile", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4020, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 1.249, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.355, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-52349-LACNIC", "org": "Young S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.multimega.net.ar"}, "pfx": 17, "reg": "2011-10-19", "rir": "lacnic", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52361, "h": "", "n": "ARSAT - Empresa Argentina de Soluciones Satelitales S.A.", "t": "Broadband & mobile", "w": 16, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 5, "web_bruteforce": 8, "home_connection": 11, "router_or_botnet": 9, "cve:CVE-2020-5902": 1, "cve:CVE-2020-8656": 1, "cve:CVE-2023-1389": 1, "cve:CVE-2021-26294": 2, "cve:CVE-2021-43798": 4}, "n": 11}, "ev": {"crowdsec": {"n": 10, "p": 0.9931, "hi": 11.25, "lo": 4.09, "ips": 11, "mean": 7.30, "above": true}, "blocklist_de": {"n": 5, "p": 0.8422, "hi": 8.73, "lo": 2.17, "ips": 5, "mean": 4.98, "above": true}}, "h2": [["2026-10-05", 2.897, 0.010, 0, false], ["2026-10-12", 7.527, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.963, "ts": null, "map": 0.175, "obs": 0, "own": 1.131, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 5}, "lo": 7.527, "se": 0.444, "ts": 0.667, "map": 13.121, "obs": 15, "own": 20.135, "comp": {"cins": -1.954, "dshield": -2.5221, "crowdsec": 5.4126, "vulncheck": -0.9356, "blocklist_de": 3.967}, "mass": 13.8, "listed": false}}, "abq": false, "bot": 0.278, "det": {"blocklist_de": {"ssh": 1, "bots": 4}}, "oid": "@aut-52361-LACNIC", "org": "ARSAT - Empresa Argentina de Soluciones Satelitales S.A.", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Selective", "web": "http://www.arsat.com.ar/"}, "pfx": 25, "reg": "2012-02-29", "rir": "lacnic", "s24": 191, "sib": 0, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 98048, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00599236503894}, {"a": 52362, "h": "", "n": "Servicios Innovadores de Comunicación y Entretenimiento, S.A.", "t": "Other", "w": 2, "cc": "GT", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4099, "hi": 6.17, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-12", 1.432, 0.012, 0, false]], "sh": false, "uc": 527.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.686, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.432, "se": 0.937, "ts": 1.000, "map": 6.091, "obs": 2, "own": 3.571, "comp": {"cins": -0.2918, "dshield": 8.0004, "crowdsec": -2.4852, "vulncheck": -0.5179, "blocklist_de": -1.505}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.120, "det": null, "oid": "@aut-52362-LACNIC", "org": "Servicios Innovadores de Comunicación y Entretenimiento, S.A.", "pdb": null, "pfx": 37, "reg": "2012-03-05", "rir": "lacnic", "s24": 37, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "abuse-home@tigo.com.gt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0159148425518}, {"a": 52368, "h": "", "n": "ZAM LTDA.", "t": "Other", "w": 14, "cc": "CL", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 2, "p": 0.4142, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "shodan": {"n": 5, "p": 0.8940, "hi": 9.84, "lo": 2.45, "ips": 5, "mean": 5.62, "above": true}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "phishing_db": {"n": 8, "p": 0.9958, "hi": 14.21, "lo": 4.62, "ips": 10, "mean": 8.86, "above": true}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.598, 29.670, 1, false], ["2026-10-12", 7.445, 29.622, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 8}, "lo": 29.622, "se": 0.777, "ts": 1.000, "map": 68.956, "obs": 8, "own": 60.441, "comp": {"urlhaus": -1.0388, "threatfox": -0.4765, "phishing_db": 7.3749}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.445, "se": 0.682, "ts": 0.500, "map": 19.802, "obs": 4, "own": 11.268, "comp": {"cins": 8.0161, "dshield": -1.3433, "crowdsec": -2.0328, "vulncheck": -0.7573, "blocklist_de": 0.4966}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.808, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-52368-LACNIC", "org": "ZAM LTDA.", "pdb": null, "pfx": 36, "reg": "2012-03-22", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.8393]], "ipv4": 14080, "abuse": "noc@haulmer.com", "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": [], "traffic": 0.00011566241352}, {"a": 52369, "h": "", "n": "NEOPHONE ARGENTINA", "t": "Other", "w": 2, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3950, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 0.280, 0.011, 0, false], ["2026-10-12", 1.531, 0.012, 0, false]], "sh": false, "uc": 1084, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.531, "se": 0.944, "ts": 1.000, "map": 6.615, "obs": 2, "own": 3.890, "comp": {"cins": -0.3387, "dshield": -0.7173, "crowdsec": -2.8289, "vulncheck": -0.5585, "blocklist_de": 7.7265}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.196, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-52369-LACNIC", "org": "NEOPHONE ARGENTINA SRL", "pdb": null, "pfx": 30, "reg": "2012-03-27", "rir": "lacnic", "s24": 40, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": "administracion@gilesonline.com.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037332666315}, {"a": 52371, "h": "", "n": "XF Comunicaciones", "t": "Broadband & mobile", "w": 5, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 4, "p": 0.8098, "hi": 9.06, "lo": 1.95, "ips": 5, "mean": 4.95, "above": true}}, "h2": [["2026-10-05", 3.931, 0.011, 0, false], ["2026-10-12", 22.167, 0.012, 1, false]], "sh": false, "uc": 7382.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 22.167, "se": 0.696, "ts": 1.000, "map": 60.228, "obs": 4, "own": 93.244, "comp": {"cins": -0.703, "dshield": -1.3009, "crowdsec": -5.1038, "vulncheck": -0.7473, "blocklist_de": 13.3468}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.224, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "@aut-52371-LACNIC", "org": "XF Comunicaciones S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": null, "pol": "Open", "web": "http://www.xfly.com.ar"}, "pfx": 11, "reg": "2012-05-23", "rir": "lacnic", "s24": 10, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 52393, "h": "", "n": "Corporación Dana S.A.", "t": "Other", "w": 3, "cc": "HN", "cf": null, "cs": {"c": {"web_exploit": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5207, "hi": 6.51, "lo": 1.15, "ips": 3, "mean": 3.36, "above": false}}, "h2": [["2026-10-05", 1.686, 0.011, 0, false], ["2026-10-12", 1.784, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 0.592, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.784, "se": 0.754, "ts": 1.000, "map": 5.383, "obs": 3, "own": 3.085, "comp": {"cins": -0.4793, "dshield": -0.9614, "crowdsec": 7.6126, "vulncheck": -0.6517, "blocklist_de": -2.4432}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.801, "det": null, "oid": "@aut-52393-LACNIC", "org": "Corporación Dana S.A.", "pdb": null, "pfx": 3, "reg": "2012-08-29", "rir": "lacnic", "s24": 72, "sib": 0, "tor": 0, "w24": 3, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52394, "h": "", "n": "INTERBANKING S.A.", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-52394-LACNIC", "org": "INTERBANKING S.A.", "pdb": null, "pfx": 2, "reg": "2012-08-31", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52423, "h": "", "n": "Data Miners", "t": "Other", "w": 1, "cc": "CR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1747, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.333, 0.011, 0, false], ["2026-10-12", 0.353, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.729, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.353, "se": 1.319, "ts": 1.000, "map": 3.122, "obs": 1, "own": 2.060, "comp": {"cins": -0.1138, "dshield": -0.2646, "crowdsec": 3.7886, "vulncheck": -0.2844, "blocklist_de": -0.5936}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.623, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-52423-LACNIC", "org": "Data Miners S.A. ( Racknation.cr )", "pdb": {"t": null, "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.racknation.cr"}, "pfx": 27, "reg": "2012-11-15", "rir": "lacnic", "s24": 27, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": "noc@racknation.cr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034964466054}, {"a": 52436, "h": "", "n": "Cable Televisora Color", "t": "Hosting & VPS", "w": 5, "cc": "AR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 3, "p": 0.6220, "hi": 7.47, "lo": 1.32, "ips": 3, "mean": 3.86, "above": false}}, "h2": [["2026-10-12", 8.143, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 3}, "lo": 8.143, "se": 0.634, "ts": 0.600, "map": 19.569, "obs": 5, "own": 3.885, "comp": {"cins": -0.7826, "dshield": 1.7686, "crowdsec": -5.5237, "vulncheck": 0.4874, "blocklist_de": 8.4179}, "mass": 3.8, "listed": false}}, "abq": true, "bot": 0.237, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "@aut-52436-LACNIC", "org": "Cable Televisora Color", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": null}, "pfx": 47, "reg": "2013-01-25", "rir": "lacnic", "s24": 35, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00277734243969}, {"a": 52439, "h": "", "n": "Banda Ancha", "t": "Broadband & mobile", "w": 0, "cc": "CL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1608, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.753, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.191, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-52439-LACNIC", "org": "OPTIC TELECOMUNICACIONES LIMITADA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": null, "pol": "Selective", "web": "http://www.bandaancha.cl"}, "pfx": 45, "reg": "2013-02-14", "rir": "lacnic", "s24": 44, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009042017364}, {"a": 52444, "h": "", "n": "Pogliotti & Pogliotti Construcciones S.A.", "t": "Broadband & mobile", "w": 5, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2021-3129": 1, "cve:CVE-2021-34427": 1, "cve:CVE-2021-43798": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.3175, "hi": 5.00, "lo": 0.88, "ips": 3, "mean": 2.58, "above": false}, "blocklist_de": {"n": 2, "p": 0.2913, "hi": 5.15, "lo": 0.67, "ips": 2, "mean": 2.46, "above": false}}, "h2": [["2026-10-05", 2.550, 0.010, 0, false], ["2026-10-12", 1.715, 0.011, 0, false]], "sh": false, "uc": 447.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.104, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.715, "se": 0.605, "ts": 0.600, "map": 3.947, "obs": 5, "own": 6.123, "comp": {"cins": -0.903, "dshield": -1.5626, "crowdsec": 2.6244, "vulncheck": -0.8032, "blocklist_de": 3.4109}, "mass": 4.6, "listed": false}}, "abq": true, "bot": 0.181, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-52444-LACNIC", "org": "Pogliotti & Pogliotti Construcciones S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.sitsa.com.ar"}, "pfx": 104, "reg": "2013-02-26", "rir": "lacnic", "s24": 207, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 143104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00246579485019}, {"a": 52449, "h": "", "n": "My Tech BZ", "t": "Other", "w": 0, "cc": "BZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.892, "det": null, "oid": "@aut-52449-LACNIC", "org": "My Tech BZ", "pdb": null, "pfx": 4, "reg": "2013-03-07", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52468, "h": "", "n": "Ufinet Latam AS52468", "t": "Broadband & mobile", "w": 50, "cc": "PA", "cf": {"rb": "", "wb": "", "rep": 6.40, "waf": 1.74}, "cs": {"c": {"http_flood": 11, "web_exploit": 18, "bad_crawling": 2, "proxy_or_vpn": 12, "ssh_bruteforce": 12, "web_bruteforce": 21, "home_connection": 19, "mail_bruteforce": 6, "router_or_botnet": 22, "cve:CVE-2017-9841": 1, "cve:CVE-2026-8181": 2, "cve:CVE-2017-16894": 1, "cve:CVE-2026-60137": 5, "cve:CVE-2026-63030": 5}, "n": 27}, "ev": {"shodan": {"n": 2, "p": 0.0059, "hi": 2.08, "lo": 0.27, "ips": 2, "mean": 0.99, "above": false}, "dshield": {"n": 3, "p": 0.3368, "hi": 5.13, "lo": 0.90, "ips": 3, "mean": 2.65, "above": false}, "crowdsec": {"n": 27, "p": 1.0000, "hi": 10.59, "lo": 5.66, "ips": 27, "mean": 7.96, "above": true}, "vulncheck": {"n": 3, "p": 0.3439, "hi": 5.18, "lo": 0.91, "ips": 3, "mean": 2.67, "above": false}, "blocklist_de": {"n": 17, "p": 0.9999, "hi": 12.66, "lo": 5.77, "ips": 17, "mean": 8.93, "above": true}}, "h2": [["2026-10-05", 3.086, 0.008, 0, false], ["2026-10-12", 5.761, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.841, "ts": null, "map": 0.132, "obs": 0, "own": 0.662, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 27, "vulncheck": 3, "blocklist_de": 17}, "lo": 5.761, "se": 0.380, "ts": 0.540, "map": 9.024, "obs": 50, "own": 13.832, "comp": {"cins": -3.2452, "dshield": -1.4615, "crowdsec": 2.8269, "vulncheck": -0.6026, "blocklist_de": 6.076}, "mass": 47.1, "listed": false}}, "abq": false, "bot": 0.404, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 7, "bots": 10}}, "oid": "@aut-52245-LACNIC", "org": "UFINET PANAMA S.A.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.ufinet.com/"}, "pfx": 961, "reg": "2013-05-08", "rir": "lacnic", "s24": 947, "sib": 1, "tor": 0, "w24": 47, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 278016, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.061732}, {"a": 52469, "h": "", "n": "Offshore Racks S.A", "t": "Other", "w": 6, "cc": "PA", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.4206, "hi": 6.27, "lo": 0.81, "ips": 6, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.012, 6.874, 0, false], ["2026-10-12", 0.012, 6.950, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 6.950, "se": 1.222, "ts": 1.000, "map": 40.005, "obs": 2, "own": 37.887, "comp": {"urlhaus": -0.2081, "threatfox": -0.2193, "phishing_db": 5.7426}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.909, "det": null, "oid": "@aut-52469-LACNIC", "org": "Offshore Racks S.A", "pdb": null, "pfx": 8, "reg": "2013-05-09", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003553406901}, {"a": 52485, "h": "", "n": "networksdelmanana.com", "t": "Other", "w": 0, "cc": "HN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.873, "det": null, "oid": "@aut-52485-LACNIC", "org": "networksdelmanana.com", "pdb": null, "pfx": 5, "reg": "2013-06-10", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "admin1@networksdelmanana.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000008570738}, {"a": 52490, "h": "", "n": "Cooperativa de Electricidad Ltda. de Pedro Luro", "t": "Broadband & mobile", "w": 6, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 5, "p": 0.9135, "hi": 10.42, "lo": 2.59, "ips": 6, "mean": 5.95, "above": true}}, "h2": [["2026-10-05", 12.610, 0.011, 1, false], ["2026-10-12", 41.526, 0.012, 1, false]], "sh": false, "uc": 11621.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 5}, "lo": 41.526, "se": 0.629, "ts": 1.000, "map": 101.057, "obs": 5, "own": 155.412, "comp": {"cins": -0.8955, "dshield": -1.5534, "crowdsec": -6.0809, "vulncheck": -0.8015, "blocklist_de": 15.3405}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.224, "det": {"blocklist_de": {"imap": 6, "mail": 6}}, "oid": "@aut-52490-LACNIC", "org": "COOPERATIVA DE ELECTRICIDAD DE PEDRO LURO", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.luronet.com.ar"}, "pfx": 9, "reg": "2013-09-18", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 52503, "h": "", "n": "FDJ S.A.", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.230, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-52503-LACNIC", "org": "MALARGÜE ONLINE", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.malargueonline.com.ar"}, "pfx": 2, "reg": "2014-05-15", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "noc@malargueonline.com.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52527, "h": "", "n": "IW NET", "t": "Hosting & VPS", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 9.423, 0.011, 0, false], ["2026-10-12", 0.557, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.557, "se": 1.414, "ts": 1.000, "map": 5.818, "obs": 1, "own": 1.413, "comp": {"cins": -0.0946, "dshield": -0.2219, "crowdsec": -0.8791, "vulncheck": -0.2474, "blocklist_de": 4.5976}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-52527-LACNIC", "org": "IWNET TELECOM LTDA ME", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.athontelecom.com.br"}, "pfx": 18, "reg": "2013-05-23", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00236558749665}, {"a": 52532, "h": "", "n": "Speednet Telecomunicações", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 2790.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.196, "det": null, "oid": "@aut-52532-LACNIC", "org": "Speednet Telecomunicações Ltda ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Tbps", "pol": "Open", "web": "https://www.speednettelecom.com.br/"}, "pfx": 6, "reg": "2013-05-29", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52571, "h": "", "n": "G2G Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 1, "p": 0.1563, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 1.320, 0.011, 0, false], ["2026-10-12", 1.432, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.432, "se": 0.939, "ts": 0.500, "map": 6.102, "obs": 2, "own": 9.795, "comp": {"cins": -0.3143, "dshield": -0.6721, "crowdsec": 1.5761, "vulncheck": -0.5381, "blocklist_de": 3.1507}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.163, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-52571-LACNIC", "org": "G2G COM PROD ELETRO E SERV LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.g2gtelecom.com.br"}, "pfx": 48, "reg": "2013-02-18", "rir": "lacnic", "s24": 40, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52573, "h": "", "n": "UNE TELECOM LTDA", "t": "Broadband & mobile", "w": 5, "cc": "BR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1767, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "urlhaus": {"n": 1, "p": 0.1951, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 3, "p": 0.5770, "hi": 7.02, "lo": 1.24, "ips": 3, "mean": 3.62, "above": false}}, "h2": [["2026-10-12", 2.656, 0.450, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.450, "se": 1.547, "ts": 1.000, "map": 4.557, "obs": 1, "own": 13.666, "comp": {"urlhaus": 3.9125, "threatfox": -0.2671, "phishing_db": -0.5026}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.656, "se": 0.667, "ts": 0.750, "map": 6.866, "obs": 4, "own": 10.671, "comp": {"cins": -0.7712, "dshield": 1.8059, "crowdsec": -5.4649, "vulncheck": -0.7687, "blocklist_de": 8.5191}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"ssh": 3}}, "oid": "@aut-52573-LACNIC", "org": "Une Telecom Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.unetelecom.com.br"}, "pfx": 70, "reg": "2013-02-18", "rir": "lacnic", "s24": 98, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 35584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00474009828495}, {"a": 52602, "h": "", "n": "SKORPION SISTEMA DE TELECOMUNICAÇÕES", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": 2880.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 35.813, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.125, "det": null, "oid": "@aut-52602-LACNIC", "org": "SKORPION SISTEMA DE TELECOMUNICAÇÕES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.skorpionet.com.br/"}, "pfx": 8, "reg": "2013-03-21", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52626, "h": "", "n": "NovaNet Provedor e Web Ltda", "t": "Broadband & mobile", "w": 11, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "blocklist_de": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 9, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 23.674, 0.011, 1, false], ["2026-10-12", 19.230, 0.012, 1, false]], "sh": false, "uc": 14672.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 19.230, "se": 0.623, "ts": 0.600, "map": 46.065, "obs": 5, "own": 71.089, "comp": {"cins": -0.8311, "dshield": -1.4725, "crowdsec": 0.3231, "vulncheck": -0.7854, "blocklist_de": 7.9895}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.128, "det": {"blocklist_de": {"imap": 9, "mail": 9}}, "oid": "@aut-52626-LACNIC", "org": "NovaNet Provedor e Web Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.novateltelecom.com.br/"}, "pfx": 15, "reg": "2013-04-03", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52737, "h": "", "n": "Floriani Serviços de Telecomunicação Ltda ME", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 4, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 4.579, 0.011, 0, false], ["2026-10-12", 5.141, 0.012, 0, false]], "sh": false, "uc": 4980.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.141, "se": 1.021, "ts": 1.000, "map": 25.709, "obs": 2, "own": 41.809, "comp": {"cins": -0.2678, "dshield": -0.5836, "crowdsec": -2.3041, "vulncheck": -0.4946, "blocklist_de": 8.2907}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.244, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-52737-LACNIC", "org": "Floriani Serviços de Telecomunicação Ltda ME", "pdb": null, "pfx": 10, "reg": "2013-01-29", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52758, "h": "", "n": "Global Network Telecomunicações do Brasil", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 12744.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.180, "det": null, "oid": "@aut-52758-LACNIC", "org": "Global Network Telecomunicações do Brasil Ltda.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://gln.net.br/"}, "pfx": 27, "reg": "2012-08-31", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52769, "h": "", "n": "Lagosnet Internet Banda Larga", "t": "Broadband & mobile", "w": 7, "cc": "BR", "cf": null, "cs": {"c": {"mail_bruteforce": 4}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 4, "mean": 2.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 4, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 8.178, 0.011, 0, false], ["2026-10-12", 16.214, 0.012, 1, false]], "sh": false, "uc": 4264.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 16.214, "se": 0.691, "ts": 0.500, "map": 43.908, "obs": 4, "own": 68.108, "comp": {"cins": -0.6274, "dshield": -1.1921, "crowdsec": 2.234, "vulncheck": -0.72, "blocklist_de": 5.4814}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.212, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-52769-LACNIC", "org": "LagosNet Internet Banda Larga Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.lagosnetminas.com.br"}, "pfx": 5, "reg": "2012-09-10", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52783, "h": "", "n": "ALCANS TELECOM LTDA", "t": "Broadband & mobile", "w": 7, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3369, "hi": 5.53, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}, "blocklist_de": {"n": 4, "p": 0.7864, "hi": 8.67, "lo": 1.87, "ips": 5, "mean": 4.74, "above": false}}, "h2": [["2026-10-05", 14.542, 0.011, 1, false], ["2026-10-12", 8.942, 0.012, 0, false]], "sh": false, "uc": 1014.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 8.942, "se": 0.574, "ts": 0.667, "map": 19.539, "obs": 6, "own": 30.114, "comp": {"cins": -1.0703, "dshield": -1.7569, "crowdsec": -1.6061, "vulncheck": -0.8377, "blocklist_de": 9.6371}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.169, "det": {"blocklist_de": {"ssh": 2, "bots": 1, "imap": 2, "mail": 2}}, "oid": "@aut-52783-LACNIC", "org": "ALCANS TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.alcans.com.br"}, "pfx": 14, "reg": "2012-09-18", "rir": "lacnic", "s24": 52, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00675511482093}, {"a": 52799, "h": "", "n": "ADENTRO TECNOLOGIA LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.536, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-52799-LACNIC", "org": "ADENTRO TECNOLOGIA LTDA", "pdb": null, "pfx": 13, "reg": "2012-10-02", "rir": "lacnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52800, "h": "", "n": "OS CONNECT INFORMATICA EIRELI - EPP", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3543.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 1.287, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.183, "det": null, "oid": "@aut-52800-LACNIC", "org": "OS CONNECT INFORMATICA EIRELI - EPP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.osconnect.com.br"}, "pfx": 20, "reg": "2012-10-02", "rir": "lacnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52815, "h": "", "n": "DF LINK TELECOM COMERCIO E SERVIÇOS DE COMUNICAÇÃO", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2587.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.130, "det": null, "oid": "@aut-52815-LACNIC", "org": "CEV FIBRA COMERCIO E SERVICOS DE COMUNICACAO LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.vectelecom.com.br"}, "pfx": 2, "reg": "2012-10-09", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52870, "h": "", "n": "Disk Sistema Tele-Informatica", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 7395.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 1.249, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.138, "det": null, "oid": "@aut-52870-LACNIC", "org": "Disk Sistema Telecomunicações Ltda.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.disksistema.com.br"}, "pfx": 25, "reg": "2012-01-31", "rir": "lacnic", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52871, "h": "", "n": "Mowry", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 3, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3293, "hi": 5.47, "lo": 0.71, "ips": 3, "mean": 2.61, "above": false}}, "h2": [["2026-10-05", 2.200, 0.011, 0, false], ["2026-10-12", 1.008, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 1.551, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.008, "se": 0.920, "ts": 1.000, "map": 4.173, "obs": 2, "own": 6.675, "comp": {"cins": -0.3068, "dshield": -0.6582, "crowdsec": 5.9002, "vulncheck": -0.5316, "blocklist_de": -1.5812}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.162, "det": null, "oid": "@aut-52871-LACNIC", "org": "TASCOM TELECOMUNICAÇÕES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Open", "web": "https://mowry.com.br"}, "pfx": 41, "reg": "2012-01-31", "rir": "lacnic", "s24": 57, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00256574379243}, {"a": 52892, "h": "", "n": "Coprel Telecom LTDA", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "urlhaus": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.1760, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 4.269, 0.526, 0, false], ["2026-10-12", 1.181, 0.562, 0, false]], "sh": false, "uc": 375.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.562, "se": 1.604, "ts": 1.000, "map": 6.293, "obs": 1, "own": 19.675, "comp": {"urlhaus": 4.0935, "threatfox": -0.2197, "phishing_db": -0.4082}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.181, "se": 0.929, "ts": 0.500, "map": 4.955, "obs": 2, "own": 7.944, "comp": {"cins": -0.3246, "dshield": -0.6913, "crowdsec": 1.4727, "vulncheck": -0.5469, "blocklist_de": 3.084}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.199, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-268218-LACNIC", "org": "COPREL TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.copreltelecom.com.br"}, "pfx": 70, "reg": "2012-06-15", "rir": "lacnic", "s24": 51, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00240841929657}, {"a": 52904, "h": "", "n": "Multpontos Telecomunicações", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.484, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.484, "se": 1.383, "ts": 1.000, "map": 4.801, "obs": 1, "own": 8.979, "comp": {"cins": -0.1039, "dshield": -0.2427, "crowdsec": -0.961, "vulncheck": -0.2657, "blocklist_de": 4.5357}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.216, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-52904-LACNIC", "org": "Multpontos Telecomunicações Ltda - ME", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.multpontostelecom.com.br/"}, "pfx": 20, "reg": "2012-07-25", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52928, "h": "", "n": "JANAJA SERVICOS LTDA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.255, 0.011, 0, false], ["2026-10-12", 0.272, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.272, "se": 1.276, "ts": 1.000, "map": 2.209, "obs": 1, "own": 3.916, "comp": {"cins": -0.1422, "dshield": -0.3266, "crowdsec": -1.2924, "vulncheck": -0.3337, "blocklist_de": 4.281}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-52928-LACNIC", "org": "NORTETEL TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "https://linknortetel.com.br/"}, "pfx": 31, "reg": "2012-08-13", "rir": "lacnic", "s24": 48, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00141752207919}, {"a": 52933, "h": "", "n": "CONECTIVA TECNOLOGIA LTDA", "t": "Other", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-52933-LACNIC", "org": "CONECTIVA TECNOLOGIA LTDA", "pdb": null, "pfx": 5, "reg": "2012-08-15", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52944, "h": "", "n": "MEGALINK TELECOMUNICACOES", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1367.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.197, "det": null, "oid": "@aut-52944-LACNIC", "org": "MEGALINK TELECOMUNICACOES LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.megalinkcorp.com.br"}, "pfx": 9, "reg": "2012-08-24", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52965, "h": "", "n": "1 Telecom Servicos de Internet", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 413.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.599, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.130, "det": null, "oid": "@aut-52965-LACNIC", "org": "1TELECOM SERVICOS DE TECNOLOGIA EM INTERNET LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://umtelecom.com.br/"}, "pfx": 128, "reg": "2011-02-11", "rir": "lacnic", "s24": 68, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 78592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002365816299}, {"a": 52967, "h": "", "n": "Veloso Assessoria em TI EIRELI - ME", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.340, 0.012, 0, false]], "sh": false, "uc": 3320.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.340, "se": 1.314, "ts": 1.000, "map": 2.963, "obs": 1, "own": 5.342, "comp": {"cins": -0.1276, "dshield": -0.2948, "crowdsec": -1.1671, "vulncheck": -0.3091, "blocklist_de": 4.3782}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.191, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-52967-LACNIC", "org": "NT Brasil Tecnologia Ltda. ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://conectv.com.br"}, "pfx": 28, "reg": "2011-02-21", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 52974, "h": "", "n": "Henet Telecomunicacoes Ltda", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3074, "hi": 5.28, "lo": 0.69, "ips": 2, "mean": 2.52, "above": false}, "blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-12", 1.913, 0.012, 0, false]], "sh": false, "uc": 1003.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 1.469, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.913, "se": 0.757, "ts": 0.667, "map": 5.790, "obs": 3, "own": 9.076, "comp": {"cins": -0.5113, "dshield": -1.0135, "crowdsec": 3.4567, "vulncheck": -0.6685, "blocklist_de": 1.8864}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.140, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-52974-LACNIC", "org": "Henet Telecomunicacoes Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.henet.com.br"}, "pfx": 106, "reg": "2011-03-04", "rir": "lacnic", "s24": 72, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 46336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00615496625688}, {"a": 52995, "h": "", "n": "TECHNet Informática", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 960.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 1.013, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.142, "det": null, "oid": "@aut-52995-LACNIC", "org": "TEN INTERNET Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.teninternet.com.br"}, "pfx": 25, "reg": "2011-05-24", "rir": "lacnic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00139949245401}, {"a": 53004, "h": "", "n": "Downup Telecomunicacoes e Servico", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 9179.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.125, "det": null, "oid": "@aut-53004-LACNIC", "org": "Downup Telecomunicacoes e servico LTDA", "pdb": null, "pfx": 4, "reg": "2011-06-20", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53005, "h": "", "n": "CONNECT TELECOMUNICACOES LTDA", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4005, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-12", 1.824, 0.012, 0, false]], "sh": false, "uc": 3820.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.824, "se": 0.953, "ts": 1.000, "map": 8.002, "obs": 2, "own": 12.874, "comp": {"cins": -0.3286, "dshield": -0.6987, "crowdsec": -2.7559, "vulncheck": -0.5502, "blocklist_de": 7.8068}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-53005-LACNIC", "org": "REDE CONNECT TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://grupoconnectba.com.br/"}, "pfx": 19, "reg": "2011-06-21", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00245747452041}, {"a": 53006, "h": "", "n": "ALGAR TELECOM S/A", "t": "Broadband & mobile", "w": 9, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.0363, "hi": 2.81, "lo": 0.36, "ips": 2, "mean": 1.34, "above": false}, "crowdsec": {"n": 2, "p": 0.0000, "hi": 0.88, "lo": 0.11, "ips": 2, "mean": 0.42, "above": false}, "blocklist_de": {"n": 5, "p": 0.0532, "hi": 3.03, "lo": 0.75, "ips": 5, "mean": 1.73, "above": false}}, "h2": [["2026-10-12", 0.425, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.774, "ts": null, "map": 0.102, "obs": 0, "own": 0.470, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.425, "se": 0.502, "ts": 0.556, "map": 0.802, "obs": 9, "own": 1.243, "comp": {"cins": -1.6281, "dshield": 1.5303, "crowdsec": -5.1379, "vulncheck": -0.9098, "blocklist_de": 7.3191}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.149, "det": {"blocklist_de": {"ssh": 3, "bots": 2}}, "oid": "@aut-53006-LACNIC", "org": "ALGAR TELECOM S/A", "pdb": null, "pfx": 8, "reg": "2011-06-21", "rir": "lacnic", "s24": 2304, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 589824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03018090614427}, {"a": 53038, "h": "", "n": "IDC19 - Intelligent Data Center", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1765, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.283, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.212, "obs": 0, "own": 0.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53038-LACNIC", "org": "IDC19 SOLUCOES EM TECNOLOGIA DA INFORMACAO LTDA", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.idc19.com.br"}, "pfx": 27, "reg": "2011-09-05", "rir": "lacnic", "s24": 25, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53055, "h": "", "n": "DIMENOC SERVICOS DE INFORMATICA", "t": "Hosting & VPS", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5674, "hi": 6.93, "lo": 1.22, "ips": 3, "mean": 3.57, "above": false}, "crowdsec": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "vulncheck": {"n": 2, "p": 0.4037, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 1.605, 0.011, 0, false], ["2026-10-12", 1.489, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.241, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.489, "se": 0.784, "ts": 0.667, "map": 4.598, "obs": 3, "own": 0.951, "comp": {"cins": -0.3303, "dshield": -0.7019, "crowdsec": 1.4154, "vulncheck": 4.2357, "blocklist_de": -1.6996}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.955, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 2}}, "oid": "@aut-53055-LACNIC", "org": "DIMENOC SERVICOS DE INFORMATICA LTDA", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "http://hostdime.com.br"}, "pfx": 42, "reg": "2020-02-06", "rir": "lacnic", "s24": 56, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30720, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53057, "h": "", "n": "RedeHost Internet", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1516, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.241, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.879, "ts": null, "map": 0.183, "obs": 0, "own": 0.085, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53057-LACNIC", "org": "RedeHost Internet Ltda.", "pdb": {"t": "Content", "sc": "South America", "tr": null, "pol": "No", "web": "https://www.umbler.com"}, "pfx": 31, "reg": "2009-08-14", "rir": "lacnic", "s24": 56, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53062, "h": "", "n": "Brasil TecPar", "t": "Transit & backbone", "w": 8, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2025-55182": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.6575, "hi": 7.13, "lo": 1.53, "ips": 4, "mean": 3.89, "above": false}, "blocklist_de": {"n": 4, "p": 0.7545, "hi": 8.21, "lo": 1.77, "ips": 4, "mean": 4.49, "above": false}}, "h2": [["2026-10-05", 4.813, 0.011, 0, false], ["2026-10-12", 6.547, 0.012, 0, false]], "sh": false, "uc": 562.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.001, "ts": null, "map": 0.183, "obs": 0, "own": 1.890, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 4}, "lo": 6.547, "se": 0.520, "ts": 0.500, "map": 12.797, "obs": 8, "own": 40.020, "comp": {"cins": -1.3316, "dshield": -2.0232, "crowdsec": 1.0793, "vulncheck": -0.8775, "blocklist_de": 7.096}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.169, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "imap": 2, "mail": 2}}, "oid": "@family-8478", "org": "ACESSOLINE TELECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.brasiltecpar.com.br"}, "pfx": 92, "reg": "2009-08-21", "rir": "lacnic", "s24": 107, "sib": 4, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00567317542985}, {"a": 53075, "h": "", "n": "Holistica Provedor Internet Ltda", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 2.062, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 305.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.619, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.143, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-53075-LACNIC", "org": "Holistica Provedor Internet Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.holistica.com.br"}, "pfx": 57, "reg": "2009-09-11", "rir": "lacnic", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 63744, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00250282314618}, {"a": 53080, "h": "", "n": "Vero Internet AS53080", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1428, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.208, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 494, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 2.117, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 1.217, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.172, "det": {"shodan": {"compromised": 1}}, "oid": "@family-10416", "org": "VERO S.A", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.redetelecom.com.br"}, "pfx": 43, "reg": "2009-10-07", "rir": "lacnic", "s24": 68, "sib": 35, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00171899205555}, {"a": 53094, "h": "", "n": "Guanhaes Internet", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1289.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.199, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-53094-LACNIC", "org": "GHNET TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.ghnet.com.br"}, "pfx": 9, "reg": "2009-11-10", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53098, "h": "", "n": "NEWNET CONSULTORIA, INFORMATICA LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1464.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.152, "det": null, "oid": "@aut-53098-LACNIC", "org": "NEWNET CONSULTORIA, INFORMATICA LTDA", "pdb": null, "pfx": 17, "reg": "2009-11-19", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53107, "h": "", "n": "EVEO", "t": "Hosting & VPS", "w": 13, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 6, "web_bruteforce": 3, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2002-1131": 1, "cve:CVE-2009-1558": 1, "cve:CVE-2012-0392": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1636, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "shodan": {"n": 8, "p": 0.9678, "hi": 10.04, "lo": 3.27, "ips": 8, "mean": 6.26, "above": true}, "dshield": {"n": 1, "p": 0.1548, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "crowdsec": {"n": 7, "p": 0.9019, "hi": 8.51, "lo": 2.58, "ips": 8, "mean": 5.18, "above": true}, "threatfox": {"n": 1, "p": 0.1855, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 5, "p": 0.8359, "hi": 8.62, "lo": 2.14, "ips": 6, "mean": 4.92, "above": true}}, "h2": [["2026-10-05", 5.549, 0.754, 0, false], ["2026-10-12", 6.956, 0.209, 0, false]], "sh": false, "uc": 303.8, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.209, "se": 1.417, "ts": 1.000, "map": 1.560, "obs": 1, "own": 0.717, "comp": {"urlhaus": -0.208, "threatfox": 2.6859, "phishing_db": -0.4072}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 5}, "lo": 6.956, "se": 0.451, "ts": 0.500, "map": 12.230, "obs": 14, "own": 2.393, "comp": {"cins": 0.9914, "dshield": -0.9684, "crowdsec": 0.8477, "vulncheck": -0.9356, "blocklist_de": 3.9625}, "mass": 13.9, "listed": false}}, "abq": false, "bot": 0.975, "det": {"shodan": {"c2": 1, "compromised": 7}, "threatfox": {"family:Remus": 1}, "blocklist_de": {"ftp": 1, "ssh": 4, "bots": 1}}, "oid": "@aut-53107-LACNIC", "org": "EVEO S.A.", "pdb": {"t": "Content", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.eveo.com.br"}, "pfx": 254, "reg": "2009-12-10", "rir": "lacnic", "s24": 205, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8212]], "ipv4": 96512, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00309665676537}, {"a": 53112, "h": "", "n": "Sulnet", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.691, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.180, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53112-LACNIC", "org": "SULNET TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.sulnet.com.br"}, "pfx": 6, "reg": "2009-12-11", "rir": "lacnic", "s24": 52, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53139, "h": "", "n": "RDF Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1777.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.190, "det": null, "oid": "@aut-53139-LACNIC", "org": "RDF Informatica Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.rdfnet.com.br"}, "pfx": 32, "reg": "2010-04-16", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53153, "h": "", "n": "CINTE Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53153-LACNIC", "org": "CINTE TELECOM COMERCIO E SERVICOS LTDA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.cinte.com.br"}, "pfx": 10, "reg": "2010-06-02", "rir": "lacnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53180, "h": "", "n": "Infortel Comunicacoes", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 2.434, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 1.693, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53180-LACNIC", "org": "INFORTEL COMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.infortel.net.br"}, "pfx": 3, "reg": "2010-08-13", "rir": "lacnic", "s24": 36, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53181, "h": "", "n": "K2 Telecom e Multimidia", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 771.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.791, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.202, "det": null, "oid": "@aut-53181-LACNIC", "org": "Avanca Telecom e Servicos LTDA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.k2telecom.com.br"}, "pfx": 4, "reg": "2010-08-18", "rir": "lacnic", "s24": 40, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00139862300508}, {"a": 53185, "h": "", "n": "Zago & Zago Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.172, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53185-LACNIC", "org": "zago & zago telecomunicacoes ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.sacranet.com.br"}, "pfx": 5, "reg": "2010-08-23", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53190, "h": "", "n": "VERO S.A", "t": "Other", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 2, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.534, 0.012, 0, false]], "sh": false, "uc": 8431, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 3.772, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.189, "det": null, "oid": "@family-10416", "org": "VERO S.A", "pdb": null, "pfx": 4, "reg": "2010-08-26", "rir": "lacnic", "s24": 12, "sib": 35, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53202, "h": "", "n": "Acesso10 Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "vulncheck": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.267, 0.011, 0, false], ["2026-10-12", 0.263, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.263, "se": 1.285, "ts": 1.000, "map": 2.095, "obs": 1, "own": 3.868, "comp": {"cins": -0.0909, "dshield": -0.2136, "crowdsec": -0.8461, "vulncheck": 3.7588, "blocklist_de": -0.4751}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "@aut-53202-LACNIC", "org": "Acesso10 Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.acesso10.net.br"}, "pfx": 24, "reg": "2010-09-09", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53231, "h": "", "n": "Grupo Host LTDA", "t": "Hosting & VPS", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6044, "hi": 7.29, "lo": 1.28, "ips": 3, "mean": 3.76, "above": false}}, "h2": [["2026-10-05", 7.579, 0.011, 0, false], ["2026-10-12", 4.566, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.566, "se": 0.777, "ts": 1.000, "map": 14.483, "obs": 3, "own": 2.890, "comp": {"cins": -0.4346, "dshield": -0.8867, "crowdsec": 8.2358, "vulncheck": -0.6259, "blocklist_de": -2.2219}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.209, "det": null, "oid": "@aut-53231-LACNIC", "org": "GRUPOHOST COMUNICACAO MULTIMIDIA LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.hostfiber.com.br"}, "pfx": 38, "reg": "2010-11-30", "rir": "lacnic", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00133858526844}, {"a": 53240, "h": "", "n": "Net Onze Provedor de Acesso a Internet Ltda", "t": "Broadband & mobile", "w": 5, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1325, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "crowdsec": {"n": 3, "p": 0.5022, "hi": 6.35, "lo": 1.12, "ips": 4, "mean": 3.28, "above": false}, "blocklist_de": {"n": 3, "p": 0.5877, "hi": 7.12, "lo": 1.25, "ips": 4, "mean": 3.67, "above": false}}, "h2": [["2026-10-05", 2.514, 0.011, 0, false], ["2026-10-12", 5.431, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.419, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.431, "se": 0.572, "ts": 0.500, "map": 11.801, "obs": 6, "own": 18.219, "comp": {"cins": -1.0408, "dshield": -1.7241, "crowdsec": 1.2935, "vulncheck": -0.8322, "blocklist_de": 6.1654}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 3, "imap": 1, "mail": 1}}, "oid": "@aut-53240-LACNIC", "org": "Net Onze Provedor de Acesso a Internet Eireli", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.net11.com.br"}, "pfx": 50, "reg": "2010-12-22", "rir": "lacnic", "s24": 83, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53243, "h": "", "n": "Brasil Site Informatica", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1955, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.565, 0, false], ["2026-10-12", 0.011, 0.587, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.587, "se": 1.606, "ts": 1.000, "map": 6.763, "obs": 1, "own": 8.344, "comp": {"urlhaus": -0.078, "threatfox": -0.1032, "phishing_db": 3.7188}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.433, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.972, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-53243-LACNIC", "org": "Brasil Site Informatica LTDA", "pdb": null, "pfx": 21, "reg": "2010-12-22", "rir": "lacnic", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53271, "h": "PHENIXCITYCABLE", "n": "Phenix Cable", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.3812, "hi": 5.91, "lo": 0.77, "ips": 4, "mean": 2.82, "above": false}}, "h2": [["2026-10-12", 0.352, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.182, "obs": 0, "own": 1.281, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.352, "se": 0.906, "ts": 1.000, "map": 1.357, "obs": 2, "own": 2.274, "comp": {"cins": -0.2198, "dshield": -0.4885, "crowdsec": -1.9302, "vulncheck": 5.4757, "blocklist_de": -1.1387}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.187, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "RGDPC-ARIN", "org": "Phenix Cable", "pdb": null, "pfx": 10, "reg": "2009-07-17", "rir": "arin", "s24": 123, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 31488, "abuse": "abuseissues@momentumtelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53332, "h": "C2HOSTING-01", "n": "C2Hosting, LLC", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 2.263, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": true, "bot": null, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "C2HOS-1-ARIN", "org": "C2Hosting, LLC", "pdb": null, "pfx": 3, "reg": "2009-12-09", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53340, "h": "FIBERHUB", "n": "Fiberhub", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.8490, "hi": 8.85, "lo": 2.20, "ips": 5, "mean": 5.05, "above": true}, "crowdsec": {"n": 1, "p": 0.1160, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}, "blocklist_de": {"n": 1, "p": 0.1607, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.172, 0.011, 0, false], ["2026-10-12", 0.766, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 1.398, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.766, "se": 0.908, "ts": 0.500, "map": 3.096, "obs": 2, "own": 4.954, "comp": {"cins": -0.348, "dshield": -0.7343, "crowdsec": 1.2399, "vulncheck": -0.5659, "blocklist_de": 2.9322}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.932, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1}}, "oid": "VEGAS-3-ARIN", "org": "VegasNAP, LLC", "pdb": {"t": "Content", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.fiberhub.com"}, "pfx": 41, "reg": "2009-12-11", "rir": "arin", "s24": 88, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 23040, "abuse": "abusereports@fiberhub.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 53428, "h": "KCS-US-NEBIUS", "n": "Nebius - AS53428", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.775, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.412, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.967, "det": {"shodan": {"compromised": 1}}, "oid": "NB-374-ARIN", "org": "Nebius Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.nebius.com"}, "pfx": 9, "reg": "2024-12-13", "rir": "arin", "s24": 19, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53514, "h": "UHQ", "n": "UHQ", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 3, "first_seen_30d": 3, "ssh_bruteforce": 3, "web_bruteforce": 5, "cve:CVE-2025-3248": 2, "cve:CVE-2021-41773": 2, "cve:CVE-2024-56159": 2, "cve:CVE-2025-22457": 2, "cve:CVE-2025-29927": 3}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.996, "det": null, "oid": "USL-61-ARIN", "org": "UHQ Services LLC", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "20-100Mbps", "pol": "Open", "web": "https://uhq.services"}, "pfx": 1, "reg": "2025-06-23", "rir": "arin", "s24": 1, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "noc@uhq.services", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014665623843}, {"a": 53586, "h": "WITTE-1", "n": "Wittenberg Telephone Company", "t": "Other", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.351, 0.011, 0, false], ["2026-10-12", 0.348, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.775, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.348, "se": 1.332, "ts": 1.000, "map": 3.043, "obs": 1, "own": 2.100, "comp": {"cins": -0.0787, "dshield": -0.1858, "crowdsec": -0.7362, "vulncheck": 3.9187, "blocklist_de": -0.4114}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.180, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "WITTE-1-ARIN", "org": "Wittenberg Telephone Company", "pdb": null, "pfx": 23, "reg": "2010-06-24", "rir": "arin", "s24": 19, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53667, "h": "PONYNET", "n": "FranTech Solutions", "t": "Hosting & VPS", "w": 137, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 74, "data_centre": 46, "web_exploit": 80, "bad_crawling": 46, "proxy_or_vpn": 47, "ssh_bruteforce": 37, "web_bruteforce": 78, "home_connection": 8, "mail_bruteforce": 10, "router_or_botnet": 2, "cve:CVE-2017-9841": 13, "cve:CVE-2018-20062": 21, "cve:CVE-2026-60137": 16, "cve:CVE-2026-63030": 34, "cve:CVE-2026-87902": 7}, "n": 102}, "ev": {"cins": {"n": 10, "p": 0.9996, "hi": 16.12, "lo": 5.86, "ips": 13, "mean": 10.45, "above": true}, "shodan": {"n": 6, "p": 0.9096, "hi": 9.36, "lo": 2.60, "ips": 6, "mean": 5.53, "above": true}, "dshield": {"n": 3, "p": 0.6024, "hi": 7.27, "lo": 1.28, "ips": 3, "mean": 3.75, "above": false}, "urlhaus": {"n": 1, "p": 0.1941, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 61, "p": 1.0000, "hi": 56.78, "lo": 37.34, "ips": 102, "mean": 46.63, "above": true}, "threatfox": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1718, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "phishing_db": {"n": 19, "p": 1.0000, "hi": 26.29, "lo": 12.50, "ips": 22, "mean": 18.86, "above": true}, "blocklist_de": {"n": 10, "p": 0.9992, "hi": 14.97, "lo": 5.45, "ips": 11, "mean": 9.71, "above": true}}, "h2": [["2026-10-05", 103.192, 32.401, 2, false], ["2026-10-12", 71.319, 27.978, 2, false]], "sh": false, "uc": 563.9, "v2": {"band": 2, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 19}, "lo": 27.978, "se": 0.721, "ts": 0.905, "map": 57.983, "obs": 21, "own": 19.512, "comp": {"urlhaus": -0.156, "threatfox": -0.2269, "phishing_db": 6.0693}, "mass": 8.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 10, "dshield": 3, "crowdsec": 61, "vulncheck": 1, "blocklist_de": 10}, "lo": 71.319, "se": 0.359, "ts": 0.718, "map": 108.452, "obs": 85, "own": 21.050, "comp": {"cins": 6.5257, "dshield": -2.1799, "crowdsec": 9.81, "vulncheck": -0.9174, "blocklist_de": -7.1585}, "mass": 73.7, "listed": true}}, "abq": false, "bot": 0.878, "det": {"shodan": {"compromised": 6}, "threatfox": {"family:Aisuru": 1, "family:Cobalt Strike": 1}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ftp": 1, "sip": 1, "ssh": 8, "mail": 1}}, "oid": "SYNDI-5-ARIN", "org": "FranTech Solutions", "pdb": {"t": null, "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://frantech.ca"}, "pfx": 41, "reg": "2010-11-19", "rir": "arin", "s24": 124, "sib": 0, "tor": 21, "w24": 72, "drop": 0, "hist": [["2026-10-05", 0.8659], ["2026-10-12", 0.9969]], "ipv4": 34304, "abuse": "admin@frantech.ca", "score": 0.9969, "groups": ["sensors", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.00795789235536}, {"a": 53724, "h": "EVM", "n": "ExtraVM", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "threatfox": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1966, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.626, 0, false], ["2026-10-12", 0.460, 0.647, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.647, "se": 1.639, "ts": 1.000, "map": 7.861, "obs": 1, "own": 10.011, "comp": {"urlhaus": -0.059, "threatfox": 3.8924, "phishing_db": -0.1452}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.460, "se": 1.385, "ts": 1.000, "map": 4.441, "obs": 1, "own": 3.150, "comp": {"cins": -0.0667, "dshield": -0.1582, "crowdsec": -0.6271, "vulncheck": 4.0853, "blocklist_de": -0.3487}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.915, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}}, "oid": "EL-1152-ARIN", "org": "EXTRAVM LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://extravm.com"}, "pfx": 11, "reg": "2024-08-13", "rir": "arin", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse@extravm.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000701736265}, {"a": 53755, "h": "IOFLOOD", "n": "Input Output Flood", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.4315, "hi": 5.18, "lo": 1.29, "ips": 5, "mean": 2.96, "above": false}, "crowdsec": {"n": 1, "p": 0.0084, "hi": 2.08, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "threatfox": {"n": 1, "p": 0.1684, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1110, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "phishing_db": {"n": 3, "p": 0.4928, "hi": 6.28, "lo": 1.11, "ips": 3, "mean": 3.24, "above": false}}, "h2": [["2026-10-05", 0.455, 1.492, 0, false], ["2026-10-12", 0.144, 1.160, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 1.160, "se": 0.958, "ts": 0.750, "map": 3.419, "obs": 4, "own": 1.358, "comp": {"urlhaus": -0.845, "threatfox": 0.7014, "phishing_db": 2.9993}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.144, "se": 0.862, "ts": 0.500, "map": 0.518, "obs": 2, "own": 0.108, "comp": {"cins": -0.3212, "dshield": -0.6849, "crowdsec": 1.5069, "vulncheck": 1.8891, "blocklist_de": -1.6535}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.948, "det": {"shodan": {"compromised": 5}, "threatfox": {"family:PureRAT": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "IOFL-ARIN", "org": "Input Output Flood LLC", "pdb": {"t": "Content", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.ioflood.com"}, "pfx": 170, "reg": "2011-05-10", "rir": "arin", "s24": 482, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 212736, "abuse": "abuse@ioflood.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53759, "h": "VND", "n": "Visual Net Design LC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.771, "det": {"shodan": {"compromised": 1}}, "oid": "VNDL-ARIN", "org": "Visual Net Design LC", "pdb": null, "pfx": 3, "reg": "2011-05-12", "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@vndx.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53813, "h": "ZSCALER-INC", "n": "Zscaler AS53813", "t": "Hosting & VPS", "w": 9, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.68, "waf": 0.59}, "cs": null, "ev": {"dshield": {"n": 6, "p": 0.9001, "hi": 9.12, "lo": 2.53, "ips": 9, "mean": 5.39, "above": true}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.782, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.883, "ts": null, "map": 0.150, "obs": 0, "own": 0.124, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.782, "se": 0.562, "ts": 1.000, "map": 1.666, "obs": 6, "own": 0.329, "comp": {"cins": -0.9913, "dshield": 15.1373, "crowdsec": -6.5219, "vulncheck": -0.8225, "blocklist_de": -4.8974}, "mass": 5.1, "listed": false}}, "abq": true, "bot": 0.254, "det": null, "oid": "ZSCAL-ARIN", "org": "ZSCALER, INC.", "pdb": {"t": "Network Services", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.zscaler.com"}, "pfx": 370, "reg": "2011-06-03", "rir": "arin", "s24": 552, "sib": 6, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 143104, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.108137}, {"a": 53824, "h": "LIQUIDWEB", "n": "Liquid Web, L.L.C", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5161, "hi": 6.47, "lo": 1.14, "ips": 3, "mean": 3.34, "above": false}, "crowdsec": {"n": 1, "p": 0.1125, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.654, 0.011, 0, false], ["2026-10-12", 0.174, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 0.213, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.174, "se": 1.209, "ts": 1.000, "map": 1.252, "obs": 1, "own": 0.275, "comp": {"cins": -0.1556, "dshield": -0.3554, "crowdsec": 3.2941, "vulncheck": -0.3549, "blocklist_de": -0.8097}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.990, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}}, "oid": "LQWB-ARIN", "org": "Liquid Web, L.L.C", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://liquidweb.com"}, "pfx": 6, "reg": "2011-07-05", "rir": "arin", "s24": 93, "sib": 8, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23808, "abuse": "abuse@liquidweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53850, "h": "GORILLASERVERS", "n": "GorillaServers", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 6, "p": 0.8186, "hi": 7.73, "lo": 2.14, "ips": 6, "mean": 4.57, "above": true}, "crowdsec": {"n": 1, "p": 0.0409, "hi": 2.85, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "vulncheck": {"n": 3, "p": 0.5601, "hi": 6.86, "lo": 1.21, "ips": 3, "mean": 3.54, "above": false}, "phishing_db": {"n": 1, "p": 0.1509, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1073, "hi": 3.74, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.536, 0.673, 0, false], ["2026-10-12", 0.882, 0.200, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.200, "se": 1.409, "ts": 1.000, "map": 1.473, "obs": 1, "own": 0.672, "comp": {"urlhaus": -0.2362, "threatfox": -0.2385, "phishing_db": 2.4879}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 1}, "lo": 0.882, "se": 0.640, "ts": 0.600, "map": 2.089, "obs": 5, "own": 0.424, "comp": {"cins": -0.6206, "dshield": -1.1821, "crowdsec": -1.17, "vulncheck": 3.9045, "blocklist_de": 1.1987}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.965, "det": {"shodan": {"c2": 1, "compromised": 5}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 1}}, "oid": "GORIL-3-ARIN", "org": "GorillaServers, Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://GorillaServers.com"}, "pfx": 90, "reg": "2011-07-14", "rir": "arin", "s24": 249, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 90624, "abuse": "abuse@GorillaServers.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00526403808234}, {"a": 53856, "h": "NJIX", "n": "NJ IX", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 5}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.2719, "hi": 4.99, "lo": 0.65, "ips": 5, "mean": 2.38, "above": false}}, "h2": [["2026-10-05", 0.626, 0.011, 0, false], ["2026-10-12", 0.660, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.007, "ts": null, "map": 0.184, "obs": 0, "own": 0.548, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.660, "se": 0.899, "ts": 1.000, "map": 2.612, "obs": 2, "own": 1.526, "comp": {"cins": -0.3285, "dshield": -0.6986, "crowdsec": 5.6217, "vulncheck": -0.5502, "blocklist_de": -1.6906}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.836, "det": null, "oid": "GPIEX-1-ARIN", "org": "NJ IX", "pdb": null, "pfx": 28, "reg": "2018-10-29", "rir": "arin", "s24": 98, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25856, "abuse": "abuse@nj-ix.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53914, "h": "GENESIS-HOSTING-SOLUTIONS-LLC", "n": "Genesis Hosting Solutions, LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.982, "det": {"shodan": {"compromised": 1}}, "oid": "GHSL-ARIN", "org": "Genesis Hosting Solutions, LLC", "pdb": null, "pfx": 6, "reg": "2011-08-05", "rir": "arin", "s24": 14, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 53958, "h": "BART-BM", "n": "AUPROXIES LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.829, "det": null, "oid": "AL-3094-ARIN", "org": "AUPROXIES LLC", "pdb": null, "pfx": 2, "reg": "2024-09-16", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@auproxies.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 54102, "h": "FABFIBERNET", "n": "Fabulous Fiber LLC", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 2, "ssh_bruteforce": 1, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 55468.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 122.487, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.515, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "FFL-22-ARIN", "org": "Fabulous Fiber LLC", "pdb": null, "pfx": 1, "reg": "2014-06-26", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 54113, "h": "FASTLY", "n": "Fastly, Inc.", "t": "CDN & platforms", "w": 2, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.20, "waf": 0.17}, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.0957, "hi": 3.51, "lo": 0.46, "ips": 2, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.210, 0.008, 0, false], ["2026-10-12", 0.073, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.807, "ts": null, "map": 0.117, "obs": 0, "own": 1.523, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.073, "se": 0.817, "ts": 1.000, "map": 0.243, "obs": 2, "own": 0.504, "comp": {"cins": -0.4467, "dshield": 6.9131, "crowdsec": -3.5718, "vulncheck": -0.6332, "blocklist_de": -2.282}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.137, "det": null, "oid": "SKYCA-3-ARIN", "org": "Fastly, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "100+Tbps", "pol": "Selective", "web": "https://www.fastly.com"}, "pfx": 579, "reg": "2011-10-04", "rir": "arin", "s24": 1474, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 645888, "abuse": "abuse@fastly.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.372048}, {"a": 54290, "h": "HOSTWINDS", "n": "Hostwinds", "t": "Hosting & VPS", "w": 91, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 3, "web_exploit": 2, "bad_crawling": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2025-22457": 1}, "n": 4}, "ev": {"shodan": {"n": 16, "p": 0.9961, "hi": 9.07, "lo": 4.04, "ips": 16, "mean": 6.35, "above": true}, "crowdsec": {"n": 4, "p": 0.0466, "hi": 2.96, "lo": 0.64, "ips": 4, "mean": 1.62, "above": false}, "threatfox": {"n": 1, "p": 0.1512, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "vulncheck": {"n": 2, "p": 0.2054, "hi": 4.46, "lo": 0.58, "ips": 2, "mean": 2.12, "above": false}, "phishing_db": {"n": 64, "p": 1.0000, "hi": 56.94, "lo": 37.81, "ips": 83, "mean": 46.96, "above": true}, "blocklist_de": {"n": 1, "p": 0.0260, "hi": 2.58, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}}, "h2": [["2026-10-05", 0.720, 13.182, 1, false], ["2026-10-12", 0.573, 13.115, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 64}, "lo": 13.115, "se": 0.710, "ts": 0.985, "map": 25.635, "obs": 65, "own": 8.917, "comp": {"urlhaus": -2.616, "threatfox": -0.4572, "phishing_db": 7.9434}, "mass": 25.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 1}, "lo": 0.573, "se": 0.557, "ts": 0.571, "map": 1.198, "obs": 7, "own": 0.238, "comp": {"cins": -1.0095, "dshield": -1.6887, "crowdsec": 4.3141, "vulncheck": 1.1348, "blocklist_de": -1.1766}, "mass": 5.3, "listed": false}}, "abq": true, "bot": 0.888, "det": {"shodan": {"c2": 4, "compromised": 12}, "threatfox": {"family:PureRAT": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"sip": 1}}, "oid": "HOSTP-7-ARIN", "org": "HostPapa", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.hostwinds.com/"}, "pfx": 73, "reg": "2011-12-05", "rir": "arin", "s24": 786, "sib": 11, "tor": 0, "w24": 70, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.8393]], "ipv4": 327936, "abuse": null, "score": 0.8393, "groups": ["phishing", "shodan"], "sensors": [], "traffic": null}, {"a": 54548, "h": "PROFITBRICKS-USA", "n": "ProfitBricks USA", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 2, "cve:CVE-2019-17050": 2, "cve:CVE-2021-41714": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 10.467, 0.011, 1, false], ["2026-10-12", 2.680, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.680, "se": 0.975, "ts": 1.000, "map": 12.353, "obs": 2, "own": 7.278, "comp": {"cins": -0.2579, "dshield": -0.5644, "crowdsec": 6.5478, "vulncheck": -0.4845, "blocklist_de": -1.3334}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "PROFI-33-ARIN", "org": "IONOS Cloud Inc.", "pdb": null, "pfx": 7, "reg": "2012-03-15", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@ionos.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 54600, "h": "PEG-SV", "n": "RAKsmart", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.0025, "hi": 2.08, "lo": 0.52, "ips": 5, "mean": 1.19, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.78, "lo": 0.06, "ips": 1, "mean": 0.33, "above": false}, "threatfox": {"n": 3, "p": 0.4582, "hi": 6.00, "lo": 1.06, "ips": 3, "mean": 3.10, "above": false}, "phishing_db": {"n": 2, "p": 0.0722, "hi": 3.26, "lo": 0.42, "ips": 2, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.048, 0.454, 0, false], ["2026-10-12", 0.023, 0.459, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 2}, "lo": 0.459, "se": 0.961, "ts": 0.600, "map": 1.286, "obs": 5, "own": 0.548, "comp": {"urlhaus": -1.1121, "threatfox": 2.0409, "phishing_db": 0.9489}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.023, "se": 1.013, "ts": 1.000, "map": 0.111, "obs": 1, "own": 0.023, "comp": {"cins": -0.2745, "dshield": -0.5965, "crowdsec": 1.9856, "vulncheck": -0.5013, "blocklist_de": -1.4173}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.450, "det": {"shodan": {"c2": 1, "compromised": 4}, "threatfox": {"family:Havoc": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 1}}, "oid": "PT-82-ARIN", "org": "PEG TECH INC", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.raksmart.com"}, "pfx": 394, "reg": "2012-04-03", "rir": "arin", "s24": 1901, "sib": 7, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 576512, "abuse": "abuse@petaexpress.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01131988243269}, {"a": 54641, "h": "IMH-IAD", "n": "InMotion Hosting (IAD)", "t": "Hosting & VPS", "w": 16, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "web_bruteforce": 4}, "n": 4}, "ev": {"shodan": {"n": 4, "p": 0.6289, "hi": 6.87, "lo": 1.48, "ips": 4, "mean": 3.75, "above": false}, "crowdsec": {"n": 4, "p": 0.5813, "hi": 6.47, "lo": 1.39, "ips": 4, "mean": 3.53, "above": false}, "vulncheck": {"n": 1, "p": 0.1654, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "phishing_db": {"n": 8, "p": 0.9940, "hi": 13.41, "lo": 4.36, "ips": 11, "mean": 8.36, "above": true}}, "h2": [["2026-10-05", 3.486, 7.166, 0, false], ["2026-10-12", 1.698, 7.186, 0, false]], "sh": false, "uc": 285.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 8}, "lo": 7.186, "se": 0.814, "ts": 1.000, "map": 17.193, "obs": 8, "own": 6.139, "comp": {"urlhaus": -1.1805, "threatfox": -0.4939, "phishing_db": 6.1451}, "mass": 3.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.698, "se": 0.617, "ts": 0.800, "map": 3.979, "obs": 5, "own": 0.791, "comp": {"cins": -0.7211, "dshield": -1.3261, "crowdsec": 7.8412, "vulncheck": 0.6025, "blocklist_de": -3.6217}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.987, "det": {"shodan": {"compromised": 4}, "vulncheck": {"botnet_node": 1}}, "oid": "INMOT-1-ARIN", "org": "InMotion Hosting, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.inmotionhosting.com/"}, "pfx": 53, "reg": "2012-04-17", "rir": "arin", "s24": 156, "sib": 2, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 48384, "abuse": "abuse@inmotionhosting.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 54723, "h": "AS54723-MIDWEST-DATA-CENTER", "n": "Midwest Data Center, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1756, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 0.281, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.211, "obs": 0, "own": 0.124, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.172, "det": {"shodan": {"compromised": 1}}, "oid": "MDC-78-ARIN", "org": "Midwest Data Center, Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Selective", "web": "https://www.mwdata.net"}, "pfx": 20, "reg": "2018-04-18", "rir": "arin", "s24": 26, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 54801, "h": "ZILLION-NETWORK", "n": "Zillion Network Inc.", "t": "Other", "w": 21, "cc": "US", "cf": {"rb": "lo", "wb": null, "rep": 2.50, "waf": null}, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0050, "hi": 2.03, "lo": 0.26, "ips": 2, "mean": 0.97, "above": false}, "threatfox": {"n": 7, "p": 0.9782, "hi": 11.73, "lo": 3.55, "ips": 10, "mean": 7.14, "above": true}, "phishing_db": {"n": 1, "p": 0.0809, "hi": 3.43, "lo": 0.26, "ips": 7, "mean": 1.44, "above": false}, "blocklist_de": {"n": 1, "p": 0.0258, "hi": 2.57, "lo": 0.19, "ips": 2, "mean": 1.08, "above": false}}, "h2": [["2026-10-05", 0.333, 1.365, 0, false], ["2026-10-12", 0.235, 1.556, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 1}, "lo": 1.556, "se": 0.867, "ts": 0.875, "map": 3.832, "obs": 8, "own": 3.907, "comp": {"urlhaus": -1.2703, "threatfox": 4.4424, "phishing_db": -0.2025}, "mass": 4.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.235, "se": 0.717, "ts": 0.667, "map": 0.660, "obs": 3, "own": 0.380, "comp": {"cins": -0.6207, "dshield": -1.1823, "crowdsec": 2.3013, "vulncheck": -0.7174, "blocklist_de": 1.1978}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.905, "det": {"threatfox": {"family:DCRat": 2, "family:Remcos": 1, "family:PureRAT": 7}, "blocklist_de": {"ftp": 1, "bots": 1}}, "oid": "ZN-20-ARIN", "org": "Zillion Network Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://zillion.network"}, "pfx": 228, "reg": "2023-12-22", "rir": "arin", "s24": 788, "sib": 0, "tor": 0, "w24": 10, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 226048, "abuse": "abuse54801@gmail.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00628158201378}, {"a": 54804, "h": "CSMIII-BUNKIELA", "n": "CableSouth Media III", "t": "Broadband & mobile", "w": 10, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.2405, "hi": 4.74, "lo": 0.62, "ips": 10, "mean": 2.26, "above": false}}, "h2": [["2026-10-05", 0.105, 0.009, 0, false], ["2026-10-12", 0.095, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.874, "ts": null, "map": 0.146, "obs": 0, "own": 0.769, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.095, "se": 0.861, "ts": 1.000, "map": 0.332, "obs": 2, "own": 0.553, "comp": {"cins": -0.2697, "dshield": -0.5872, "crowdsec": -2.3185, "vulncheck": 4.8582, "blocklist_de": -1.393}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.174, "det": {"vulncheck": {"botnet_node": 10}}, "oid": "CMIL-5-ARIN", "org": "CableSouth Media III LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.swyftfiber.com"}, "pfx": 81, "reg": "2012-08-15", "rir": "arin", "s24": 625, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 209408, "abuse": "noc@swyftconnect.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 54913, "h": "CLOUDWEBMANAGE-CANADA", "n": "Kamatera, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6314, "hi": 7.58, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}}, "h2": [["2026-10-05", 0.528, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.506, "det": {"shodan": {"compromised": 3}}, "oid": "KAMAT-ARIN", "org": "Kamatera, Inc.", "pdb": null, "pfx": 11, "reg": "2018-08-27", "rir": "arin", "s24": 11, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse@cloudwm.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041871789001}, {"a": 54994, "h": "ML-1432-54994", "n": "meteversecloud", "t": "Hosting & VPS", "w": 5, "cc": "CA", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.0282, "hi": 2.73, "lo": 0.59, "ips": 4, "mean": 1.49, "above": false}, "urlhaus": {"n": 1, "p": 0.1579, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 2, "p": 0.0006, "hi": 1.60, "lo": 0.21, "ips": 2, "mean": 0.76, "above": false}, "vulncheck": {"n": 1, "p": 0.0505, "hi": 3.01, "lo": 0.23, "ips": 1, "mean": 1.27, "above": false}, "blocklist_de": {"n": 3, "p": 0.1092, "hi": 3.56, "lo": 0.63, "ips": 3, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 3.796, 0.142, 0, false], ["2026-10-12", 0.434, 0.157, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.157, "se": 1.388, "ts": 1.000, "map": 1.119, "obs": 1, "own": 0.499, "comp": {"urlhaus": 2.9567, "threatfox": -0.4117, "phishing_db": -0.8064}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 3}, "lo": 0.434, "se": 0.576, "ts": 0.500, "map": 0.937, "obs": 6, "own": 0.186, "comp": {"cins": -1.0825, "dshield": -1.7703, "crowdsec": -1.6967, "vulncheck": 0.0701, "blocklist_de": 5.8078}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"c2": 4}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 3}}, "oid": "ML-1432-ARIN", "org": "Meteverse Limited.", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Tbps", "pol": "Open", "web": "https://meteversecloud.com/"}, "pfx": 1095, "reg": "2023-04-13", "rir": "arin", "s24": 1101, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 281856, "abuse": "abuse@meteversecloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00222646313234}, {"a": 55045, "h": "TEKTONIC", "n": "TekTonic", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.852, "det": {"shodan": {"compromised": 1}}, "oid": "MPP-29-ARIN", "org": "TekTonic", "pdb": null, "pfx": 14, "reg": "2013-02-22", "rir": "arin", "s24": 32, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@tektonic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55081, "h": "24SHELLS", "n": "24Shells Inc", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.90, "waf": 0.78}, "cs": {"c": {"ssh_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1750, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "dshield": {"n": 1, "p": 0.1688, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 2, "p": 0.2271, "hi": 4.63, "lo": 0.60, "ips": 2, "mean": 2.21, "above": false}, "phishing_db": {"n": 1, "p": 0.1715, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1430, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 1.728, 0.255, 0, false], ["2026-10-12", 2.584, 0.267, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.267, "se": 1.443, "ts": 1.000, "map": 2.153, "obs": 1, "own": 0.971, "comp": {"urlhaus": -0.1902, "threatfox": -0.2062, "phishing_db": 2.7897}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.584, "se": 0.609, "ts": 0.400, "map": 5.989, "obs": 5, "own": 1.184, "comp": {"cins": 3.2899, "dshield": 1.4141, "crowdsec": -0.2271, "vulncheck": -0.8015, "blocklist_de": -0.4919}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.604, "det": {"blocklist_de": {"ssh": 1}}, "oid": "TS-74-ARIN", "org": "24 SHELLS", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.24shells.net"}, "pfx": 18, "reg": "2013-03-01", "rir": "arin", "s24": 135, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39680, "abuse": "abuse@24shells.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.081846}, {"a": 55214, "h": "COAST", "n": "Coast Communications Company", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.110, 0.011, 0, false], ["2026-10-12", 1.689, 0.012, 0, false]], "sh": false, "uc": 1110.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.689, "se": 0.948, "ts": 0.500, "map": 7.384, "obs": 2, "own": 4.342, "comp": {"cins": -0.3049, "dshield": -0.6546, "crowdsec": 1.671, "vulncheck": -0.5299, "blocklist_de": 3.2115}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.148, "det": {"blocklist_de": {"mail": 1}}, "oid": "CC-620-ARIN", "org": "Coast Communications Company", "pdb": null, "pfx": 15, "reg": "2013-04-24", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": "abuseissues@momentumtelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55256, "h": "NETSKOPE", "n": "Netskope", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.52, "waf": 0.46}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.045, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.856, "ts": null, "map": 0.139, "obs": 0, "own": 0.110, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.537, "ts": null, "map": 0.062, "obs": 0, "own": 0.017, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.295, "det": null, "oid": "NETSK-ARIN", "org": "Netskope Inc", "pdb": {"t": "Network Services", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.netskope.com/"}, "pfx": 622, "reg": "2013-05-03", "rir": "arin", "s24": 784, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 200704, "abuse": "netops@netskope.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.140121}, {"a": 55286, "h": "SERVER-MANIA", "n": "ServerMania Inc", "t": "Hosting & VPS", "w": 17, "cc": "CA", "cf": {"rb": "hi", "wb": "hi", "rep": 1.43, "waf": 1.25}, "cs": {"c": {"http_flood": 5, "data_centre": 1, "web_exploit": 7, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2024-20767": 1, "cve:CVE-2025-22457": 1}, "n": 7}, "ev": {"dshield": {"n": 5, "p": 0.6139, "hi": 6.29, "lo": 1.56, "ips": 5, "mean": 3.59, "above": false}, "urlhaus": {"n": 1, "p": 0.1532, "hi": 4.25, "lo": 0.32, "ips": 2, "mean": 1.79, "above": false}, "crowdsec": {"n": 7, "p": 0.0566, "hi": 3.06, "lo": 0.92, "ips": 7, "mean": 1.86, "above": false}, "vulncheck": {"n": 2, "p": 0.1284, "hi": 3.81, "lo": 0.49, "ips": 2, "mean": 1.82, "above": false}, "blocklist_de": {"n": 2, "p": 0.0297, "hi": 2.70, "lo": 0.35, "ips": 2, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 1.440, 0.133, 0, false], ["2026-10-12", 1.090, 0.147, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.147, "se": 1.382, "ts": 1.000, "map": 1.036, "obs": 1, "own": 0.463, "comp": {"urlhaus": 2.8979, "threatfox": -0.4173, "phishing_db": -0.8187}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 7, "vulncheck": 2, "blocklist_de": 2}, "lo": 1.090, "se": 0.448, "ts": 0.438, "map": 1.877, "obs": 16, "own": 0.369, "comp": {"cins": -1.8755, "dshield": 5.7019, "crowdsec": 1.6084, "vulncheck": -0.0391, "blocklist_de": -3.3726}, "mass": 13.0, "listed": false}}, "abq": false, "bot": 0.365, "det": {"threatfox": {"family:XWorm": 1, "family:Hermes": 2}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 2}}, "oid": "BNS-34-ARIN", "org": "B2 Net Solutions Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.servermania.com"}, "pfx": 789, "reg": "2013-05-16", "rir": "arin", "s24": 1243, "sib": 0, "tor": 0, "w24": 16, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 345088, "abuse": "abuse-system@servermania.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.051082}, {"a": 55293, "h": "A2HOSTING", "n": "hosting.com", "t": "Hosting & VPS", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"shodan": {"n": 3, "p": 0.2333, "hi": 4.44, "lo": 0.78, "ips": 3, "mean": 2.29, "above": false}, "urlhaus": {"n": 1, "p": 0.1851, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 3, "p": 0.1717, "hi": 4.02, "lo": 0.71, "ips": 3, "mean": 2.08, "above": false}, "phishing_db": {"n": 6, "p": 0.9338, "hi": 10.12, "lo": 2.81, "ips": 6, "mean": 5.98, "above": true}}, "h2": [["2026-10-05", 0.691, 3.836, 0, false], ["2026-10-12", 0.449, 3.950, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 6}, "lo": 3.950, "se": 0.865, "ts": 0.857, "map": 10.097, "obs": 7, "own": 3.734, "comp": {"urlhaus": 1.2206, "threatfox": -0.5147, "phishing_db": 3.2326}, "mass": 4.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.449, "se": 0.727, "ts": 1.000, "map": 1.287, "obs": 3, "own": 0.257, "comp": {"cins": -0.5461, "dshield": -1.0687, "crowdsec": 6.7187, "vulncheck": -0.6854, "blocklist_de": -2.7725}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.991, "det": {"shodan": {"compromised": 3}}, "oid": "A2HOS-ARIN", "org": "A2 Hosting, Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://hosting.com"}, "pfx": 76, "reg": "2013-05-17", "rir": "arin", "s24": 349, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 93696, "abuse": "abuse@hosting.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 55313, "h": "HANELCOM-AS-VN", "n": "Hanel Communication JSC", "t": "Other", "w": 3, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "home_connection": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 2, "p": 0.3751, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 3.801, 0.011, 0, false], ["2026-10-12", 7.717, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.717, "se": 0.681, "ts": 0.500, "map": 20.462, "obs": 4, "own": 11.639, "comp": {"cins": 3.7708, "dshield": -1.2597, "crowdsec": 1.7723, "vulncheck": -0.7373, "blocklist_de": 0.8661}, "mass": 3.2, "listed": false}}, "abq": true, "bot": 0.689, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-55313-APNIC", "org": "Hanel Communication JSC", "pdb": null, "pfx": 27, "reg": "2009-12-02", "rir": "apnic", "s24": 28, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000309567062}, {"a": 55330, "h": "GCN-DCN-AS", "n": "AFGHANTELECOM GOVERNMENT COMMUNICATION NETWORK", "t": "Broadband & mobile", "w": 45, "cc": "AF", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 9, "first_seen_30d": 1, "ssh_bruteforce": 13, "web_bruteforce": 25, "mail_bruteforce": 35, "router_or_botnet": 8, "cve:CVE-2024-28000": 3}, "n": 41}, "ev": {"crowdsec": {"n": 17, "p": 1.0000, "hi": 19.26, "lo": 8.79, "ips": 41, "mean": 13.59, "above": true}, "blocklist_de": {"n": 9, "p": 0.9973, "hi": 13.89, "lo": 4.80, "ips": 18, "mean": 8.84, "above": true}}, "h2": [["2026-10-05", 23.773, 0.010, 1, false], ["2026-10-12", 22.379, 0.011, 1, false]], "sh": false, "uc": 10076.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.993, "ts": null, "map": 0.182, "obs": 0, "own": 1.284, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 17, "vulncheck": 0, "blocklist_de": 9}, "lo": 22.379, "se": 0.402, "ts": 0.654, "map": 35.737, "obs": 26, "own": 54.616, "comp": {"cins": -2.5689, "dshield": -2.8867, "crowdsec": 5.7792, "vulncheck": -0.9684, "blocklist_de": 5.6147}, "mass": 24.0, "listed": false}}, "abq": true, "bot": 0.178, "det": {"blocklist_de": {"bots": 2, "imap": 15, "mail": 16}}, "oid": "ORG-GCN1-AP-APNIC", "org": "Government Communications Network", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.afghantelecom.af/"}, "pfx": 122, "reg": "2009-12-08", "rir": "apnic", "s24": 122, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 31232, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00413727693787}, {"a": 55342, "h": "HOMENET6837-AS-AP", "n": "Homenet Mongolia", "t": "Transit & backbone", "w": 0, "cc": "MN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 3.409, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 4.551, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.262, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HA7-AP-APNIC", "org": "Homenet", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.homenet.mn"}, "pfx": 2, "reg": "2009-12-18", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "info@homenet.mn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000983093052}, {"a": 55352, "h": "FIVENET-IN", "n": "Microscan Internet Private Ltd", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.1333, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "urlhaus": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 5, "p": 0.5147, "hi": 5.65, "lo": 1.40, "ips": 5, "mean": 3.22, "above": false}, "blocklist_de": {"n": 1, "p": 0.0886, "hi": 3.52, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}}, "h2": [["2026-10-05", 1.645, 0.257, 0, false], ["2026-10-12", 1.633, 0.279, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.279, "se": 1.458, "ts": 1.000, "map": 2.354, "obs": 1, "own": 6.791, "comp": {"urlhaus": 3.4942, "threatfox": -0.3461, "phishing_db": -0.6657}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.633, "se": 0.538, "ts": 0.714, "map": 3.342, "obs": 7, "own": 5.169, "comp": {"cins": -1.1231, "dshield": 0.7733, "crowdsec": 5.6459, "vulncheck": -0.8469, "blocklist_de": -1.849}, "mass": 6.0, "listed": false}}, "abq": true, "bot": 0.121, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-55352-APNIC", "org": "Microscan Internet Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.microscan.co.in"}, "pfx": 233, "reg": "2009-12-30", "rir": "apnic", "s24": 324, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 114944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01123661872944}, {"a": 55406, "h": "HRCTECH-01-AS-AP", "n": "HRC Technologies", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 2.688, 0.012, 0, false]], "sh": false, "uc": 1269.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.688, "se": 0.975, "ts": 0.500, "map": 12.395, "obs": 2, "own": 19.954, "comp": {"cins": -0.2588, "dshield": 3.842, "crowdsec": 2.1508, "vulncheck": -0.4854, "blocklist_de": -1.3376}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.154, "det": null, "oid": "ORG-HTL8-AP-APNIC", "org": "HRC Technologies Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.hrctech.net"}, "pfx": 20, "reg": "2010-02-05", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@hrctech.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55410, "h": "VIL-AS-AP", "n": "Vodafone Idea India", "t": "Broadband & mobile", "w": 7, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"shodan": {"n": 2, "p": 0.0016, "hi": 1.78, "lo": 0.23, "ips": 2, "mean": 0.85, "above": false}, "crowdsec": {"n": 5, "p": 0.0148, "hi": 2.52, "lo": 0.63, "ips": 5, "mean": 1.44, "above": false}, "blocklist_de": {"n": 3, "p": 0.0910, "hi": 3.40, "lo": 0.60, "ips": 3, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.653, 0.008, 0, false], ["2026-10-12", 0.621, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.608, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.621, "se": 0.518, "ts": 0.625, "map": 1.222, "obs": 8, "own": 1.893, "comp": {"cins": -1.3901, "dshield": -2.0775, "crowdsec": 2.7194, "vulncheck": -0.8848, "blocklist_de": 3.2271}, "mass": 8.1, "listed": false}}, "abq": true, "bot": 0.233, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "ORG-VIL2-AP-APNIC", "org": "Vodafone Idea Ltd. (VIL)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.myvi.in/"}, "pfx": 1273, "reg": "2010-02-09", "rir": "apnic", "s24": 1192, "sib": 6, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 795136, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00439252378083}, {"a": 55423, "h": "JASTEL-NETWORK-TH-IDC-AP", "n": "JasTel Network", "t": "Other", "w": 3, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1876, "hi": 4.31, "lo": 0.56, "ips": 2, "mean": 2.06, "above": false}, "blocklist_de": {"n": 2, "p": 0.3106, "hi": 5.31, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}}, "h2": [["2026-10-05", 0.840, 0.010, 0, false], ["2026-10-12", 1.490, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.969, "ts": null, "map": 0.177, "obs": 0, "own": 0.469, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.490, "se": 0.660, "ts": 0.500, "map": 3.763, "obs": 4, "own": 2.144, "comp": {"cins": -0.7503, "dshield": -1.3659, "crowdsec": 1.0481, "vulncheck": -0.7624, "blocklist_de": 4.5494}, "mass": 3.6, "listed": false}}, "abq": false, "bot": null, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-JN1-AP-APNIC", "org": "JasTel Network Company Limited", "pdb": null, "pfx": 98, "reg": "2010-02-18", "rir": "apnic", "s24": 173, "sib": 9, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 69376, "abuse": "administrator@jastel.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00113256065232}, {"a": 55430, "h": "STARHUB-NGNBN", "n": "StarHub AS55430", "t": "Other", "w": 5, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"urlhaus": {"n": 2, "p": 0.2734, "hi": 5.01, "lo": 0.65, "ips": 2, "mean": 2.39, "above": false}, "crowdsec": {"n": 3, "p": 0.0000, "hi": 0.92, "lo": 0.16, "ips": 3, "mean": 0.48, "above": false}, "blocklist_de": {"n": 2, "p": 0.0005, "hi": 1.58, "lo": 0.21, "ips": 2, "mean": 0.75, "above": false}}, "h2": [["2026-10-05", 0.497, 0.301, 0, false], ["2026-10-12", 0.156, 0.336, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.336, "se": 1.121, "ts": 1.000, "map": 1.395, "obs": 2, "own": 1.489, "comp": {"urlhaus": 3.534, "threatfox": -0.5212, "phishing_db": -1.0537}, "mass": 5.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.156, "se": 0.592, "ts": 0.600, "map": 0.346, "obs": 5, "own": 0.198, "comp": {"cins": -1.0283, "dshield": -1.71, "crowdsec": 1.4093, "vulncheck": -0.8298, "blocklist_de": 2.4922}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.141, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-SIPL5-AP-APNIC", "org": "Starhub Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.starhub.com"}, "pfx": 115, "reg": "2010-02-26", "rir": "apnic", "s24": 2784, "sib": 8, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 741888, "abuse": "abuse@starhub.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03065702538093}, {"a": 55470, "h": "CYFUTURE-AS-IN", "n": "Cyfuture", "t": "Enterprise, edu & gov", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.2104, "hi": 4.50, "lo": 0.58, "ips": 2, "mean": 2.14, "above": false}, "crowdsec": {"n": 2, "p": 0.1746, "hi": 4.21, "lo": 0.55, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.374, 0.010, 0, false], ["2026-10-12", 0.392, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.175, "obs": 0, "own": 1.919, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.392, "se": 0.877, "ts": 1.000, "map": 1.489, "obs": 2, "own": 8.620, "comp": {"cins": -0.355, "dshield": -0.7469, "crowdsec": 5.2884, "vulncheck": -0.5713, "blocklist_de": -1.8236}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.693, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-55470-APNIC", "org": "Cyfuture India Pvt. Ltd.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://cyfuture.com/"}, "pfx": 129, "reg": "2010-04-06", "rir": "apnic", "s24": 187, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 65792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00047415774735}, {"a": 55490, "h": "TRUEMOVEH-AS-AP", "n": "True Move H Universal Communication Co., Ltd", "t": "Other", "w": 1, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 2.864, 0.012, 0, false]], "sh": false, "uc": 2758.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.864, "se": 0.980, "ts": 0.500, "map": 13.299, "obs": 2, "own": 7.855, "comp": {"cins": -0.2765, "dshield": -0.6004, "crowdsec": 1.9646, "vulncheck": -0.5033, "blocklist_de": 3.3969}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.616, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RCL16-AP-APNIC", "org": "Realmove Company Limited", "pdb": null, "pfx": 5, "reg": "2010-04-20", "rir": "apnic", "s24": 16, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@trueinternet.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55492, "h": "DFN-BD", "n": "Dhaka Fiber Net Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 1.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.219, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DFNL1-AP-APNIC", "org": "Dhaka Fiber Net Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.dfnbd.net"}, "pfx": 22, "reg": "2010-04-21", "rir": "apnic", "s24": 19, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00127395862364}, {"a": 55501, "h": "CONNECTEL-PK", "n": "Web Concepts", "t": "Other", "w": 2, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.309, 0.609, 0, false], ["2026-10-12", 1.756, 0.012, 0, false]], "sh": false, "uc": 1310.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.756, "se": 0.951, "ts": 0.500, "map": 7.692, "obs": 2, "own": 4.532, "comp": {"cins": 4.5661, "dshield": -0.6595, "crowdsec": 1.6444, "vulncheck": -0.5322, "blocklist_de": -1.5848}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.166, "det": null, "oid": "ORG-WCL3-AP-APNIC", "org": "Web Concepts (Pvt) Ltd", "pdb": null, "pfx": 42, "reg": "2010-04-29", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00114667448181}, {"a": 55577, "h": "CABLELITE-AS-AP", "n": "Atria Convergence Technologies Ltd.,", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 3}, "n": 5}, "ev": {"dshield": {"n": 2, "p": 0.3076, "hi": 5.29, "lo": 0.69, "ips": 2, "mean": 2.52, "above": false}, "urlhaus": {"n": 1, "p": 0.1849, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 5, "p": 0.4746, "hi": 5.42, "lo": 1.35, "ips": 5, "mean": 3.09, "above": false}, "blocklist_de": {"n": 3, "p": 0.4070, "hi": 5.62, "lo": 0.99, "ips": 3, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 4.275, 0.247, 0, false], ["2026-10-12", 2.533, 0.268, 0, false]], "sh": false, "uc": 323.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.268, "se": 1.452, "ts": 1.000, "map": 2.235, "obs": 1, "own": 6.440, "comp": {"urlhaus": 3.4588, "threatfox": -0.3514, "phishing_db": -0.6769}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.533, "se": 0.488, "ts": 0.500, "map": 4.725, "obs": 10, "own": 7.284, "comp": {"cins": -1.526, "dshield": 1.8602, "crowdsec": 1.3961, "vulncheck": -0.8999, "blocklist_de": 2.1162}, "mass": 9.3, "listed": false}}, "abq": false, "bot": 0.093, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-ACTP1-AP-APNIC", "org": "Atria Convergence Technologies Pvt. Ltd.,", "pdb": null, "pfx": 152, "reg": "2010-07-13", "rir": "apnic", "s24": 354, "sib": 4, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 90624, "abuse": "abuse@actcorp.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02633563002048}, {"a": 55592, "h": "KDT-AS-KR", "n": "Korea Data Telecommunication Co., Ltd.", "t": "Broadband & mobile", "w": 1, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1078, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "phishing_db": {"n": 1, "p": 0.1736, "hi": 4.47, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.008, 0.265, 0, false], ["2026-10-12", 0.008, 0.276, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.276, "se": 1.449, "ts": 1.000, "map": 2.268, "obs": 1, "own": 6.612, "comp": {"urlhaus": -0.1843, "threatfox": -0.2017, "phishing_db": 2.831}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.776, "ts": null, "map": 0.146, "obs": 0, "own": 0.428, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.603, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-55592-APNIC", "org": "Korea Data Telecommunication Co., Ltd.", "pdb": null, "pfx": 121, "reg": "2010-07-21", "rir": "apnic", "s24": 124, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32000, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55639, "h": "ASIAWEB-SERVICE-HK", "n": "Asia Web Service Ltd", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.640, "det": null, "oid": "ORG-AWSL1-AP-APNIC", "org": "Asia Web Services Ltd", "pdb": null, "pfx": 6, "reg": "2010-07-26", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@vpshosting.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55652, "h": "DASHNET-AS-ID", "n": "SUMIDHAZ PERMATA BUNDA", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.106, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-55652-APNIC", "org": "Sumidhaz Permata Bunda, PT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://dash.net.id"}, "pfx": 8, "reg": "2010-08-04", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@dash.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55666, "h": "GMEDIA-AS-ID", "n": "PT Media Sarana Data (GMEDIA)", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 4, "p": 0.7447, "hi": 8.08, "lo": 1.74, "ips": 4, "mean": 4.42, "above": false}, "crowdsec": {"n": 3, "p": 0.5378, "hi": 6.66, "lo": 1.17, "ips": 3, "mean": 3.43, "above": false}}, "h2": [["2026-10-05", 1.928, 0.011, 0, false], ["2026-10-12", 3.526, 0.012, 0, false]], "sh": false, "uc": 837.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 1.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.526, "se": 0.670, "ts": 0.750, "map": 9.164, "obs": 4, "own": 14.261, "comp": {"cins": 3.7812, "dshield": -1.2529, "crowdsec": 5.1874, "vulncheck": -0.7356, "blocklist_de": -3.3713}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.200, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-55666-APNIC", "org": "PT Media Sarana Data", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://gmedia.id"}, "pfx": 77, "reg": "2010-08-04", "rir": "apnic", "s24": 62, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33792, "abuse": "abuse@gmedia.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0027270422894}, {"a": 55679, "h": "HYPERMEDIA-AS-ID", "n": "Hyperindo Media Perkasa", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.203, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-55679-APNIC", "org": "PT Hyperindo Media Perkasa", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.hypermedia.net.id"}, "pfx": 6, "reg": "2010-08-04", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@hypermedia.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55685, "h": "JLM-AS-ID", "n": "Jala Lintas Media AS55685", "t": "Transit & backbone", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-87902": 1}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.2947, "hi": 5.18, "lo": 0.67, "ips": 4, "mean": 2.47, "above": false}, "blocklist_de": {"n": 1, "p": 0.1635, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 1.529, 0.011, 0, false], ["2026-10-12", 1.718, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 2.029, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.718, "se": 0.755, "ts": 0.667, "map": 5.206, "obs": 3, "own": 16.580, "comp": {"cins": -0.5165, "dshield": -1.0218, "crowdsec": 3.3995, "vulncheck": -0.6712, "blocklist_de": 1.8534}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.191, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-137303-APNIC", "org": "PT Jala Lintas Media - NAP", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.jlm.net.id"}, "pfx": 81, "reg": "2010-08-04", "rir": "apnic", "s24": 81, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": "abuse@jlm.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0060236865546}, {"a": 55688, "h": "BEON-AS-ID", "n": "Jagoan Hosting", "t": "Hosting & VPS", "w": 2, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 15, "p": 1.0000, "hi": 21.75, "lo": 9.45, "ips": 15, "mean": 15.07, "above": true}, "vulncheck": {"n": 1, "p": 0.1924, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "phishing_db": {"n": 1, "p": 0.1929, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.011, 0.473, 0, false], ["2026-10-12", 0.277, 0.493, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.493, "se": 1.558, "ts": 1.000, "map": 5.179, "obs": 1, "own": 2.378, "comp": {"urlhaus": -0.1011, "threatfox": -0.128, "phishing_db": 3.4998}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.277, "se": 1.294, "ts": 1.000, "map": 2.250, "obs": 1, "own": 0.531, "comp": {"cins": -0.0886, "dshield": -0.2082, "crowdsec": -0.825, "vulncheck": 3.789, "blocklist_de": -0.4628}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.916, "det": {"shodan": {"compromised": 15}, "vulncheck": {"attack_tooling": 1}}, "oid": "@aut-55688-APNIC", "org": "PT. Beon Intermedia", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.jagoanhosting.com/"}, "pfx": 29, "reg": "2010-08-04", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7424, "abuse": "abuse@jagoanhosting.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 55693, "h": "BATI-AS-ID", "n": "PT. Bangun Abadi Teknologi Indonesia", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 4.421, 0.011, 0, false], ["2026-10-12", 4.849, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.849, "se": 1.017, "ts": 0.500, "map": 24.100, "obs": 2, "own": 14.339, "comp": {"cins": 4.6867, "dshield": -0.5527, "crowdsec": 2.223, "vulncheck": -0.4782, "blocklist_de": -1.303}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.286, "det": {"shodan": {"c2": 1}}, "oid": "@aut-55693-APNIC", "org": "PT. Bangun Abadi Teknologi Indonesia", "pdb": null, "pfx": 8, "reg": "2010-08-04", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@mybati.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55699, "h": "STARNET-AS-ID", "n": "Starnet", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0867, "hi": 3.50, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "blocklist_de": {"n": 2, "p": 0.3338, "hi": 5.51, "lo": 0.72, "ips": 2, "mean": 2.62, "above": false}}, "h2": [["2026-10-05", 0.542, 0.010, 0, false], ["2026-10-12", 1.195, 0.011, 0, false]], "sh": false, "uc": 3623.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.180, "obs": 0, "own": 1.251, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.195, "se": 0.748, "ts": 0.667, "map": 3.566, "obs": 3, "own": 5.594, "comp": {"cins": -0.5765, "dshield": -1.1158, "crowdsec": -0.8142, "vulncheck": -0.6991, "blocklist_de": 5.8708}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.127, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.megavision.net.id"}, "pfx": 35, "reg": "2010-08-04", "rir": "apnic", "s24": 134, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 34304, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.011045869032}, {"a": 55701, "h": "ASNET-AS-ID", "n": "Usaha Adisanggoro", "t": "Transit & backbone", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 1.994, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 6250, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 2.648, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 2.098, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.346, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-55701-APNIC", "org": "PT. Usaha Adisanggoro", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.as.net.id"}, "pfx": 31, "reg": "2010-08-04", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": "abuse@as.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0031078084796}, {"a": 55720, "h": "GIGABIT-MY", "n": "TheGigabit", "t": "Hosting & VPS", "w": 19, "cc": "MY", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 4, "ssh_bruteforce": 3, "web_bruteforce": 5, "mail_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 4, "cve:CVE-2020-15415": 1, "cve:CVE-2021-41773": 2}, "n": 5}, "ev": {"shodan": {"n": 4, "p": 0.4854, "hi": 5.78, "lo": 1.24, "ips": 4, "mean": 3.16, "above": false}, "urlhaus": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 5, "p": 0.5850, "hi": 6.09, "lo": 1.51, "ips": 5, "mean": 3.48, "above": false}, "vulncheck": {"n": 1, "p": 0.1435, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "phishing_db": {"n": 2, "p": 0.3397, "hi": 5.55, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "blocklist_de": {"n": 2, "p": 0.2566, "hi": 4.87, "lo": 0.63, "ips": 10, "mean": 2.32, "above": false}}, "h2": [["2026-10-05", 1.820, 1.751, 0, false], ["2026-10-12", 2.167, 1.836, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 2}, "lo": 1.836, "se": 1.034, "ts": 0.667, "map": 6.546, "obs": 3, "own": 2.538, "comp": {"urlhaus": 2.4224, "threatfox": -0.4552, "phishing_db": 1.5378}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 2}, "lo": 2.167, "se": 0.527, "ts": 0.625, "map": 4.339, "obs": 8, "own": 0.856, "comp": {"cins": -1.2003, "dshield": -1.8945, "crowdsec": 4.751, "vulncheck": -0.0488, "blocklist_de": 1.2539}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.775, "det": {"shodan": {"compromised": 4}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 9, "imap": 1, "mail": 1}}, "oid": "ORG-GHSB1-AP-APNIC", "org": "Gigabit Hosting Sdn Bhd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.thegigabit.com"}, "pfx": 270, "reg": "2010-08-16", "rir": "apnic", "s24": 273, "sib": 0, "tor": 4, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 69888, "abuse": "noc@cnc-int.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0023163525037}, {"a": 55736, "h": "DataKnox-DNX", "n": "DataKnox-DNX", "t": "Broadband & mobile", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 1.421, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.204, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.triforce.com.au"}, "pfx": 11, "reg": "2015-10-13", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008694026726}, {"a": 55769, "h": "SEATELECOM-KH", "n": "SEATEL(CAMBODIA)", "t": "Broadband & mobile", "w": 0, "cc": "KH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2026.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.309, "det": null, "oid": "ORG-SEAT1-AP-APNIC", "org": "SOUTH EAST ASIA TELECOM (Cambodia) Co., LTD", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.yes.com.kh"}, "pfx": 37, "reg": "2013-09-12", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012927155164}, {"a": 55803, "h": "HOSTOPIA-AU", "n": "Digital Pacific Pty Ltd", "t": "Broadband & mobile", "w": 8, "cc": "AU", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 6, "home_connection": 5, "mail_bruteforce": 2, "cve:CVE-2019-18935": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.0308, "hi": 2.67, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}, "crowdsec": {"n": 7, "p": 0.7584, "hi": 6.69, "lo": 2.03, "ips": 7, "mean": 4.07, "above": false}, "phishing_db": {"n": 1, "p": 0.1325, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.0801, "hi": 3.42, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}}, "h2": [["2026-10-05", 1.955, 0.158, 0, false], ["2026-10-12", 1.724, 0.166, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.166, "se": 1.391, "ts": 1.000, "map": 1.159, "obs": 1, "own": 3.459, "comp": {"urlhaus": -0.2681, "threatfox": -0.2583, "phishing_db": 2.2999}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.724, "se": 0.517, "ts": 0.875, "map": 3.389, "obs": 8, "own": 5.236, "comp": {"cins": -1.2337, "dshield": -1.9282, "crowdsec": 9.1359, "vulncheck": -0.8642, "blocklist_de": -2.4956}, "mass": 6.8, "listed": false}}, "abq": false, "bot": 0.979, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-JAHP1-AP-APNIC", "org": "Hostopia Australia Web Pty Ltd", "pdb": {"t": "NSP", "sc": "Australia", "tr": null, "pol": "Open", "web": "https://www.digitalpacific.com.au/"}, "pfx": 37, "reg": "2010-10-08", "rir": "apnic", "s24": 363, "sib": 5, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 101888, "abuse": "abuse@hostopia.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001929149471}, {"a": 55821, "h": "RADIUSTELECOMS-AS-AP", "n": "Radius Telecoms Inc.", "t": "Broadband & mobile", "w": 2, "cc": "PH", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "shodan": {"n": 1, "p": 0.0801, "hi": 3.42, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "blocklist_de": {"n": 1, "p": 0.1272, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-12", 0.469, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.147, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.469, "se": 0.888, "ts": 0.500, "map": 1.819, "obs": 2, "own": 2.909, "comp": {"cins": 4.331, "dshield": -0.8545, "crowdsec": -3.3659, "vulncheck": -0.614, "blocklist_de": 2.4952}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.115, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-RTI2-AP-APNIC", "org": "RADIUS TELECOMS, INC.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.radius.ph"}, "pfx": 60, "reg": "2010-10-18", "rir": "apnic", "s24": 182, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 112896, "abuse": "abuse@radius.ph", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00730099561522}, {"a": 55824, "h": "NKN-CORE-NW", "n": "NKN Core Network", "t": "Other", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 5, "mail_bruteforce": 1, "cve:CVE-2024-28000": 3}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1456, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "shodan": {"n": 2, "p": 0.1183, "hi": 3.72, "lo": 0.48, "ips": 2, "mean": 1.77, "above": false}, "crowdsec": {"n": 7, "p": 0.7991, "hi": 7.06, "lo": 2.14, "ips": 8, "mean": 4.30, "above": true}, "phishing_db": {"n": 1, "p": 0.1386, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "blocklist_de": {"n": 2, "p": 0.2321, "hi": 4.67, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 3.159, 0.167, 0, false], ["2026-10-12", 2.767, 0.175, 0, false]], "sh": false, "uc": 171.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.175, "se": 1.396, "ts": 1.000, "map": 1.246, "obs": 1, "own": 1.494, "comp": {"urlhaus": -0.2582, "threatfox": -0.2523, "phishing_db": 2.3567}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.767, "se": 0.489, "ts": 0.700, "map": 5.195, "obs": 10, "own": 2.931, "comp": {"cins": 1.9079, "dshield": -2.2023, "crowdsec": 5.3024, "vulncheck": -0.9005, "blocklist_de": -1.0662}, "mass": 9.3, "listed": false}}, "abq": false, "bot": 0.131, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://nkn.gov.in/"}, "pfx": 177, "reg": "2010-10-19", "rir": "apnic", "s24": 324, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 195840, "abuse": "abuseteam@nkn.in", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00850467844803}, {"a": 55828, "h": "DRIK-BD", "n": "Drik ICT Ltd", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.557, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.557, "se": 1.414, "ts": 1.000, "map": 5.818, "obs": 1, "own": 11.088, "comp": {"cins": -0.0946, "dshield": -0.2219, "crowdsec": -0.8791, "vulncheck": -0.2474, "blocklist_de": 4.5976}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.234, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-DIL4-AP-APNIC", "org": "Drik ICT Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.drikict.net/"}, "pfx": 12, "reg": "2010-10-22", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056005303436}, {"a": 55836, "h": "RELIANCEJIO-IN", "n": "Reliance Jio Infocomm NLD Network", "t": "Broadband & mobile", "w": 136, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 1.00, "waf": 0.64}, "cs": {"c": {"http_flood": 20, "web_exploit": 22, "bad_crawling": 7, "proxy_or_vpn": 18, "first_seen_30d": 2, "ssh_bruteforce": 9, "web_bruteforce": 23, "home_connection": 28, "mail_bruteforce": 5, "router_or_botnet": 1, "cve:CVE-2024-28000": 12}, "n": 32}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 1.15, "lo": 0.25, "ips": 4, "mean": 0.63, "above": false}, "shodan": {"n": 8, "p": 0.0000, "hi": 0.40, "lo": 0.13, "ips": 8, "mean": 0.25, "above": false}, "dshield": {"n": 27, "p": 0.3516, "hi": 3.76, "lo": 2.01, "ips": 28, "mean": 2.83, "above": false}, "urlhaus": {"n": 1, "p": 0.0044, "hi": 1.88, "lo": 0.14, "ips": 1, "mean": 0.79, "above": false}, "crowdsec": {"n": 29, "p": 0.0000, "hi": 0.88, "lo": 0.48, "ips": 32, "mean": 0.67, "above": false}, "blocklist_de": {"n": 71, "p": 0.9771, "hi": 4.63, "lo": 3.14, "ips": 78, "mean": 3.85, "above": true}}, "h2": [["2026-10-05", 0.792, 0.050, 0, false], ["2026-10-12", 1.200, 0.034, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.034, "se": 1.314, "ts": 1.000, "map": 0.187, "obs": 1, "own": 0.614, "comp": {"urlhaus": 1.4714, "threatfox": -0.5051, "phishing_db": -1.0163}, "mass": 5.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 27, "crowdsec": 29, "vulncheck": 0, "blocklist_de": 71}, "lo": 1.200, "se": 0.366, "ts": 0.542, "map": 1.811, "obs": 131, "own": 2.788, "comp": {"cins": -1.9948, "dshield": 1.3689, "crowdsec": -8.3036, "vulncheck": -1.0093, "blocklist_de": 11.9264}, "mass": 165.6, "listed": false}}, "abq": true, "bot": 0.097, "det": {"shodan": {"c2": 1, "compromised": 7}, "blocklist_de": {"ssh": 2, "bots": 46, "imap": 17, "mail": 19, "apache": 11, "bruteforcelogin": 11}}, "oid": "ORG-RJIL1-AP-APNIC", "org": "Reliance Jio Infocomm Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100+Tbps", "pol": "Open", "web": "http://www.jio.com"}, "pfx": 1044, "reg": "2010-10-27", "rir": "apnic", "s24": 16506, "sib": 2, "tor": 0, "w24": 121, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7818240, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 2.033634}, {"a": 55850, "h": "MERCURYNZ-AS-AP", "n": "Mercury NZ", "t": "Broadband & mobile", "w": 1, "cc": "NZ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1176, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}}, "h2": [["2026-10-12", 0.066, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 0.880, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.066, "se": 1.100, "ts": 1.000, "map": 0.382, "obs": 1, "own": 0.639, "comp": {"cins": -0.2133, "dshield": 4.0646, "crowdsec": -1.879, "vulncheck": -0.4341, "blocklist_de": -1.1058}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MNL16-AP-APNIC", "org": "Mercury NZ Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.mercury.co.nz"}, "pfx": 29, "reg": "2010-11-04", "rir": "apnic", "s24": 423, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 109312, "abuse": "abuse-alerts@as55850.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01307509441875}, {"a": 55884, "h": "ORIONVM-AU", "n": "OrionVM Cloud - Australia", "t": "Hosting & VPS", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.129, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.735, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OVSP1-AP-APNIC", "org": "Orion Virtualisation Solutions Pty Limited", "pdb": {"t": "NSP", "sc": "Australia", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.orionvm.com/"}, "pfx": 24, "reg": "2010-11-24", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@orionvm.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55915, "h": "CLASSIC-NP", "n": "ClassicTech Pvt. Ltd.", "t": "Transit & backbone", "w": 0, "cc": "NP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1118, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 2.538, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 1.881, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.152, "det": null, "oid": "ORG-CTPL4-AP-APNIC", "org": "Classic Tech Pvt. Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.classic.com.np"}, "pfx": 36, "reg": "2010-12-02", "rir": "apnic", "s24": 29, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": "ipadmin@classic.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00226440682692}, {"a": 55933, "h": "CLOUDIE-AS-AP", "n": "Cloudie", "t": "Hosting & VPS", "w": 42, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 9, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 7, "ssh_bruteforce": 19, "web_bruteforce": 9, "mail_bruteforce": 1, "cve:CVE-2017-9841": 6, "cve:CVE-2019-9082": 5, "cve:CVE-2018-20062": 5, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 25}, "ev": {"shodan": {"n": 22, "p": 1.0000, "hi": 17.69, "lo": 8.85, "ips": 22, "mean": 12.95, "above": true}, "urlhaus": {"n": 1, "p": 0.1846, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 21, "p": 1.0000, "hi": 15.39, "lo": 7.58, "ips": 25, "mean": 11.20, "above": true}, "threatfox": {"n": 6, "p": 0.9574, "hi": 11.22, "lo": 3.11, "ips": 6, "mean": 6.63, "above": true}, "vulncheck": {"n": 2, "p": 0.3079, "hi": 5.29, "lo": 0.69, "ips": 2, "mean": 2.52, "above": false}, "phishing_db": {"n": 6, "p": 0.9322, "hi": 10.06, "lo": 2.79, "ips": 6, "mean": 5.95, "above": true}, "blocklist_de": {"n": 8, "p": 0.9732, "hi": 10.39, "lo": 3.38, "ips": 8, "mean": 6.48, "above": true}}, "h2": [["2026-10-05", 5.959, 7.889, 0, false], ["2026-10-12", 8.441, 6.526, 0, false]], "sh": true, "uc": 138.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 6, "phishing_db": 6}, "lo": 6.526, "se": 0.795, "ts": 0.462, "map": 14.720, "obs": 13, "own": 5.298, "comp": {"urlhaus": 0.4108, "threatfox": 2.0276, "phishing_db": 1.8771}, "mass": 7.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 21, "vulncheck": 2, "blocklist_de": 8}, "lo": 8.441, "se": 0.398, "ts": 0.677, "map": 13.323, "obs": 31, "own": 2.602, "comp": {"cins": -2.6813, "dshield": -2.9433, "crowdsec": 7.8522, "vulncheck": -0.5234, "blocklist_de": 2.279}, "mass": 26.7, "listed": false}}, "abq": false, "bot": 0.948, "det": {"shodan": {"c2": 5, "compromised": 17}, "threatfox": {"family:PureRAT": 1, "family:AdaptixC2": 2, "family:Cobalt Strike": 1, "family:Unknown malware": 2}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"ftp": 1, "ssh": 7}}, "oid": "ORG-CL18-AP-APNIC", "org": "Cloudie Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://worria.com/"}, "pfx": 125, "reg": "2010-12-10", "rir": "apnic", "s24": 363, "sib": 3, "tor": 0, "w24": 34, "drop": 42, "hist": [["2026-10-05", 0.9970], ["2026-10-12", 1.0000]], "ipv4": 107008, "abuse": "abuse@cloudie.hk", "score": 1.0000, "groups": ["sensors", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0019301435456}, {"a": 55953, "h": "XIM-HK", "n": "XIMBO Internet Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.956, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-XIL1-AP-APNIC", "org": "XIMBO Internet Limited", "pdb": null, "pfx": 3, "reg": "2010-12-23", "rir": "apnic", "s24": 3, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "ipadmin@layerstack.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 55960, "h": "BJ-GUANGHUAN-AP", "n": "Beijing Guanghuan Xinwang Digital", "t": "Other", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "cve:CVE-2023-23752": 1}, "n": 1}, "ev": {"shodan": {"n": 6, "p": 0.0141, "hi": 2.54, "lo": 0.70, "ips": 6, "mean": 1.50, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.85, "lo": 0.06, "ips": 1, "mean": 0.36, "above": false}, "vulncheck": {"n": 1, "p": 0.0223, "hi": 2.50, "lo": 0.19, "ips": 1, "mean": 1.05, "above": false}, "phishing_db": {"n": 1, "p": 0.0262, "hi": 2.58, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}}, "h2": [["2026-10-05", 6.031, 0.067, 0, false], ["2026-10-12", 0.050, 0.072, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.072, "se": 1.341, "ts": 1.000, "map": 0.419, "obs": 1, "own": 0.542, "comp": {"urlhaus": -0.433, "threatfox": -0.3377, "phishing_db": 1.5267}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.050, "se": 0.830, "ts": 0.500, "map": 0.170, "obs": 2, "own": 0.101, "comp": {"cins": -0.3706, "dshield": -0.7751, "crowdsec": 1.0195, "vulncheck": 1.6494, "blocklist_de": -1.9023}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.789, "det": {"shodan": {"compromised": 6}, "vulncheck": {"attack_tooling": 1}}, "oid": "@aut-55960-APNIC", "org": "Beijing Guanghuan Xinwang Digital", "pdb": null, "pfx": 47, "reg": "2010-12-24", "rir": "apnic", "s24": 1718, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 468224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00446564742624}, {"a": 55967, "h": "Baidu", "n": "Baidu", "t": "Hyperscale cloud", "w": 16, "cc": "CN", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 2.96}, "cs": {"c": {"http_flood": 11, "web_exploit": 15, "bad_crawling": 1, "web_bruteforce": 5, "home_connection": 14, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4396": 15, "cve:CVE-2021-26084": 6}, "n": 16}, "ev": {"crowdsec": {"n": 2, "p": 0.1984, "hi": 4.40, "lo": 0.57, "ips": 16, "mean": 2.10, "above": false}}, "h2": [["2026-10-05", 0.884, 0.010, 0, false], ["2026-10-12", 0.440, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 0.340, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.440, "se": 0.881, "ts": 1.000, "map": 1.687, "obs": 2, "own": 0.719, "comp": {"cins": -0.349, "dshield": -0.7362, "crowdsec": 5.3625, "vulncheck": -0.5667, "blocklist_de": -1.7938}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.993, "det": null, "oid": "@aut-55967-APNIC", "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.baidu.com"}, "pfx": 39, "reg": "2010-12-24", "rir": "apnic", "s24": 162, "sib": 9, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 46080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03701146470624}, {"a": 55990, "h": "HWCSNET", "n": "Huawei Cloud(China)", "t": "Hyperscale cloud", "w": 96, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 31, "web_exploit": 17, "bad_crawling": 9, "proxy_or_vpn": 5, "first_seen_30d": 13, "ssh_bruteforce": 28, "web_bruteforce": 16, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2016-1555": 4, "cve:CVE-2017-9841": 10, "cve:CVE-2019-9082": 4, "cve:CVE-2024-6387": 11, "cve:CVE-2018-20062": 4}, "n": 39}, "ev": {"cins": {"n": 9, "p": 0.3459, "hi": 4.30, "lo": 1.49, "ips": 9, "mean": 2.74, "above": false}, "shodan": {"n": 223, "p": 1.0000, "hi": 17.30, "lo": 13.88, "ips": 223, "mean": 15.55, "above": true}, "dshield": {"n": 4, "p": 0.0033, "hi": 2.09, "lo": 0.45, "ips": 4, "mean": 1.14, "above": false}, "urlhaus": {"n": 9, "p": 0.9766, "hi": 9.94, "lo": 3.43, "ips": 9, "mean": 6.33, "above": true}, "crowdsec": {"n": 39, "p": 0.0273, "hi": 2.88, "lo": 1.71, "ips": 39, "mean": 2.26, "above": false}, "threatfox": {"n": 14, "p": 0.9988, "hi": 11.15, "lo": 4.71, "ips": 14, "mean": 7.64, "above": true}, "vulncheck": {"n": 3, "p": 0.0012, "hi": 1.81, "lo": 0.32, "ips": 3, "mean": 0.93, "above": false}, "phishing_db": {"n": 3, "p": 0.0020, "hi": 1.91, "lo": 0.34, "ips": 3, "mean": 0.98, "above": false}, "blocklist_de": {"n": 22, "p": 0.4583, "hi": 4.07, "lo": 2.04, "ips": 22, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 0.704, 1.982, 0, false], ["2026-10-12", 1.578, 1.975, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 9, "threatfox": 14, "phishing_db": 3}, "lo": 1.975, "se": 0.807, "ts": 0.538, "map": 4.327, "obs": 26, "own": 3.073, "comp": {"urlhaus": 3.2799, "threatfox": 0.691, "phishing_db": -0.8798}, "mass": 38.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 9, "dshield": 4, "crowdsec": 39, "vulncheck": 3, "blocklist_de": 22}, "lo": 1.578, "se": 0.374, "ts": 0.506, "map": 2.431, "obs": 77, "own": 1.000, "comp": {"cins": 4.5381, "dshield": -1.9959, "crowdsec": -0.0633, "vulncheck": -0.7821, "blocklist_de": 0.5851}, "mass": 84.4, "listed": false}}, "abq": true, "bot": 0.359, "det": {"shodan": {"c2": 5, "malware": 4, "compromised": 214}, "threatfox": {"family:Cobalt Strike": 13, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ftp": 2, "ssh": 20}}, "oid": "@aut-63727-APNIC", "org": "Huawei", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Tbps", "pol": "Selective", "web": "https://www.huaweicloud.com"}, "pfx": 385, "reg": "2010-12-24", "rir": "apnic", "s24": 6274, "sib": 2, "tor": 0, "w24": 93, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 1631488, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.01209917966088}, {"a": 56005, "h": "Fastidc", "n": "Zhengzhou Fastidc Technology Co.,Ltd.", "t": "Other", "w": 12, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 10, "cve:CVE-2024-6387": 10}, "n": 11}, "ev": {"crowdsec": {"n": 8, "p": 0.9270, "hi": 8.54, "lo": 2.78, "ips": 11, "mean": 5.32, "above": true}, "threatfox": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 7, "p": 0.9580, "hi": 10.28, "lo": 3.11, "ips": 8, "mean": 6.26, "above": true}}, "h2": [["2026-10-05", 4.949, 0.179, 0, false], ["2026-10-12", 6.075, 0.186, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.186, "se": 1.405, "ts": 1.000, "map": 1.343, "obs": 1, "own": 1.621, "comp": {"urlhaus": -0.2257, "threatfox": 2.5783, "phishing_db": -0.4315}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 7}, "lo": 6.075, "se": 0.444, "ts": 0.533, "map": 10.544, "obs": 15, "own": 5.922, "comp": {"cins": -2.0533, "dshield": -2.5882, "crowdsec": 1.3613, "vulncheck": -0.9421, "blocklist_de": 7.9714}, "mass": 15.1, "listed": false}}, "abq": false, "bot": 0.899, "det": {"threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 8}}, "oid": "@aut-56005-APNIC", "org": "Zhengzhou Fastidc Technology Co.,Ltd.", "pdb": null, "pfx": 9, "reg": "2010-12-24", "rir": "apnic", "s24": 260, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 133120, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0000290552457}, {"a": 56030, "h": "VOYAGERNET-AS-AP", "n": "Voyager Internet", "t": "Transit & backbone", "w": 0, "cc": "NZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0203, "hi": 2.45, "lo": 0.18, "ips": 1, "mean": 1.03, "above": false}}, "h2": [["2026-10-05", 0.062, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.156, "obs": 0, "own": 1.236, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.610, "ts": null, "map": 0.085, "obs": 0, "own": 0.398, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.238, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VIL1-AP-APNIC", "org": "Voyager Internet Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.voyager.co.nz"}, "pfx": 33, "reg": "2011-01-10", "rir": "apnic", "s24": 439, "sib": 8, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 112896, "abuse": "abuse@voyager.co.nz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00205046521875}, {"a": 56038, "h": "RACKCORP-AP", "n": "RackCorp", "t": "Hosting & VPS", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1765, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.283, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.212, "obs": 0, "own": 0.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.664, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.rackcorp.com/"}, "pfx": 26, "reg": "2011-01-14", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@rackcorp.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001063825188}, {"a": 56040, "h": "CMNET-GuangDong-AP", "n": "China Mobile Group GuangDong Company", "t": "Broadband & mobile", "w": 8, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 2, "ssh_bruteforce": 3, "cve:CVE-2024-6387": 1}, "n": 6}, "ev": {"shodan": {"n": 3, "p": 0.0000, "hi": 0.97, "lo": 0.17, "ips": 3, "mean": 0.50, "above": false}, "dshield": {"n": 2, "p": 0.0110, "hi": 2.28, "lo": 0.30, "ips": 2, "mean": 1.09, "above": false}, "crowdsec": {"n": 6, "p": 0.0000, "hi": 1.22, "lo": 0.34, "ips": 6, "mean": 0.72, "above": false}}, "h2": [["2026-10-05", 0.152, 0.007, 0, false], ["2026-10-12", 0.205, 0.007, 0, false]], "sh": false, "uc": 78.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.749, "ts": null, "map": 0.090, "obs": 0, "own": 0.408, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.205, "se": 0.515, "ts": 0.750, "map": 0.398, "obs": 8, "own": 0.618, "comp": {"cins": -1.2837, "dshield": 2.7207, "crowdsec": 6.1382, "vulncheck": -0.8712, "blocklist_de": -6.232}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.417, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 537, "reg": "2011-01-19", "rir": "apnic", "s24": 3268, "sib": 28, "tor": 0, "w24": 8, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2553856, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02455145247594}, {"a": 56041, "h": "CMNET-Zhejiang-AP", "n": "China Mobile Group Zhejiang Company", "t": "Broadband & mobile", "w": 53, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 5, "first_seen_30d": 2, "ssh_bruteforce": 21, "web_bruteforce": 8, "mail_bruteforce": 4, "cve:CVE-2024-6387": 11}, "n": 29}, "ev": {"cins": {"n": 9, "p": 0.0173, "hi": 2.65, "lo": 0.92, "ips": 11, "mean": 1.69, "above": false}, "shodan": {"n": 18, "p": 0.0000, "hi": 1.03, "lo": 0.48, "ips": 18, "mean": 0.73, "above": false}, "dshield": {"n": 13, "p": 0.0293, "hi": 2.83, "lo": 1.16, "ips": 13, "mean": 1.92, "above": false}, "crowdsec": {"n": 23, "p": 0.0000, "hi": 1.02, "lo": 0.52, "ips": 29, "mean": 0.75, "above": false}, "blocklist_de": {"n": 10, "p": 0.0000, "hi": 1.26, "lo": 0.46, "ips": 10, "mean": 0.81, "above": false}}, "h2": [["2026-10-05", 0.392, 0.005, 0, false], ["2026-10-12", 0.602, 0.005, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.005, "se": 1.670, "ts": null, "map": 0.053, "obs": 0, "own": 0.240, "comp": null, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 9, "dshield": 13, "crowdsec": 23, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.602, "se": 0.386, "ts": 0.418, "map": 0.945, "obs": 55, "own": 1.459, "comp": {"cins": 7.2056, "dshield": 2.6854, "crowdsec": -2.3799, "vulncheck": -0.997, "blocklist_de": -5.1764}, "mass": 61.2, "listed": false}}, "abq": false, "bot": 0.398, "det": {"shodan": {"compromised": 18}, "blocklist_de": {"ftp": 1, "ssh": 6, "imap": 2, "mail": 3}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 2209, "reg": "2011-01-19", "rir": "apnic", "s24": 11666, "sib": 28, "tor": 0, "w24": 45, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5409792, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03528018345878}, {"a": 56042, "h": "CMNET-Shanxi-AP", "n": "China Mobile Group Shanxi Company", "t": "Broadband & mobile", "w": 17, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 4}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0232, "hi": 2.51, "lo": 0.19, "ips": 1, "mean": 1.06, "above": false}, "dshield": {"n": 6, "p": 0.5425, "hi": 5.55, "lo": 1.54, "ips": 6, "mean": 3.28, "above": false}, "crowdsec": {"n": 8, "p": 0.0024, "hi": 2.19, "lo": 0.71, "ips": 9, "mean": 1.37, "above": false}, "blocklist_de": {"n": 3, "p": 0.0124, "hi": 2.39, "lo": 0.42, "ips": 3, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.459, 0.007, 0, false], ["2026-10-12", 0.886, 0.008, 0, false]], "sh": false, "uc": 67.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.781, "ts": null, "map": 0.105, "obs": 0, "own": 0.488, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 3}, "lo": 0.886, "se": 0.435, "ts": 0.444, "map": 1.478, "obs": 18, "own": 2.282, "comp": {"cins": 0.476, "dshield": 5.3104, "crowdsec": 0.029, "vulncheck": -0.9502, "blocklist_de": -3.0806}, "mass": 17.2, "listed": false}}, "abq": false, "bot": 0.391, "det": {"blocklist_de": {"ssh": 1, "imap": 2, "mail": 2}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 217, "reg": "2011-01-19", "rir": "apnic", "s24": 2100, "sib": 28, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 875008, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00715483986984}, {"a": 56044, "h": "CMNET-AS-Liaoning", "n": "China Mobile Group Liaoning Company", "t": "Broadband & mobile", "w": 20, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "mail_bruteforce": 4, "router_or_botnet": 2, "cve:CVE-2024-6387": 2, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 12}, "ev": {"cins": {"n": 2, "p": 0.0159, "hi": 2.42, "lo": 0.31, "ips": 2, "mean": 1.15, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.52, "lo": 0.04, "ips": 1, "mean": 0.22, "above": false}, "dshield": {"n": 6, "p": 0.1932, "hi": 3.88, "lo": 1.08, "ips": 6, "mean": 2.29, "above": false}, "crowdsec": {"n": 12, "p": 0.0000, "hi": 1.75, "lo": 0.69, "ips": 12, "mean": 1.17, "above": false}, "blocklist_de": {"n": 4, "p": 0.0007, "hi": 1.80, "lo": 0.39, "ips": 4, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 0.535, 0.006, 0, false], ["2026-10-12", 0.695, 0.007, 0, false]], "sh": false, "uc": 76.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.738, "ts": null, "map": 0.085, "obs": 0, "own": 0.384, "comp": null, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 6, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.695, "se": 0.418, "ts": 0.500, "map": 1.128, "obs": 24, "own": 1.742, "comp": {"cins": 1.9444, "dshield": 3.3402, "crowdsec": 0.99, "vulncheck": -0.9677, "blocklist_de": -3.7926}, "mass": 23.8, "listed": false}}, "abq": false, "bot": 0.424, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 2, "mail": 3}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 399, "reg": "2011-01-19", "rir": "apnic", "s24": 3801, "sib": 28, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1956096, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01303383801018}, {"a": 56045, "h": "CMNET-Jiangxi-AP", "n": "China Mobile communications corporation", "t": "Broadband & mobile", "w": 19, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 4, "cve:CVE-2019-9082": 4, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 4}, "n": 10}, "ev": {"cins": {"n": 4, "p": 0.0045, "hi": 2.15, "lo": 0.46, "ips": 4, "mean": 1.18, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.27, "lo": 0.02, "ips": 1, "mean": 0.11, "above": false}, "dshield": {"n": 5, "p": 0.0020, "hi": 2.04, "lo": 0.51, "ips": 5, "mean": 1.17, "above": false}, "urlhaus": {"n": 2, "p": 0.1139, "hi": 3.68, "lo": 0.48, "ips": 2, "mean": 1.75, "above": false}, "crowdsec": {"n": 10, "p": 0.0000, "hi": 0.79, "lo": 0.29, "ips": 10, "mean": 0.51, "above": false}, "blocklist_de": {"n": 5, "p": 0.0000, "hi": 1.14, "lo": 0.28, "ips": 5, "mean": 0.65, "above": false}}, "h2": [["2026-10-05", 0.335, 0.144, 0, false], ["2026-10-12", 0.383, 0.161, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.161, "se": 1.126, "ts": 1.000, "map": 0.640, "obs": 2, "own": 1.813, "comp": {"urlhaus": 2.8012, "threatfox": -0.5352, "phishing_db": -1.0862}, "mass": 7.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 5, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 5}, "lo": 0.383, "se": 0.420, "ts": 0.417, "map": 0.634, "obs": 24, "own": 0.980, "comp": {"cins": 5.6506, "dshield": 1.722, "crowdsec": -2.2988, "vulncheck": -0.9733, "blocklist_de": -3.1625}, "mass": 27.1, "listed": false}}, "abq": false, "bot": 0.408, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 3, "imap": 1, "mail": 2}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 962, "reg": "2011-01-19", "rir": "apnic", "s24": 7689, "sib": 28, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3344896, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01478292544456}, {"a": 56046, "h": "CMNET-Jiangsu-AP", "n": "CMNET-Jiangsu-AP", "t": "Broadband & mobile", "w": 204, "cc": "CN", "cf": {"rb": "hi", "wb": "", "rep": 1.36, "waf": 2.65}, "cs": {"c": {"http_flood": 66, "web_exploit": 6, "bad_crawling": 12, "proxy_or_vpn": 3, "first_seen_30d": 5, "ssh_bruteforce": 30, "web_bruteforce": 72, "mail_bruteforce": 15, "cve:CVE-2024-6387": 10, "cve:CVE-2025-4396": 40, "cve:CVE-2022-26134": 14, "cve:CVE-2024-12847": 3, "cve:CVE-2024-28000": 20}, "n": 178}, "ev": {"cins": {"n": 4, "p": 0.0000, "hi": 1.31, "lo": 0.28, "ips": 4, "mean": 0.72, "above": false}, "shodan": {"n": 9, "p": 0.0000, "hi": 0.50, "lo": 0.17, "ips": 9, "mean": 0.32, "above": false}, "dshield": {"n": 9, "p": 0.0001, "hi": 1.82, "lo": 0.63, "ips": 9, "mean": 1.16, "above": false}, "urlhaus": {"n": 3, "p": 0.0854, "hi": 3.36, "lo": 0.59, "ips": 4, "mean": 1.73, "above": false}, "crowdsec": {"n": 40, "p": 0.0000, "hi": 1.35, "lo": 0.80, "ips": 178, "mean": 1.06, "above": false}, "threatfox": {"n": 1, "p": 0.0008, "hi": 1.49, "lo": 0.11, "ips": 1, "mean": 0.63, "above": false}, "phishing_db": {"n": 1, "p": 0.0000, "hi": 0.60, "lo": 0.04, "ips": 1, "mean": 0.25, "above": false}, "blocklist_de": {"n": 25, "p": 0.0001, "hi": 2.16, "lo": 1.13, "ips": 25, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.610, 0.226, 0, false], ["2026-10-12", 0.711, 0.227, 0, false]], "sh": false, "uc": 51.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 1, "phishing_db": 1}, "lo": 0.227, "se": 0.994, "ts": 0.600, "map": 0.666, "obs": 5, "own": 1.905, "comp": {"urlhaus": 2.384, "threatfox": -0.3095, "phishing_db": -0.8555}, "mass": 15.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 9, "crowdsec": 40, "vulncheck": 0, "blocklist_de": 25}, "lo": 0.711, "se": 0.377, "ts": 0.513, "map": 1.084, "obs": 78, "own": 1.671, "comp": {"cins": -0.0584, "dshield": -0.3185, "crowdsec": 0.1756, "vulncheck": -1.0025, "blocklist_de": 2.6778}, "mass": 85.2, "listed": false}}, "abq": false, "bot": 0.397, "det": {"shodan": {"c2": 2, "compromised": 7}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 12, "imap": 7, "mail": 13}}, "oid": null, "org": null, "pdb": null, "pfx": 3629, "reg": "2011-01-19", "rir": "apnic", "s24": 14171, "sib": 0, "tor": 0, "w24": 62, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7879936, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.053776}, {"a": 56047, "h": "CMNET-Hunan-AP", "n": "China Mobile Group Hunan Company", "t": "Broadband & mobile", "w": 69, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 3, "first_seen_30d": 15, "ssh_bruteforce": 20, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 55}, "ev": {"cins": {"n": 4, "p": 0.1831, "hi": 3.98, "lo": 0.86, "ips": 4, "mean": 2.18, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 1.21, "lo": 0.26, "ips": 4, "mean": 0.66, "above": false}, "dshield": {"n": 6, "p": 0.3169, "hi": 4.46, "lo": 1.24, "ips": 6, "mean": 2.63, "above": false}, "urlhaus": {"n": 1, "p": 0.1030, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "crowdsec": {"n": 20, "p": 0.0865, "hi": 3.17, "lo": 1.54, "ips": 55, "mean": 2.29, "above": false}, "blocklist_de": {"n": 7, "p": 0.0577, "hi": 3.06, "lo": 0.93, "ips": 8, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.934, 0.081, 0, false], ["2026-10-12", 1.404, 0.091, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.091, "se": 1.346, "ts": 1.000, "map": 0.578, "obs": 1, "own": 1.715, "comp": {"urlhaus": 2.4333, "threatfox": -0.4545, "phishing_db": -0.9011}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 6, "crowdsec": 20, "vulncheck": 0, "blocklist_de": 7}, "lo": 1.404, "se": 0.395, "ts": 0.541, "map": 2.210, "obs": 37, "own": 3.402, "comp": {"cins": 3.7185, "dshield": 1.1345, "crowdsec": 1.7606, "vulncheck": -0.9851, "blocklist_de": -3.4419}, "mass": 37.6, "listed": false}}, "abq": false, "bot": 0.492, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 7, "mail": 1}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 1755, "reg": "2011-01-19", "rir": "apnic", "s24": 3071, "sib": 28, "tor": 0, "w24": 33, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1642752, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0178177698309}, {"a": 56048, "h": "CMNET-BEIJING-AP", "n": "China Mobile Group Beijing Company", "t": "Broadband & mobile", "w": 17, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 4, "ssh_bruteforce": 9, "web_bruteforce": 3, "mail_bruteforce": 4, "cve:CVE-2024-6387": 3, "cve:CVE-2025-55182": 1}, "n": 11}, "ev": {"cins": {"n": 1, "p": 0.0018, "hi": 1.65, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}, "shodan": {"n": 2, "p": 0.0000, "hi": 0.60, "lo": 0.08, "ips": 2, "mean": 0.29, "above": false}, "dshield": {"n": 4, "p": 0.0264, "hi": 2.70, "lo": 0.58, "ips": 4, "mean": 1.48, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 1.43, "lo": 0.54, "ips": 11, "mean": 0.94, "above": false}, "threatfox": {"n": 1, "p": 0.0393, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "blocklist_de": {"n": 6, "p": 0.0018, "hi": 2.06, "lo": 0.57, "ips": 6, "mean": 1.22, "above": false}}, "h2": [["2026-10-05", 0.388, 0.037, 0, false], ["2026-10-12", 0.561, 0.039, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.039, "se": 1.333, "ts": 1.000, "map": 0.210, "obs": 1, "own": 0.730, "comp": {"urlhaus": -0.5384, "threatfox": 1.3312, "phishing_db": -0.7255}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 6}, "lo": 0.561, "se": 0.423, "ts": 0.500, "map": 0.929, "obs": 22, "own": 1.434, "comp": {"cins": -0.1995, "dshield": 1.4392, "crowdsec": 0.4696, "vulncheck": -0.9656, "blocklist_de": 0.5761}, "mass": 22.8, "listed": false}}, "abq": false, "bot": 0.459, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:DanaBot": 1}, "blocklist_de": {"ssh": 3, "imap": 2, "mail": 3}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 623, "reg": "2011-01-19", "rir": "apnic", "s24": 4421, "sib": 28, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1625344, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01499803015464}, {"a": 56067, "h": "METRABYTE-TH", "n": "Metrabyte DataCenter Co.,Ltd", "t": "Hosting & VPS", "w": 4, "cc": "TH", "cf": null, "cs": {"c": {"first_seen_30d": 1}, "n": 1}, "ev": {"shodan": {"n": 17, "p": 1.0000, "hi": 23.49, "lo": 10.72, "ips": 17, "mean": 16.58, "above": true}, "crowdsec": {"n": 1, "p": 0.1563, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "threatfox": {"n": 1, "p": 0.1964, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1899, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "phishing_db": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 1.087, 2.381, 0, false], ["2026-10-12", 1.055, 2.408, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 2.408, "se": 1.166, "ts": 0.500, "map": 11.628, "obs": 2, "own": 4.431, "comp": {"urlhaus": -0.2939, "threatfox": 2.2151, "phishing_db": 2.1584}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.055, "se": 0.943, "ts": 0.500, "map": 4.444, "obs": 2, "own": 0.935, "comp": {"cins": -0.2334, "dshield": -0.5158, "crowdsec": 2.4231, "vulncheck": 2.4194, "blocklist_de": -1.2081}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.594, "det": {"shodan": {"compromised": 17}, "threatfox": {"family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-MC4-AP-APNIC", "org": "Metrabyte Co.,Ltd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.metrabyte.cloud"}, "pfx": 7, "reg": "2011-02-04", "rir": "apnic", "s24": 40, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 11264, "abuse": "abuse@metrabyte.cloud", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00043959750744}, {"a": 56150, "h": "VHOST-AS-VN", "n": "Viet Solutions Services Trading Company Limited", "t": "Hosting & VPS", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3924, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 4.071, 0.011, 0, false], ["2026-10-12", 0.394, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.290, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.394, "se": 1.339, "ts": 1.000, "map": 3.608, "obs": 1, "own": 0.838, "comp": {"cins": -0.1073, "dshield": -0.2502, "crowdsec": 3.8668, "vulncheck": -0.2723, "blocklist_de": -0.56}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.659, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-56150-APNIC", "org": "Viet Solutions Services Trading Company Limited", "pdb": null, "pfx": 23, "reg": "2011-03-17", "rir": "apnic", "s24": 22, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014052750278}, {"a": 56153, "h": "LUUTRUSO-AS-VN", "n": "Digital Storage Company", "t": "Transit & backbone", "w": 3, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4090, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.537, 0.659, 0, false], ["2026-10-12", 3.827, 0.686, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.686, "se": 1.657, "ts": 1.000, "map": 8.588, "obs": 1, "own": 39.090, "comp": {"urlhaus": -0.0586, "threatfox": -0.0806, "phishing_db": 3.9158}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.827, "se": 0.998, "ts": 1.000, "map": 18.356, "obs": 2, "own": 60.243, "comp": {"cins": -0.2405, "dshield": -0.5301, "crowdsec": 6.7848, "vulncheck": -0.4658, "blocklist_de": -1.2448}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.926, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-56153-APNIC", "org": "Digital Storage Company Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://123host.vn/en/"}, "pfx": 10, "reg": "2011-03-17", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012637776368}, {"a": 56166, "h": "IISERBNET-IN", "n": "IISER Bhopal Campus", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.119, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-IIOS1-AP-APNIC", "org": "Indian Institute of Science Education and Research Bhopal", "pdb": null, "pfx": 1, "reg": "2011-03-21", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56201, "h": "ZOHO-IN", "n": "Zoho-IN", "t": "Other", "w": 3, "cc": "IN", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6268, "hi": 7.52, "lo": 1.33, "ips": 3, "mean": 3.88, "above": false}}, "h2": [["2026-10-05", 4.910, 0.011, 0, false], ["2026-10-12", 1.201, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 0.623, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 1.201, "se": 0.786, "ts": 1.000, "map": 3.691, "obs": 3, "own": 2.222, "comp": {"cins": -0.2781, "dshield": -0.6035, "crowdsec": -2.3822, "vulncheck": 7.3991, "blocklist_de": -1.4356}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.954, "det": {"vulncheck": {"c2_server": 3}}, "oid": "ORG-ZCPL1-AP-APNIC", "org": "ZOHO Corporation Private Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.zoho.in"}, "pfx": 33, "reg": "2011-04-14", "rir": "apnic", "s24": 58, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "abuse@zohocorp.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56207, "h": "COMCLARK-PH", "n": "ComClark Network & Technology Corp", "t": "Other", "w": 3, "cc": "PH", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4018, "hi": 6.10, "lo": 0.79, "ips": 3, "mean": 2.91, "above": false}}, "h2": [["2026-10-12", 0.974, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 0.618, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.974, "se": 0.918, "ts": 1.000, "map": 4.020, "obs": 2, "own": 2.352, "comp": {"cins": -0.3109, "dshield": 7.8592, "crowdsec": -2.6266, "vulncheck": -0.5351, "blocklist_de": -1.6016}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.088, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-CNTC1-AP-APNIC", "org": "ComClark Network & Technology Corp", "pdb": null, "pfx": 17, "reg": "2011-04-18", "rir": "apnic", "s24": 60, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": "abuse@convergeict.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01399119113978}, {"a": 56233, "h": "ATSINDO-AS-ID", "n": "ATS INTERNET", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 0.437, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.437, "se": 1.360, "ts": 1.000, "map": 4.149, "obs": 1, "own": 7.638, "comp": {"cins": -0.1011, "dshield": -0.2364, "crowdsec": 3.9422, "vulncheck": -0.2603, "blocklist_de": -0.5278}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.249, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.ats-com.net"}, "pfx": 25, "reg": "2011-05-03", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@ats-com.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56254, "h": "UNRI-AS-ID", "n": "UNIVERSITAS RIAU", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-56254-APNIC", "org": "UNIVERSITAS RIAU", "pdb": null, "pfx": 2, "reg": "2011-05-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@unri.ac.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56255, "h": "TRANSTECH-AS-ID", "n": "PT Transtech Communication Media", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.858, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.858, "se": 1.529, "ts": 1.000, "map": 10.892, "obs": 1, "own": 8.268, "comp": {"cins": -0.0595, "dshield": 4.885, "crowdsec": -0.5621, "vulncheck": -0.17, "blocklist_de": -0.3117}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.184, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-56255-APNIC", "org": "PT Transtech Communication Media", "pdb": null, "pfx": 4, "reg": "2011-05-03", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@transtech.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56260, "h": "PASCAL-AS-ID", "n": "Pascal Indonesia", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": 19921.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 87.650, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.681, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"mail": 1}}, "oid": "@aut-56260-APNIC", "org": "PT Pascal Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.pascalwave.com"}, "pfx": 4, "reg": "2011-05-03", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@pascalwave.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56264, "h": "TOMATOWEB-BD", "n": "Tomato Web Limited", "t": "Transit & backbone", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 3, "web_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1508, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 2, "p": 0.3293, "hi": 5.47, "lo": 0.71, "ips": 3, "mean": 2.61, "above": false}}, "h2": [["2026-10-05", 0.223, 0.011, 0, false], ["2026-10-12", 1.008, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 2.206, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.008, "se": 0.920, "ts": 1.000, "map": 4.173, "obs": 2, "own": 13.561, "comp": {"cins": -0.3068, "dshield": -0.6582, "crowdsec": 5.9002, "vulncheck": -0.5316, "blocklist_de": -1.5812}, "mass": 1.4, "listed": false}}, "abq": true, "bot": 0.174, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TWL1-AP-APNIC", "org": "Tomato Web (Pvt) Limited", "pdb": {"t": "NSP", "sc": null, "tr": "50-100Gbps", "pol": "Open", "web": "https://www.tomatoweb.com.bd"}, "pfx": 57, "reg": "2011-05-04", "rir": "apnic", "s24": 57, "sib": 4, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00053751989556}, {"a": 56286, "h": "IXTELECOM-MY", "n": "IX Telecom", "t": "Broadband & mobile", "w": 0, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.833, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.579, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IT1-AP-APNIC", "org": "IX Telecom SDN. BHD.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://ixtelecom.net"}, "pfx": 31, "reg": "2011-05-16", "rir": "apnic", "s24": 36, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "noc@ixtelecom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007074806283}, {"a": 56300, "h": "MYREPUBLIC-SG", "n": "MyRepublic Singapore", "t": "Transit & backbone", "w": 3, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1690, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "dshield": {"n": 1, "p": 0.1614, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 1, "p": 0.0683, "hi": 3.26, "lo": 0.24, "ips": 1, "mean": 1.38, "above": false}}, "h2": [["2026-10-12", 0.916, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.970, "ts": null, "map": 0.177, "obs": 0, "own": 1.661, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.916, "se": 0.743, "ts": 0.333, "map": 2.696, "obs": 3, "own": 8.603, "comp": {"cins": 4.0208, "dshield": 2.5576, "crowdsec": -0.6671, "vulncheck": -0.6912, "blocklist_de": -2.8345}, "mass": 2.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ML5-AP-APNIC", "org": "MYREPUBLIC LIMITED", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://myrepublic.net/sg/"}, "pfx": 169, "reg": "2013-09-17", "rir": "apnic", "s24": 171, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 43776, "abuse": "abuse@myrepublic.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01089253320194}, {"a": 56309, "h": "SIAMDATA-TH", "n": "ReadyIDC", "t": "Broadband & mobile", "w": 26, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2021-21978": 1, "cve:CVE-2021-22175": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1786, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "shodan": {"n": 36, "p": 1.0000, "hi": 38.23, "lo": 22.19, "ips": 36, "mean": 29.75, "above": true}, "crowdsec": {"n": 2, "p": 0.2517, "hi": 4.83, "lo": 0.63, "ips": 2, "mean": 2.30, "above": false}, "vulncheck": {"n": 8, "p": 0.9945, "hi": 13.62, "lo": 4.43, "ips": 22, "mean": 8.49, "above": true}, "blocklist_de": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 6.627, 0.011, 0, false], ["2026-10-12", 4.911, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.997, "ts": null, "map": 0.183, "obs": 0, "own": 1.307, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 8, "blocklist_de": 1}, "lo": 4.911, "se": 0.509, "ts": 0.667, "map": 9.335, "obs": 12, "own": 14.582, "comp": {"cins": 2.8276, "dshield": -1.7984, "crowdsec": -1.887, "vulncheck": 6.2483, "blocklist_de": -1.7631}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.514, "det": {"shodan": {"compromised": 36}, "vulncheck": {"botnet_node": 22}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SCC3-AP-APNIC", "org": "Siamdata Communication Co.,ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "https://readyidc.com"}, "pfx": 40, "reg": "2011-06-21", "rir": "apnic", "s24": 114, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 34560, "abuse": "abuse@readyidc.com", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.00886415168046}, {"a": 56322, "h": "ServerAstra-AS", "n": "ServerAstra", "t": "Hosting & VPS", "w": 4, "cc": "HU", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2024-0204": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "threatfox": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 2.124, 3.608, 0, false], ["2026-10-12", 2.271, 3.615, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 3.615, "se": 1.185, "ts": 1.000, "map": 18.608, "obs": 2, "own": 6.974, "comp": {"urlhaus": -0.2395, "threatfox": 5.2387, "phishing_db": -0.4495}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.271, "se": 0.964, "ts": 1.000, "map": 10.224, "obs": 2, "own": 2.095, "comp": {"cins": -0.2663, "dshield": -0.5807, "crowdsec": 6.4347, "vulncheck": -0.4932, "blocklist_de": -1.376}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.796, "det": {"threatfox": {"family:PureRAT": 1, "family:AsyncRAT": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-SK286-RIPE", "org": "ServerAstra Kft.", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://serverastra.com"}, "pfx": 21, "reg": "2011-01-28", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 2, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@serverastra.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037206654936}, {"a": 56340, "h": "UmnyeSeti-AS", "n": "Grand", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2026-53787": 1, "cve:CVE-2026-75650": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0818, "hi": 3.44, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}}, "h2": [["2026-10-05", 0.128, 0.010, 0, false], ["2026-10-12", 0.134, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.180, "obs": 0, "own": 1.229, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.134, "se": 1.176, "ts": 1.000, "map": 0.899, "obs": 1, "own": 1.534, "comp": {"cins": -0.1712, "dshield": -0.3884, "crowdsec": 3.1147, "vulncheck": -0.3781, "blocklist_de": -0.8899}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.523, "det": null, "oid": "ORG-GL125-RIPE", "org": "Grand Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://umnyeseti.ru/"}, "pfx": 36, "reg": "2011-02-01", "rir": "ripencc", "s24": 143, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36608, "abuse": "support@umnyeseti.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56380, "h": "AS-ITFRUIT", "n": "''IT FRUIT'' S.R.L.", "t": "Hosting & VPS", "w": 6, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 4, "web_exploit": 1, "bad_crawling": 2, "web_bruteforce": 6}, "n": 6}, "ev": {"shodan": {"n": 4, "p": 0.8044, "hi": 8.96, "lo": 1.93, "ips": 4, "mean": 4.90, "above": true}, "crowdsec": {"n": 3, "p": 0.6294, "hi": 7.55, "lo": 1.33, "ips": 6, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 9.021, 0.011, 0, false], ["2026-10-12", 9.610, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.610, "se": 0.797, "ts": 1.000, "map": 31.733, "obs": 3, "own": 6.332, "comp": {"cins": -0.4002, "dshield": -0.8273, "crowdsec": 8.7323, "vulncheck": -0.6037, "blocklist_de": -2.0501}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.872, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-FS324-RIPE", "org": "''IT FRUIT'' S.R.L.", "pdb": null, "pfx": 6, "reg": "2021-08-18", "rir": "ripencc", "s24": 10, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00014074012785}, {"a": 56400, "h": "ASSPDChernega", "n": "SPD Chernega Aleksandr Anatolevich", "t": "Transit & backbone", "w": 5, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.723, 12.167, 1, false], ["2026-10-12", 8.347, 0.849, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.849, "se": 1.762, "ts": 1.000, "map": 11.936, "obs": 1, "own": 64.292, "comp": {"urlhaus": 4.404, "threatfox": -0.1064, "phishing_db": -0.1919}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 8.347, "se": 0.816, "ts": 0.333, "map": 27.707, "obs": 3, "own": 90.250, "comp": {"cins": -0.3534, "dshield": -0.7441, "crowdsec": 1.1869, "vulncheck": 1.7288, "blocklist_de": 2.8972}, "mass": 1.6, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CHER1-RIPE", "org": "SPD Chernega Aleksandr Anatolevich", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://flycom.ua"}, "pfx": 11, "reg": "2011-02-15", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "admin@flycom.net.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00124487483547}, {"a": 56508, "h": "ARDC", "n": "ARDC", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.1590, "hi": 4.08, "lo": 0.53, "ips": 2, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.748, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.681, "ts": null, "map": 0.110, "obs": 0, "own": 1.006, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.799, "det": {"shodan": {"doublepulsar": 2}}, "oid": "ORG-ARDC1-RIPE", "org": "Amateur Radio Digital Communications", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://ardc.net"}, "pfx": 30, "reg": "2023-07-24", "rir": "ripencc", "s24": 255, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72960, "abuse": "abuse@ardc.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56582, "h": "NETFACTOR-ASN", "n": "NETFACTOR TELEKOMINIKASYON VE TEKNOLOJI HIZMETLERI SANAYI VE", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1584, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 1.619, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.190, "obs": 0, "own": 0.728, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.504, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NTVT1-RIPE", "org": "Netfactor Telekominikasyon ve Teknoloji Hizmetleri San. ve Tic. A.S.", "pdb": null, "pfx": 47, "reg": "2011-04-04", "rir": "ripencc", "s24": 47, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": "abuse@netfactor.net.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039611592885}, {"a": 56588, "h": "EE-CERT", "n": "CERT-EE", "t": "Other", "w": 0, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.403, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-EIC3-RIPE", "org": "Information System Authority", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "https://cert.ee"}, "pfx": 1, "reg": "2011-04-06", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@cert.ee", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000282977884}, {"a": 56630, "h": "MELBICOM-EU-AS", "n": "Melbikomas", "t": "Hosting & VPS", "w": 14, "cc": "LT", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0577, "hi": 3.11, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "vulncheck": {"n": 7, "p": 0.9799, "hi": 11.92, "lo": 3.61, "ips": 12, "mean": 7.25, "above": true}, "phishing_db": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 1.010, 0.213, 0, false], ["2026-10-12", 1.407, 0.223, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.223, "se": 1.421, "ts": 1.000, "map": 1.706, "obs": 1, "own": 0.774, "comp": {"urlhaus": -0.2178, "threatfox": -0.2261, "phishing_db": 2.6041}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 7, "blocklist_de": 0}, "lo": 1.407, "se": 0.563, "ts": 0.875, "map": 2.900, "obs": 8, "own": 0.587, "comp": {"cins": -0.6723, "dshield": -1.2575, "crowdsec": -1.5738, "vulncheck": 9.3488, "blocklist_de": -3.3867}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.827, "det": {"vulncheck": {"botnet_node": 12}}, "oid": "ORG-MU30-RIPE", "org": "Melbikomas UAB", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://melbicom.net"}, "pfx": 147, "reg": "2015-12-15", "rir": "ripencc", "s24": 197, "sib": 4, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 57856, "abuse": "abuse@melbicom.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00352955843637}, {"a": 56642, "h": "BG-TVNET2", "n": "TVNET2 Ltd", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2685.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.172, "det": null, "oid": "ORG-TL564-RIPE", "org": "TVNET2 Ltd", "pdb": null, "pfx": 3, "reg": "2016-06-14", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "noc@ipacct.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003961323665}, {"a": 56655, "h": "GIGAHOST", "n": "Gigahost AS", "t": "Hosting & VPS", "w": 16, "cc": "NO", "cf": null, "cs": {"c": {"http_flood": 15, "data_centre": 4, "web_exploit": 14, "bad_crawling": 13, "proxy_or_vpn": 14, "web_bruteforce": 14, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2011-3600": 2, "cve:CVE-2015-9406": 5, "cve:CVE-2017-9841": 9, "cve:CVE-2018-13379": 3, "cve:CVE-2018-20062": 8}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1923, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 4, "p": 0.7740, "hi": 8.48, "lo": 1.83, "ips": 4, "mean": 4.63, "above": false}, "crowdsec": {"n": 8, "p": 0.9932, "hi": 13.14, "lo": 4.27, "ips": 15, "mean": 8.19, "above": true}, "blocklist_de": {"n": 1, "p": 0.1821, "hi": 4.56, "lo": 0.34, "ips": 2, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 17.755, 2.251, 1, false], ["2026-10-12", 20.951, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.263, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.951, "se": 0.488, "ts": 0.800, "map": 39.367, "obs": 10, "own": 7.699, "comp": {"cins": 2.2163, "dshield": -2.0775, "crowdsec": 9.2079, "vulncheck": -0.8848, "blocklist_de": -3.3953}, "mass": 8.0, "listed": false}}, "abq": false, "bot": 0.766, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-GA1182-RIPE", "org": "Gigahost AS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "http://gigahost.no"}, "pfx": 30, "reg": "2018-02-07", "rir": "ripencc", "s24": 37, "sib": 1, "tor": 12, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "abuse@as56655.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00380793794506}, {"a": 56694, "h": "SmartApe", "n": "SmartApe", "t": "Broadband & mobile", "w": 22, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1291, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "vulncheck": {"n": 9, "p": 0.9986, "hi": 15.14, "lo": 5.23, "ips": 12, "mean": 9.64, "above": true}, "phishing_db": {"n": 5, "p": 0.9052, "hi": 10.16, "lo": 2.53, "ips": 8, "mean": 5.80, "above": true}, "blocklist_de": {"n": 1, "p": 0.1676, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 1.310, 7.939, 0, false], ["2026-10-12", 5.612, 7.982, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 7.982, "se": 0.872, "ts": 1.000, "map": 21.626, "obs": 5, "own": 49.789, "comp": {"urlhaus": -0.8016, "threatfox": -0.4384, "phishing_db": 5.94}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 9, "blocklist_de": 1}, "lo": 5.612, "se": 0.522, "ts": 0.818, "map": 10.959, "obs": 11, "own": 17.231, "comp": {"cins": -0.8684, "dshield": -1.5197, "crowdsec": -2.9747, "vulncheck": 9.4782, "blocklist_de": -0.3275}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.715, "det": {"vulncheck": {"c2_server": 2, "botnet_node": 10}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-LSA101-RIPE", "org": "LLC Smart Ape", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://www.smartape.ru"}, "pfx": 26, "reg": "2015-12-11", "rir": "ripencc", "s24": 71, "sib": 0, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.8651]], "ipv4": 19712, "abuse": "abuse@smartape.ru", "score": 0.8651, "groups": ["vulncheck", "phishing"], "sensors": [], "traffic": 0.0004461702014}, {"a": 56740, "h": "DATAHATA-AS", "n": "DataHata", "t": "Transit & backbone", "w": 3, "cc": "BY", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4117, "hi": 6.19, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 0.995, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 2.476, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.995, "se": 0.950, "ts": 1.000, "map": 4.178, "obs": 2, "own": 14.310, "comp": {"cins": -0.1831, "dshield": -0.4134, "crowdsec": -1.6346, "vulncheck": 6.0059, "blocklist_de": -0.9512}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.999, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-DL127-RIPE", "org": "DataHata Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.datahata.by/"}, "pfx": 31, "reg": "2011-05-06", "rir": "ripencc", "s24": 33, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": "abuse@datahata.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01585758570744}, {"a": 56803, "h": "AS-DATASOURCE", "n": "Datasource AG", "t": "Other", "w": 2, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-26134": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.530, "det": null, "oid": "ORG-DA327-RIPE", "org": "Datasource AG", "pdb": null, "pfx": 1, "reg": "2011-05-19", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "noc@datasource.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003322652754}, {"a": 56812, "h": "ASZARKO", "n": "CHP Zarko Alexandr Ivanovich", "t": "Other", "w": 52, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2025-4396": 1}, "n": 3}, "ev": {"dshield": {"n": 3, "p": 0.6342, "hi": 7.61, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "crowdsec": {"n": 3, "p": 0.5832, "hi": 7.08, "lo": 1.25, "ips": 3, "mean": 3.65, "above": false}, "blocklist_de": {"n": 12, "p": 1.0000, "hi": 18.72, "lo": 7.40, "ips": 48, "mean": 12.52, "above": true}}, "h2": [["2026-10-05", 43.302, 0.011, 1, false], ["2026-10-12", 57.992, 0.012, 1, false]], "sh": false, "uc": 19303.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 12}, "lo": 57.992, "se": 0.423, "ts": 0.667, "map": 97.584, "obs": 18, "own": 54.434, "comp": {"cins": -2.33, "dshield": 0.8793, "crowdsec": -7.1301, "vulncheck": -0.9575, "blocklist_de": 15.5127}, "mass": 19.3, "listed": false}}, "abq": true, "bot": 0.283, "det": {"blocklist_de": {"bots": 1, "imap": 47, "mail": 47}}, "oid": "ORG-ZARK1-RIPE", "org": "CHP Zarko Alexandr Ivanovich", "pdb": null, "pfx": 5, "reg": "2011-05-20", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00035464489926}, {"a": 56814, "h": "T2TELECOM-AS", "n": "M2 CONNECT LLC", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4200, "hi": 6.27, "lo": 0.81, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 7.023, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 7.023, "se": 0.821, "ts": 0.667, "map": 23.394, "obs": 3, "own": 38.084, "comp": {"cins": -0.2738, "dshield": 3.7704, "crowdsec": -2.3494, "vulncheck": 4.8125, "blocklist_de": -1.4136}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.450, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-TTL45-RIPE", "org": "M2 CONNECT LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://dtc.su"}, "pfx": 5, "reg": "2021-03-02", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002898590849}, {"a": 56838, "h": "VATUS", "n": "PUH Vatus Rafal Wejman", "t": "Other", "w": 9, "cc": "PL", "cf": null, "cs": {"c": {"mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 21.308, 0.011, 1, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 27246.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.159, "det": {"blocklist_de": {"imap": 6, "mail": 7}}, "oid": "ORG-PVRW1-RIPE", "org": "PUH Vatus Rafal Wejman", "pdb": null, "pfx": 1, "reg": "2011-05-24", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027310260666}, {"a": 56851, "h": "VPS-UA-AS", "n": "PE Skurykhin Mukola Volodumurovuch", "t": "Hosting & VPS", "w": 2, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3749, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "crowdsec": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "phishing_db": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.472, 0.443, 0, false], ["2026-10-12", 0.308, 0.461, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.461, "se": 1.542, "ts": 1.000, "map": 4.688, "obs": 1, "own": 2.138, "comp": {"urlhaus": -0.1102, "threatfox": -0.1371, "phishing_db": 3.4185}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.308, "se": 1.295, "ts": 1.000, "map": 2.591, "obs": 1, "own": 0.589, "comp": {"cins": -0.1222, "dshield": -0.2831, "crowdsec": 3.6878, "vulncheck": -0.2996, "blocklist_de": -0.637}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.791, "det": {"shodan": {"doublepulsar": 2}}, "oid": "ORG-PSMV2-RIPE", "org": "PE Skurykhin Mukola Volodumurovuch", "pdb": null, "pfx": 35, "reg": "2011-05-27", "rir": "ripencc", "s24": 35, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@vps.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56898, "h": "NL-PRIVATEHOST", "n": "Private Host", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.976, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PHB5-RIPE", "org": "Private Host BV", "pdb": {"t": "Content", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.privatehost.com/"}, "pfx": 8, "reg": "2014-11-03", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@privatehost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56907, "h": "STVGroup", "n": "SBK Service LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.359, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-SSL123-RIPE", "org": "SBK Service LLC", "pdb": null, "pfx": 1, "reg": "2011-06-09", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56911, "h": "ASN-WARIAN", "n": "WARIAN", "t": "Transit & backbone", "w": 7, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 4, "router_or_botnet": 1}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.5482, "hi": 6.75, "lo": 1.19, "ips": 5, "mean": 3.48, "above": false}, "blocklist_de": {"n": 2, "p": 0.3841, "hi": 5.94, "lo": 0.77, "ips": 4, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 5.268, 0.011, 0, false], ["2026-10-12", 5.701, 0.012, 0, false]], "sh": false, "uc": 1367.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 2.215, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.701, "se": 0.613, "ts": 0.600, "map": 13.386, "obs": 5, "own": 42.080, "comp": {"cins": -0.8426, "dshield": -1.4872, "crowdsec": 3.2472, "vulncheck": -0.7884, "blocklist_de": 3.8588}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.206, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-WSDG3-RIPE", "org": "Warian S.R.L.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.warian.net"}, "pfx": 26, "reg": "2011-06-09", "rir": "ripencc", "s24": 56, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": "abuse@warian.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017793303426}, {"a": 56958, "h": "RaiolaNetworks", "n": "Raiola Networks", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 0.378, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-RNS11-RIPE", "org": "Raiola Networks S.L.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://raiolanetworks.com/"}, "pfx": 8, "reg": "2021-12-02", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@as56958.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015860210316}, {"a": 56962, "h": "RHS", "n": "RHS", "t": "Other", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 5664.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.208, "det": null, "oid": "ORG-VRTA1-RIPE", "org": "RHS s.r.l.", "pdb": null, "pfx": 6, "reg": "2021-09-17", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 56971, "h": "AS56971", "n": "CGI GLOBAL LIMITED", "t": "Broadband & mobile", "w": 39, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 17, "bad_crawling": 4, "proxy_or_vpn": 3, "first_seen_30d": 13, "ssh_bruteforce": 20, "web_bruteforce": 11, "mail_bruteforce": 1, "cve:CVE-2013-3827": 2, "cve:CVE-2014-2383": 2, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 5, "cve:CVE-2018-20062": 5}, "n": 30}, "ev": {"shodan": {"n": 15, "p": 1.0000, "hi": 16.92, "lo": 7.35, "ips": 15, "mean": 11.72, "above": true}, "crowdsec": {"n": 28, "p": 1.0000, "hi": 26.39, "lo": 14.26, "ips": 30, "mean": 19.94, "above": true}, "threatfox": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 2, "p": 0.3657, "hi": 5.78, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "phishing_db": {"n": 1, "p": 0.1647, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 10, "p": 0.9989, "hi": 14.34, "lo": 5.21, "ips": 10, "mean": 9.30, "above": true}}, "h2": [["2026-10-05", 22.004, 0.879, 1, false], ["2026-10-12", 23.078, 0.893, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.893, "se": 1.142, "ts": 0.500, "map": 3.894, "obs": 2, "own": 10.181, "comp": {"urlhaus": -0.4047, "threatfox": 1.7504, "phishing_db": 1.6398}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 28, "vulncheck": 2, "blocklist_de": 10}, "lo": 23.078, "se": 0.383, "ts": 0.700, "map": 35.702, "obs": 40, "own": 54.541, "comp": {"cins": -2.9246, "dshield": -3.0574, "crowdsec": 9.2709, "vulncheck": -0.6224, "blocklist_de": 2.3024}, "mass": 33.6, "listed": false}}, "abq": false, "bot": 0.621, "det": {"shodan": {"c2": 5, "compromised": 10}, "threatfox": {"family:Evilginx": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ftp": 1, "ssh": 8, "bots": 1}}, "oid": "ORG-CGL23-RIPE", "org": "CGI GLOBAL LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://hostvds.com"}, "pfx": 171, "reg": "2019-10-01", "rir": "ripencc", "s24": 171, "sib": 1, "tor": 0, "w24": 36, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 43776, "abuse": "abuse@cloudbackbone.net", "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00235621193659}, {"a": 57026, "h": "CHEB-AS", "n": "JSC \"ER-Telecom Holding\" Cheboksary branch", "t": "Broadband & mobile", "w": 2050, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1635, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 1, "p": 0.0729, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "blocklist_de": {"n": 9, "p": 0.9966, "hi": 13.39, "lo": 4.63, "ips": 2049, "mean": 8.53, "above": true}}, "h2": [["2026-10-05", 6.006, 0.010, 0, false], ["2026-10-12", 7.910, 0.011, 0, false]], "sh": false, "uc": 339.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 9}, "lo": 7.910, "se": 0.474, "ts": 0.818, "map": 14.441, "obs": 11, "own": 22.139, "comp": {"cins": -1.8719, "dshield": -0.8275, "crowdsec": -7.971, "vulncheck": -0.9298, "blocklist_de": 15.6641}, "mass": 12.8, "listed": false}}, "abq": false, "bot": 0.443, "det": {"blocklist_de": {"imap": 1, "mail": 2049, "apache": 2048}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 49, "reg": "2011-07-05", "rir": "ripencc", "s24": 161, "sib": 121, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 77312, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.0007948666341}, {"a": 57043, "h": "HOSTKEY-AS", "n": "HOSTKEY B.V.", "t": "Hosting & VPS", "w": 35, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.2720, "hi": 5.00, "lo": 0.65, "ips": 2, "mean": 2.38, "above": false}, "shodan": {"n": 53, "p": 1.0000, "hi": 28.77, "lo": 18.35, "ips": 53, "mean": 23.32, "above": true}, "dshield": {"n": 2, "p": 0.2385, "hi": 4.73, "lo": 0.61, "ips": 2, "mean": 2.25, "above": false}, "crowdsec": {"n": 3, "p": 0.0450, "hi": 2.94, "lo": 0.52, "ips": 3, "mean": 1.52, "above": false}, "threatfox": {"n": 4, "p": 0.7656, "hi": 8.36, "lo": 1.80, "ips": 4, "mean": 4.57, "above": false}, "vulncheck": {"n": 11, "p": 0.9991, "hi": 13.76, "lo": 5.23, "ips": 16, "mean": 9.07, "above": true}, "phishing_db": {"n": 4, "p": 0.6478, "hi": 7.04, "lo": 1.51, "ips": 5, "mean": 3.84, "above": false}, "blocklist_de": {"n": 4, "p": 0.4440, "hi": 5.51, "lo": 1.19, "ips": 4, "mean": 3.01, "above": false}}, "h2": [["2026-10-05", 2.561, 1.776, 0, false], ["2026-10-12", 2.499, 2.020, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 4}, "lo": 2.020, "se": 0.856, "ts": 0.500, "map": 4.946, "obs": 8, "own": 1.898, "comp": {"urlhaus": -1.2773, "threatfox": 2.3006, "phishing_db": 2.2014}, "mass": 4.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 3, "vulncheck": 11, "blocklist_de": 4}, "lo": 2.499, "se": 0.445, "ts": 0.500, "map": 4.296, "obs": 22, "own": 0.845, "comp": {"cins": 3.7381, "dshield": 0.4288, "crowdsec": -5.5561, "vulncheck": 3.4244, "blocklist_de": 0.816}, "mass": 14.7, "listed": false}}, "abq": false, "bot": 0.861, "det": {"shodan": {"c2": 3, "compromised": 50}, "threatfox": {"family:Tsundere": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 2}, "vulncheck": {"c2_server": 14, "botnet_node": 2}, "blocklist_de": {"ftp": 1, "ssh": 3}}, "oid": "ORG-HB14-RIPE", "org": "HOSTKEY B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.hostkey.com"}, "pfx": 619, "reg": "2011-07-07", "rir": "ripencc", "s24": 616, "sib": 1, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 170496, "abuse": "abuse@hostkey.nl", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.01444923124822}, {"a": 57044, "h": "BRYANSK-AS", "n": "JSC \"ER-Telecom Holding\" Bryansk branch", "t": "Broadband & mobile", "w": 9, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 5, "home_connection": 5, "cve:CVE-2024-6387": 1}, "n": 5}, "ev": {"cins": {"n": 3, "p": 0.5580, "hi": 6.84, "lo": 1.20, "ips": 3, "mean": 3.53, "above": false}, "dshield": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 5, "p": 0.5242, "hi": 5.71, "lo": 1.42, "ips": 5, "mean": 3.26, "above": false}, "blocklist_de": {"n": 2, "p": 0.2353, "hi": 4.70, "lo": 0.61, "ips": 2, "mean": 2.24, "above": false}}, "h2": [["2026-10-05", 3.258, 0.010, 0, false], ["2026-10-12", 3.530, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.967, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.530, "se": 0.479, "ts": 0.455, "map": 6.517, "obs": 11, "own": 10.040, "comp": {"cins": 7.8289, "dshield": -0.5988, "crowdsec": -0.5366, "vulncheck": -0.92, "blocklist_de": -2.5053}, "mass": 11.5, "listed": false}}, "abq": false, "bot": 0.432, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 86, "reg": "2011-07-07", "rir": "ripencc", "s24": 317, "sib": 121, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 138240, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00142302484555}, {"a": 57050, "h": "DREAMSERVER-SRL", "n": "DreamServer.ro", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SDS36-RIPE", "org": "DreamServer S.R.L.", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://dreamserver.ro"}, "pfx": 5, "reg": "2020-03-31", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@dreamserver.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004143038897}, {"a": 57070, "h": "ITCOM-Shkoder", "n": "ITCOM Shpk", "t": "Other", "w": 0, "cc": "AL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.339, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SS176-RIPE", "org": "ITCOM Shpk", "pdb": null, "pfx": 2, "reg": "2011-07-12", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "info@itcom.al", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022488307519}, {"a": 57100, "h": "WEBNETWORK", "n": "Individual entrepreneur Dyachenko Valentina Ivanovna", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.343, "det": null, "oid": "ORG-WN11-RIPE", "org": "Individual entrepreneur Dyachenko Valentina Ivanovna", "pdb": null, "pfx": 1, "reg": "2011-07-19", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@pitline.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 57164, "h": "OT", "n": "ViacheslavFitiunin", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.303, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.303, "se": 1.292, "ts": 1.000, "map": 2.548, "obs": 1, "own": 4.537, "comp": {"cins": -0.1235, "dshield": 4.5304, "crowdsec": -1.1322, "vulncheck": -0.302, "blocklist_de": -0.6439}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-VF71-RIPE", "org": "Viacheslav Fitiunin", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://makeevka.com"}, "pfx": 27, "reg": "2023-07-10", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040421382925}, {"a": 57169, "h": "EDIS-AS-EU", "n": "EDIS GmbH", "t": "Enterprise, edu & gov", "w": 7, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.6726, "hi": 7.27, "lo": 1.57, "ips": 4, "mean": 3.97, "above": false}, "threatfox": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "phishing_db": {"n": 3, "p": 0.6076, "hi": 7.32, "lo": 1.29, "ips": 5, "mean": 3.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1481, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.008, 4.838, 0, false], ["2026-10-12", 0.158, 3.611, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 3.611, "se": 0.931, "ts": 0.750, "map": 10.736, "obs": 4, "own": 43.457, "comp": {"urlhaus": -0.7052, "threatfox": 0.9464, "phishing_db": 3.7586}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.158, "se": 1.198, "ts": 1.000, "map": 1.103, "obs": 1, "own": 6.900, "comp": {"cins": -0.1775, "dshield": -0.4017, "crowdsec": -1.5885, "vulncheck": -0.3872, "blocklist_de": 4.0468}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.727, "det": {"shodan": {"c2": 3, "doublepulsar": 1}, "threatfox": {"family:pupy": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-EG44-RIPE", "org": "EDIS GmbH", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.edis.at"}, "pfx": 120, "reg": "2011-08-11", "rir": "ripencc", "s24": 121, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30976, "abuse": "abuse@edis.at", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00186026969889}, {"a": 57218, "h": "RighTel", "n": "\"Rightel Communication Service Company PJS\"", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0461, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}}, "h2": [["2026-10-12", 0.033, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.126, "obs": 0, "own": 0.249, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.033, "se": 1.041, "ts": 1.000, "map": 0.171, "obs": 1, "own": 0.103, "comp": {"cins": -0.2537, "dshield": 3.8665, "crowdsec": -2.1958, "vulncheck": -0.4801, "blocklist_de": -1.3116}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ETSN1-RIPE", "org": "\"Rightel Communication Service Company PJS\"", "pdb": null, "pfx": 76, "reg": "2011-08-25", "rir": "ripencc", "s24": 1138, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 308992, "abuse": "abuse@rightel.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0144135751188}, {"a": 57242, "h": "ASFREENET", "n": "ASFREENET", "t": "Broadband & mobile", "w": 3, "cc": "UA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}}, "h2": [["2026-10-12", 6.536, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 6.536, "se": 0.824, "ts": 1.000, "map": 21.420, "obs": 3, "own": 35.299, "comp": {"cins": -0.2254, "dshield": -0.4998, "crowdsec": -1.9747, "vulncheck": 8.3252, "blocklist_de": -1.1674}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.916, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-FREE4-RIPE", "org": "FOP Martyinchuk Aleksandr Vasilevich", "pdb": null, "pfx": 8, "reg": "2011-09-05", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003657973566}, {"a": 57248, "h": "WISPER-AS", "n": "Wisper s.r.o.", "t": "Other", "w": 3, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 3, "p": 0.6386, "hi": 7.66, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 8.993, 0.011, 0, false], ["2026-10-12", 10.197, 0.012, 1, false]], "sh": false, "uc": 4166.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 10.197, "se": 0.801, "ts": 1.000, "map": 33.786, "obs": 3, "own": 19.379, "comp": {"cins": -0.4989, "dshield": -0.9934, "crowdsec": -3.9081, "vulncheck": -0.6622, "blocklist_de": 10.9763}, "mass": 2.3, "listed": false}}, "abq": true, "bot": 0.168, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-WS54-RIPE", "org": "Wisper s.r.o.", "pdb": null, "pfx": 6, "reg": "2011-09-06", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022373587962}, {"a": 57269, "h": "DIGI-ES", "n": "DIGI ES", "t": "Broadband & mobile", "w": 17, "cc": "ES", "cf": {"rb": "", "wb": "", "rep": 0.52, "waf": 0.58}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 2, "p": 0.1862, "hi": 4.30, "lo": 0.56, "ips": 2, "mean": 2.05, "above": false}, "dshield": {"n": 7, "p": 0.8888, "hi": 8.26, "lo": 2.50, "ips": 7, "mean": 5.02, "above": true}, "crowdsec": {"n": 3, "p": 0.0028, "hi": 1.98, "lo": 0.35, "ips": 3, "mean": 1.02, "above": false}, "blocklist_de": {"n": 5, "p": 0.3647, "hi": 4.83, "lo": 1.20, "ips": 5, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.420, 0.008, 0, false], ["2026-10-12", 1.747, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.830, "ts": null, "map": 0.127, "obs": 0, "own": 0.627, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 7, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.747, "se": 0.438, "ts": 0.412, "map": 2.982, "obs": 17, "own": 4.593, "comp": {"cins": 2.945, "dshield": 6.2405, "crowdsec": -6.7601, "vulncheck": -0.9534, "blocklist_de": 1.0143}, "mass": 18.1, "listed": false}}, "abq": false, "bot": 0.136, "det": {"blocklist_de": {"bots": 5}}, "oid": "ORG-DSTS3-RIPE", "org": "DIGI SPAIN TELECOM S.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.digimobil.es"}, "pfx": 13, "reg": "2011-09-09", "rir": "ripencc", "s24": 1098, "sib": 0, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 354816, "abuse": "abuse@digimobil.es", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.172348}, {"a": 57344, "h": "TELEHOUSE-AS", "n": "Telehouse", "t": "Broadband & mobile", "w": 6, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6078, "hi": 7.32, "lo": 1.29, "ips": 6, "mean": 3.78, "above": false}}, "h2": [["2026-10-05", 0.425, 0.011, 0, false], ["2026-10-12", 0.687, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.998, "ts": null, "map": 0.183, "obs": 0, "own": 1.313, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.687, "se": 0.776, "ts": 1.000, "map": 2.051, "obs": 3, "own": 3.374, "comp": {"cins": -0.297, "dshield": -0.6397, "crowdsec": -2.5243, "vulncheck": 7.1047, "blocklist_de": -1.5316}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.463, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 6}}, "oid": "ORG-TE13-RIPE", "org": "Telehouse EAD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.telehouse.bg"}, "pfx": 104, "reg": "2011-10-03", "rir": "ripencc", "s24": 112, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30464, "abuse": "abuse@telehouse.bg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00096493256793}, {"a": 57359, "h": "PYHANET-AS", "n": "Pyhänet Oy", "t": "Other", "w": 3, "cc": "FI", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 3, "cve:CVE-2025-22457": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6080, "hi": 7.33, "lo": 1.29, "ips": 3, "mean": 3.78, "above": false}, "blocklist_de": {"n": 3, "p": 0.6314, "hi": 7.58, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}}, "h2": [["2026-10-05", 16.892, 0.011, 1, false], ["2026-10-12", 18.725, 0.012, 1, false]], "sh": false, "uc": 7510.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 18.725, "se": 0.577, "ts": 0.500, "map": 41.163, "obs": 6, "own": 23.193, "comp": {"cins": -0.9795, "dshield": -1.654, "crowdsec": 1.8708, "vulncheck": -0.8201, "blocklist_de": 6.6939}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.226, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-PO37-RIPE", "org": "Pyhanet Oy", "pdb": null, "pfx": 8, "reg": "2015-12-07", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "hostmaster@pyhanet.fi", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009813831097}, {"a": 57367, "h": "ECO-ATMAN-PL", "n": "ATMAN XaaS", "t": "Hosting & VPS", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.233, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.245, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.088, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.800, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AS25-RIPE", "org": "Atman Sp. z o.o.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.atman.pl/"}, "pfx": 40, "reg": "2011-10-10", "rir": "ripencc", "s24": 52, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "abuse@atman.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007595862768}, {"a": 57378, "h": "ROSTOV-AS", "n": "JSC \"ER-Telecom Holding\" Rostov-on-Don branch", "t": "Broadband & mobile", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0556, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "dshield": {"n": 1, "p": 0.1459, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 1, "p": 0.0401, "hi": 2.84, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}}, "h2": [["2026-10-05", 0.961, 0.010, 0, false], ["2026-10-12", 0.310, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.943, "ts": null, "map": 0.169, "obs": 0, "own": 1.040, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.310, "se": 0.867, "ts": 0.500, "map": 1.151, "obs": 2, "own": 1.833, "comp": {"cins": -0.3686, "dshield": 3.3368, "crowdsec": 1.0394, "vulncheck": -0.5815, "blocklist_de": -1.892}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.421, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-RA21-RIPE", "org": "JSC \"ER-Telecom Holding\"", "pdb": null, "pfx": 86, "reg": "2011-10-12", "rir": "ripencc", "s24": 252, "sib": 121, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 119040, "abuse": "abuse@domru.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011388917001}, {"a": 57388, "h": "IBC-AS", "n": "I.B.C-TELECOM", "t": "Broadband & mobile", "w": 5, "cc": "AL", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 2.371, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.371, "se": 0.987, "ts": 0.500, "map": 10.795, "obs": 2, "own": 17.949, "comp": {"cins": -0.2, "dshield": -0.4481, "crowdsec": 2.7902, "vulncheck": 2.668, "blocklist_de": -1.0374}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.411, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-IS153-RIPE", "org": "I.B.C - Telecom Sh.p.k.", "pdb": {"t": "Route Server", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.ibc.al"}, "pfx": 14, "reg": "2011-10-14", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "noc@ibc.al", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00126378041858}, {"a": 57443, "h": "OSHNOGROUP-AS", "n": "Oshno group", "t": "Other", "w": 0, "cc": "TJ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OGL7-RIPE", "org": "Oshno group LLC", "pdb": null, "pfx": 7, "reg": "2018-07-18", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "support@oshnogroup.tj", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005115851145}, {"a": 57494, "h": "ADMAN-AS", "n": "Adman.com", "t": "Hosting & VPS", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.8490, "hi": 8.85, "lo": 2.20, "ips": 5, "mean": 5.05, "above": true}, "crowdsec": {"n": 1, "p": 0.1160, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}, "vulncheck": {"n": 1, "p": 0.1794, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1607, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 1.298, 0.011, 0, false], ["2026-10-12", 1.294, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 0.216, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.294, "se": 0.771, "ts": 0.333, "map": 3.987, "obs": 3, "own": 0.812, "comp": {"cins": -0.4383, "dshield": -0.8929, "crowdsec": 0.3841, "vulncheck": 1.3722, "blocklist_de": 2.3515}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.835, "det": {"shodan": {"compromised": 5}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AL402-RIPE", "org": "Adman LLC", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://adman.com"}, "pfx": 78, "reg": "2011-11-14", "rir": "ripencc", "s24": 88, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 22528, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00030024076775}, {"a": 57497, "h": "FarasoSamanehPasargad", "n": "Faraso Samaneh Pasargad", "t": "Enterprise, edu & gov", "w": 2, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "phishing_db": {"n": 1, "p": 0.1929, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.321, 0.473, 0, false], ["2026-10-12", 0.341, 0.493, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.493, "se": 1.558, "ts": 1.000, "map": 5.179, "obs": 1, "own": 25.968, "comp": {"urlhaus": -0.1011, "threatfox": -0.128, "phishing_db": 3.4998}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.341, "se": 1.312, "ts": 1.000, "map": 2.967, "obs": 1, "own": 19.373, "comp": {"cins": -0.1161, "dshield": -0.2697, "crowdsec": 3.761, "vulncheck": -0.2886, "blocklist_de": -0.6054}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.474, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FSPL2-RIPE", "org": "Faraso Samaneh Pasargad Ltd.", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": null}, "pfx": 29, "reg": "2011-11-14", "rir": "ripencc", "s24": 29, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@faraso.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012395279025}, {"a": 57509, "h": "LL-Investment-Ltd", "n": "L&L Investment Ltd.", "t": "Other", "w": 4, "cc": "BG", "cf": null, "cs": {"c": {}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 66.039, 0.012, 1, false], ["2026-10-12", 70.122, 0.013, 1, false]], "sh": true, "uc": 40234.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 70.122, "se": 0.868, "ts": 0.333, "map": 265.512, "obs": 3, "own": 153.033, "comp": {"cins": 4.4961, "dshield": 3.465, "crowdsec": 1.321, "vulncheck": -0.5594, "blocklist_de": -1.7474}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.850, "det": null, "oid": "ORG-LIL16-RIPE", "org": "L&L Investment Ltd.", "pdb": null, "pfx": 1, "reg": "2017-08-03", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@cloudbs.biz", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 57558, "h": "METIS-AS", "n": "METIS S.R.L.", "t": "Broadband & mobile", "w": 201, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "home_connection": 131, "mail_bruteforce": 172, "router_or_botnet": 4}, "n": 172}, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 6, "p": 0.9640, "hi": 11.66, "lo": 3.23, "ips": 172, "mean": 6.89, "above": true}, "blocklist_de": {"n": 6, "p": 0.9655, "hi": 11.77, "lo": 3.26, "ips": 57, "mean": 6.96, "above": true}}, "h2": [["2026-10-05", 152.995, 0.011, 1, false], ["2026-10-12", 190.028, 0.013, 1, false]], "sh": false, "uc": 244010.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 6}, "lo": 190.028, "se": 0.454, "ts": 0.462, "map": 340.144, "obs": 13, "own": 518.080, "comp": {"cins": -1.7318, "dshield": -0.5745, "crowdsec": 1.3231, "vulncheck": -0.9189, "blocklist_de": 9.1251}, "mass": 11.2, "listed": false}}, "abq": false, "bot": 0.251, "det": {"blocklist_de": {"imap": 57, "mail": 57}}, "oid": "ORG-MS182-RIPE", "org": "METIS S.R.L.", "pdb": null, "pfx": 2, "reg": "2011-11-28", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 1536, "abuse": "abuse@metissrl.it", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": null}, {"a": 57568, "h": "TR_Arvancloud", "n": "ARVANCLOUD GLOBAL TECHNOLOGIES L.L.C", "t": "Hosting & VPS", "w": 4, "cc": "AE", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "dshield": {"n": 1, "p": 0.1946, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.4096, "hi": 6.17, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 0.397, 0.011, 0, false], ["2026-10-12", 10.894, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 10.894, "se": 0.685, "ts": 0.500, "map": 28.883, "obs": 4, "own": 5.712, "comp": {"cins": -0.6496, "dshield": 2.2222, "crowdsec": -1.3986, "vulncheck": -0.7285, "blocklist_de": 5.3114}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.581, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-AGTL2-RIPE", "org": "ARVANCLOUD GLOBAL TECHNOLOGIES L.L.C", "pdb": null, "pfx": 8, "reg": "2022-10-31", "rir": "ripencc", "s24": 19, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@arvancloud.ae", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086613668295}, {"a": 57588, "h": "HAYAT-ISP-ASN", "n": "Hayat for Internet & Communication", "t": "Enterprise, edu & gov", "w": 0, "cc": "IQ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 4277.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 3.217, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 3.999, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.204, "det": null, "oid": "ORG-HFIC1-RIPE", "org": "Hayat for Internet & communication LLC", "pdb": {"t": "Enterprise", "sc": "Middle East", "tr": null, "pol": "Open", "web": "http://hayat-isp.net"}, "pfx": 20, "reg": "2011-12-06", "rir": "ripencc", "s24": 20, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "info@hayat-isp.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013928645094}, {"a": 57722, "h": "ATI-KOS-AS", "n": "N.SH.T \"ATI-KOS\" sh.p.k", "t": "Other", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.086, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NS121-RIPE", "org": "N.SH.T \"ATI-KOS\" sh.p.k", "pdb": null, "pfx": 4, "reg": "2012-01-25", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000003823086}, {"a": 57736, "h": "HOLSTEBRO-KOMMUNE", "n": "Holstebro Kommune", "t": "Other", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-HK44-RIPE", "org": "Holstebro Kommune", "pdb": null, "pfx": 6, "reg": "2019-05-16", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "ripe-admin@holstebro.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003156887616}, {"a": 57793, "h": "thirteenten", "n": "1310.io", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 1.590, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.891, "ts": null, "map": 0.187, "obs": 0, "own": 0.698, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.236, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LA1398-RIPE", "org": "1310 Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://1310.io"}, "pfx": 15, "reg": "2019-05-28", "rir": "ripencc", "s24": 51, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "support@1310.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 57814, "h": "Cloud9", "n": "Cloud9", "t": "Hosting & VPS", "w": 1, "cc": "GE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "vulncheck": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.243, 0.011, 0, false], ["2026-10-12", 0.282, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.282, "se": 1.297, "ts": 1.000, "map": 2.308, "obs": 1, "own": 0.546, "comp": {"cins": -0.0877, "dshield": -0.2063, "crowdsec": -0.8175, "vulncheck": 3.7998, "blocklist_de": -0.4584}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.632, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-CL434-RIPE", "org": "Cloud 9 Ltd.", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.cloud9.ge/"}, "pfx": 28, "reg": "2012-02-15", "rir": "ripencc", "s24": 28, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "abuse@cloud9.ge", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020407742784}, {"a": 57844, "h": "SPD-Net", "n": "SPDNet Telekomunikasyon", "t": "Broadband & mobile", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.289, 0.011, 0, false], ["2026-10-12", 0.426, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.426, "se": 1.354, "ts": 1.000, "map": 3.997, "obs": 1, "own": 7.336, "comp": {"cins": -0.1028, "dshield": -0.2401, "crowdsec": 3.922, "vulncheck": -0.2635, "blocklist_de": -0.5364}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.905, "det": null, "oid": "ORG-STHB1-RIPE", "org": "SPDNet Telekomunikasyon Hizmetleri Bilgi Teknolojileri Taahhut Sanayi Ve Ticaret A.S.", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.spd.net.tr"}, "pfx": 19, "reg": "2012-02-21", "rir": "ripencc", "s24": 19, "sib": 1, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@spd.net.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 57847, "h": "ASPEChAYKOF", "n": "CHAIKOF Ltd.", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4980.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.494, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CHAI1-RIPE", "org": "CHAIKOF Ltd.", "pdb": null, "pfx": 1, "reg": "2012-02-21", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 57858, "h": "AS57858", "n": "Angelnet Limited", "t": "Other", "w": 9, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 7, "bad_crawling": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "mail_bruteforce": 2, "cve:CVE-2020-5902": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2025-22457": 2, "cve:CVE-2025-55182": 1}, "n": 9}, "ev": {"crowdsec": {"n": 6, "p": 0.8393, "hi": 8.01, "lo": 2.22, "ips": 9, "mean": 4.73, "above": true}, "blocklist_de": {"n": 1, "p": 0.1278, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 3.657, 0.010, 0, false], ["2026-10-12", 2.844, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.967, "ts": null, "map": 0.176, "obs": 0, "own": 0.464, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.844, "se": 0.539, "ts": 0.857, "map": 5.821, "obs": 7, "own": 3.290, "comp": {"cins": -1.0956, "dshield": -1.7845, "crowdsec": 8.5644, "vulncheck": -0.8422, "blocklist_de": -1.687}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.667, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-AL993-RIPE", "org": "Angelnet Limited", "pdb": null, "pfx": 178, "reg": "2012-02-23", "rir": "ripencc", "s24": 180, "sib": 4, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 46080, "abuse": "noc1@interconnects.us", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00049372992649}, {"a": 57860, "h": "ZENCURITY-NET", "n": "Zencurity ApS", "t": "Enterprise, edu & gov", "w": 3, "cc": "DK", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2015-4455": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2016-2389": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2018-13379": 2}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 130.477, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.717, "det": null, "oid": "ORG-ZA135-RIPE", "org": "Zencurity ApS", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.zencurity.dk"}, "pfx": 1, "reg": "2015-11-30", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 3, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@zencurity.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000070889809}, {"a": 57888, "h": "TELESAT-AS", "n": "Telesat", "t": "Other", "w": 1, "cc": "HR", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1076, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 1, "p": 0.1560, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-12", 0.698, 0.012, 0, false]], "sh": false, "uc": 593.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 0.545, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.698, "se": 0.903, "ts": 0.500, "map": 2.772, "obs": 2, "own": 1.622, "comp": {"cins": -0.3536, "dshield": -0.7444, "crowdsec": 1.1853, "vulncheck": -0.5702, "blocklist_de": 2.8962}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.356, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TD32-RIPE", "org": "Telesat d.o.o.", "pdb": null, "pfx": 16, "reg": "2012-03-06", "rir": "ripencc", "s24": 100, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00062417781729}, {"a": 57961, "h": "RASH-AS", "n": "Qendra Nderuniversitare e Sherbimeve dhe Rrjeti Telematik", "t": "Enterprise, edu & gov", "w": 0, "cc": "AL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 3.523, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 5.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.295, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-QNES1-RIPE", "org": "RASH - Rrjeti Akademik Shqiptar", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.rash.al"}, "pfx": 12, "reg": "2012-03-20", "rir": "ripencc", "s24": 11, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@rash.al", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001513705667}, {"a": 57970, "h": "OLECOMUNICACION", "n": "OLE COMUNICACION S.L.", "t": "Other", "w": 5, "cc": "ES", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1873, "hi": 4.62, "lo": 0.35, "ips": 5, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.199, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.199, "se": 1.244, "ts": 1.000, "map": 1.464, "obs": 1, "own": 0.974, "comp": {"cins": -0.103, "dshield": -0.2407, "crowdsec": -0.9534, "vulncheck": 3.6102, "blocklist_de": -0.5379}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.235, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-OCS6-RIPE", "org": "OLE COMUNICACION S.L.", "pdb": null, "pfx": 41, "reg": "2012-03-22", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003883353257}, {"a": 57999, "h": "DATANETISP-AS", "n": "DataNet ISP", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.134, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LDI3-RIPE", "org": "LLC DataNet ISP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://datanet.kiev.ua"}, "pfx": 4, "reg": "2017-06-20", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028330956285}, {"a": 58000, "h": "MTN-NET-AS", "n": "Nikita Sergienko", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 22.390, 0.013, 1, false]], "sh": false, "uc": 12597.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 22.390, "se": 0.825, "ts": 0.333, "map": 77.235, "obs": 3, "own": 44.336, "comp": {"cins": -0.3905, "dshield": 3.2411, "crowdsec": 0.8292, "vulncheck": -0.5971, "blocklist_de": 2.6579}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.463, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NS573-RIPE", "org": "Nikita Sergienko", "pdb": null, "pfx": 3, "reg": "2012-03-29", "rir": "ripencc", "s24": 4, "sib": 13, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58033, "h": "INTERNETSOLUTIONS-AS", "n": "TOO Internet Resheniya", "t": "Other", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.728, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TIR1-RIPE", "org": "TOO Internet Resheniya", "pdb": null, "pfx": 5, "reg": "2018-11-19", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "info@id.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000471540629}, {"a": 58051, "h": "Zume", "n": "Alpha Internet", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-AIL65-RIPE", "org": "Alpha Internet Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://alphainternet.uk"}, "pfx": 5, "reg": "2023-03-22", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@zume.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58061, "h": "SCALAXY-AS", "n": "Scalaxy", "t": "Other", "w": 20, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 12, "bad_crawling": 1, "proxy_or_vpn": 10, "web_bruteforce": 14, "cve:CVE-2019-9194": 1, "cve:CVE-2024-4577": 4, "cve:CVE-2021-23394": 1, "cve:CVE-2024-28000": 3, "cve:CVE-2026-87902": 1}, "n": 14}, "ev": {"shodan": {"n": 15, "p": 0.9998, "hi": 12.69, "lo": 5.51, "ips": 15, "mean": 8.79, "above": true}, "dshield": {"n": 1, "p": 0.1236, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "crowdsec": {"n": 10, "p": 0.9548, "hi": 8.39, "lo": 3.05, "ips": 14, "mean": 5.44, "above": true}, "vulncheck": {"n": 3, "p": 0.5143, "hi": 6.45, "lo": 1.14, "ips": 3, "mean": 3.33, "above": false}, "phishing_db": {"n": 2, "p": 0.3094, "hi": 5.30, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}}, "h2": [["2026-10-05", 4.515, 0.923, 0, false], ["2026-10-12", 2.498, 0.528, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.528, "se": 1.135, "ts": 1.000, "map": 2.208, "obs": 2, "own": 2.404, "comp": {"urlhaus": -0.4982, "threatfox": -0.3613, "phishing_db": 3.2778}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 10, "vulncheck": 3, "blocklist_de": 0}, "lo": 2.498, "se": 0.461, "ts": 0.714, "map": 4.422, "obs": 14, "own": 2.495, "comp": {"cins": -1.5411, "dshield": -0.1997, "crowdsec": 11.112, "vulncheck": 0.8781, "blocklist_de": -7.3691}, "mass": 9.4, "listed": false}}, "abq": false, "bot": 0.856, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 13}, "vulncheck": {"c2_server": 1, "botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SB577-RIPE", "org": "Scalaxy B.V.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://scalaxy.com"}, "pfx": 319, "reg": "2019-08-06", "rir": "ripencc", "s24": 384, "sib": 0, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 98304, "abuse": "abuse@scalaxy.com", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00546084576012}, {"a": 58065, "h": "PacketExchange", "n": "Packet Exchange", "t": "Broadband & mobile", "w": 50, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 20, "data_centre": 1, "web_exploit": 46, "bad_crawling": 21, "proxy_or_vpn": 16, "ssh_bruteforce": 12, "web_bruteforce": 43, "mail_bruteforce": 12, "cve:CVE-2017-9841": 10, "cve:CVE-2021-3129": 12, "cve:CVE-2026-56290": 5, "cve:CVE-2026-60137": 16, "cve:CVE-2026-63030": 11}, "n": 49}, "ev": {"dshield": {"n": 2, "p": 0.2958, "hi": 5.19, "lo": 0.67, "ips": 2, "mean": 2.47, "above": false}, "crowdsec": {"n": 20, "p": 1.0000, "hi": 14.18, "lo": 6.86, "ips": 49, "mean": 10.24, "above": true}, "blocklist_de": {"n": 1, "p": 0.0737, "hi": 3.33, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 5.091, 0.009, 0, false], ["2026-10-12", 5.080, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.159, "obs": 0, "own": 0.900, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 20, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.080, "se": 0.411, "ts": 0.870, "map": 8.170, "obs": 23, "own": 12.537, "comp": {"cins": -2.2352, "dshield": -0.1157, "crowdsec": 14.7804, "vulncheck": -0.9526, "blocklist_de": -7.9829}, "mass": 17.8, "listed": false}}, "abq": false, "bot": 0.440, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-ONL20-RIPE", "org": "Orion Network Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://packetexchange.eu"}, "pfx": 397, "reg": "2018-03-19", "rir": "ripencc", "s24": 395, "sib": 1, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 102400, "abuse": "abuse@packetexchange.org", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00205448779814}, {"a": 58087, "h": "FlorianKolb", "n": "Datalix", "t": "Broadband & mobile", "w": 19, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 10, "web_exploit": 10, "bad_crawling": 10, "proxy_or_vpn": 10, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 10, "home_connection": 11, "mail_bruteforce": 2, "cve:CVE-2015-9406": 2, "cve:CVE-2017-9841": 9, "cve:CVE-2018-13379": 3, "cve:CVE-2018-20062": 6, "cve:CVE-2021-26086": 1}, "n": 12}, "ev": {"cins": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 16, "p": 1.0000, "hi": 22.70, "lo": 10.12, "ips": 16, "mean": 15.88, "above": true}, "crowdsec": {"n": 7, "p": 0.9813, "hi": 12.09, "lo": 3.66, "ips": 12, "mean": 7.35, "above": true}, "threatfox": {"n": 3, "p": 0.6438, "hi": 7.71, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}, "vulncheck": {"n": 3, "p": 0.6356, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}, "blocklist_de": {"n": 4, "p": 0.7971, "hi": 8.84, "lo": 1.90, "ips": 4, "mean": 4.83, "above": true}}, "h2": [["2026-10-05", 33.937, 0.439, 1, false], ["2026-10-12", 35.991, 5.964, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 5.964, "se": 1.004, "ts": 1.000, "map": 21.143, "obs": 3, "own": 49.717, "comp": {"urlhaus": -0.4216, "threatfox": 5.7375, "phishing_db": -0.6384}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 7, "vulncheck": 3, "blocklist_de": 4}, "lo": 35.991, "se": 0.454, "ts": 0.467, "map": 63.292, "obs": 15, "own": 96.949, "comp": {"cins": 1.4213, "dshield": -2.3808, "crowdsec": 2.8151, "vulncheck": 0.557, "blocklist_de": 3.1289}, "mass": 11.5, "listed": false}}, "abq": false, "bot": 0.717, "det": {"shodan": {"c2": 3, "compromised": 13}, "threatfox": {"family:Sliver": 2, "family:AdaptixC2": 1}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"bots": 1, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-DA1371-RIPE", "org": "Florian Kolb", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://datalix.de"}, "pfx": 31, "reg": "2024-01-19", "rir": "ripencc", "s24": 33, "sib": 0, "tor": 10, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 8448, "abuse": "abuse@datalix.de", "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00251202455355}, {"a": 58096, "h": "Elit-TV-AS", "n": "Viter Evgeniy Vasilevich", "t": "Broadband & mobile", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.3701, "hi": 5.82, "lo": 0.76, "ips": 2, "mean": 2.77, "above": false}, "vulncheck": {"n": 1, "p": 0.1920, "hi": 4.67, "lo": 0.35, "ips": 4, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 5.163, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 5.163, "se": 0.690, "ts": 0.500, "map": 13.694, "obs": 4, "own": 21.493, "comp": {"cins": -0.5196, "dshield": 2.709, "crowdsec": 3.3656, "vulncheck": 1.0979, "blocklist_de": -2.6423}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.466, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-VEV1-RIPE", "org": "Viter Evgeniy Vasilevich", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://elit-tv.ru"}, "pfx": 11, "reg": "2016-05-31", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "info@elit-tv.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00108927991095}, {"a": 58212, "h": "DATAFOREST", "n": "Dataforest", "t": "Transit & backbone", "w": 19, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.9754, "hi": 11.46, "lo": 3.47, "ips": 7, "mean": 6.97, "above": true}, "threatfox": {"n": 9, "p": 0.9988, "hi": 15.54, "lo": 5.37, "ips": 15, "mean": 9.90, "above": true}, "vulncheck": {"n": 2, "p": 0.3993, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "phishing_db": {"n": 2, "p": 0.4009, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 0.174, 15.826, 1, false], ["2026-10-12", 0.560, 19.163, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 9, "phishing_db": 2}, "lo": 19.163, "se": 0.761, "ts": 0.818, "map": 42.717, "obs": 11, "own": 134.533, "comp": {"urlhaus": -1.2518, "threatfox": 5.9885, "phishing_db": 0.6441}, "mass": 3.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.560, "se": 0.925, "ts": 1.000, "map": 2.228, "obs": 2, "own": 7.605, "comp": {"cins": -0.2033, "dshield": -0.4549, "crowdsec": -1.7982, "vulncheck": 5.7055, "blocklist_de": -1.0543}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.833, "det": {"shodan": {"compromised": 6, "doublepulsar": 1}, "threatfox": {"family:PureRAT": 15}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}}, "oid": "ORG-HSG23-RIPE", "org": "dataforest GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://dataforest.net"}, "pfx": 69, "reg": "2020-04-14", "rir": "ripencc", "s24": 69, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 17664, "abuse": "abuse@dataforest.net", "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.00455229143235}, {"a": 58215, "h": "Omniline-net-as", "n": "Omniline Investment s.r.o.", "t": "Other", "w": 3, "cc": "CZ", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2021-41773": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 78.899, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.985, "det": {"blocklist_de": {"apache": 1}}, "oid": "ORG-OIS6-RIPE", "org": "Omniline Investment s.r.o.", "pdb": null, "pfx": 1, "reg": "2012-05-29", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008147228614}, {"a": 58224, "h": "TCI", "n": "TCI", "t": "Other", "w": 88, "cc": "IR", "cf": {"rb": "hi", "wb": "hi", "rep": 1.06, "waf": 0.93}, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 17, "proxy_or_vpn": 4, "first_seen_30d": 2, "ssh_bruteforce": 29, "web_bruteforce": 19, "mail_bruteforce": 20, "router_or_botnet": 7, "cve:CVE-2024-6387": 2, "cve:CVE-2026-4020": 2, "cve:CVE-2024-12847": 2, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 37}, "ev": {"cins": {"n": 10, "p": 0.0208, "hi": 2.71, "lo": 0.99, "ips": 10, "mean": 1.76, "above": false}, "shodan": {"n": 1, "p": 0.0000, "hi": 0.17, "lo": 0.01, "ips": 1, "mean": 0.07, "above": false}, "dshield": {"n": 32, "p": 0.9692, "hi": 5.58, "lo": 3.13, "ips": 32, "mean": 4.28, "above": true}, "urlhaus": {"n": 4, "p": 0.2293, "hi": 4.26, "lo": 0.92, "ips": 4, "mean": 2.33, "above": false}, "crowdsec": {"n": 34, "p": 0.0000, "hi": 1.33, "lo": 0.76, "ips": 37, "mean": 1.03, "above": false}, "blocklist_de": {"n": 12, "p": 0.0000, "hi": 1.36, "lo": 0.54, "ips": 14, "mean": 0.91, "above": false}}, "h2": [["2026-10-05", 0.631, 0.549, 0, false], ["2026-10-12", 0.847, 0.303, 0, false]], "sh": false, "uc": 51.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 4, "threatfox": 0, "phishing_db": 0}, "lo": 0.303, "se": 0.979, "ts": 1.000, "map": 0.877, "obs": 4, "own": 0.981, "comp": {"urlhaus": 3.2217, "threatfox": -0.5663, "phishing_db": -1.1601}, "mass": 17.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 10, "dshield": 32, "crowdsec": 34, "vulncheck": 0, "blocklist_de": 12}, "lo": 0.847, "se": 0.374, "ts": 0.386, "map": 1.285, "obs": 88, "own": 0.725, "comp": {"cins": 5.0797, "dshield": 7.0465, "crowdsec": -2.2252, "vulncheck": -1.003, "blocklist_de": -7.2538}, "mass": 88.6, "listed": false}}, "abq": true, "bot": 0.531, "det": {"shodan": {"malware": 1}, "threatfox": {"family:Mirai": 1}, "blocklist_de": {"ssh": 8, "imap": 5, "mail": 6}}, "oid": "ORG-ITCP1-RIPE", "org": "Iran Telecommunication Company PJS", "pdb": null, "pfx": 1190, "reg": "2012-05-29", "rir": "ripencc", "s24": 12433, "sib": 5, "tor": 0, "w24": 82, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3416832, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.069232}, {"a": 58272, "h": "LEADERTELECOMBV-AS", "n": "LeaderTelecom", "t": "Broadband & mobile", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0944, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 1.212, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.751, "ts": null, "map": 0.136, "obs": 0, "own": 0.382, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.921, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LB21-RIPE", "org": "LeaderTelecom B.V.", "pdb": null, "pfx": 150, "reg": "2012-06-12", "rir": "ripencc", "s24": 150, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38400, "abuse": "info@leadertelecom.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58289, "h": "KazNetCom", "n": "KazNetCom", "t": "Broadband & mobile", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3990, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 1.287, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.181, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-KNCL3-RIPE", "org": "Kazakhstan Network Communication LLP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.kaznetcom.kz"}, "pfx": 14, "reg": "2022-10-13", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00074062804571}, {"a": 58329, "h": "SERVINGA-NL", "n": "rackplace", "t": "Hosting & VPS", "w": 5, "cc": "DE", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "phishing_db": {"n": 4, "p": 0.8130, "hi": 9.11, "lo": 1.96, "ips": 4, "mean": 4.98, "above": true}}, "h2": [["2026-10-05", 0.012, 31.793, 1, false], ["2026-10-12", 0.012, 45.454, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 4}, "lo": 45.454, "se": 0.844, "ts": 0.800, "map": 124.111, "obs": 5, "own": 41.119, "comp": {"urlhaus": -0.6256, "threatfox": 1.1149, "phishing_db": 5.958}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.196, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.703, "det": {"threatfox": {"family:Evilginx": 1}}, "oid": "ORG-SG288-RIPE", "org": "servinga GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.servinga.com"}, "pfx": 8, "reg": "2012-06-27", "rir": "ripencc", "s24": 9, "sib": 5, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 2304, "abuse": "abuse@servinga.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 58369, "h": "FIBERNET-AS-ID", "n": "Fiber Networks Indonesia", "t": "Broadband & mobile", "w": 6, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 3, "router_or_botnet": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2025-54236": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1193, "hi": 3.88, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "urlhaus": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.4675, "hi": 6.07, "lo": 1.07, "ips": 3, "mean": 3.13, "above": false}, "blocklist_de": {"n": 2, "p": 0.3526, "hi": 5.66, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}}, "h2": [["2026-10-05", 6.012, 0.414, 0, false], ["2026-10-12", 3.242, 0.441, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.441, "se": 1.543, "ts": 1.000, "map": 4.418, "obs": 1, "own": 13.211, "comp": {"urlhaus": 3.8943, "threatfox": -0.2713, "phishing_db": -0.5111}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.242, "se": 0.609, "ts": 0.600, "map": 7.509, "obs": 5, "own": 11.634, "comp": {"cins": -0.8709, "dshield": -1.523, "crowdsec": 2.9514, "vulncheck": -0.7955, "blocklist_de": 3.6479}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.257, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-58369-APNIC", "org": "PT. Fiber Networks Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://fiber.net.id"}, "pfx": 151, "reg": "2011-08-12", "rir": "apnic", "s24": 104, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59648, "abuse": "abuse@fiber.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0027286856388}, {"a": 58394, "h": "BPK-AS-ID", "n": "Badan Pemeriksa Keuangan", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.917, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-58394-APNIC", "org": "Badan Pemeriksa Keuangan (BPK RI)", "pdb": null, "pfx": 2, "reg": "2011-08-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58396, "h": "DETELNETWORKS-ID", "n": "DETELNET", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.130, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://detelnetworks.id"}, "pfx": 5, "reg": "2011-08-18", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@detelnetworks.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58397, "h": "INFINYS-AS-ID", "n": "PT Infinys System Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1648, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.679, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 0.293, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.847, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-58397-APNIC", "org": "PT Infinys System Indonesia", "pdb": null, "pfx": 39, "reg": "2011-08-18", "rir": "apnic", "s24": 39, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@isi.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58424, "h": "XINWEITELECOM-KH", "n": "Xinwei Telecom Cambodia", "t": "Broadband & mobile", "w": 1, "cc": "KH", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.415, 0.012, 0, false]], "sh": false, "uc": 1035.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.415, "se": 1.349, "ts": 1.000, "map": 3.857, "obs": 1, "own": 7.060, "comp": {"cins": -0.1043, "dshield": -0.2436, "crowdsec": 3.9028, "vulncheck": -0.2666, "blocklist_de": -0.5446}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.204, "det": null, "oid": "ORG-XTCL1-AP-APNIC", "org": "Xinwei (Cambodia) Telecom Co. Ltd", "pdb": {"t": "Non-Profit", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://cootel.com.kh/"}, "pfx": 28, "reg": "2011-09-21", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008009201522}, {"a": 58461, "h": "CT-HangZhou-IDC", "n": "China Telecom Hangzhou IDC Network", "t": "Broadband & mobile", "w": 35, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 5, "first_seen_30d": 3, "ssh_bruteforce": 25, "web_bruteforce": 2, "cve:CVE-2024-6387": 17}, "n": 29}, "ev": {"cins": {"n": 5, "p": 0.6464, "hi": 6.54, "lo": 1.62, "ips": 5, "mean": 3.73, "above": false}, "shodan": {"n": 20, "p": 0.9859, "hi": 7.13, "lo": 3.45, "ips": 20, "mean": 5.15, "above": true}, "dshield": {"n": 2, "p": 0.0993, "hi": 3.54, "lo": 0.46, "ips": 2, "mean": 1.69, "above": false}, "crowdsec": {"n": 26, "p": 0.9979, "hi": 7.47, "lo": 3.95, "ips": 29, "mean": 5.59, "above": true}, "blocklist_de": {"n": 13, "p": 0.9755, "hi": 8.12, "lo": 3.33, "ips": 13, "mean": 5.50, "above": true}}, "h2": [["2026-10-05", 4.011, 0.071, 0, false], ["2026-10-12", 3.995, 0.009, 0, false]], "sh": false, "uc": 64.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.809, "ts": null, "map": 0.118, "obs": 0, "own": 0.565, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 2, "crowdsec": 26, "vulncheck": 0, "blocklist_de": 13}, "lo": 3.995, "se": 0.384, "ts": 0.565, "map": 6.142, "obs": 46, "own": 9.425, "comp": {"cins": 3.7173, "dshield": -2.0861, "crowdsec": 1.7701, "vulncheck": -0.9923, "blocklist_de": 0.7999}, "mass": 48.9, "listed": false}}, "abq": true, "bot": 0.293, "det": {"shodan": {"compromised": 20}, "blocklist_de": {"ssh": 13}}, "oid": null, "org": null, "pdb": null, "pfx": 363, "reg": "2011-12-01", "rir": "apnic", "s24": 1441, "sib": 0, "tor": 0, "w24": 32, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 374528, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00575688939488}, {"a": 58466, "h": "CT-Guangzhou-IDC", "n": "CHINANET Guangdong province network", "t": "Hyperscale cloud", "w": 69, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 11, "data_centre": 4, "web_exploit": 8, "bad_crawling": 4, "ssh_bruteforce": 9, "home_connection": 1, "cve:CVE-2024-6387": 7, "cve:CVE-2022-22947": 1}, "n": 23}, "ev": {"cins": {"n": 27, "p": 1.0000, "hi": 27.19, "lo": 14.53, "ips": 46, "mean": 20.44, "above": true}, "shodan": {"n": 16, "p": 0.9926, "hi": 8.47, "lo": 3.78, "ips": 16, "mean": 5.92, "above": true}, "crowdsec": {"n": 21, "p": 0.9993, "hi": 9.09, "lo": 4.48, "ips": 23, "mean": 6.62, "above": true}, "threatfox": {"n": 1, "p": 0.1465, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "blocklist_de": {"n": 7, "p": 0.7693, "hi": 6.79, "lo": 2.05, "ips": 7, "mean": 4.13, "above": false}}, "h2": [["2026-10-05", 10.715, 0.095, 2, false], ["2026-10-12", 10.152, 0.099, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.099, "se": 1.359, "ts": 1.000, "map": 0.613, "obs": 1, "own": 0.552, "comp": {"urlhaus": -0.3344, "threatfox": 2.0297, "phishing_db": -0.558}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 27, "dshield": 0, "crowdsec": 21, "vulncheck": 0, "blocklist_de": 7}, "lo": 10.152, "se": 0.375, "ts": 0.491, "map": 15.622, "obs": 55, "own": 6.392, "comp": {"cins": 23.3792, "dshield": -3.3298, "crowdsec": -5.1614, "vulncheck": -1.0007, "blocklist_de": -9.7449}, "mass": 75.3, "listed": true}}, "abq": true, "bot": 0.906, "det": {"shodan": {"compromised": 16}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 7}}, "oid": "@family-36574", "org": "CHINANET Guangdong province network", "pdb": null, "pfx": 185, "reg": "2011-12-08", "rir": "apnic", "s24": 875, "sib": 2, "tor": 0, "w24": 39, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 255488, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "cins"], "traffic": 0.00065787596914}, {"a": 58470, "h": "JPL-PK-Peering-AS-PK", "n": "Mobilink Peering", "t": "Broadband & mobile", "w": 15, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "web_bruteforce": 5, "home_connection": 5, "router_or_botnet": 1, "cve:CVE-2019-8318": 2, "cve:CVE-2024-12847": 5}, "n": 5}, "ev": {"dshield": {"n": 5, "p": 0.9126, "hi": 10.40, "lo": 2.58, "ips": 7, "mean": 5.93, "above": true}, "crowdsec": {"n": 3, "p": 0.6098, "hi": 7.34, "lo": 1.29, "ips": 5, "mean": 3.79, "above": false}, "blocklist_de": {"n": 2, "p": 0.4082, "hi": 6.16, "lo": 0.80, "ips": 3, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 5.114, 0.011, 0, false], ["2026-10-12", 36.181, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 36.181, "se": 0.487, "ts": 0.500, "map": 67.407, "obs": 10, "own": 103.216, "comp": {"cins": -1.3629, "dshield": 9.145, "crowdsec": -1.4019, "vulncheck": -0.8815, "blocklist_de": 0.1057}, "mass": 7.8, "listed": false}}, "abq": true, "bot": 0.160, "det": {"blocklist_de": {"bots": 1, "apache": 2, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://jazz.com.pk/"}, "pfx": 21, "reg": "2011-12-13", "rir": "apnic", "s24": 21, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00187354667885}, {"a": 58477, "h": "ARGON-AS-ID", "n": "Argon Data Communication", "t": "Enterprise, edu & gov", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 3, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2022-46604": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 3, "p": 0.6133, "hi": 7.38, "lo": 1.30, "ips": 5, "mean": 3.81, "above": false}}, "h2": [["2026-10-05", 5.275, 0.011, 0, false], ["2026-10-12", 5.574, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 3.245, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.574, "se": 0.782, "ts": 1.000, "map": 17.863, "obs": 3, "own": 101.570, "comp": {"cins": -0.4253, "dshield": -0.8709, "crowdsec": 8.3683, "vulncheck": -0.6201, "blocklist_de": -2.1756}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.955, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-58477-APNIC", "org": "Argon Data Communication", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.argonhost.com/"}, "pfx": 19, "reg": "2011-12-21", "rir": "apnic", "s24": 19, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "support@easyway.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0027009407788}, {"a": 58485, "h": "WIFIAN-AS-ID", "n": "WIFIAN ID", "t": "Broadband & mobile", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 4, "mean": 3.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 19.189, 0.011, 1, false], ["2026-10-12", 21.886, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 21.886, "se": 0.694, "ts": 0.750, "map": 59.373, "obs": 4, "own": 92.029, "comp": {"cins": -0.5735, "dshield": -1.1111, "crowdsec": 6.3659, "vulncheck": -0.6978, "blocklist_de": 1.494}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.296, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-58485-APNIC", "org": "WIFIAN ID", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://wifian.id"}, "pfx": 9, "reg": "2011-12-21", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@wifian.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002546551304}, {"a": 58487, "h": "CRI-AS-AP", "n": "Rumahweb Indonesia", "t": "Other", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 41, "p": 1.0000, "hi": 45.35, "lo": 27.23, "ips": 41, "mean": 35.80, "above": true}, "crowdsec": {"n": 1, "p": 0.1213, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "threatfox": {"n": 1, "p": 0.1936, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.3674, "hi": 5.79, "lo": 0.75, "ips": 3, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.181, 0.308, 0, false], ["2026-10-12", 1.866, 0.320, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.320, "se": 1.473, "ts": 1.000, "map": 2.748, "obs": 1, "own": 3.252, "comp": {"urlhaus": -0.1476, "threatfox": 3.0998, "phishing_db": -0.3152}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.866, "se": 0.757, "ts": 0.667, "map": 5.620, "obs": 3, "own": 3.225, "comp": {"cins": -0.5526, "dshield": -1.0788, "crowdsec": -0.6155, "vulncheck": -0.6884, "blocklist_de": 6.0553}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"c2": 1, "compromised": 40}, "threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-RA56-AP-APNIC", "org": "Rumahweb", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://rumahweb.co.id"}, "pfx": 57, "reg": "2011-12-21", "rir": "apnic", "s24": 81, "sib": 0, "tor": 1, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 28416, "abuse": "abuse@rumahweb.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0004479300936}, {"a": 58492, "h": "UNISSULA-AS-ID", "n": "Universitas Islam Sultan Agung", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.232, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-58492-APNIC", "org": "Universitas Islam Sultan Agung", "pdb": null, "pfx": 6, "reg": "2011-12-21", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@unissula.ac.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58495, "h": "HSPNET-AS-ID", "n": "PT Parsaoran Global Datatrans", "t": "Transit & backbone", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.2915, "hi": 4.83, "lo": 0.85, "ips": 3, "mean": 2.49, "above": false}, "blocklist_de": {"n": 3, "p": 0.4873, "hi": 6.23, "lo": 1.10, "ips": 3, "mean": 3.21, "above": false}}, "h2": [["2026-10-05", 0.623, 0.010, 0, false], ["2026-10-12", 2.110, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.950, "ts": null, "map": 0.172, "obs": 0, "own": 1.525, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.110, "se": 0.568, "ts": 0.500, "map": 4.556, "obs": 6, "own": 14.323, "comp": {"cins": -1.0885, "dshield": -1.7768, "crowdsec": 0.8597, "vulncheck": -0.8409, "blocklist_de": 5.7567}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.138, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-58495-APNIC", "org": "PT Parsaoran Global Datatrans", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://ionnetwork.co.id/"}, "pfx": 293, "reg": "2011-12-21", "rir": "apnic", "s24": 228, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 97024, "abuse": "abuse@ionnetwork.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0093455573002}, {"a": 58503, "h": "PUSATMEDIA-AS-ID", "n": "Pusat Media Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.268, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-58503-APNIC", "org": "PT Pusat Media Indonesia", "pdb": null, "pfx": 2, "reg": "2011-12-21", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58504, "h": "TECHMINDS-NP", "n": "TECHMINDS NETWORKS", "t": "Broadband & mobile", "w": 3, "cc": "NP", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 6.931, 0.012, 0, false]], "sh": false, "uc": 1562.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.931, "se": 0.789, "ts": 0.333, "map": 22.456, "obs": 3, "own": 35.191, "comp": {"cins": -0.4478, "dshield": 2.9986, "crowdsec": 0.2975, "vulncheck": -0.6338, "blocklist_de": 2.2907}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.203, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TNPL2-AP-APNIC", "org": "Techminds Network Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://techminds.com.np"}, "pfx": 16, "reg": "2011-12-22", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "info@techminds.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0025007215758}, {"a": 58519, "h": "CHINATELECOM-Ctcloud", "n": "China Telecom Cloud", "t": "Hyperscale cloud", "w": 53, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 1, "web_exploit": 14, "bad_crawling": 1, "proxy_or_vpn": 20, "first_seen_30d": 7, "ssh_bruteforce": 37, "web_bruteforce": 13, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2024-6387": 31, "cve:CVE-2018-20062": 2}, "n": 49}, "ev": {"cins": {"n": 1, "p": 0.0254, "hi": 2.56, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "shodan": {"n": 24, "p": 0.9790, "hi": 6.37, "lo": 3.28, "ips": 24, "mean": 4.71, "above": true}, "crowdsec": {"n": 44, "p": 1.0000, "hi": 8.90, "lo": 5.44, "ips": 49, "mean": 7.08, "above": true}, "blocklist_de": {"n": 18, "p": 0.9958, "hi": 8.45, "lo": 3.94, "ips": 22, "mean": 6.02, "above": true}}, "h2": [["2026-10-05", 4.322, 0.007, 0, false], ["2026-10-12", 3.528, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.784, "ts": null, "map": 0.106, "obs": 0, "own": 0.142, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 44, "vulncheck": 0, "blocklist_de": 18}, "lo": 3.528, "se": 0.375, "ts": 0.698, "map": 5.465, "obs": 63, "own": 2.243, "comp": {"cins": -2.2702, "dshield": -3.2729, "crowdsec": 7.0141, "vulncheck": -0.997, "blocklist_de": 2.618}, "mass": 60.8, "listed": false}}, "abq": true, "bot": 0.845, "det": {"shodan": {"c2": 1, "compromised": 23}, "blocklist_de": {"ssh": 20, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 260, "reg": "2012-02-03", "rir": "apnic", "s24": 2014, "sib": 0, "tor": 0, "w24": 47, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 564992, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00073075381314}, {"a": 58539, "h": "CHINATELECOM-Hebei-Langfang-IDC", "n": "Langfang,Hebei province, P.R.China", "t": "Broadband & mobile", "w": 35, "cc": "CN", "cf": {"rb": "lo", "wb": "lo", "rep": 2.19, "waf": 1.82}, "cs": {"c": {"http_flood": 33, "web_exploit": 33, "bad_crawling": 10, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 4, "cve:CVE-2025-36604": 1, "cve:CVE-2026-75650": 1}, "n": 34}, "ev": {"dshield": {"n": 1, "p": 0.1633, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 2, "p": 0.1984, "hi": 4.40, "lo": 0.57, "ips": 34, "mean": 2.10, "above": false}}, "h2": [["2026-10-05", 0.423, 0.010, 0, false], ["2026-10-12", 0.889, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.186, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.889, "se": 0.739, "ts": 0.667, "map": 2.592, "obs": 3, "own": 4.062, "comp": {"cins": -0.5146, "dshield": 2.7286, "crowdsec": 3.4202, "vulncheck": -0.6702, "blocklist_de": -2.6178}, "mass": 2.4, "listed": false}}, "abq": true, "bot": 0.995, "det": null, "oid": "@aut-58539-APNIC", "org": "Langfang,Hebei province, P.R.China", "pdb": null, "pfx": 76, "reg": "2012-03-02", "rir": "apnic", "s24": 162, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00559090051598}, {"a": 58541, "h": "CHINATELECOM-SHANDONG-QINGDAO-IDC", "n": "China Telecom Qingdao IDC Network", "t": "Broadband & mobile", "w": 7, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 5, "cve:CVE-2024-6387": 4}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.2579, "hi": 4.61, "lo": 0.81, "ips": 3, "mean": 2.38, "above": false}, "crowdsec": {"n": 5, "p": 0.5201, "hi": 5.68, "lo": 1.41, "ips": 5, "mean": 3.24, "above": false}, "blocklist_de": {"n": 4, "p": 0.6232, "hi": 6.82, "lo": 1.47, "ips": 4, "mean": 3.72, "above": false}}, "h2": [["2026-10-05", 1.986, 0.010, 0, false], ["2026-10-12", 2.599, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 0.964, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.599, "se": 0.502, "ts": 0.556, "map": 4.989, "obs": 9, "own": 7.692, "comp": {"cins": -1.4794, "dshield": -2.157, "crowdsec": 1.8386, "vulncheck": -0.895, "blocklist_de": 5.6936}, "mass": 8.9, "listed": false}}, "abq": true, "bot": 0.695, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 4}}, "oid": "@aut-58541-APNIC", "org": "Qingdao,266000", "pdb": null, "pfx": 54, "reg": "2012-03-02", "rir": "apnic", "s24": 320, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 90112, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001469063908}, {"a": 58542, "h": "CHINATELECOM-TIANJIN", "n": "China Telecom Tianjin Province IDC Network", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.0725, "hi": 3.27, "lo": 0.42, "ips": 2, "mean": 1.56, "above": false}, "crowdsec": {"n": 1, "p": 0.0117, "hi": 2.20, "lo": 0.17, "ips": 1, "mean": 0.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.0666, "hi": 3.24, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}}, "h2": [["2026-10-05", 0.867, 0.009, 0, false], ["2026-10-12", 0.212, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.902, "ts": null, "map": 0.156, "obs": 0, "own": 0.872, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.212, "se": 0.854, "ts": 0.500, "map": 0.770, "obs": 2, "own": 1.227, "comp": {"cins": -0.4195, "dshield": -0.8608, "crowdsec": 0.5572, "vulncheck": -0.6164, "blocklist_de": 2.4719}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.614, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 65, "reg": "2012-03-02", "rir": "apnic", "s24": 434, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 115968, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00065716636908}, {"a": 58563, "h": "CHINATELECOM-Hubei-IDC", "n": "China Telecom Hubei Province Network", "t": "Broadband & mobile", "w": 10, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 6, "cve:CVE-2018-20062": 1}, "n": 9}, "ev": {"cins": {"n": 2, "p": 0.2706, "hi": 4.98, "lo": 0.65, "ips": 2, "mean": 2.37, "above": false}, "shodan": {"n": 16, "p": 0.9991, "hi": 10.43, "lo": 4.65, "ips": 16, "mean": 7.29, "above": true}, "dshield": {"n": 1, "p": 0.0910, "hi": 3.55, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}, "crowdsec": {"n": 8, "p": 0.5971, "hi": 5.44, "lo": 1.77, "ips": 9, "mean": 3.39, "above": false}, "blocklist_de": {"n": 6, "p": 0.7618, "hi": 7.10, "lo": 1.97, "ips": 7, "mean": 4.20, "above": false}}, "h2": [["2026-10-05", 1.794, 0.009, 0, false], ["2026-10-12", 3.140, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.874, "ts": null, "map": 0.146, "obs": 0, "own": 0.770, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 6}, "lo": 3.140, "se": 0.436, "ts": 0.471, "map": 5.306, "obs": 17, "own": 8.158, "comp": {"cins": 2.9094, "dshield": -1.4478, "crowdsec": -0.6133, "vulncheck": -0.954, "blocklist_de": 3.1682}, "mass": 18.3, "listed": false}}, "abq": true, "bot": 0.785, "det": {"shodan": {"compromised": 16}, "blocklist_de": {"ssh": 7}}, "oid": "@aut-58563-APNIC", "org": "CHINANET Hubei province network", "pdb": null, "pfx": 170, "reg": "2012-03-23", "rir": "apnic", "s24": 623, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 181248, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00053273703964}, {"a": 58580, "h": "Fastrack", "n": "Fastrack Technology", "t": "Transit & backbone", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 20, "p": 1.0000, "hi": 27.31, "lo": 13.22, "ips": 20, "mean": 19.74, "above": true}}, "h2": [["2026-10-05", 0.011, 0.454, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 2.522, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 1.851, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.399, "det": {"shodan": {"c2": 20}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.fastracktechnology.com.au"}, "pfx": 30, "reg": "2012-04-12", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 9984, "abuse": "noc@ftpl.com.au", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 58593, "h": "BLUECLOUD", "n": "Microsoft Azure China (Shanghai Blue Cloud)", "t": "Hosting & VPS", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.64, "lo": 0.05, "ips": 1, "mean": 0.27, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.53, "lo": 0.04, "ips": 1, "mean": 0.22, "above": false}}, "h2": [["2026-10-05", 0.040, 0.007, 0, false], ["2026-10-12", 0.016, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.754, "ts": null, "map": 0.093, "obs": 0, "own": 0.065, "comp": null, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.016, "se": 0.991, "ts": 1.000, "map": 0.076, "obs": 1, "own": 0.016, "comp": {"cins": -0.2944, "dshield": -0.6347, "crowdsec": 1.7786, "vulncheck": -0.5204, "blocklist_de": -1.5184}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.660, "det": {"shodan": {"c2": 1}}, "oid": "@aut-58593-APNIC", "org": "Shanghai Blue Cloud Technology Co.,Ltd", "pdb": null, "pfx": 37, "reg": "2012-05-04", "rir": "apnic", "s24": 3012, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1165312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039474859554}, {"a": 58604, "h": "PACKETWORX-PH", "n": "PACKETWORX INC.", "t": "Other", "w": 0, "cc": "PH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.986, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BOI1-AP-APNIC", "org": "PACKETWORX INC.", "pdb": null, "pfx": 2, "reg": "2012-05-16", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@packetworx.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58677, "h": "DOFAIMPNET-PH", "n": "DOF Bldg., BSP Complex", "t": "Other", "w": 0, "cc": "PH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.119, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DOF4-AP-APNIC", "org": "Department of Finance", "pdb": null, "pfx": 1, "reg": "2012-08-09", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58678, "h": "INTECHONLINE-IN", "n": "Intech Online Private Limited", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2024-4577": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0935, "hi": 3.58, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "crowdsec": {"n": 2, "p": 0.2087, "hi": 4.48, "lo": 0.58, "ips": 2, "mean": 2.14, "above": false}, "blocklist_de": {"n": 1, "p": 0.1371, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 2.108, 0.010, 0, false], ["2026-10-12", 0.993, 0.011, 0, false]], "sh": false, "uc": 231.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.978, "ts": null, "map": 0.179, "obs": 0, "own": 1.208, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.993, "se": 0.743, "ts": 0.667, "map": 2.946, "obs": 3, "own": 4.621, "comp": {"cins": -0.5447, "dshield": -1.0664, "crowdsec": 3.0944, "vulncheck": -0.6847, "blocklist_de": 1.6756}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.157, "det": {"shodan": {"malware": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-58678-APNIC", "org": "Intech Online Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.intechonline.net"}, "pfx": 151, "reg": "2012-08-10", "rir": "apnic", "s24": 152, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38912, "abuse": "info@intechonline.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00457092528483}, {"a": 58682, "h": "LEVEL3-BD", "n": "Level3 Carrier", "t": "Broadband & mobile", "w": 8, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 3, "proxy_or_vpn": 5, "ssh_bruteforce": 5, "web_bruteforce": 7, "home_connection": 6, "mail_bruteforce": 2, "router_or_botnet": 6, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"crowdsec": {"n": 3, "p": 0.6133, "hi": 7.38, "lo": 1.30, "ips": 7, "mean": 3.81, "above": false}, "blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 9.321, 0.011, 0, false], ["2026-10-12", 10.090, 0.012, 1, false]], "sh": false, "uc": 3885.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 10.090, "se": 0.683, "ts": 0.750, "map": 26.838, "obs": 4, "own": 41.643, "comp": {"cins": -0.6099, "dshield": -1.1662, "crowdsec": 5.9073, "vulncheck": -0.7131, "blocklist_de": 1.2654}, "mass": 2.8, "listed": false}}, "abq": true, "bot": 0.200, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-LCL1-AP-APNIC", "org": "LEVEL3 CARRIER LIMITED", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.level3carrier.com/"}, "pfx": 19, "reg": "2012-08-16", "rir": "apnic", "s24": 19, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00291489380418}, {"a": 58689, "h": "ICCNET-DHK-BD", "n": "ICC Communication", "t": "Broadband & mobile", "w": 15, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 4, "ssh_bruteforce": 5, "web_bruteforce": 2, "router_or_botnet": 4}, "n": 7}, "ev": {"cins": {"n": 2, "p": 0.4153, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "crowdsec": {"n": 4, "p": 0.7765, "hi": 8.52, "lo": 1.83, "ips": 7, "mean": 4.65, "above": false}, "vulncheck": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 5, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 19.767, 0.011, 1, false], ["2026-10-12", 20.147, 0.012, 1, false]], "sh": false, "uc": 2553, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 20.147, "se": 0.533, "ts": 0.500, "map": 41.009, "obs": 8, "own": 63.216, "comp": {"cins": 6.5478, "dshield": -1.8666, "crowdsec": 2.5916, "vulncheck": -0.023, "blocklist_de": -2.1424}, "mass": 6.4, "listed": false}}, "abq": true, "bot": 0.201, "det": {"vulncheck": {"botnet_node": 5}, "blocklist_de": {"bots": 1}}, "oid": "ORG-IC1-AP-APNIC", "org": "ICC Communication", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.icc.com.bd/"}, "pfx": 28, "reg": "2012-08-28", "rir": "apnic", "s24": 28, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00676022620799}, {"a": 58697, "h": "THREESPARK-NET-AF", "n": "G/38 Qala e Mosa Shaheed Square ,", "t": "Other", "w": 2, "cc": "AF", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 5.536, 0.013, 0, false]], "sh": false, "uc": 8854.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 16.699, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.191, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 5, "reg": "2012-09-05", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "noc@vitaltelecom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000972886176}, {"a": 58715, "h": "EARTHTELECOMMUNICATION-AS", "n": "Earth Telecommunication", "t": "Broadband & mobile", "w": 7, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "proxy_or_vpn": 4, "web_bruteforce": 4, "home_connection": 3, "router_or_botnet": 5}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.7664, "hi": 8.37, "lo": 1.80, "ips": 5, "mean": 4.57, "above": false}, "blocklist_de": {"n": 2, "p": 0.3985, "hi": 6.07, "lo": 0.79, "ips": 3, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 10.605, 0.011, 1, false], ["2026-10-12", 11.425, 0.012, 1, false]], "sh": false, "uc": 268.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 1.721, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 11.425, "se": 0.575, "ts": 0.667, "map": 24.975, "obs": 6, "own": 38.502, "comp": {"cins": -0.9527, "dshield": -1.6225, "crowdsec": 4.9563, "vulncheck": -0.8144, "blocklist_de": 3.0448}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.223, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-ETPL4-AP-APNIC", "org": "Earth Telecommunication ( pvt ) Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.earth.net.bd"}, "pfx": 106, "reg": "2012-10-03", "rir": "apnic", "s24": 35, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 83712, "abuse": "info@earth.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00139793153961}, {"a": 58717, "h": "SUMMITCOMMUNICATIONS-BD", "n": "Summit Communications Limited AS58717", "t": "Broadband & mobile", "w": 8, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 7, "proxy_or_vpn": 6, "web_bruteforce": 6, "home_connection": 6, "mail_bruteforce": 1, "router_or_botnet": 8, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"crowdsec": {"n": 6, "p": 0.9450, "hi": 10.58, "lo": 2.93, "ips": 8, "mean": 6.25, "above": true}}, "h2": [["2026-10-05", 5.849, 0.011, 0, false], ["2026-10-12", 8.090, 0.012, 0, false]], "sh": false, "uc": 1265.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 1.634, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.090, "se": 0.571, "ts": 1.000, "map": 17.451, "obs": 6, "own": 26.902, "comp": {"cins": -0.8748, "dshield": -1.5278, "crowdsec": 11.8048, "vulncheck": -0.7965, "blocklist_de": -4.3526}, "mass": 4.4, "listed": false}}, "abq": true, "bot": 0.184, "det": null, "oid": "ORG-SCL5-AP-APNIC", "org": "Summit Communications Limited", "pdb": {"t": null, "sc": "Global", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.summitcommunications.net/"}, "pfx": 56, "reg": "2012-10-10", "rir": "apnic", "s24": 45, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21504, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00357785591574}, {"a": 58731, "h": "TELINTLSA-AS", "n": "Telkomcel", "t": "Broadband & mobile", "w": 0, "cc": "TL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1171.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.128, "det": null, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.telkomcel.tl"}, "pfx": 18, "reg": "2012-11-02", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050409737856}, {"a": 58772, "h": "ChinaNet-Fujian-Fuzhou-IDC", "n": "CHINANET Fujian province Fuzhou IDC network", "t": "Other", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "shodan": {"n": 3, "p": 0.5353, "hi": 6.63, "lo": 1.17, "ips": 3, "mean": 3.42, "above": false}, "crowdsec": {"n": 1, "p": 0.1228, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.742, 0.011, 0, false], ["2026-10-12", 0.850, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.579, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.850, "se": 0.913, "ts": 0.500, "map": 3.448, "obs": 2, "own": 2.023, "comp": {"cins": 4.4785, "dshield": -0.7341, "crowdsec": 1.241, "vulncheck": -0.5658, "blocklist_de": -1.7881}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.558, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-58772-APNIC", "org": "CHINANET Fujian province Fuzhou IDC network", "pdb": null, "pfx": 11, "reg": "2012-12-14", "rir": "apnic", "s24": 79, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 22016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000142878931}, {"a": 58791, "h": "GMO-I-R2", "n": "GMO Internet West", "t": "Broadband & mobile", "w": 14, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 4, "bad_crawling": 1, "ssh_bruteforce": 8, "web_bruteforce": 4, "home_connection": 8, "mail_bruteforce": 2, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 10}, "ev": {"shodan": {"n": 7, "p": 0.8480, "hi": 7.63, "lo": 2.31, "ips": 7, "mean": 4.64, "above": true}, "dshield": {"n": 1, "p": 0.1308, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 8, "p": 0.8763, "hi": 7.59, "lo": 2.47, "ips": 10, "mean": 4.73, "above": true}, "vulncheck": {"n": 1, "p": 0.1324, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 4, "p": 0.6113, "hi": 6.71, "lo": 1.45, "ips": 5, "mean": 3.67, "above": false}}, "h2": [["2026-10-05", 2.072, 0.010, 0, false], ["2026-10-12", 3.723, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.921, "ts": null, "map": 0.163, "obs": 0, "own": 0.947, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 4}, "lo": 3.723, "se": 0.455, "ts": 0.571, "map": 6.558, "obs": 14, "own": 10.091, "comp": {"cins": -1.8234, "dshield": -0.7419, "crowdsec": 3.7797, "vulncheck": -0.4607, "blocklist_de": 2.5207}, "mass": 12.3, "listed": false}}, "abq": false, "bot": 0.727, "det": {"shodan": {"compromised": 6, "doublepulsar": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 5}}, "oid": "@family-41747", "org": "GMO Internet, Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "https://internet.gmo"}, "pfx": 181, "reg": "2012-12-27", "rir": "apnic", "s24": 339, "sib": 5, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 128512, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00231285212795}, {"a": 58800, "h": "ACENET-BD", "n": "ACE IT Networks", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 22500, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.526, "det": null, "oid": "ORG-AINL1-AP-APNIC", "org": "ACE IT Networks Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.ace.net.bd"}, "pfx": 5, "reg": "2013-01-10", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58821, "h": "IDNIC-LJN-AS-ID", "n": "Lintas Jaringan Nusantara", "t": "Broadband & mobile", "w": 6, "cc": "ID", "cf": {"rb": "lo", "wb": null, "rep": 2.47, "waf": null}, "cs": {"c": {"http_flood": 4, "web_exploit": 2, "bad_crawling": 4, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 1, "router_or_botnet": 5, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.7635, "hi": 8.33, "lo": 1.79, "ips": 5, "mean": 4.55, "above": false}, "blocklist_de": {"n": 2, "p": 0.3971, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 9.149, 0.011, 0, false], ["2026-10-12", 10.940, 0.012, 1, false]], "sh": false, "uc": 1573.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 1.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 10.940, "se": 0.574, "ts": 0.667, "map": 23.702, "obs": 6, "own": 36.545, "comp": {"cins": -0.9551, "dshield": -1.6254, "crowdsec": 4.928, "vulncheck": -0.8149, "blocklist_de": 3.0267}, "mass": 4.9, "listed": false}}, "abq": true, "bot": 0.264, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-149725-APNIC", "org": "PT Lintas Jaringan Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://lintas.net.id"}, "pfx": 40, "reg": "2013-03-01", "rir": "apnic", "s24": 37, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0097560318328}, {"a": 58826, "h": "ICOMBANGLADESHLTD-BD", "n": "ping by ICOM Bangladesh", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.427, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IBL2-AP-APNIC", "org": "ICOM Bangladesh Ltd", "pdb": null, "pfx": 8, "reg": "2013-03-06", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58854, "h": "kaopy", "n": "Kaopu Cloud", "t": "Hosting & VPS", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "cve:CVE-2024-6387": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3800, "hi": 5.90, "lo": 0.77, "ips": 3, "mean": 2.81, "above": false}, "blocklist_de": {"n": 2, "p": 0.4054, "hi": 6.13, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 7.672, 0.011, 0, false], ["2026-10-12", 8.497, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.283, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.497, "se": 0.681, "ts": 0.500, "map": 22.377, "obs": 4, "own": 4.428, "comp": {"cins": -0.6604, "dshield": -1.2403, "crowdsec": 1.9051, "vulncheck": -0.7325, "blocklist_de": 5.2297}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.862, "det": {"blocklist_de": {"ssh": 3}}, "oid": "@aut-58854-APNIC", "org": "Kaopu Cloud", "pdb": null, "pfx": 11, "reg": "2013-03-06", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58895, "h": "EBONE1-PK", "n": "Ebone Network", "t": "Broadband & mobile", "w": 11, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2025-22457": 2, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.7499, "hi": 7.47, "lo": 1.86, "ips": 5, "mean": 4.27, "above": false}, "vulncheck": {"n": 1, "p": 0.1660, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 7, "p": 0.9736, "hi": 11.30, "lo": 3.42, "ips": 7, "mean": 6.87, "above": true}}, "h2": [["2026-10-05", 5.456, 0.010, 0, false], ["2026-10-12", 8.494, 0.011, 0, false]], "sh": false, "uc": 403.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.978, "ts": null, "map": 0.178, "obs": 0, "own": 1.206, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 7}, "lo": 8.494, "se": 0.462, "ts": 0.538, "map": 15.040, "obs": 13, "own": 23.082, "comp": {"cins": -1.8607, "dshield": -2.4571, "crowdsec": -1.4734, "vulncheck": -0.4779, "blocklist_de": 10.3735}, "mass": 12.7, "listed": false}}, "abq": false, "bot": 0.158, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 4, "imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ENL3-AP-APNIC", "org": "E Bone Network (Pvt.) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.ebonenet.com/"}, "pfx": 158, "reg": "2013-04-15", "rir": "apnic", "s24": 153, "sib": 1, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 48640, "abuse": "abuse@ebonenet.com", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00450315833781}, {"a": 58898, "h": "RAINBOWISP-AS", "n": "Rainbow Communications India", "t": "Broadband & mobile", "w": 17, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 10, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 13, "home_connection": 4, "mail_bruteforce": 4, "router_or_botnet": 2}, "n": 14}, "ev": {"crowdsec": {"n": 8, "p": 0.9926, "hi": 12.99, "lo": 4.22, "ips": 14, "mean": 8.10, "above": true}, "vulncheck": {"n": 2, "p": 0.4085, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "blocklist_de": {"n": 2, "p": 0.3936, "hi": 6.02, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 13.814, 0.011, 1, false], ["2026-10-12", 19.794, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 1.658, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 2, "blocklist_de": 2}, "lo": 19.794, "se": 0.474, "ts": 0.667, "map": 36.421, "obs": 12, "own": 55.918, "comp": {"cins": -1.4375, "dshield": -2.1202, "crowdsec": 8.5496, "vulncheck": 0.4103, "blocklist_de": -0.4133}, "mass": 8.5, "listed": false}}, "abq": true, "bot": 0.264, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "@aut-58898-APNIC", "org": "Rainbow communications India Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://rainbowisp.in"}, "pfx": 57, "reg": "2013-04-17", "rir": "apnic", "s24": 42, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00084991591515}, {"a": 58906, "h": "SIPL-AS", "n": "Shivansh Infotech", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 1.421, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.107, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-58906-APNIC", "org": "Shivansh Infotech pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.shivanshinfotech.in"}, "pfx": 11, "reg": "2013-04-17", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081512762187}, {"a": 58910, "h": "ASSB-AS-MY", "n": "ACODA", "t": "Broadband & mobile", "w": 0, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 1.539, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.270, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ASSB2-AP-APNIC", "org": "Acoda Solutions (M) Sdn. Bhd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.acoda.my"}, "pfx": 13, "reg": "2013-04-24", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@acoda.my", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58912, "h": "CTSL-BD", "n": "Chittagong Telecom Services", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CTSL1-AP-APNIC", "org": "Chittagong Telecom Services Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.ctgtel.net"}, "pfx": 8, "reg": "2013-04-29", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "info@ctgtel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00059434638091}, {"a": 58923, "h": "INTERCLOUDLTD-AS-AP", "n": "InterCloud BD", "t": "Hosting & VPS", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1612, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.308, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.308, "se": 1.295, "ts": 1.000, "map": 2.591, "obs": 1, "own": 0.589, "comp": {"cins": -0.1222, "dshield": -0.2831, "crowdsec": 3.6878, "vulncheck": -0.2996, "blocklist_de": -0.637}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-IL5-AP-APNIC", "org": "InterCloud ltd", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.intercloud.com.bd"}, "pfx": 33, "reg": "2013-05-10", "rir": "apnic", "s24": 35, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": "abuse@intercloud.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026621045089}, {"a": 58946, "h": "GRAMEEN1-AS-AP", "n": "GRAMEEN COMMUNICATIONS", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 37.556, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 10937.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.228, "det": {"blocklist_de": {"ssh": 3}}, "oid": "ORG-GC2-AP-APNIC", "org": "GRAMEEN COMMUNICATIONS", "pdb": null, "pfx": 2, "reg": "2013-06-20", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58952, "h": "FRONTIIRCOLTD-MM", "n": "Frontiir", "t": "Transit & backbone", "w": 2, "cc": "MM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "dshield": {"n": 2, "p": 0.4117, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 1.590, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 2.491, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.590, "se": 0.944, "ts": 1.000, "map": 6.897, "obs": 2, "own": 22.465, "comp": {"cins": -0.2861, "dshield": 8.0427, "crowdsec": -2.4428, "vulncheck": -0.5126, "blocklist_de": -1.4764}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.331, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FCL5-AP-APNIC", "org": "Frontiir Co., Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.frontiir.com"}, "pfx": 37, "reg": "2013-07-02", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "abuse@frontiir.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00503069275296}, {"a": 58955, "h": "BANGMODENTERPRISE-TH", "n": "Bangmod Enterprise", "t": "Hosting & VPS", "w": 2, "cc": "TH", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 10, "p": 0.9993, "hi": 15.15, "lo": 5.51, "ips": 10, "mean": 9.82, "above": true}, "crowdsec": {"n": 1, "p": 0.1416, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "blocklist_de": {"n": 2, "p": 0.3841, "hi": 5.94, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 0.231, 0.011, 0, false], ["2026-10-12", 2.541, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.241, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.541, "se": 0.765, "ts": 0.667, "map": 7.839, "obs": 3, "own": 1.566, "comp": {"cins": -0.5352, "dshield": -1.0516, "crowdsec": -0.4694, "vulncheck": -0.6803, "blocklist_de": 6.1893}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.330, "det": {"shodan": {"c2": 1, "compromised": 9}, "blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-BECL1-AP-APNIC", "org": "Bangmod Enterprise Co., Ltd.", "pdb": {"t": "Content", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://bangmod.cloud"}, "pfx": 55, "reg": "2013-07-09", "rir": "apnic", "s24": 56, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 14592, "abuse": "abuse@bangmod.cloud", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00170913452184}, {"a": 58963, "h": "INFONET-AS-IN", "n": "Infonet online solutions", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.732, 0.011, 0, false], ["2026-10-12", 0.812, 0.013, 0, false]], "sh": false, "uc": 17421.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.812, "se": 1.514, "ts": 1.000, "map": 10.069, "obs": 1, "own": 7.565, "comp": {"cins": -0.0687, "dshield": -0.1629, "crowdsec": -0.6454, "vulncheck": -0.1914, "blocklist_de": 4.7715}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.129, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-58963-APNIC", "org": "Infonet online solutions private limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.infonetonline.in"}, "pfx": 5, "reg": "2013-07-22", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@info-net.co.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 58965, "h": "ABSPL-AS-IN", "n": "ANJANI BROADBAND SOLUTIONS", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1535, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-12", 0.274, 0.012, 0, false]], "sh": false, "uc": 563.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 1.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.274, "se": 1.276, "ts": 1.000, "map": 2.230, "obs": 1, "own": 3.944, "comp": {"cins": -0.129, "dshield": -0.298, "crowdsec": 3.6067, "vulncheck": -0.3116, "blocklist_de": -0.6723}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.194, "det": null, "oid": "@aut-58965-APNIC", "org": "ANJANI BROADBAND SOLUTIONS PVT.LTD.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.zeonet.co.in"}, "pfx": 29, "reg": "2013-07-22", "rir": "apnic", "s24": 43, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00359094352317}, {"a": 59019, "h": "BJKSCNET", "n": "Beijing Kingsoft Cloud Internet Technology", "t": "Hosting & VPS", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.1855, "hi": 4.30, "lo": 0.56, "ips": 2, "mean": 2.05, "above": false}, "blocklist_de": {"n": 1, "p": 0.1161, "hi": 3.85, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.381, 0.010, 0, false], ["2026-10-12", 0.109, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 0.168, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.109, "se": 1.153, "ts": 1.000, "map": 0.698, "obs": 1, "own": 0.151, "comp": {"cins": -0.2014, "dshield": -0.4511, "crowdsec": -1.7831, "vulncheck": -0.4192, "blocklist_de": 3.8894}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.916, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-59019-APNIC", "org": "Beijing Kingsoft Cloud Internet Technology Co., Ltd", "pdb": null, "pfx": 37, "reg": "2013-09-09", "rir": "apnic", "s24": 218, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 123392, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040928580758}, {"a": 59134, "h": "IDNIC-DATACOMM-AS-ID", "n": "PT Datacomm Diangraha", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3696, "hi": 5.81, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}}, "h2": [["2026-10-05", 0.273, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.679, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.924, "ts": null, "map": 0.197, "obs": 0, "own": 0.293, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.750, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-59134-APNIC", "org": "PT. Datacomm Diangraha", "pdb": null, "pfx": 28, "reg": "2013-09-09", "rir": "apnic", "s24": 39, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": "abuse@datacomm.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59135, "h": "IDNIC-SDK-AS-ID", "n": "PT Suraloka Digital Kreatif", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.975, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-59135-APNIC", "org": "PT Suraloka Digital Kreatif", "pdb": null, "pfx": 3, "reg": "2013-09-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@suraloka.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59139, "h": "WIFIKU-AS-ID", "n": "PT. Wifiku Indonesia", "t": "Transit & backbone", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.534, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.934, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 20.941, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-59139-APNIC", "org": "PT Wifiku Indonesia", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.wifiku.net.id"}, "pfx": 19, "reg": "2013-09-09", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@wifiku.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59147, "h": "IDNIC-DRUPADI-AS-ID", "n": "Drupadi Prima", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9632, "hi": 11.59, "lo": 3.22, "ips": 6, "mean": 6.85, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.641, "det": {"shodan": {"compromised": 6}}, "oid": "@aut-59147-APNIC", "org": "PT. Drupadi Prima", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.drupadi.com"}, "pfx": 3, "reg": "2013-09-09", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": "abuse@drupadi.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 59149, "h": "TUJUHDELAPANSEMBILANNET-AS-ID", "n": "TUJUH DELAPAN SEMBILAN NET", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 5.568, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-59149-APNIC", "org": "PT. TUJUH DELAPAN SEMBILAN NET", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://jatayu.id"}, "pfx": 7, "reg": "2013-09-09", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "hostmaster@jatayu.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59151, "h": "IDNIC-JOGJAPROV-AS-ID", "n": "Diskominfo DIY", "t": "Other", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 4, "first_seen_30d": 1, "web_bruteforce": 4, "router_or_botnet": 4, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.185, "det": null, "oid": "@aut-59151-APNIC", "org": "Diskominfo DIY", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://jogjaprov.go.id"}, "pfx": 5, "reg": "2013-09-09", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004469696946}, {"a": 59162, "h": "UPCSPL-AS-IN", "n": "U.P.Communication Services", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3674, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 4.297, 0.011, 0, false], ["2026-10-12", 0.888, 0.012, 0, false]], "sh": false, "uc": 1089.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 1.427, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.888, "se": 0.915, "ts": 1.000, "map": 3.610, "obs": 2, "own": 5.781, "comp": {"cins": -0.3713, "dshield": -0.7764, "crowdsec": -3.0602, "vulncheck": -0.5835, "blocklist_de": 7.4687}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.151, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-59162-APNIC", "org": "U.P. COMMUNICATION SERVICES PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.upcspl.in"}, "pfx": 81, "reg": "2013-09-09", "rir": "apnic", "s24": 81, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004632864057}, {"a": 59165, "h": "AUSPICE-AS", "n": "Auspice Infratel", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"home_connection": 3, "mail_bruteforce": 3, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 3, "mean": 1.89, "above": false}, "blocklist_de": {"n": 4, "p": 0.8038, "hi": 8.95, "lo": 1.93, "ips": 6, "mean": 4.89, "above": true}}, "h2": [["2026-10-05", 23.494, 0.011, 1, false], ["2026-10-12", 16.037, 0.012, 1, false]], "sh": false, "uc": 3627.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 16.037, "se": 0.621, "ts": 0.800, "map": 38.325, "obs": 5, "own": 59.116, "comp": {"cins": -0.8923, "dshield": -1.5494, "crowdsec": -3.1327, "vulncheck": -0.8007, "blocklist_de": 11.4149}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.203, "det": {"blocklist_de": {"imap": 6, "mail": 6}}, "oid": "@aut-59165-APNIC", "org": "Auspice Infratel Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.auspice.in"}, "pfx": 6, "reg": "2013-09-09", "rir": "apnic", "s24": 21, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "support@auspice.in", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 59169, "h": "KNDG-AS", "n": "KNGD INFOSYS", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 12207, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.257, "det": null, "oid": "@aut-59169-APNIC", "org": "KNGD INFOSYS PVT LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.kngd.co.in"}, "pfx": 8, "reg": "2013-09-09", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59187, "h": "NEEVAI-AS-IN", "n": "NEEVCLOUD.COM", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 3.545, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 1.501, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.990, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-59187-APNIC", "org": "NEEVAI SUPERCLOUD PVT LTD", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://neevcloud.com"}, "pfx": 10, "reg": "2013-09-09", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "admin@neevcloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59211, "h": "ONEASIAHOST", "n": "OneAsiaHost", "t": "Hosting & VPS", "w": 1, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 1.763, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.439, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": "2013-10-15", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@oneasiahost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049317740459}, {"a": 59223, "h": "CT-Qinghai-IDC", "n": "CHINANET Qinghai province IDC network", "t": "Other", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "blocklist_de": {"n": 1, "p": 0.1786, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.262, 0.011, 0, false], ["2026-10-12", 0.282, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 0.659, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.282, "se": 1.282, "ts": 1.000, "map": 2.316, "obs": 1, "own": 1.506, "comp": {"cins": -0.1398, "dshield": -0.3215, "crowdsec": -1.2722, "vulncheck": -0.3298, "blocklist_de": 4.2967}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.756, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 28, "reg": "2013-11-05", "rir": "apnic", "s24": 45, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003820333296}, {"a": 59253, "h": "LEASEWEB-APAC-SIN-11", "n": "Leaseweb Singapore", "t": "Hosting & VPS", "w": 10, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"shodan": {"n": 6, "p": 0.8734, "hi": 8.57, "lo": 2.38, "ips": 6, "mean": 5.06, "above": true}, "crowdsec": {"n": 4, "p": 0.5460, "hi": 6.20, "lo": 1.34, "ips": 4, "mean": 3.39, "above": false}, "vulncheck": {"n": 4, "p": 0.7659, "hi": 8.37, "lo": 1.80, "ips": 4, "mean": 4.57, "above": false}, "phishing_db": {"n": 2, "p": 0.3670, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 1.949, 0.882, 0, false], ["2026-10-12", 2.126, 0.902, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.902, "se": 1.140, "ts": 1.000, "map": 3.936, "obs": 2, "own": 1.582, "comp": {"urlhaus": -0.4252, "threatfox": -0.3346, "phishing_db": 3.7562}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 4, "blocklist_de": 0}, "lo": 2.126, "se": 0.548, "ts": 0.500, "map": 4.383, "obs": 8, "own": 0.873, "comp": {"cins": -0.8742, "dshield": -1.5271, "crowdsec": 5.883, "vulncheck": 3.7396, "blocklist_de": -4.3498}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.928, "det": {"shodan": {"c2": 4, "compromised": 2}, "vulncheck": {"c2_server": 2, "botnet_node": 1, "attack_tooling": 1}}, "oid": "ORG-LAPP1-AP-APNIC", "org": "LEASEWEB SINGAPORE PTE. LTD.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.leaseweb.com/"}, "pfx": 92, "reg": "2013-12-09", "rir": "apnic", "s24": 179, "sib": 0, "tor": 1, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 58624, "abuse": "abuse@sg.leaseweb.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.01972807519373}, {"a": 59257, "h": "CMPAKLIMITED-AS-AP", "n": "CMPak", "t": "Other", "w": 41, "cc": "PK", "cf": {"rb": "hi", "wb": "hi", "rep": 1.39, "waf": 1.22}, "cs": {"c": {"http_flood": 17, "web_exploit": 32, "bad_crawling": 3, "ssh_bruteforce": 6, "web_bruteforce": 24, "router_or_botnet": 11, "cve:CVE-2017-9841": 6, "cve:CVE-2019-9082": 6, "cve:CVE-2018-10562": 11, "cve:CVE-2018-20062": 6, "cve:CVE-2024-12847": 26}, "n": 32}, "ev": {"dshield": {"n": 3, "p": 0.5822, "hi": 7.07, "lo": 1.25, "ips": 3, "mean": 3.65, "above": false}, "crowdsec": {"n": 6, "p": 0.8393, "hi": 8.01, "lo": 2.22, "ips": 32, "mean": 4.73, "above": true}, "blocklist_de": {"n": 7, "p": 0.9701, "hi": 11.02, "lo": 3.34, "ips": 7, "mean": 6.71, "above": true}}, "h2": [["2026-10-05", 6.594, 0.010, 0, false], ["2026-10-12", 9.185, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.967, "ts": null, "map": 0.176, "obs": 0, "own": 0.464, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 7}, "lo": 9.185, "se": 0.438, "ts": 0.438, "map": 15.860, "obs": 16, "own": 8.897, "comp": {"cins": -2.0983, "dshield": 1.6307, "crowdsec": -1.8481, "vulncheck": -0.9448, "blocklist_de": 7.4179}, "mass": 15.7, "listed": false}}, "abq": true, "bot": 0.071, "det": {"blocklist_de": {"bots": 6, "apache": 1}}, "oid": "ORG-CL1-AP-APNIC", "org": "CMPak Limited", "pdb": null, "pfx": 198, "reg": "2013-12-17", "rir": "apnic", "s24": 180, "sib": 1, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 142336, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.052703}, {"a": 59278, "h": "VNTNET-AS-ID", "n": "Jaringan VNT Indonesia", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 38.610, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.297, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-59278-APNIC", "org": "PT Jaringan VNT Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://vnt.co.id"}, "pfx": 8, "reg": "2014-02-05", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "hostmaster@vnt.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59362, "h": "KSNETWORK-AS-AP", "n": "KS Network Ltd.", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4061, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-12", 2.264, 0.012, 0, false]], "sh": false, "uc": 7875, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.264, "se": 0.966, "ts": 1.000, "map": 10.218, "obs": 2, "own": 16.469, "comp": {"cins": -0.3157, "dshield": -0.6747, "crowdsec": -2.6618, "vulncheck": -0.5393, "blocklist_de": 7.9093}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.199, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-KNL3-AP-APNIC", "org": "KS Network Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.ksnetworkbd.com/"}, "pfx": 30, "reg": "2014-05-14", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "support@ksnetworkbd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00208041849979}, {"a": 59364, "h": "VHOST-HOLDINGS-SG", "n": "vHost Holdings Pte Ltd", "t": "Hosting & VPS", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.887, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-VHPL1-AP-APNIC", "org": "vHost Holdings Pte Ltd", "pdb": null, "pfx": 4, "reg": "2014-05-16", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@getyourvm.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59431, "h": "RAV-NET-01", "n": "Ravand Tazeh Co,.PJS.", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.810, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RTC4-RIPE", "org": "Ravand Tazeh Co,.PJS.", "pdb": null, "pfx": 11, "reg": "2012-07-10", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse@ouriran.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59441, "h": "Hostiran-Network", "n": "Hostiran DC Network", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 13, "p": 1.0000, "hi": 18.01, "lo": 7.38, "ips": 13, "mean": 12.20, "above": true}}, "h2": [["2026-10-05", 0.865, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 0.229, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.852, "ts": null, "map": 0.174, "obs": 0, "own": 0.076, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.637, "det": {"shodan": {"c2": 1, "compromised": 12}}, "oid": "ORG-NSSM5-RIPE", "org": "NOAVARAN SHABAKEH SABZ MEHREGAN (Ltd.)", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Selective", "web": "https://hostiran.net"}, "pfx": 76, "reg": "2012-07-11", "rir": "ripencc", "s24": 69, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 24832, "abuse": "ripe@hostiran.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00039464558254}, {"a": 59444, "h": "ASAMSNET", "n": "AMSNET Andrzej Szreter", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.138, "det": null, "oid": "ORG-AA270-RIPE", "org": "Andrzej Szreter AMSNET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://amsnet.pl"}, "pfx": 7, "reg": "2012-07-12", "rir": "ripencc", "s24": 10, "sib": 1, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@amsnet.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59493, "h": "MIMIC", "n": "MIMIC", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.954, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-CVL13-RIPE", "org": "Cudo Ventures Ltd", "pdb": null, "pfx": 3, "reg": "2018-03-06", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "ripe@cudoventures.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005477348264}, {"a": 59497, "h": "BUKNET-AS", "n": "Buknet", "t": "Broadband & mobile", "w": 11, "cc": "UA", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4124, "hi": 6.20, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1922, "hi": 4.67, "lo": 0.35, "ips": 8, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 5.610, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 5.610, "se": 0.694, "ts": 0.500, "map": 15.125, "obs": 4, "own": 23.773, "comp": {"cins": -0.551, "dshield": 6.2508, "crowdsec": -4.2311, "vulncheck": 1.0057, "blocklist_de": 1.6355}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.245, "det": {"vulncheck": {"botnet_node": 8}, "blocklist_de": {"bots": 1}}, "oid": "ORG-BL132-RIPE", "org": "Buknet LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://intelekt.net"}, "pfx": 31, "reg": "2012-07-25", "rir": "ripencc", "s24": 30, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": "admin@intelekt.cv.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00258317114496}, {"a": 59504, "h": "vpsville-AS", "n": "LLC Vpsville", "t": "Hosting & VPS", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3477, "hi": 5.62, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "vulncheck": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "phishing_db": {"n": 2, "p": 0.4051, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.198, 1.979, 0, false], ["2026-10-12", 0.863, 1.993, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.993, "se": 1.157, "ts": 1.000, "map": 9.465, "obs": 2, "own": 3.626, "comp": {"urlhaus": -0.3306, "threatfox": -0.2925, "phishing_db": 4.4969}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.863, "se": 0.938, "ts": 0.500, "map": 3.565, "obs": 2, "own": 0.753, "comp": {"cins": -0.2604, "dshield": -0.5691, "crowdsec": -2.2473, "vulncheck": 2.2392, "blocklist_de": 3.5022}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.988, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-VL264-RIPE", "org": "LLC Vpsville", "pdb": null, "pfx": 51, "reg": "2012-07-27", "rir": "ripencc", "s24": 56, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "admin@vpsville.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081201804969}, {"a": 59545, "h": "VXbits", "n": "Vertixo B.V", "t": "Transit & backbone", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3618, "hi": 5.74, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 2.324, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.192, "obs": 0, "own": 1.513, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.244, "det": {"shodan": {"c2": 1, "doublepulsar": 1}}, "oid": "ORG-VB19-RIPE", "org": "Vertixo BV", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "http://vxbits.net"}, "pfx": 10, "reg": "2012-08-07", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": "noc@vertixo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59573, "h": "SariSystemBandarabasCompany", "n": "Sari System Bandarabas Company LLC", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1293.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.640, "det": null, "oid": "ORG-SSBC1-RIPE", "org": "Sari System Bandarabas Company LLC", "pdb": null, "pfx": 1, "reg": "2012-08-13", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004932048336}, {"a": 59577, "h": "LINKCOM-LVIV-AS", "n": "ISP LinkCom", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.335, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 1.077, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.215, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-LNL41-RIPE", "org": "LinkCom Networks LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://linkcom.lviv.ua"}, "pfx": 9, "reg": "2017-05-10", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@linkcom.lviv.ua", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00191109691899}, {"a": 59591, "h": "WIRENET_AS", "n": "WIRENET LLC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.984, 0, false]], "sh": false, "uc": 9960.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.984, "se": 1.853, "ts": 1.000, "map": 15.037, "obs": 1, "own": 27.352, "comp": {"urlhaus": 4.5003, "threatfox": -0.0588, "phishing_db": -0.1048}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.452, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-WL72-RIPE", "org": "WIRENET LLC", "pdb": null, "pfx": 1, "reg": "2012-08-14", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "admin@wirenet.tv", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59632, "h": "PIDGINHOST-AS", "n": "SC PIDGIN HOST SRL", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.975, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SPHS3-RIPE", "org": "SC PIDGIN HOST SRL", "pdb": null, "pfx": 1, "reg": "2012-08-31", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@pidginhost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001595551851}, {"a": 59642, "h": "CHERRYSERVERS2-AS", "n": "Cherry Servers NL", "t": "Hosting & VPS", "w": 4, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2018-13379": 2, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 2, "p": 0.3669, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}, "threatfox": {"n": 1, "p": 0.1969, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 2.876, 0.439, 0, false], ["2026-10-12", 1.546, 0.454, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.454, "se": 1.540, "ts": 1.000, "map": 4.568, "obs": 1, "own": 2.096, "comp": {"urlhaus": -0.1015, "threatfox": 3.4796, "phishing_db": -0.2327}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.546, "se": 0.942, "ts": 1.000, "map": 6.672, "obs": 2, "own": 1.363, "comp": {"cins": -0.2855, "dshield": -0.6177, "crowdsec": 6.1798, "vulncheck": -0.512, "blocklist_de": -1.4731}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.625, "det": {"shodan": {"malware": 1}, "threatfox": {"family:Cobalt Strike": 2}}, "oid": "ORG-UDC69-RIPE", "org": "UAB \"Cherry Servers\"", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "http://www.cherryservers.com"}, "pfx": 25, "reg": "2012-09-03", "rir": "ripencc", "s24": 33, "sib": 6, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@cherryservers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0049885672435}, {"a": 59651, "h": "AS-QualityNetwork", "n": "Alex Largman", "t": "Other", "w": 498, "cc": "IL", "cf": null, "cs": {"c": {"http_flood": 261, "web_exploit": 461, "bad_crawling": 28, "proxy_or_vpn": 5, "web_bruteforce": 492, "home_connection": 1, "cve:CVE-2019-18935": 22, "cve:CVE-2022-39290": 30, "cve:CVE-2024-28000": 11, "cve:CVE-2026-60137": 161, "cve:CVE-2026-63030": 289}, "n": 493}, "ev": {"dshield": {"n": 4, "p": 0.8001, "hi": 8.89, "lo": 1.91, "ips": 4, "mean": 4.86, "above": true}, "crowdsec": {"n": 13, "p": 1.0000, "hi": 18.03, "lo": 7.38, "ips": 493, "mean": 12.21, "above": true}, "blocklist_de": {"n": 2, "p": 0.3848, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 25.536, 0.011, 1, false], ["2026-10-12", 29.273, 0.012, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.630, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 2}, "lo": 29.273, "se": 0.420, "ts": 0.684, "map": 48.093, "obs": 19, "own": 26.898, "comp": {"cins": -2.0136, "dshield": 3.4221, "crowdsec": 9.073, "vulncheck": -0.9395, "blocklist_de": -4.2751}, "mass": 14.5, "listed": false}}, "abq": false, "bot": 0.616, "det": {"blocklist_de": {"apache": 2}}, "oid": "ORG-BAY43-RIPE", "org": "Alex Largman", "pdb": null, "pfx": 39, "reg": "2021-04-07", "rir": "ripencc", "s24": 55, "sib": 0, "tor": 0, "w24": 17, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 14080, "abuse": "info@quality-network.eu", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield"], "traffic": 0.00262654117154}, {"a": 59668, "h": "ATURON", "n": "Turon Media", "t": "Broadband & mobile", "w": 6, "cc": "UZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1829, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1299, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "vulncheck": {"n": 1, "p": 0.1833, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 3, "p": 0.5970, "hi": 7.21, "lo": 1.27, "ips": 3, "mean": 3.72, "above": false}}, "h2": [["2026-10-12", 5.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.188, "obs": 0, "own": 1.479, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 3}, "lo": 5.607, "se": 0.586, "ts": 0.500, "map": 12.491, "obs": 6, "own": 19.372, "comp": {"cins": -0.9529, "dshield": 1.2438, "crowdsec": -3.5228, "vulncheck": 0.2263, "blocklist_de": 6.9243}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.377, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 3}}, "oid": "ORG-TMX1-RIPE", "org": "Turon Media XK", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://turontelecom.uz"}, "pfx": 12, "reg": "2012-09-14", "rir": "ripencc", "s24": 70, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": "ripe@turontelecom.uz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0028754758924}, {"a": 59684, "h": "ASHOSTERKG", "n": "Hoster kg, Ltd.", "t": "Hosting & VPS", "w": 0, "cc": "KG", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8033, "hi": 8.94, "lo": 1.92, "ips": 4, "mean": 4.89, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.887, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-HOST5-RIPE", "org": "Hoster kg, Ltd.", "pdb": null, "pfx": 10, "reg": "2012-09-19", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 2816, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00006651038124}, {"a": 59692, "h": "IQWEB", "n": "IQWeb FZ LLC", "t": "Other", "w": 11, "cc": "AE", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 4, "p": 0.8063, "hi": 9.00, "lo": 1.94, "ips": 11, "mean": 4.91, "above": true}}, "h2": [["2026-10-05", 0.299, 10.369, 1, false], ["2026-10-12", 0.010, 10.153, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 10.153, "se": 0.914, "ts": 1.000, "map": 30.395, "obs": 4, "own": 27.905, "comp": {"urlhaus": -0.6153, "threatfox": -0.3963, "phishing_db": 6.0521}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.305, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.997, "det": null, "oid": "ORG-IF46-RIPE", "org": "IQWeb FZ-LLC", "pdb": {"t": null, "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://iqweb.io"}, "pfx": 36, "reg": "2023-01-26", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 9216, "abuse": "abuse@iqweb.io", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00000501776171}, {"a": 59706, "h": "RWC", "n": "RWC", "t": "Broadband & mobile", "w": 1, "cc": "UZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 3.092, 0.011, 0, false], ["2026-10-12", 3.341, 0.012, 0, false]], "sh": false, "uc": 4507.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.341, "se": 0.990, "ts": 0.500, "map": 15.842, "obs": 2, "own": 25.607, "comp": {"cins": -0.2681, "dshield": -0.5842, "crowdsec": 2.0521, "vulncheck": -0.495, "blocklist_de": 3.4515}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.189, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-WCL19-RIPE", "org": "\"RUBICON WIRELESS COMMUNICATION\" JSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.perfectum.uz/"}, "pfx": 6, "reg": "2024-01-16", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "info@perfectum.uz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004718771912}, {"a": 59711, "h": "HZ-EU-AS", "n": "HZ-NL", "t": "Other", "w": 5, "cc": "BG", "cf": {"rb": "hi", "wb": "hi", "rep": 0.63, "waf": 0.55}, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.1885, "hi": 4.32, "lo": 0.56, "ips": 2, "mean": 2.06, "above": false}, "threatfox": {"n": 1, "p": 0.1849, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "phishing_db": {"n": 4, "p": 0.7601, "hi": 8.29, "lo": 1.78, "ips": 4, "mean": 4.53, "above": false}}, "h2": [["2026-10-05", 0.339, 3.064, 0, false], ["2026-10-12", 0.007, 3.069, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 4}, "lo": 3.069, "se": 0.896, "ts": 0.800, "map": 8.296, "obs": 5, "own": 8.099, "comp": {"urlhaus": -0.892, "threatfox": 0.6305, "phishing_db": 4.0035}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.704, "ts": null, "map": 0.118, "obs": 0, "own": 0.113, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.721, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-FNL9-RIPE", "org": "HZ Hosting Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.hostzealot.com/"}, "pfx": 162, "reg": "2012-10-03", "rir": "ripencc", "s24": 214, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 54784, "abuse": "abuse@hostzealot.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.116352}, {"a": 59729, "h": "ITL-BG", "n": "ROUTE 95 LLC", "t": "Other", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "phishing_db": {"n": 3, "p": 0.6377, "hi": 7.65, "lo": 1.35, "ips": 3, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 0.321, 7.242, 0, false], ["2026-10-12", 0.341, 7.302, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 7.302, "se": 1.001, "ts": 1.000, "map": 26.108, "obs": 3, "own": 24.340, "comp": {"urlhaus": -0.4524, "threatfox": -0.3451, "phishing_db": 5.6859}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.341, "se": 1.312, "ts": 1.000, "map": 2.967, "obs": 1, "own": 1.952, "comp": {"cins": -0.1161, "dshield": -0.2697, "crowdsec": 3.761, "vulncheck": -0.2886, "blocklist_de": -0.6054}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.860, "det": null, "oid": "ORG-RL646-RIPE", "org": "ROUTE 95 LLC", "pdb": null, "pfx": 17, "reg": "2014-10-27", "rir": "ripencc", "s24": 29, "sib": 5, "tor": 1, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@route95.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058297233098}, {"a": 59766, "h": "ASWICITY", "n": "WicitY", "t": "Broadband & mobile", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.009, 0.317, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 1.450, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.169, "obs": 0, "own": 0.564, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.203, "det": {"shodan": {"c2": 1}}, "oid": "ORG-WSDD1-RIPE", "org": "WicitY srl", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.wicity.it"}, "pfx": 3, "reg": "2014-10-13", "rir": "ripencc", "s24": 76, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": "abuse@wicity.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009161179325}, {"a": 59782, "h": "InterBlock-ASN", "n": "INTERBLOCK", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.158, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SNRR1-RIPE", "org": "ITB Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://interblock.pl"}, "pfx": 9, "reg": "2014-10-03", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@interblock.pl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59787, "h": "WEBHS", "n": "WebSP - Comercio e Prestacao de Servicos Informaticos, Lda", "t": "Other", "w": 0, "cc": "PT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.392, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-WCEP1-RIPE", "org": "WebSP - Comercio e Prestacao de Servicos Informaticos, Lda", "pdb": null, "pfx": 16, "reg": "2014-10-01", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@webhs.pt", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001780877312}, {"a": 59833, "h": "SEVTELECOM-AS", "n": "JSC Sevastopol Telekom", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 3, "mean": 2.83, "above": false}, "blocklist_de": {"n": 2, "p": 0.4075, "hi": 6.15, "lo": 0.80, "ips": 3, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 8.643, 0.011, 0, false], ["2026-10-12", 9.425, 0.012, 0, false]], "sh": false, "uc": 6978, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 9.425, "se": 0.683, "ts": 0.500, "map": 25.167, "obs": 4, "own": 39.066, "comp": {"cins": -0.6546, "dshield": -1.2319, "crowdsec": 1.9622, "vulncheck": -0.7303, "blocklist_de": 5.2738}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.470, "det": {"blocklist_de": {"imap": 2, "mail": 3}}, "oid": "ORG-GA480-RIPE", "org": "JSC Sevastopol Telekom", "pdb": null, "pfx": 15, "reg": "2014-09-10", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "ripe@sevtelecom.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 59891, "h": "FSIT", "n": "FSIT AG", "t": "Hosting & VPS", "w": 1, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 1.763, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.653, "det": null, "oid": "ORG-FA509-RIPE", "org": "FSIT AG", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.fsit.com"}, "pfx": 8, "reg": "2014-08-20", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@fsit.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000132798798}, {"a": 59895, "h": "BINARYRACKS-AS", "n": "Binary Racks", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.4061, "hi": 6.14, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 2.264, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.264, "se": 0.966, "ts": 1.000, "map": 10.218, "obs": 2, "own": 2.099, "comp": {"cins": -0.3157, "dshield": -0.6747, "crowdsec": -2.6618, "vulncheck": -0.5393, "blocklist_de": 7.9093}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.822, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-BRL9-RIPE", "org": "Binary Racks Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.binaryracks.com"}, "pfx": 24, "reg": "2014-08-19", "rir": "ripencc", "s24": 24, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@binaryracks.co.uk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60017, "h": "FASTLINES", "n": "FASTLINES SRL", "t": "Other", "w": 10, "cc": "IT", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 9, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 63.885, 0.011, 1, false], ["2026-10-12", 46.317, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 46.317, "se": 0.708, "ts": 0.750, "map": 129.131, "obs": 4, "own": 73.192, "comp": {"cins": -0.6167, "dshield": -1.1764, "crowdsec": -1.1393, "vulncheck": -0.7158, "blocklist_de": 9.9027}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.255, "det": {"blocklist_de": {"imap": 9, "mail": 9}}, "oid": "ORG-FS175-RIPE", "org": "FASTLINES SRL", "pdb": null, "pfx": 1, "reg": "2020-04-08", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@fastlines.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60051, "h": "Earthlink-dmcc", "n": "Earthlink Telecommunications DMCC", "t": "Broadband & mobile", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9652, "hi": 11.74, "lo": 3.26, "ips": 6, "mean": 6.94, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 6}}, "oid": "ORG-ETET1-RIPE", "org": "Earthlink Telecommunications Equipment Trading & Services DMCC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Selective", "web": "http://Earthlink.iq"}, "pfx": 4, "reg": "2018-02-13", "rir": "ripencc", "s24": 4, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": "abuse@earthlink.iq", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 60068, "h": "CDN77", "n": "CDN77", "t": "Hosting & VPS", "w": 388, "cc": "GB", "cf": {"rb": "hi", "wb": "", "rep": 0.68, "waf": 0.81}, "cs": {"c": {"http_flood": 110, "data_centre": 86, "web_exploit": 126, "bad_crawling": 102, "proxy_or_vpn": 35, "ssh_bruteforce": 30, "web_bruteforce": 130, "home_connection": 28, "mail_bruteforce": 38, "cve:CVE-2017-9841": 30, "cve:CVE-2025-4396": 20, "cve:CVE-2022-35914": 15, "cve:CVE-2024-28000": 23, "cve:CVE-2026-63030": 32}, "n": 137}, "ev": {"cins": {"n": 1, "p": 0.1216, "hi": 3.91, "lo": 0.29, "ips": 17, "mean": 1.65, "above": false}, "shodan": {"n": 1, "p": 0.0140, "hi": 2.28, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}, "dshield": {"n": 4, "p": 0.6638, "hi": 7.19, "lo": 1.55, "ips": 4, "mean": 3.93, "above": false}, "crowdsec": {"n": 70, "p": 1.0000, "hi": 36.38, "lo": 24.59, "ips": 137, "mean": 30.24, "above": true}, "vulncheck": {"n": 88, "p": 1.0000, "hi": 82.99, "lo": 58.51, "ips": 230, "mean": 70.30, "above": true}, "blocklist_de": {"n": 7, "p": 0.9023, "hi": 8.52, "lo": 2.58, "ips": 13, "mean": 5.18, "above": true}}, "h2": [["2026-10-05", 21.609, 0.009, 2, false], ["2026-10-12", 18.191, 0.010, 2, false]], "sh": false, "uc": 166.1, "v2": {"band": 2, "host": {"n": null, "lo": 0.010, "se": 1.890, "ts": null, "map": 0.152, "obs": 0, "own": 0.128, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 4, "crowdsec": 70, "vulncheck": 88, "blocklist_de": 7}, "lo": 18.191, "se": 0.357, "ts": 0.518, "map": 27.002, "obs": 170, "own": 5.259, "comp": {"cins": -2.6193, "dshield": -1.8273, "crowdsec": 12.7053, "vulncheck": 6.1868, "blocklist_de": -9.7559}, "mass": 75.3, "listed": true}}, "abq": false, "bot": 0.701, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"botnet_node": 230}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 2, "mail": 2, "apache": 8, "bruteforcelogin": 8}}, "oid": "ORG-DL201-RIPE", "org": "Datacamp Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Tbps", "pol": "Open", "web": "http://www.cdn77.com"}, "pfx": 421, "reg": "2014-06-04", "rir": "ripencc", "s24": 507, "sib": 3, "tor": 0, "w24": 152, "drop": 0, "hist": [["2026-10-05", 0.8538], ["2026-10-12", 0.8493]], "ipv4": 130048, "abuse": "abuse@datacamp.co.uk", "score": 0.8493, "groups": ["sensors", "vulncheck"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.108485}, {"a": 60077, "h": "AT-CLOUD", "n": "Asre Dadeha Asiatech", "t": "Hosting & VPS", "w": 7, "cc": "IR", "cf": null, "cs": {"c": {"data_centre": 6, "ssh_bruteforce": 6}, "n": 6}, "ev": {"shodan": {"n": 5, "p": 0.8765, "hi": 9.41, "lo": 2.34, "ips": 5, "mean": 5.37, "above": true}, "dshield": {"n": 1, "p": 0.1862, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1425, "hi": 4.14, "lo": 0.31, "ips": 6, "mean": 1.74, "above": false}, "vulncheck": {"n": 1, "p": 0.1866, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1743, "hi": 4.48, "lo": 0.34, "ips": 5, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 3.969, 0.011, 0, false], ["2026-10-12", 3.266, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.242, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 3.266, "se": 0.687, "ts": 0.250, "map": 8.656, "obs": 4, "own": 1.735, "comp": {"cins": -0.5746, "dshield": 2.4975, "crowdsec": -0.7984, "vulncheck": 0.9406, "blocklist_de": 1.4868}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.406, "det": {"shodan": {"compromised": 5}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 5}}, "oid": "ORG-ADA42-RIPE", "org": "Asre Dadeha Asiatech", "pdb": null, "pfx": 18, "reg": "2022-06-27", "rir": "ripencc", "s24": 55, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 14080, "abuse": "abuse@asiatech.ir", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00044730789525}, {"a": 60098, "h": "INSIT-AS", "n": "Insit-Invest", "t": "Broadband & mobile", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4024, "hi": 6.10, "lo": 0.79, "ips": 4, "mean": 2.91, "above": false}}, "h2": [["2026-10-12", 0.624, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 1.533, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.624, "se": 0.929, "ts": 1.000, "map": 2.511, "obs": 2, "own": 4.221, "comp": {"cins": -0.1994, "dshield": -0.4469, "crowdsec": -1.7668, "vulncheck": 5.7618, "blocklist_de": -1.0344}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.483, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-FAV5-RIPE", "org": "Filippov Aleksei Vladilenovich", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.insit.ru"}, "pfx": 60, "reg": "2014-05-20", "rir": "ripencc", "s24": 60, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": "abuse@insit.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60099, "h": "RES", "n": "UAB Radijo elektronines sistemos", "t": "Other", "w": 4, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 4, "p": 0.8121, "hi": 9.10, "lo": 1.96, "ips": 4, "mean": 4.97, "above": true}}, "h2": [["2026-10-05", 5.280, 0.011, 0, false], ["2026-10-12", 7.190, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 7.190, "se": 0.720, "ts": 1.000, "map": 19.700, "obs": 4, "own": 11.716, "comp": {"cins": -0.3051, "dshield": -0.6548, "crowdsec": -2.5839, "vulncheck": 9.4903, "blocklist_de": -1.5723}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.147, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-URES1-RIPE", "org": "UAB Radijo elektronines sistemos", "pdb": null, "pfx": 4, "reg": "2020-04-28", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 3072, "abuse": "info@res.lt", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0000445155425}, {"a": 60117, "h": "HS", "n": "Host Sailor Ltd", "t": "Hosting & VPS", "w": 15, "cc": "AE", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 1, "p": 0.1501, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 1, "p": 0.1399, "hi": 4.11, "lo": 0.31, "ips": 2, "mean": 1.73, "above": false}, "phishing_db": {"n": 10, "p": 0.9996, "hi": 16.49, "lo": 6.00, "ips": 13, "mean": 10.70, "above": true}}, "h2": [["2026-10-05", 4.020, 23.673, 1, false], ["2026-10-12", 1.082, 22.703, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 10}, "lo": 22.703, "se": 0.762, "ts": 1.000, "map": 50.502, "obs": 10, "own": 17.134, "comp": {"urlhaus": -1.247, "threatfox": -0.5011, "phishing_db": 7.2963}, "mass": 3.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.082, "se": 0.925, "ts": 0.500, "map": 4.499, "obs": 2, "own": 0.921, "comp": {"cins": 4.5078, "dshield": -0.7094, "crowdsec": 1.3745, "vulncheck": -0.555, "blocklist_de": -1.7202}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.959, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HSL15-RIPE", "org": "Host Sailor Ltd", "pdb": null, "pfx": 53, "reg": "2014-05-13", "rir": "ripencc", "s24": 58, "sib": 0, "tor": 1, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 16896, "abuse": "abuse@hostsailor.com", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.0009067183}, {"a": 60118, "h": "CyberSmartSolutions-AS", "n": "INVITE Systems SRL", "t": "Other", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.705, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ANMM3-RIPE", "org": "INVITE Systems SRL", "pdb": null, "pfx": 2, "reg": "2014-05-12", "rir": "ripencc", "s24": 8, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@invitesys.ro", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60131, "h": "HIGH5-NL", "n": "High5", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.215, "obs": 0, "own": 0.386, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.660, "det": {"shodan": {"malware": 1}}, "oid": "ORG-HB11-RIPE", "org": "High5! B.V.", "pdb": {"t": null, "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://high5.nl"}, "pfx": 4, "reg": "2014-05-06", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "abuse@high5.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60144, "h": "THREE-W-INFRA-AS", "n": "3W Infra B.V.", "t": "Enterprise, edu & gov", "w": 1, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1632, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.281, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 2.811, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.281, "se": 1.280, "ts": 1.000, "map": 2.310, "obs": 1, "own": 14.863, "comp": {"cins": -0.1274, "dshield": -0.2945, "crowdsec": 3.6255, "vulncheck": -0.3088, "blocklist_de": -0.6641}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.907, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IB55-RIPE", "org": "3W Infra B.V.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.3winfra.com"}, "pfx": 46, "reg": "2014-04-30", "rir": "ripencc", "s24": 41, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": "abuse@3winfra.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004768233475}, {"a": 60187, "h": "LGFL-AS", "n": "London Grid for Learning Trust", "t": "Enterprise, edu & gov", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0482, "hi": 2.97, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.935, "ts": null, "map": 0.167, "obs": 0, "own": 1.699, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.669, "ts": null, "map": 0.105, "obs": 0, "own": 0.951, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.511, "det": {"shodan": {"c2": 1}}, "oid": "ORG-LGFL2-RIPE", "org": "London Grid for Learning Trust", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.lgfl.net"}, "pfx": 47, "reg": "2013-09-09", "rir": "ripencc", "s24": 279, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 81664, "abuse": "abuse@lgfl.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00248460468233}, {"a": 60195, "h": "SCARNET-AS", "n": "Scarnet", "t": "Broadband & mobile", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.368, 0.011, 0, false], ["2026-10-12", 5.886, 0.013, 0, false]], "sh": false, "uc": 4947.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.886, "se": 1.031, "ts": 0.500, "map": 30.211, "obs": 2, "own": 49.175, "comp": {"cins": -0.2377, "dshield": -0.5244, "crowdsec": 2.3761, "vulncheck": -0.4627, "blocklist_de": 3.6506}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-SSMS4-RIPE", "org": "SCARNET Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://scarnet.eu"}, "pfx": 2, "reg": "2013-09-05", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@scarnet.eu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60203, "h": "INNOVASUR-AS", "n": "Innovaciones Tecnlogicas del Sur S.L.", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.241, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 383.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 0.636, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.886, "ts": null, "map": 0.185, "obs": 0, "own": 0.250, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.208, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ITDS1-RIPE", "org": "Innovaciones Tecnlogicas del Sur S.L.", "pdb": null, "pfx": 32, "reg": "2013-09-04", "rir": "ripencc", "s24": 53, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": "abuse@innovasur.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025990926244}, {"a": 60246, "h": "PG-19", "n": "Consumer Internet Cooperative PG-19", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1408, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "vulncheck": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 2, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 1.004, 0.506, 0, false], ["2026-10-12", 1.897, 0.544, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.544, "se": 1.594, "ts": 1.000, "map": 5.970, "obs": 1, "own": 18.511, "comp": {"urlhaus": 4.0651, "threatfox": -0.2279, "phishing_db": -0.4243}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.897, "se": 0.779, "ts": 0.333, "map": 5.883, "obs": 3, "own": 9.404, "comp": {"cins": -0.4207, "dshield": -0.8629, "crowdsec": 0.5459, "vulncheck": 1.4394, "blocklist_de": 2.464}, "mass": 1.9, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CICP1-RIPE", "org": "Consumer Internet Cooperative PG-19", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": null, "pol": "Open", "web": "http://pg19.ru"}, "pfx": 29, "reg": "2021-05-31", "rir": "ripencc", "s24": 57, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014725116483}, {"a": 60258, "h": "ENGINET-AS", "n": "ENGINET LLC", "t": "Other", "w": 4, "cc": "AZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1937, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.4068, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-12", 9.096, 0.012, 0, false]], "sh": false, "uc": 1562.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 9.096, "se": 0.682, "ts": 0.500, "map": 24.232, "obs": 4, "own": 13.764, "comp": {"cins": -0.6583, "dshield": 2.1914, "crowdsec": -1.4657, "vulncheck": -0.7317, "blocklist_de": 5.2456}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.167, "det": {"blocklist_de": {"bots": 1, "apache": 1}}, "oid": "ORG-EA699-RIPE", "org": "ENGINET LLC", "pdb": null, "pfx": 20, "reg": "2013-08-23", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@azedunet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00260323170184}, {"a": 60294, "h": "DE-DGW", "n": "Deutsche Glasfaser", "t": "Broadband & mobile", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1064, "hi": 3.61, "lo": 0.47, "ips": 2, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 1.201, 0.010, 0, false], ["2026-10-12", 0.282, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.935, "ts": null, "map": 0.167, "obs": 0, "own": 1.006, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.282, "se": 0.864, "ts": 1.000, "map": 1.046, "obs": 2, "own": 1.666, "comp": {"cins": -0.3718, "dshield": -0.7773, "crowdsec": 5.0796, "vulncheck": -0.5839, "blocklist_de": -1.9083}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-BG38-RIPE", "org": "Deutsche Glasfaser Wholesale GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://deutsche-glasfaser.de/"}, "pfx": 19, "reg": "2013-08-16", "rir": "ripencc", "s24": 280, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 88576, "abuse": "abuse@deutsche-glasfaser.de", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02310307616865}, {"a": 60330, "h": "BCTBY-AS", "n": "Belarusian Cloud Technologies", "t": "Hosting & VPS", "w": 0, "cc": "BY", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6000, "hi": 7.24, "lo": 1.28, "ips": 3, "mean": 3.74, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.269, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.111, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.723, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-BCTJ1-RIPE", "org": "Belarusian Cloud Technologies LLC", "pdb": null, "pfx": 28, "reg": "2013-08-12", "rir": "ripencc", "s24": 33, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "abuse@becloud.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003435288928}, {"a": 60404, "h": "Liteserver", "n": "LiteServer", "t": "Hosting & VPS", "w": 29, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 26, "data_centre": 6, "web_exploit": 28, "bad_crawling": 17, "proxy_or_vpn": 25, "ssh_bruteforce": 18, "web_bruteforce": 26, "mail_bruteforce": 10, "router_or_botnet": 2, "cve:CVE-2015-9406": 5, "cve:CVE-2017-9841": 15, "cve:CVE-2018-13379": 4, "cve:CVE-2018-20062": 14, "cve:CVE-2021-41773": 5}, "n": 29}, "ev": {"shodan": {"n": 7, "p": 0.9710, "hi": 11.09, "lo": 3.36, "ips": 7, "mean": 6.75, "above": true}, "dshield": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 24, "p": 1.0000, "hi": 27.41, "lo": 14.12, "ips": 29, "mean": 20.30, "above": true}, "blocklist_de": {"n": 2, "p": 0.3635, "hi": 5.76, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}}, "h2": [["2026-10-05", 26.537, 0.298, 1, false], ["2026-10-12", 26.036, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 0.217, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 24, "vulncheck": 0, "blocklist_de": 2}, "lo": 26.036, "se": 0.398, "ts": 0.889, "map": 42.157, "obs": 27, "own": 8.208, "comp": {"cins": -2.378, "dshield": -1.6116, "crowdsec": 16.6744, "vulncheck": -0.9598, "blocklist_de": -6.5899}, "mass": 20.2, "listed": false}}, "abq": false, "bot": 0.795, "det": {"shodan": {"c2": 1, "malware": 3, "compromised": 3}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-TIGB3-RIPE", "org": "The Infrastructure Group B.V.", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://liteserver.nl"}, "pfx": 87, "reg": "2013-07-24", "rir": "ripencc", "s24": 87, "sib": 2, "tor": 19, "w24": 24, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 35072, "abuse": "abuse@liteserver.nl", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.002354630975}, {"a": 60439, "h": "SERVERNET-AS", "n": "Server.net", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1592, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.263, 0.011, 0, false], ["2026-10-12", 0.264, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 0.251, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.264, "se": 1.270, "ts": 1.000, "map": 2.123, "obs": 1, "own": 0.477, "comp": {"cins": -0.1313, "dshield": -0.3029, "crowdsec": 3.5799, "vulncheck": -0.3154, "blocklist_de": -0.684}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.933, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SIL65-RIPE", "org": "SERVERNET INTERNET LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://server.net"}, "pfx": 37, "reg": "2023-11-30", "rir": "ripencc", "s24": 46, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": "abuse@server.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00182814389526}, {"a": 60530, "h": "ALCONN-AS", "n": "INTERCONN", "t": "Other", "w": 4, "cc": "IT", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6379, "hi": 7.65, "lo": 1.35, "ips": 4, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 0.491, 0.011, 0, false], ["2026-10-12", 9.488, 0.012, 0, false]], "sh": false, "uc": 2794.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 9.488, "se": 0.799, "ts": 1.000, "map": 31.457, "obs": 3, "own": 18.042, "comp": {"cins": -0.5027, "dshield": -0.9996, "crowdsec": -3.9323, "vulncheck": -0.6641, "blocklist_de": 10.9411}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.286, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-AS937-RIPE", "org": "ALCONN SRL", "pdb": {"t": null, "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.alconn.it"}, "pfx": 16, "reg": "2013-07-02", "rir": "ripencc", "s24": 13, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "abuse@alconn.it", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008616837625}, {"a": 60558, "h": "SECUREDSERVERS-EU", "n": "PHOENIX NAP, LLC.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.72, "waf": 0.63}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 0.244, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.886, "ts": null, "map": 0.185, "obs": 0, "own": 0.087, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.680, "det": null, "oid": "ORG-PNL7-RIPE", "org": "PHOENIX NAP, LLC.", "pdb": null, "pfx": 29, "reg": "2013-06-25", "rir": "ripencc", "s24": 53, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": "abuse@phoenixnap.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.101302}, {"a": 60591, "h": "SUPPORTCHAIN-AS", "n": "Support Chain LLC", "t": "Other", "w": 0, "cc": "BY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.757, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SCL67-RIPE", "org": "Support Chain LLC", "pdb": null, "pfx": 7, "reg": "2020-11-10", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@hostfly.by", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002603882632}, {"a": 60592, "h": "GRANSY", "n": "Gransy s.r.o. - anycastdns.cz", "t": "Hosting & VPS", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.129, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.838, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GS113-RIPE", "org": "Gransy s.r.o.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://gransy.com/"}, "pfx": 18, "reg": "2013-06-19", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@regtons.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60602, "h": "INOVARE-AS", "n": "IPHOST", "t": "Hosting & VPS", "w": 0, "cc": "MD", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4048, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.169, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.773, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-IS368-RIPE", "org": "Inovare-Prim SRL", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://iphost.md"}, "pfx": 13, "reg": "2013-06-18", "rir": "ripencc", "s24": 13, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@innovahosting.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016652007645}, {"a": 60627, "h": "RA-AS", "n": "Rayankadeh Apadana Company Ltd", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.215, "obs": 0, "own": 0.386, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.608, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RACL2-RIPE", "org": "Rayankadeh Apadana Company Ltd", "pdb": null, "pfx": 7, "reg": "2013-06-11", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000039338493}, {"a": 60631, "h": "PARVASYSTEM", "n": "Vandad Vira Hooman LLC", "t": "Other", "w": 12, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 4, "ssh_bruteforce": 5, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 7}, "ev": {"shodan": {"n": 49, "p": 1.0000, "hi": 52.24, "lo": 32.74, "ips": 49, "mean": 42.01, "above": true}, "crowdsec": {"n": 6, "p": 0.9173, "hi": 9.58, "lo": 2.66, "ips": 7, "mean": 5.66, "above": true}, "vulncheck": {"n": 2, "p": 0.3926, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "phishing_db": {"n": 1, "p": 0.1805, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 5, "p": 0.8845, "hi": 9.60, "lo": 2.39, "ips": 5, "mean": 5.48, "above": true}}, "h2": [["2026-10-05", 14.374, 0.311, 1, false], ["2026-10-12", 12.156, 0.321, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.321, "se": 1.471, "ts": 1.000, "map": 2.766, "obs": 1, "own": 3.245, "comp": {"urlhaus": -0.1625, "threatfox": -0.1844, "phishing_db": 2.9905}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 2, "blocklist_de": 5}, "lo": 12.156, "se": 0.467, "ts": 0.462, "map": 22.057, "obs": 13, "own": 12.394, "comp": {"cins": -1.6907, "dshield": -2.3307, "crowdsec": 1.7166, "vulncheck": 0.1266, "blocklist_de": 6.6654}, "mass": 10.8, "listed": false}}, "abq": true, "bot": 0.512, "det": {"shodan": {"compromised": 49}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 5}}, "oid": "ORG-VVHL1-RIPE", "org": "Vandad Vira Hooman LLC", "pdb": null, "pfx": 89, "reg": "2013-06-10", "rir": "ripencc", "s24": 89, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8212]], "ipv4": 22784, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0008165355804}, {"a": 60647, "h": "MERT-TURKOGLU-DATAHOST-INTERNET-VE-BILISIM-TEKNOLOJILERI", "n": "MERT TURKOGLU trading as DATAHOST INTERNET VE BILISIM TEKNOLOJILERI", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MTTA6-RIPE", "org": "MERT TURKOGLU trading as DATAHOST INTERNET VE BILISIM TEKNOLOJILERI", "pdb": null, "pfx": 6, "reg": "2023-09-11", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@datahost.net.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60721, "h": "bursabil", "n": "Bursabil Teknoloji", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4006, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 2.555, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.323, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-BTA44-RIPE", "org": "Bursabil Teknoloji A.S.", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.bursabil.com.tr"}, "pfx": 16, "reg": "2013-05-23", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@bursabil.com.tr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001054416316}, {"a": 60729, "h": "TORSERVERS-NET", "n": "Zwiebelfreunde", "t": "Hosting & VPS", "w": 141, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 141, "data_centre": 129, "web_exploit": 141, "bad_crawling": 135, "proxy_or_vpn": 141, "ssh_bruteforce": 112, "web_bruteforce": 141, "mail_bruteforce": 24, "cve:CVE-2015-9406": 23, "cve:CVE-2017-9841": 116, "cve:CVE-2018-13379": 37, "cve:CVE-2018-20062": 94, "cve:CVE-2021-26086": 20}, "n": 141}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 141, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 11.171, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.632, "det": {"blocklist_de": {"apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-SEF5-RIPE", "org": "Stiftung Erneuerbare Freiheit", "pdb": {"t": "Non-Profit", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.zwiebelfreunde.de/"}, "pfx": 3, "reg": "2013-05-22", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 141, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@renewablefreedom.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60733, "h": "PERKE-NET", "n": "PERKE", "t": "Hosting & VPS", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.786, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.963, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-ZPTA1-RIPE", "org": "ZORAN PEROVIC trading as Agencija Perke.NET", "pdb": {"t": "Content", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.perke.net"}, "pfx": 3, "reg": "2018-12-17", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000014883021}, {"a": 60781, "h": "LEASEWEB-NL-AMS-01", "n": "LeaseWeb Netherlands / AMS-01", "t": "Hosting & VPS", "w": 36, "cc": "NL", "cf": {"rb": "hi", "wb": "", "rep": 1.03, "waf": 1.09}, "cs": {"c": {"http_flood": 10, "data_centre": 3, "web_exploit": 13, "bad_crawling": 13, "proxy_or_vpn": 5, "first_seen_30d": 2, "ssh_bruteforce": 5, "web_bruteforce": 8, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2021-41773": 2, "cve:CVE-2022-22965": 1}, "n": 20}, "ev": {"shodan": {"n": 12, "p": 0.4541, "hi": 4.46, "lo": 1.76, "ips": 12, "mean": 2.98, "above": false}, "dshield": {"n": 1, "p": 0.0255, "hi": 2.57, "lo": 0.19, "ips": 1, "mean": 1.08, "above": false}, "urlhaus": {"n": 1, "p": 0.1428, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "crowdsec": {"n": 15, "p": 0.5127, "hi": 4.46, "lo": 1.94, "ips": 20, "mean": 3.09, "above": false}, "threatfox": {"n": 3, "p": 0.4891, "hi": 6.25, "lo": 1.10, "ips": 3, "mean": 3.22, "above": false}, "vulncheck": {"n": 10, "p": 0.9754, "hi": 9.29, "lo": 3.38, "ips": 11, "mean": 6.03, "above": true}, "blocklist_de": {"n": 1, "p": 0.0029, "hi": 1.77, "lo": 0.13, "ips": 1, "mean": 0.74, "above": false}}, "h2": [["2026-10-05", 1.337, 0.565, 0, false], ["2026-10-12", 1.143, 0.583, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 0}, "lo": 0.583, "se": 1.007, "ts": 0.750, "map": 1.858, "obs": 4, "own": 0.773, "comp": {"urlhaus": 1.5741, "threatfox": 1.678, "phishing_db": -1.0065}, "mass": 4.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 15, "vulncheck": 10, "blocklist_de": 1}, "lo": 1.143, "se": 0.421, "ts": 0.556, "map": 1.862, "obs": 27, "own": 0.366, "comp": {"cins": -2.127, "dshield": -1.2458, "crowdsec": 10.1447, "vulncheck": 2.6637, "blocklist_de": -7.4202}, "mass": 16.3, "listed": false}}, "abq": false, "bot": 0.543, "det": {"shodan": {"c2": 1, "compromised": 11}, "threatfox": {"family:Remcos": 1, "family:PureRAT": 1, "family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 11}, "blocklist_de": {"bots": 1}}, "oid": "ORG-OB3-RIPE", "org": "LeaseWeb Netherlands B.V.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.leaseweb.com"}, "pfx": 379, "reg": "2013-05-13", "rir": "ripencc", "s24": 1573, "sib": 0, "tor": 3, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 416768, "abuse": "abuse@nl.leaseweb.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.070977}, {"a": 60784, "h": "Iradeum-AS", "n": "Iradeum Trading", "t": "Other", "w": 2, "cc": "BG", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 6.104, 0.011, 0, false], ["2026-10-12", 19.666, 0.013, 1, false]], "sh": false, "uc": 10312.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 19.666, "se": 0.822, "ts": 0.667, "map": 68.027, "obs": 3, "own": 39.072, "comp": {"cins": -0.4262, "dshield": -0.8723, "crowdsec": 0.4951, "vulncheck": -0.6206, "blocklist_de": 7.0376}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.232, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-IT43-RIPE", "org": "\"Iradeum Trading\" Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.iradeum.com"}, "pfx": 4, "reg": "2013-05-13", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003700313643}, {"a": 60791, "h": "HGDATA", "n": "HGdata s.r.o.", "t": "Other", "w": 0, "cc": "SK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5468.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.144, "det": null, "oid": "ORG-HS79-RIPE", "org": "HGdata s.r.o.", "pdb": null, "pfx": 1, "reg": "2013-05-10", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006026825808}, {"a": 60806, "h": "ZICOMNEXT", "n": "ZICOM", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0974, "hi": 3.63, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.179, "obs": 0, "own": 1.226, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.756, "ts": null, "map": 0.138, "obs": 0, "own": 0.392, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.183, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-NSZO29-RIPE", "org": "\"ZICOM NEXT\" SPOLKA Z OGRANICZONA ODPOWIEDZIALNOSCIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://zicom.pl"}, "pfx": 18, "reg": "2013-05-08", "rir": "ripencc", "s24": 144, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00154470859062}, {"a": 60831, "h": "ARKADIA", "n": "Arkadia Spolka Cywilna Krysztof Rozmus Barbara Rozmus", "t": "Other", "w": 10, "cc": "PL", "cf": null, "cs": {"c": {"mail_bruteforce": 5, "router_or_botnet": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4143, "hi": 6.21, "lo": 0.81, "ips": 5, "mean": 2.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 6, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 49.817, 0.011, 1, false], ["2026-10-12", 35.389, 0.013, 1, false]], "sh": false, "uc": 19296.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 35.389, "se": 0.703, "ts": 0.500, "map": 97.918, "obs": 4, "own": 55.531, "comp": {"cins": -0.5888, "dshield": -1.1344, "crowdsec": 2.6286, "vulncheck": -0.7044, "blocklist_de": 5.7768}, "mass": 2.7, "listed": false}}, "abq": true, "bot": 0.124, "det": {"blocklist_de": {"imap": 6, "mail": 6}}, "oid": "ORG-AS186-RIPE", "org": "Arkadia Spolka Cywilna Krysztof Rozmus Barbara Rozmus", "pdb": null, "pfx": 2, "reg": "2013-05-01", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60840, "h": "TELECOMSERVICEVRN", "n": "OJSC Telecom-Service", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.340, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.340, "se": 1.327, "ts": 1.000, "map": 2.935, "obs": 1, "own": 5.522, "comp": {"cins": -0.0799, "dshield": -0.1885, "crowdsec": -0.7468, "vulncheck": 3.903, "blocklist_de": -0.4175}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.448, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-OT46-RIPE", "org": "OJSC Telecom-Service", "pdb": null, "pfx": 25, "reg": "2013-04-26", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@vrn.tv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011235183729}, {"a": 60841, "h": "BERRYBYTE", "n": "BerryByte", "t": "Transit & backbone", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.094, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 3.270, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.631, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BA1481-RIPE", "org": "berrybyte Limited", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Selective", "web": "https://berrybyte.net"}, "pfx": 8, "reg": "2022-12-13", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@berrybyte.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60904, "h": "ATSTEL-AS", "n": "ATC Telecom LTD.", "t": "Broadband & mobile", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.858, 0.984, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.984, "se": 1.853, "ts": 1.000, "map": 15.037, "obs": 1, "own": 67.852, "comp": {"urlhaus": 4.5003, "threatfox": -0.0588, "phishing_db": -0.1048}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.858, "se": 1.529, "ts": 1.000, "map": 10.892, "obs": 1, "own": 22.595, "comp": {"cins": -0.0595, "dshield": 4.885, "crowdsec": -0.5621, "vulncheck": -0.17, "blocklist_de": -0.3117}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ATL29-RIPE", "org": "ATC Telecom LTD.", "pdb": null, "pfx": 4, "reg": "2013-04-16", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse-c@atscom.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60917, "h": "TEDRA", "n": "TEDRA GLOBAL SOLUTIONS SL", "t": "Transit & backbone", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.094, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 3.270, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.365, "det": {"shodan": {"doublepulsar": 2}}, "oid": "ORG-TSS32-RIPE", "org": "TEDRA GLOBAL SOLUTIONS S.L.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.tedra.com"}, "pfx": 8, "reg": "2013-04-12", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@tedra.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 60976, "h": "POL", "n": "Parsan Lin Co. PJS", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7682, "hi": 8.40, "lo": 1.81, "ips": 4, "mean": 4.59, "above": false}, "crowdsec": {"n": 1, "p": 0.1544, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.263, 0.011, 0, false], ["2026-10-12", 0.277, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 0.668, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.277, "se": 1.278, "ts": 1.000, "map": 2.269, "obs": 1, "own": 1.470, "comp": {"cins": -0.1282, "dshield": -0.2963, "crowdsec": 3.616, "vulncheck": -0.3102, "blocklist_de": -0.6682}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.960, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-PO1-RIPE", "org": "Parsan Lin Co. PJS", "pdb": null, "pfx": 44, "reg": "2016-05-18", "rir": "ripencc", "s24": 42, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "abuse@parsonline.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000516637422}, {"a": 60982, "h": "XZONE", "n": "XZONE", "t": "Other", "w": 5, "cc": "RO", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 4, "mean": 2.97, "above": false}}, "h2": [["2026-10-12", 13.362, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 13.362, "se": 0.809, "ts": 0.667, "map": 44.799, "obs": 3, "own": 25.718, "comp": {"cins": -0.4468, "dshield": -0.9073, "crowdsec": 0.3066, "vulncheck": -0.6332, "blocklist_de": 6.8765}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.579, "det": {"blocklist_de": {"bots": 2, "apache": 2}}, "oid": "ORG-XIS6-RIPE", "org": "X-ZONE IT SRL", "pdb": null, "pfx": 8, "reg": "2023-11-20", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "noc@x-zoneservers.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010440451584}, {"a": 60987, "h": "FIBRACADIZ", "n": "FIBERDAN NETWORKS, S.L", "t": "Broadband & mobile", "w": 5, "cc": "ES", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 5}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 5, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 16.974, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.353, "det": null, "oid": "ORG-FNS24-RIPE", "org": "FIBERDAN NETWORKS, S.L", "pdb": null, "pfx": 6, "reg": "2021-06-23", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "ripe@fiberdan.es", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61010, "h": "IPNET-AS", "n": "IPNET", "t": "Other", "w": 0, "cc": "KG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.164, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IO21-RIPE", "org": "IPNET OOO", "pdb": {"t": null, "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "https://ipnet.kg"}, "pfx": 5, "reg": "2013-03-15", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003136241316}, {"a": 61019, "h": "MEDIABAY-ASIA-AS", "n": "Mediabay Asia LLC", "t": "Other", "w": 5, "cc": "UZ", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.271, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-MAL15-RIPE", "org": "Mediabay Asia LLC", "pdb": null, "pfx": 2, "reg": "2013-03-13", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61031, "h": "ESCOMTEL-AS", "n": "Escomtel Backbone Network", "t": "Broadband & mobile", "w": 7, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 6, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 3.978, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.978, "se": 1.020, "ts": 0.500, "map": 19.297, "obs": 2, "own": 32.293, "comp": {"cins": -0.1796, "dshield": 4.2355, "crowdsec": -1.6053, "vulncheck": 2.8359, "blocklist_de": -0.9329}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.463, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-EBNL2-RIPE", "org": "ESCOMTEL BACKGROUND COMMUNICATION NETWORKS Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.escomtel.ru"}, "pfx": 6, "reg": "2013-03-11", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "nocbb@escomtel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61053, "h": "VPSNET-AS", "n": "Esnet", "t": "Hosting & VPS", "w": 6, "cc": "LT", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 5, "p": 0.9114, "hi": 10.36, "lo": 2.57, "ips": 6, "mean": 5.91, "above": true}}, "h2": [["2026-10-05", 0.011, 16.094, 1, false], ["2026-10-12", 0.011, 16.127, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 16.127, "se": 0.859, "ts": 1.000, "map": 43.902, "obs": 5, "own": 15.130, "comp": {"urlhaus": -0.7312, "threatfox": -0.4241, "phishing_db": 6.5634}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.114, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UA290-RIPE", "org": "UAB ESNET", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.VPSnet.com"}, "pfx": 13, "reg": "2013-03-05", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 7936, "abuse": "abuse@vpsnet.lt", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.000143448756}, {"a": 61098, "h": "exoscale", "n": "Akenes SA", "t": "Hosting & VPS", "w": 6, "cc": "CH", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.6351, "hi": 6.92, "lo": 1.49, "ips": 4, "mean": 3.78, "above": false}, "dshield": {"n": 1, "p": 0.1655, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 1, "p": 0.0777, "hi": 3.39, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "vulncheck": {"n": 2, "p": 0.3721, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "phishing_db": {"n": 2, "p": 0.3755, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.445, 0.985, 0, false], ["2026-10-12", 1.045, 1.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.010, "se": 1.141, "ts": 1.000, "map": 4.477, "obs": 2, "own": 1.785, "comp": {"urlhaus": -0.4101, "threatfox": -0.3285, "phishing_db": 3.8639}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.045, "se": 0.685, "ts": 0.500, "map": 2.731, "obs": 4, "own": 0.554, "comp": {"cins": -0.5064, "dshield": 2.761, "crowdsec": -0.2225, "vulncheck": 2.9435, "blocklist_de": -2.5773}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.938, "det": {"shodan": {"c2": 2, "malware": 1, "doublepulsar": 1}, "vulncheck": {"c2_server": 2}}, "oid": "ORG-AS256-RIPE", "org": "Akenes SA", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.exoscale.ch"}, "pfx": 47, "reg": "2013-02-18", "rir": "ripencc", "s24": 151, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39168, "abuse": "abuse@exoscale.ch", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00100127363768}, {"a": 61102, "h": "INTERHOST", "n": "Interhost Networks", "t": "Hosting & VPS", "w": 12, "cc": "IL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1747, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "vulncheck": {"n": 4, "p": 0.8081, "hi": 9.03, "lo": 1.94, "ips": 12, "mean": 4.93, "above": true}}, "h2": [["2026-10-12", 3.497, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.279, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 3.497, "se": 0.712, "ts": 1.000, "map": 9.429, "obs": 4, "own": 1.954, "comp": {"cins": -0.3268, "dshield": -0.6955, "crowdsec": -2.7432, "vulncheck": 9.0851, "blocklist_de": -1.6821}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.775, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"botnet_node": 12}}, "oid": "ORG-ICSL6-RIPE", "org": "Interhost Communication Solutions Ltd.", "pdb": {"t": "NSP", "sc": "Middle East", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.interhost.co.il"}, "pfx": 31, "reg": "2013-02-15", "rir": "ripencc", "s24": 27, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0833]], "ipv4": 10496, "abuse": "abuse@interhost.net", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00023808139992}, {"a": 61106, "h": "PSCLOUD-UZ", "n": "PS Cloud Services LLC", "t": "Hosting & VPS", "w": 0, "cc": "UZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.916, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-PCSL10-RIPE", "org": "PS Cloud Services LLC", "pdb": null, "pfx": 6, "reg": "2023-01-24", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@ps.kz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000279331436}, {"a": 61112, "h": "AkileCloud", "n": "AKILE", "t": "Hosting & VPS", "w": 6, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.2595, "hi": 4.89, "lo": 0.64, "ips": 2, "mean": 2.33, "above": false}, "urlhaus": {"n": 3, "p": 0.6389, "hi": 7.66, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}, "crowdsec": {"n": 2, "p": 0.2282, "hi": 4.64, "lo": 0.60, "ips": 2, "mean": 2.21, "above": false}, "vulncheck": {"n": 1, "p": 0.1698, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1434, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.133, 10.138, 1, false], ["2026-10-12", 1.476, 7.216, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 3, "threatfox": 0, "phishing_db": 0}, "lo": 7.216, "se": 0.991, "ts": 1.000, "map": 26.271, "obs": 3, "own": 9.014, "comp": {"urlhaus": 6.4477, "threatfox": -0.5147, "phishing_db": -1.0384}, "mass": 4.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.476, "se": 0.678, "ts": 0.500, "map": 3.811, "obs": 4, "own": 0.764, "comp": {"cins": -0.6108, "dshield": -1.1675, "crowdsec": 2.4025, "vulncheck": 0.8473, "blocklist_de": 1.2601}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.381, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AL968-RIPE", "org": "AKILE LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://akilecloud.com"}, "pfx": 132, "reg": "2023-04-26", "rir": "ripencc", "s24": 134, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 47616, "abuse": "abuse@akile.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01230721321826}, {"a": 61125, "h": "SABOTAGE", "n": "SABOTAGE", "t": "Broadband & mobile", "w": 27, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 25, "data_centre": 1, "web_exploit": 26, "bad_crawling": 26, "proxy_or_vpn": 26, "first_seen_30d": 1, "web_bruteforce": 26, "home_connection": 23, "cve:CVE-2014-8739": 2, "cve:CVE-2015-9406": 13, "cve:CVE-2017-9841": 20, "cve:CVE-2018-13379": 5, "cve:CVE-2018-20062": 16}, "n": 26}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 26, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 215.609, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.676, "det": {"blocklist_de": {"bots": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-SABO2-RIPE", "org": "SABOTAGE LLC", "pdb": null, "pfx": 1, "reg": "2020-05-25", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 28, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@sabotage.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61138, "h": "ZAPPIE-HOST-AS", "n": "Zappie Host", "t": "Hosting & VPS", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2020-5902": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3657, "hi": 5.78, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "crowdsec": {"n": 1, "p": 0.1544, "hi": 4.27, "lo": 0.32, "ips": 2, "mean": 1.80, "above": false}, "threatfox": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "phishing_db": {"n": 3, "p": 0.6334, "hi": 7.60, "lo": 1.34, "ips": 5, "mean": 3.92, "above": false}}, "h2": [["2026-10-05", 0.263, 8.692, 0, false], ["2026-10-12", 0.277, 8.700, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 8.700, "se": 0.917, "ts": 0.750, "map": 25.981, "obs": 4, "own": 9.220, "comp": {"urlhaus": -0.6139, "threatfox": 1.1418, "phishing_db": 4.3556}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.277, "se": 1.278, "ts": 1.000, "map": 2.269, "obs": 1, "own": 0.512, "comp": {"cins": -0.1282, "dshield": -0.2963, "crowdsec": 3.616, "vulncheck": -0.3102, "blocklist_de": -0.6682}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.653, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Cobalt Strike": 1}}, "oid": "ORG-ZHL2-RIPE", "org": "Zappie Host LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://zappiehost.com/"}, "pfx": 19, "reg": "2015-03-04", "rir": "ripencc", "s24": 42, "sib": 0, "tor": 2, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": "abuse@zappiehost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020325144528}, {"a": 61173, "h": "GWSN-AS", "n": "Green Web Samaneh Novin", "t": "Hosting & VPS", "w": 5, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 5, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 8, "p": 0.9943, "hi": 13.54, "lo": 4.40, "ips": 8, "mean": 8.44, "above": true}, "crowdsec": {"n": 4, "p": 0.7722, "hi": 8.46, "lo": 1.82, "ips": 5, "mean": 4.62, "above": false}}, "h2": [["2026-10-05", 6.046, 0.011, 0, false], ["2026-10-12", 9.327, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.272, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.327, "se": 0.617, "ts": 0.800, "map": 22.063, "obs": 5, "own": 4.351, "comp": {"cins": 3.5369, "dshield": -1.4081, "crowdsec": 7.0417, "vulncheck": -0.7717, "blocklist_de": -3.9113}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.861, "det": {"shodan": {"compromised": 8}}, "oid": "ORG-GWSN7-RIPE", "org": "Green Web Samaneh Novin PJSC", "pdb": null, "pfx": 31, "reg": "2013-01-22", "rir": "ripencc", "s24": 31, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7936, "abuse": "abuse@greenweb.ir", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00009742671045}, {"a": 61248, "h": "IR-FUM", "n": "Ferdowsi University of Mashhad", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6372, "hi": 7.64, "lo": 1.35, "ips": 3, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 0.642, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.570, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-FUOM2-RIPE", "org": "Ferdowsi University of Mashhad", "pdb": null, "pfx": 5, "reg": "2012-12-21", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@um.ac.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000088663848}, {"a": 61254, "h": "ESTOXY-OU", "n": "ESTOXY OU", "t": "Hosting & VPS", "w": 18, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2023-1389": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-36260": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7850, "hi": 8.65, "lo": 1.86, "ips": 4, "mean": 4.72, "above": false}, "vulncheck": {"n": 8, "p": 0.9959, "hi": 14.27, "lo": 4.64, "ips": 14, "mean": 8.90, "above": true}}, "h2": [["2026-10-05", 28.668, 0.011, 1, false], ["2026-10-12", 21.079, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.290, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 8, "blocklist_de": 0}, "lo": 21.079, "se": 0.500, "ts": 0.667, "map": 39.919, "obs": 12, "own": 7.903, "comp": {"cins": -0.9562, "dshield": -1.6266, "crowdsec": 4.9158, "vulncheck": 7.4817, "blocklist_de": -4.7341}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.603, "det": {"vulncheck": {"botnet_node": 14}, "blocklist_de": {"sip": 1}}, "oid": "ORG-EO76-RIPE", "org": "ESTOXY OU", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.estoxy.com/"}, "pfx": 22, "reg": "2023-05-17", "rir": "ripencc", "s24": 22, "sib": 1, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 5632, "abuse": "abuse@estoxy.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00251029791432}, {"a": 61272, "h": "IST-AS", "n": "Informacines sistemos ir technologijos, UAB", "t": "Other", "w": 16, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 7, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2020-5902": 1, "cve:CVE-2022-22947": 1, "cve:CVE-2022-26134": 2, "cve:CVE-2024-28000": 1}, "n": 9}, "ev": {"shodan": {"n": 3, "p": 0.5450, "hi": 6.72, "lo": 1.18, "ips": 3, "mean": 3.47, "above": false}, "dshield": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 4, "p": 0.7114, "hi": 7.68, "lo": 1.65, "ips": 9, "mean": 4.20, "above": false}, "threatfox": {"n": 4, "p": 0.8097, "hi": 9.05, "lo": 1.95, "ips": 4, "mean": 4.95, "above": true}, "vulncheck": {"n": 1, "p": 0.1829, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 4.019, 3.270, 0, false], ["2026-10-12", 6.056, 5.138, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 5.138, "se": 0.928, "ts": 1.000, "map": 15.218, "obs": 4, "own": 14.528, "comp": {"urlhaus": -0.6159, "threatfox": 5.7379, "phishing_db": -0.7734}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 6.056, "se": 0.551, "ts": 0.571, "map": 12.652, "obs": 7, "own": 7.159, "comp": {"cins": -0.984, "dshield": 1.154, "crowdsec": 4.5996, "vulncheck": 0.186, "blocklist_de": -1.0241}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.553, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:Evilginx": 3, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-ISIT5-RIPE", "org": "UAB Bacloud", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.bacloud.com"}, "pfx": 41, "reg": "2012-12-12", "rir": "ripencc", "s24": 72, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.1060]], "ipv4": 18432, "abuse": "abuse@bacloud.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.0014171690225}, {"a": 61280, "h": "CMU_GRCHC", "n": "FGUP \"GRCHC\"", "t": "Other", "w": 14, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "ssh_bruteforce": 11, "mail_bruteforce": 9, "cve:CVE-2023-22515": 2}, "n": 14}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 14, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 4.650, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.957, "det": null, "oid": "ORG-CSFG1-RIPE", "org": "FGUP \"GRCHC\"", "pdb": null, "pfx": 9, "reg": "2020-06-10", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61317, "h": "ASDETUK", "n": "Hivelocity Inc. fka Digital Energy Technologies Limited (Global)", "t": "Hosting & VPS", "w": 37, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 14, "web_exploit": 37, "bad_crawling": 5, "proxy_or_vpn": 29, "ssh_bruteforce": 1, "web_bruteforce": 35, "mail_bruteforce": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2022-22947": 3}, "n": 37}, "ev": {"shodan": {"n": 1, "p": 0.0530, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "crowdsec": {"n": 10, "p": 0.9848, "hi": 10.01, "lo": 3.64, "ips": 37, "mean": 6.49, "above": true}}, "h2": [["2026-10-05", 3.794, 0.010, 0, false], ["2026-10-12", 2.930, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.940, "ts": null, "map": 0.169, "obs": 0, "own": 0.159, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.930, "se": 0.486, "ts": 1.000, "map": 5.430, "obs": 10, "own": 1.066, "comp": {"cins": -1.364, "dshield": -2.0535, "crowdsec": 13.975, "vulncheck": -0.8816, "blocklist_de": -6.5904}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.917, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HI48-RIPE", "org": "Hivelocity LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.hivelocity.net"}, "pfx": 236, "reg": "2014-09-26", "rir": "ripencc", "s24": 261, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72448, "abuse": "abuse@hivelocity.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00194426613062}, {"a": 61323, "h": "UKFAST", "n": "ANS (UKFast)", "t": "Hosting & VPS", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0396, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "crowdsec": {"n": 2, "p": 0.0872, "hi": 3.42, "lo": 0.44, "ips": 2, "mean": 1.63, "above": false}}, "h2": [["2026-10-05", 0.247, 0.010, 0, false], ["2026-10-12", 0.257, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.150, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.257, "se": 0.860, "ts": 1.000, "map": 0.941, "obs": 2, "own": 0.191, "comp": {"cins": -0.3769, "dshield": -0.7864, "crowdsec": 5.017, "vulncheck": -0.5876, "blocklist_de": -1.9338}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.895, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UL3-RIPE", "org": "ANS ACADEMY LIMITED", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.ans.co.uk"}, "pfx": 60, "reg": "2016-06-15", "rir": "ripencc", "s24": 316, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 82688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051350075163}, {"a": 61367, "h": "ASBALKHASH", "n": "TOO \"B-TEL\"", "t": "Other", "w": 2, "cc": "KZ", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.218, 0.011, 0, false], ["2026-10-12", 3.448, 0.012, 0, false]], "sh": false, "uc": 1540.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.448, "se": 0.771, "ts": 0.667, "map": 10.811, "obs": 3, "own": 6.201, "comp": {"cins": -0.4811, "dshield": -0.9644, "crowdsec": 3.7938, "vulncheck": -0.6527, "blocklist_de": 2.0786}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.254, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BTEL2-RIPE", "org": "TOO \"B-TEL\"", "pdb": null, "pfx": 13, "reg": "2012-11-07", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009585285479}, {"a": 61436, "h": "LANTA-AS", "n": "INTEX ltd.", "t": "Other", "w": 5, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1899, "hi": 4.65, "lo": 0.35, "ips": 5, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.237, 0.011, 0, false], ["2026-10-12", 0.231, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.231, "se": 1.266, "ts": 1.000, "map": 1.779, "obs": 1, "own": 1.193, "comp": {"cins": -0.0964, "dshield": -0.2259, "crowdsec": -0.8949, "vulncheck": 3.6904, "blocklist_de": -0.5036}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.434, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-IL945-RIPE", "org": "INTEX ltd.", "pdb": null, "pfx": 4, "reg": "2012-10-10", "rir": "ripencc", "s24": 40, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@intexco.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00066465424025}, {"a": 61452, "h": "", "n": "Restel S.A.", "t": "Other", "w": 4, "cc": "AR", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 4, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2021-43798": 1, "cve:CVE-2022-22965": 1}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 4, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 8.372, 0.011, 0, false], ["2026-10-12", 9.067, 0.013, 0, false]], "sh": false, "uc": 25000, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.067, "se": 1.065, "ts": 1.000, "map": 49.793, "obs": 2, "own": 29.801, "comp": {"cins": -0.1977, "dshield": -0.4436, "crowdsec": 7.3833, "vulncheck": -0.4145, "blocklist_de": -1.026}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.353, "det": null, "oid": "@aut-61452-LACNIC", "org": "Restel S.A.", "pdb": null, "pfx": 3, "reg": "2014-07-03", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61461, "h": "", "n": "Airtek Solutions", "t": "Transit & backbone", "w": 5, "cc": "VE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.1910, "hi": 4.16, "lo": 0.73, "ips": 3, "mean": 2.14, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.90, "lo": 0.07, "ips": 1, "mean": 0.38, "above": false}, "blocklist_de": {"n": 1, "p": 0.0026, "hi": 1.74, "lo": 0.13, "ips": 1, "mean": 0.74, "above": false}}, "h2": [["2026-10-12", 0.246, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.801, "ts": null, "map": 0.114, "obs": 0, "own": 0.771, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.246, "se": 0.593, "ts": 0.600, "map": 0.547, "obs": 5, "own": 1.733, "comp": {"cins": -0.9558, "dshield": 6.9581, "crowdsec": -3.5413, "vulncheck": -0.8151, "blocklist_de": -0.8552}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.268, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-61461-LACNIC", "org": "Airtek Solutions C.A.", "pdb": {"t": "NSP", "sc": "South America", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.airtekinternet.com"}, "pfx": 115, "reg": "2014-07-15", "rir": "lacnic", "s24": 1604, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1072896, "abuse": "abuse@airtek.com.ve", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01220760033416}, {"a": 61568, "h": "", "n": "FSF Tecnologia", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3566, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.256, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.256, "se": 1.264, "ts": 1.000, "map": 2.026, "obs": 1, "own": 3.565, "comp": {"cins": -0.1334, "dshield": -0.3075, "crowdsec": 3.5546, "vulncheck": -0.3191, "blocklist_de": -0.695}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-61568-LACNIC", "org": "ALOO TELECOM - FSF TECNOLOGIA SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.alootelecom.com.br"}, "pfx": 26, "reg": "2014-09-18", "rir": "lacnic", "s24": 49, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61599, "h": "", "n": "EAÍ TELECOMUNICAÇÕES LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.971, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-61599-LACNIC", "org": "EAI TELECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "https://eai.net.br"}, "pfx": 5, "reg": "2019-10-30", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61618, "h": "", "n": "Viva Tecnologia Telecomunicações", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3564.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.160, "det": null, "oid": "@aut-61618-LACNIC", "org": "VIVA TECNOLOGIA TELECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.vivatecnologia.com.br"}, "pfx": 6, "reg": "2024-06-27", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61638, "h": "", "n": "Impactnet Telecomunicacoes LTDA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 5761.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.183, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-61638-LACNIC", "org": "Impactnet Telecomunicacoes LTDA", "pdb": null, "pfx": 4, "reg": "2014-08-18", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61662, "h": "", "n": "G2 XAXIM TELECOMUNICACOES", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 21289.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.236, "det": null, "oid": "@aut-61662-LACNIC", "org": "G2 XAXIM TELECOMUNICACOES LTDA", "pdb": null, "pfx": 2, "reg": "2014-09-02", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61664, "h": "", "n": "Rondotech Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8984.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.133, "det": null, "oid": "@aut-61664-LACNIC", "org": "RONDOTECH SERVIÇO DE COMUNICAÇÃO EIRELI-EPP", "pdb": null, "pfx": 1, "reg": "2014-09-02", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61670, "h": "", "n": "New Net Informatica e Telecomunicações", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 6884.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.186, "det": null, "oid": "@aut-61670-LACNIC", "org": "New Net Informatica e Telecomunicações", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://newnetbandalarga.com.br"}, "pfx": 12, "reg": "2014-09-03", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61675, "h": "", "n": "GRANDE REDE TELECOM EIRELLE", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 13964.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.156, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-61675-LACNIC", "org": "GRANDE REDE TELECOM EIRELLE", "pdb": null, "pfx": 7, "reg": "2014-09-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61708, "h": "", "n": "INFOCAT INFORMÁTICA", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 6.104, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 7.060, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-61708-LACNIC", "org": "INFOCAT INFORMÁTICA LTDA", "pdb": null, "pfx": 6, "reg": "2014-07-23", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61711, "h": "", "n": "BOAVISTA- PROVEDOR DE INTERNET E INFORMATICA LTDA", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 9472.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.213, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-61711-LACNIC", "org": "BOAVISTA- PROVEDOR DE INTERNET E INFORMATICA LTDA", "pdb": null, "pfx": 5, "reg": "2014-07-25", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61729, "h": "", "n": "CB NET TELECOM", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 2539.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.178, "det": null, "oid": "@aut-61729-LACNIC", "org": "CB NET TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.cbnet.inf.br"}, "pfx": 6, "reg": "2014-08-04", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 61942, "h": "", "n": "TurboNet Telecom", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "dshield": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.304, 0.011, 0, false], ["2026-10-12", 1.585, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.585, "se": 0.943, "ts": 0.500, "map": 6.874, "obs": 2, "own": 11.021, "comp": {"cins": -0.2852, "dshield": 3.7162, "crowdsec": 1.8738, "vulncheck": -0.5117, "blocklist_de": -1.4717}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.178, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-61942-LACNIC", "org": "TURBONET TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.turbonettelecom.com.br/"}, "pfx": 49, "reg": "2014-06-10", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00141097833198}, {"a": 61976, "h": "SELECTEL-NSK", "n": "Selectel - Novosibirsk", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.264, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.106, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.857, "det": null, "oid": "ORG-SL223-RIPE", "org": "JSC Selectel", "pdb": null, "pfx": 9, "reg": "2019-09-19", "rir": "ripencc", "s24": 36, "sib": 4, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": "abuse@selectel.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62000, "h": "AS62000", "n": "moji-netrix edge network", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9570, "hi": 11.20, "lo": 3.11, "ips": 6, "mean": 6.62, "above": true}}, "h2": [["2026-10-05", 0.333, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.279, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.209, "obs": 0, "own": 0.122, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.845, "det": {"shodan": {"compromised": 6}}, "oid": "ORG-NS396-RIPE", "org": "SERVERD SAS", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://as62000.net"}, "pfx": 21, "reg": "2014-10-27", "rir": "ripencc", "s24": 27, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7168, "abuse": "abuse@as62000.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00041523584674}, {"a": 62005, "h": "BV-EU-AS", "n": "BlueVPS", "t": "Hosting & VPS", "w": 17, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 1, "p": 0.1293, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "dshield": {"n": 2, "p": 0.3920, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "crowdsec": {"n": 2, "p": 0.2851, "hi": 5.10, "lo": 0.66, "ips": 2, "mean": 2.43, "above": false}, "threatfox": {"n": 6, "p": 0.9644, "hi": 11.68, "lo": 3.24, "ips": 6, "mean": 6.91, "above": true}, "vulncheck": {"n": 5, "p": 0.9015, "hi": 10.05, "lo": 2.50, "ips": 6, "mean": 5.74, "above": true}, "blocklist_de": {"n": 1, "p": 0.1607, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 3.150, 9.139, 0, false], ["2026-10-12", 7.013, 7.430, 0, false]], "sh": false, "uc": 253, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 6, "phishing_db": 0}, "lo": 7.430, "se": 0.850, "ts": 1.000, "map": 19.144, "obs": 6, "own": 6.862, "comp": {"urlhaus": -0.8587, "threatfox": 6.3253, "phishing_db": -0.8885}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 5, "blocklist_de": 1}, "lo": 7.013, "se": 0.507, "ts": 0.455, "map": 13.485, "obs": 11, "own": 2.666, "comp": {"cins": 2.6251, "dshield": 3.0396, "crowdsec": -2.5464, "vulncheck": 3.1867, "blocklist_de": -2.3098}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.447, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:pupy": 1, "family:Havoc": 2, "family:PureRAT": 1, "family:Unknown malware": 2}, "vulncheck": {"c2_server": 3, "botnet_node": 2, "other_infrastructure": 1}, "blocklist_de": {"apache": 1}}, "oid": "ORG-BO78-RIPE", "org": "BlueVPS OU", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://bluevps.com/"}, "pfx": 84, "reg": "2022-02-07", "rir": "ripencc", "s24": 88, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.8961]], "ipv4": 22528, "abuse": "abuse@bluevps.com", "score": 0.8961, "groups": ["vulncheck", "abusech"], "sensors": [], "traffic": 0.00376241777465}, {"a": 62020, "h": "NetSat", "n": "Net Sat AB", "t": "Transit & backbone", "w": 1, "cc": "SE", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 57.873, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-NSA161-RIPE", "org": "Net Sat AB", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://netsat.se"}, "pfx": 2, "reg": "2014-03-19", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@netsat.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62025, "h": "KGPSP-AS", "n": "Komenda Glowna Panstwowej Strazy Pozarnej", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.200, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-KGPS1-RIPE", "org": "Komenda Glowna Panstwowej Strazy Pozarnej", "pdb": null, "pfx": 1, "reg": "2014-03-18", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62033, "h": "HOSTERS", "n": "CLOUDEUS", "t": "Hosting & VPS", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.972, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CS654-RIPE", "org": "CLOUDEUS SL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://as62033.net"}, "pfx": 11, "reg": "2020-05-04", "rir": "ripencc", "s24": 14, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@cloud.eus", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62044, "h": "ZSCALER-EMEA", "n": "Zscaler AS62044", "t": "Hosting & VPS", "w": 0, "cc": "CH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.63, "waf": 0.55}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.045, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.864, "ts": null, "map": 0.142, "obs": 0, "own": 0.114, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.550, "ts": null, "map": 0.066, "obs": 0, "own": 0.018, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.257, "det": null, "oid": "ORG-ZSG1-RIPE", "org": "Zscaler Switzerland GmbH", "pdb": {"t": "Network Services", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.zscaler.com"}, "pfx": 513, "reg": "2014-03-07", "rir": "ripencc", "s24": 708, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 184576, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.116308}, {"a": 62048, "h": "ACAI", "n": "Avini cultural and Art Institute", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.904, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ACAA2-RIPE", "org": "Avini cultural and Art Institute", "pdb": null, "pfx": 6, "reg": "2014-03-05", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000586423665}, {"a": 62068, "h": "SpectraIP", "n": "SpectraIP B.V.", "t": "Broadband & mobile", "w": 13, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.7877, "hi": 8.69, "lo": 1.87, "ips": 4, "mean": 4.75, "above": false}, "dshield": {"n": 1, "p": 0.1932, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.3800, "hi": 5.90, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}, "vulncheck": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "phishing_db": {"n": 3, "p": 0.6390, "hi": 7.66, "lo": 1.35, "ips": 9, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 20.487, 8.187, 1, false], ["2026-10-12", 6.234, 8.261, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 8.261, "se": 1.001, "ts": 1.000, "map": 29.444, "obs": 3, "own": 67.736, "comp": {"urlhaus": -0.4416, "threatfox": -0.341, "phishing_db": 5.7912}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 6.234, "se": 0.693, "ts": 0.500, "map": 16.676, "obs": 4, "own": 26.171, "comp": {"cins": -0.5114, "dshield": 2.7414, "crowdsec": 3.4561, "vulncheck": 1.1232, "blocklist_de": -2.6017}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.975, "det": {"shodan": {"c2": 1, "compromised": 3}, "vulncheck": {"other_infrastructure": 1}}, "oid": "ORG-SB523-RIPE", "org": "SpectraIP B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://spectraip.net"}, "pfx": 24, "reg": "2016-05-03", "rir": "ripencc", "s24": 25, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "abuse@spectraip.nl", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00126026472444}, {"a": 62077, "h": "DTI-DC-PEERING", "n": "DT Iletisim Hizmetleri A.S.", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.887, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DIHA4-RIPE", "org": "DT Iletisim Hizmetleri A.S.", "pdb": null, "pfx": 5, "reg": "2014-02-21", "rir": "ripencc", "s24": 5, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62082, "h": "HOSTLAND", "n": "Hostland LTD", "t": "Hosting & VPS", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 2, "p": 0.4176, "hi": 6.24, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 0.011, 4.283, 0, false], ["2026-10-12", 0.369, 4.345, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 4.345, "se": 1.191, "ts": 1.000, "map": 23.031, "obs": 2, "own": 8.501, "comp": {"urlhaus": -0.251, "threatfox": -0.2479, "phishing_db": 5.2619}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.369, "se": 1.343, "ts": 1.000, "map": 3.291, "obs": 1, "own": 0.795, "comp": {"cins": -0.0762, "dshield": -0.1801, "crowdsec": -0.7135, "vulncheck": 3.9527, "blocklist_de": -0.3983}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.969, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-HL61-RIPE", "org": "Hostland LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.hostland.ru/"}, "pfx": 20, "reg": "2014-02-20", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": "abuse-c@hostland.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62090, "h": "RANDERS-KOMMUNE-DK", "n": "Randers Kommune", "t": "Other", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-RK23-RIPE", "org": "Randers Kommune", "pdb": null, "pfx": 3, "reg": "2014-02-18", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@randers.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005409188924}, {"a": 62121, "h": "EBZEN", "n": "Christian Ebsen ApS", "t": "Other", "w": 0, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.953, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CEA19-RIPE", "org": "Christian Ebsen ApS", "pdb": null, "pfx": 7, "reg": "2014-02-05", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@defcon1.dk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000683561048}, {"a": 62164, "h": "HEYMMAN-2", "n": "Heymman Servers", "t": "Hosting & VPS", "w": 2, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2020-37123": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "threatfox": {"n": 1, "p": 0.1974, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.339, 0.477, 0, false], ["2026-10-12", 0.360, 0.494, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.494, "se": 1.560, "ts": 1.000, "map": 5.183, "obs": 1, "own": 2.398, "comp": {"urlhaus": -0.091, "threatfox": 3.575, "phishing_db": -0.2123}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.360, "se": 1.323, "ts": 1.000, "map": 3.207, "obs": 1, "own": 0.738, "comp": {"cins": -0.1126, "dshield": -0.2619, "crowdsec": 3.8031, "vulncheck": -0.2822, "blocklist_de": -0.5873}, "mass": 0.5, "listed": false}}, "abq": true, "bot": null, "det": {"threatfox": {"family:Remcos": 1}}, "oid": "ORG-HSC8-RIPE", "org": "Heymman Servers Corporation", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.heymman.com/"}, "pfx": 26, "reg": "2019-12-05", "rir": "ripencc", "s24": 26, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62183, "h": "NORDICOM", "n": "N C in Scandinavia AB", "t": "Transit & backbone", "w": 1, "cc": "SE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0753, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}, "blocklist_de": {"n": 1, "p": 0.1357, "hi": 4.06, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.456, 0.010, 0, false], ["2026-10-12", 0.486, 0.011, 0, false]], "sh": false, "uc": 360.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.705, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.486, "se": 0.887, "ts": 0.500, "map": 1.884, "obs": 2, "own": 6.114, "comp": {"cins": -0.3732, "dshield": -0.7796, "crowdsec": 0.9952, "vulncheck": -0.5848, "blocklist_de": 2.7697}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.205, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BA353-RIPE", "org": "Bredband2 Bredbandsson AB", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.bredbandsson.se"}, "pfx": 9, "reg": "2014-01-09", "rir": "ripencc", "s24": 156, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39936, "abuse": "abuse@bredband2.se", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000939013088}, {"a": 62206, "h": "PITLINE-AS", "n": "Pitline ltd", "t": "Transit & backbone", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.901, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 2.697, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.281, "det": null, "oid": "ORG-LA684-RIPE", "org": "Pitline Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://pitline.net"}, "pfx": 13, "reg": "2013-12-24", "rir": "ripencc", "s24": 13, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@pitline.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00067022991441}, {"a": 62212, "h": "EE", "n": "SmartApe OU", "t": "Other", "w": 2, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "threatfox": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1830, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.010, 0.430, 0, false], ["2026-10-12", 0.325, 0.444, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.444, "se": 1.535, "ts": 1.000, "map": 4.425, "obs": 1, "own": 5.289, "comp": {"urlhaus": -0.1042, "threatfox": 3.4556, "phishing_db": -0.2379}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.325, "se": 1.305, "ts": 1.000, "map": 2.778, "obs": 1, "own": 1.826, "comp": {"cins": -0.1307, "dshield": -0.3018, "crowdsec": -1.1945, "vulncheck": -0.3145, "blocklist_de": 4.3571}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.730, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Sliver": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SO162-RIPE", "org": "SmartApe OU", "pdb": null, "pfx": 18, "reg": "2021-09-07", "rir": "ripencc", "s24": 35, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "abuse@smartape.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011482126116}, {"a": 62214, "h": "RACKFOREST-AS", "n": "RackForest", "t": "Hosting & VPS", "w": 6, "cc": "HU", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 1, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 5, "home_connection": 2, "cve:CVE-2024-28000": 2}, "n": 5}, "ev": {"shodan": {"n": 7, "p": 0.9754, "hi": 11.46, "lo": 3.47, "ips": 7, "mean": 6.97, "above": true}, "crowdsec": {"n": 3, "p": 0.5258, "hi": 6.55, "lo": 1.15, "ips": 5, "mean": 3.38, "above": false}, "phishing_db": {"n": 1, "p": 0.1845, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 2.947, 0.341, 0, false], ["2026-10-12", 1.863, 0.355, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.355, "se": 1.489, "ts": 1.000, "map": 3.210, "obs": 1, "own": 1.445, "comp": {"urlhaus": -0.147, "threatfox": -0.1712, "phishing_db": 3.1107}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.863, "se": 0.755, "ts": 1.000, "map": 5.594, "obs": 3, "own": 1.117, "comp": {"cins": -0.4775, "dshield": -0.9585, "crowdsec": 7.6367, "vulncheck": -0.6507, "blocklist_de": -2.4345}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.911, "det": {"shodan": {"c2": 1, "compromised": 6}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-RIKS1-RIPE", "org": "Rackforest Zrt.", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://rackforest.com/en/"}, "pfx": 18, "reg": "2013-12-19", "rir": "ripencc", "s24": 69, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 17664, "abuse": "abuse@rackforest.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00079152488613}, {"a": 62222, "h": "QS-AS", "n": "QuickSoft LLC", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.933, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-QL35-RIPE", "org": "QuickSoft LLC", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://quick-soft.net"}, "pfx": 4, "reg": "2013-12-17", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@ipnode.ru", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62240, "h": "Clouvider", "n": "Clouvider", "t": "Hosting & VPS", "w": 981, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 1.54, "waf": 1.13}, "cs": {"c": {"http_flood": 826, "data_centre": 4, "web_exploit": 714, "bad_crawling": 207, "proxy_or_vpn": 938, "first_seen_30d": 2, "ssh_bruteforce": 42, "web_bruteforce": 892, "mail_bruteforce": 40, "cve:CVE-2017-9841": 441, "cve:CVE-2017-16894": 141, "cve:CVE-2022-35914": 333, "cve:CVE-2022-46604": 322, "cve:CVE-2023-49103": 333}, "n": 938}, "ev": {"cins": {"n": 1, "p": 0.0500, "hi": 3.00, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}, "shodan": {"n": 5, "p": 0.0228, "hi": 2.67, "lo": 0.66, "ips": 5, "mean": 1.52, "above": false}, "dshield": {"n": 13, "p": 0.9989, "hi": 11.86, "lo": 4.86, "ips": 15, "mean": 8.03, "above": true}, "crowdsec": {"n": 62, "p": 1.0000, "hi": 16.45, "lo": 10.85, "ips": 938, "mean": 13.53, "above": true}, "threatfox": {"n": 2, "p": 0.2969, "hi": 5.20, "lo": 0.68, "ips": 2, "mean": 2.48, "above": false}, "vulncheck": {"n": 4, "p": 0.4120, "hi": 5.32, "lo": 1.14, "ips": 7, "mean": 2.90, "above": false}, "phishing_db": {"n": 1, "p": 0.0399, "hi": 2.84, "lo": 0.21, "ips": 1, "mean": 1.20, "above": false}, "blocklist_de": {"n": 14, "p": 0.9906, "hi": 8.84, "lo": 3.74, "ips": 43, "mean": 6.06, "above": true}}, "h2": [["2026-10-05", 6.247, 0.197, 0, false], ["2026-10-12", 6.684, 0.333, 0, false]], "sh": false, "uc": 138.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 1}, "lo": 0.333, "se": 1.047, "ts": 0.667, "map": 1.102, "obs": 3, "own": 0.481, "comp": {"urlhaus": -0.7939, "threatfox": 2.0056, "phishing_db": 0.5113}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 13, "crowdsec": 62, "vulncheck": 4, "blocklist_de": 14}, "lo": 6.684, "se": 0.365, "ts": 0.660, "map": 10.015, "obs": 94, "own": 1.956, "comp": {"cins": -2.6292, "dshield": 1.5226, "crowdsec": 9.642, "vulncheck": -0.6763, "blocklist_de": -4.1613}, "mass": 76.0, "listed": false}}, "abq": false, "bot": 0.494, "det": {"shodan": {"c2": 1, "compromised": 4}, "threatfox": {"family:Havoc": 1, "family:AdaptixC2": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 6}, "blocklist_de": {"sip": 1, "bots": 3, "imap": 2, "mail": 4, "apache": 35, "bruteforcelogin": 25}}, "oid": "ORG-CL248-RIPE", "org": "Clouvider Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.clouvider.com"}, "pfx": 1332, "reg": "2013-12-12", "rir": "ripencc", "s24": 1376, "sib": 14, "tor": 0, "w24": 78, "drop": 1, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 361216, "abuse": "abuse@clouvider.net", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.064081}, {"a": 62241, "h": "FORESTNET", "n": "ForestNet", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.492, 0.011, 0, false], ["2026-10-12", 3.544, 0.012, 0, false]], "sh": false, "uc": 4557.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.544, "se": 0.994, "ts": 0.500, "map": 16.944, "obs": 2, "own": 27.406, "comp": {"cins": -0.2649, "dshield": -0.578, "crowdsec": 2.0858, "vulncheck": -0.4917, "blocklist_de": 3.4724}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.408, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ON48-RIPE", "org": "Forest Net LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://forestnet.pro"}, "pfx": 3, "reg": "2016-05-09", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@forestnet.pro", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62248, "h": "MODIRUM", "n": "MODIRUM MDPAY OU", "t": "Other", "w": 1, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 5.568, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.875, "det": null, "oid": "ORG-MMO3-RIPE", "org": "MODIRUM MDPAY OU", "pdb": null, "pfx": 7, "reg": "2013-12-10", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@as62248.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000440535758}, {"a": 62336, "h": "PURTEL-AS", "n": "PURtel.com", "t": "Broadband & mobile", "w": 4, "cc": "DE", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1487, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "dshield": {"n": 1, "p": 0.1369, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "blocklist_de": {"n": 1, "p": 0.0935, "hi": 3.58, "lo": 0.27, "ips": 3, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 1.302, 0.010, 0, false], ["2026-10-12", 0.595, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.929, "ts": null, "map": 0.165, "obs": 0, "own": 0.981, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.595, "se": 0.735, "ts": 0.333, "map": 1.736, "obs": 3, "own": 2.727, "comp": {"cins": 3.8739, "dshield": 2.3057, "crowdsec": -4.6765, "vulncheck": -0.7197, "blocklist_de": 1.1619}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.137, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-PG85-RIPE", "org": "PURtel.com GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.purtel.com"}, "pfx": 41, "reg": "2013-10-31", "rir": "ripencc", "s24": 303, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 79616, "abuse": "abuse@purtel.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00875307636135}, {"a": 62384, "h": "RadioService-AS", "n": "Radio Service Ltd.", "t": "Other", "w": 75, "cc": "UA", "cf": null, "cs": {"c": {"mail_bruteforce": 20, "router_or_botnet": 8}, "n": 20}, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 6, "p": 0.9519, "hi": 10.91, "lo": 3.03, "ips": 20, "mean": 6.45, "above": true}, "blocklist_de": {"n": 25, "p": 1.0000, "hi": 33.76, "lo": 17.61, "ips": 56, "mean": 25.14, "above": true}}, "h2": [["2026-10-05", 104.708, 0.011, 1, false], ["2026-10-12", 135.748, 0.012, 1, false]], "sh": false, "uc": 19311.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 25}, "lo": 135.748, "se": 0.385, "ts": 0.806, "map": 213.524, "obs": 31, "own": 118.762, "comp": {"cins": -3.0365, "dshield": -3.1063, "crowdsec": -7.897, "vulncheck": -0.9853, "blocklist_de": 21.7826}, "mass": 37.4, "listed": false}}, "abq": false, "bot": 0.257, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 56, "mail": 56}}, "oid": "ORG-RSL33-RIPE", "org": "Radio Service Ltd.", "pdb": null, "pfx": 3, "reg": "2018-02-02", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 16384, "abuse": "abuse@radioservice.net.ua", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": null}, {"a": 62390, "h": "NEXONHOST", "n": "NEXONHOST", "t": "Hosting & VPS", "w": 5, "cc": "RO", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 5, "p": 0.9103, "hi": 10.32, "lo": 2.56, "ips": 5, "mean": 5.89, "above": true}}, "h2": [["2026-10-12", 3.604, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.264, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 5, "blocklist_de": 0}, "lo": 3.604, "se": 0.654, "ts": 1.000, "map": 8.758, "obs": 5, "own": 1.801, "comp": {"cins": -0.3978, "dshield": -0.8233, "crowdsec": -3.2436, "vulncheck": 10.0668, "blocklist_de": -2.0384}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.742, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-NA1241-RIPE", "org": "NexonHost Srl", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Tbps", "pol": "Open", "web": "https://nexonhost.com"}, "pfx": 36, "reg": "2021-11-02", "rir": "ripencc", "s24": 36, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0833]], "ipv4": 9216, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00041445570834}, {"a": 62403, "h": "PLETX", "n": "PletX GmbH", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 5.100, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.972, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PG319-RIPE", "org": "PletX GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://pletx.net"}, "pfx": 2, "reg": "2024-01-10", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@pletx.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62425, "h": "KuzeyDC", "n": "KuzeyDC", "t": "Broadband & mobile", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.425, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.425, "se": 1.369, "ts": 1.000, "map": 3.963, "obs": 1, "own": 7.612, "comp": {"cins": -0.0702, "dshield": -0.1665, "crowdsec": -0.6597, "vulncheck": 4.0346, "blocklist_de": -0.3674}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.677, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-MIHL3-RIPE", "org": "Mailbox Internet Hizmetleri Ltd. Sti.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://kuzeydc.com"}, "pfx": 13, "reg": "2021-05-05", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@kuzeydc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020566406945}, {"a": 62442, "h": "Dade-Samane-Fanava", "n": "Dade Samane Fanava Company (PJS)", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-72898": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1656, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 1, "p": 0.1582, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 3.248, 0.011, 0, false], ["2026-10-12", 0.293, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.682, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.293, "se": 1.287, "ts": 1.000, "map": 2.441, "obs": 1, "own": 1.587, "comp": {"cins": -0.1249, "dshield": -0.289, "crowdsec": 3.6555, "vulncheck": -0.3044, "blocklist_de": -0.651}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.817, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DSFC2-RIPE", "org": "Dade Samane Fanava Company (PJS)", "pdb": null, "pfx": 36, "reg": "2013-09-19", "rir": "ripencc", "s24": 38, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": "abuse@fanavaidc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001420935597}, {"a": 62468, "h": "HKCLOUDX", "n": "HKCLOUDX", "t": "Hosting & VPS", "w": 56, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 49, "web_exploit": 41, "proxy_or_vpn": 37, "ssh_bruteforce": 2, "web_bruteforce": 48, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 51}, "ev": {"shodan": {"n": 4, "p": 0.6788, "hi": 7.34, "lo": 1.58, "ips": 4, "mean": 4.01, "above": false}, "crowdsec": {"n": 6, "p": 0.8970, "hi": 9.05, "lo": 2.51, "ips": 51, "mean": 5.35, "above": true}, "threatfox": {"n": 3, "p": 0.6353, "hi": 7.62, "lo": 1.34, "ips": 4, "mean": 3.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1735, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1499, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 5.026, 2.318, 0, false], ["2026-10-12", 4.611, 2.241, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 2.241, "se": 1.010, "ts": 1.000, "map": 7.666, "obs": 3, "own": 2.935, "comp": {"urlhaus": -0.5186, "threatfox": 4.8937, "phishing_db": -0.7121}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 1}, "lo": 4.611, "se": 0.527, "ts": 0.750, "map": 9.244, "obs": 8, "own": 1.820, "comp": {"cins": -1.1148, "dshield": -1.8052, "crowdsec": 8.3029, "vulncheck": 0.0355, "blocklist_de": -1.8006}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.957, "det": {"shodan": {"c2": 2, "compromised": 2}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 3}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "VL-42-ARIN", "org": "VpsQuan L.L.C.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.hkcloudx.com"}, "pfx": 91, "reg": "2013-06-07", "rir": "arin", "s24": 116, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 55040, "abuse": "admin@hkcloudx.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0015672080472}, {"a": 62513, "h": "GOCODEIT-INC", "n": "GoCodeIT Inc", "t": "Other", "w": 0, "cc": "CA", "cf": {"rb": "hi", "wb": "hi", "rep": 0.24, "waf": 0.21}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.017, "det": null, "oid": "GOCOD-ARIN", "org": "GoCodeIT Inc", "pdb": {"t": null, "sc": "North America", "tr": null, "pol": "Open", "web": "https://as835.net"}, "pfx": 6, "reg": "2020-05-20", "rir": "arin", "s24": 6, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.306396}, {"a": 62563, "h": "AS-GLOBALTELEHOST", "n": "GTHost Canada", "t": "Hosting & VPS", "w": 10, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2020-11738": 1}, "n": 1}, "ev": {"dshield": {"n": 2, "p": 0.4085, "hi": 6.16, "lo": 0.80, "ips": 3, "mean": 2.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 3, "p": 0.6328, "hi": 7.59, "lo": 1.34, "ips": 6, "mean": 3.92, "above": false}}, "h2": [["2026-10-05", 4.907, 0.011, 0, false], ["2026-10-12", 5.933, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.257, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 0}, "lo": 5.933, "se": 0.603, "ts": 0.500, "map": 13.454, "obs": 6, "own": 2.692, "comp": {"cins": -0.6525, "dshield": 5.653, "crowdsec": -1.4207, "vulncheck": 3.7039, "blocklist_de": -3.2908}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.719, "det": {"threatfox": {"family:Sliver": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 5}, "blocklist_de": {"apache": 1}}, "oid": "GC-152-ARIN", "org": "GLOBALTELEHOST Corp.", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Open", "web": "https://gthost.com/"}, "pfx": 37, "reg": "2013-07-10", "rir": "arin", "s24": 41, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "abuse@globaltelehost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01060449137328}, {"a": 62564, "h": "LINVEO-LLC", "n": "LINVEO, LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9632, "hi": 11.59, "lo": 3.22, "ips": 6, "mean": 6.85, "above": true}, "vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.503, 0.011, 0, false], ["2026-10-12", 0.482, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.482, "se": 1.395, "ts": 1.000, "map": 4.736, "obs": 1, "own": 3.377, "comp": {"cins": -0.0646, "dshield": -0.1536, "crowdsec": -0.6088, "vulncheck": 4.1141, "blocklist_de": -0.3383}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.789, "det": {"shodan": {"c2": 4, "compromised": 2}, "vulncheck": {"attack_tooling": 1}}, "oid": "LL-958-ARIN", "org": "LINVEO, LLC", "pdb": null, "pfx": 10, "reg": "2023-07-17", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": "abuse@linveo.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 62610, "h": "ZEN-DPS", "n": "Zenlayer Elastic Compute", "t": "Hosting & VPS", "w": 8, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 10.88, "waf": 3.72}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.2588, "hi": 4.61, "lo": 0.81, "ips": 3, "mean": 2.38, "above": false}, "dshield": {"n": 3, "p": 0.5331, "hi": 6.62, "lo": 1.17, "ips": 3, "mean": 3.41, "above": false}, "crowdsec": {"n": 2, "p": 0.0857, "hi": 3.41, "lo": 0.44, "ips": 2, "mean": 1.62, "above": false}, "threatfox": {"n": 2, "p": 0.3911, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "blocklist_de": {"n": 4, "p": 0.6239, "hi": 6.82, "lo": 1.47, "ips": 4, "mean": 3.73, "above": false}}, "h2": [["2026-10-05", 1.166, 1.052, 0, false], ["2026-10-12", 2.619, 0.551, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 0.551, "se": 1.140, "ts": 1.000, "map": 2.323, "obs": 2, "own": 0.974, "comp": {"urlhaus": -0.444, "threatfox": 3.5697, "phishing_db": -0.6568}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.619, "se": 0.502, "ts": 0.444, "map": 5.031, "obs": 9, "own": 0.989, "comp": {"cins": -1.4846, "dshield": 4.0796, "crowdsec": -4.3347, "vulncheck": -0.8955, "blocklist_de": 5.6445}, "mass": 8.9, "listed": false}}, "abq": false, "bot": 0.464, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:DanaBot": 2}, "blocklist_de": {"ssh": 1, "imap": 3, "mail": 3}}, "oid": "ZENLA-7-ARIN", "org": "Zenlayer Inc", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "5-10Tbps", "pol": "No", "web": "https://www.zenlayer.com/"}, "pfx": 313, "reg": "2013-07-22", "rir": "arin", "s24": 319, "sib": 6, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0274], ["2026-10-12", 0.0355]], "ipv4": 81664, "abuse": "abuse@zenlayer.com", "score": 0.0355, "groups": ["cloudflare"], "sensors": [], "traffic": 0.074248}, {"a": 62618, "h": "MICHIGANTECH", "n": "Michigan Technological University", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0495, "hi": 2.99, "lo": 0.22, "ips": 1, "mean": 1.26, "above": false}}, "h2": [["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.937, "ts": null, "map": 0.168, "obs": 0, "own": 1.709, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.671, "ts": null, "map": 0.106, "obs": 0, "own": 0.961, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 1}}, "oid": "MTU-ARIN", "org": "Michigan Technological University", "pdb": {"t": "Educational/Research", "sc": "North America", "tr": "1-5Gbps", "pol": "No", "web": "http://www.mtu.edu"}, "pfx": 3, "reg": "2013-07-23", "rir": "arin", "s24": 274, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 70144, "abuse": "abuse@mtu.edu", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62633, "h": "SERVERDIME-SERVERCHEAP-HOSTRUSH", "n": "HostRush", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 3, "p": 0.6243, "hi": 7.50, "lo": 1.32, "ips": 3, "mean": 3.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 7.493, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.493, "se": 0.793, "ts": 0.333, "map": 24.495, "obs": 3, "own": 4.902, "comp": {"cins": 4.183, "dshield": -0.9693, "crowdsec": -0.0269, "vulncheck": -0.6543, "blocklist_de": 2.0596}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.940, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1}}, "oid": "AF-397-ARIN", "org": "HostRush", "pdb": null, "pfx": 16, "reg": "2021-09-14", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@hostrush.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62642, "h": "BIGLEAF", "n": "Bigleaf Networks, Inc.", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0390, "hi": 2.82, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 1.373, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.652, "ts": null, "map": 0.099, "obs": 0, "own": 0.488, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.234, "det": {"shodan": {"compromised": 1}}, "oid": "BNL-32-ARIN", "org": "Bigleaf Networks, Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "http://www.bigleaf.net/"}, "pfx": 336, "reg": "2013-07-29", "rir": "arin", "s24": 319, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 151296, "abuse": "abuse@bigleaf.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00482961667342}, {"a": 62651, "h": "NETPROTECT-DP", "n": "Black Oak Computers (MidAtlantic)", "t": "Hosting & VPS", "w": 19, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 12, "data_centre": 12, "web_exploit": 13, "bad_crawling": 6, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 13, "mail_bruteforce": 11, "cve:CVE-2021-44228": 1, "cve:CVE-2025-55182": 7, "cve:CVE-2026-60137": 8, "cve:CVE-2026-63030": 6, "cve:CVE-2026-75650": 1}, "n": 13}, "ev": {"dshield": {"n": 2, "p": 0.3917, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "crowdsec": {"n": 13, "p": 1.0000, "hi": 16.71, "lo": 6.84, "ips": 13, "mean": 11.32, "above": true}, "blocklist_de": {"n": 3, "p": 0.5834, "hi": 7.08, "lo": 1.25, "ips": 4, "mean": 3.65, "above": false}}, "h2": [["2026-10-05", 15.257, 0.011, 1, false], ["2026-10-12", 17.897, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 0.215, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 3}, "lo": 17.897, "se": 0.426, "ts": 0.722, "map": 29.757, "obs": 18, "own": 5.805, "comp": {"cins": -2.0149, "dshield": 0.4265, "crowdsec": 9.0528, "vulncheck": -0.9396, "blocklist_de": -1.738}, "mass": 14.6, "listed": false}}, "abq": false, "bot": 0.741, "det": {"blocklist_de": {"apache": 4, "bruteforcelogin": 4}}, "oid": "STL-172-ARIN", "org": "Strong Technology, LLC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": null}, "pfx": 71, "reg": "2013-07-29", "rir": "arin", "s24": 89, "sib": 4, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22784, "abuse": "abuse@strongtechnology.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.01042621153329}, {"a": 62713, "h": "AS-PUBMATIC", "n": "PubMatic", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.67, "waf": 0.59}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.271, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.113, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.703, "det": null, "oid": "PUBMA-ARIN", "org": "PubMatic, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.pubmatic.com"}, "pfx": 30, "reg": "2013-08-16", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.109375}, {"a": 62744, "h": "QUINTEX", "n": "Quintex Alliance Consulting", "t": "Hosting & VPS", "w": 100, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 100, "data_centre": 88, "web_exploit": 100, "bad_crawling": 100, "proxy_or_vpn": 100, "web_bruteforce": 100, "cve:CVE-2015-9406": 36, "cve:CVE-2017-9841": 70, "cve:CVE-2018-13379": 27, "cve:CVE-2018-20062": 65, "cve:CVE-2021-26086": 24}, "n": 100}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 100, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 5, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.032, 0.011, 0, false], ["2026-10-12", 4.382, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.382, "se": 1.009, "ts": 0.500, "map": 21.561, "obs": 2, "own": 4.456, "comp": {"cins": -0.2535, "dshield": -0.5557, "crowdsec": 2.2066, "vulncheck": -0.4799, "blocklist_de": 3.547}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.771, "det": {"blocklist_de": {"bots": 2, "apache": 3, "bruteforcelogin": 3}}, "oid": "QAC-4-ARIN", "org": "Quintex Alliance Consulting", "pdb": {"t": "Network Services", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://quintex.com"}, "pfx": 10, "reg": "2013-08-28", "rir": "arin", "s24": 9, "sib": 0, "tor": 100, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62864, "h": "NILAS", "n": "net innovation llc", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.715, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 0.333, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.893, "det": null, "oid": "NIL-148-ARIN", "org": "net innovation llc", "pdb": null, "pfx": 21, "reg": "2021-12-08", "rir": "arin", "s24": 30, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": "noc@netinnovation.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 62874, "h": "WEB2OBJECTS", "n": "Web2Objects Global", "t": "Transit & backbone", "w": 1, "cc": "US", "cf": {"rb": "lo", "wb": "lo", "rep": 4.11, "waf": 2.38}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1176, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}}, "h2": [["2026-10-05", 0.363, 0.009, 0, false], ["2026-10-12", 0.066, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.157, "obs": 0, "own": 1.251, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.066, "se": 1.100, "ts": 1.000, "map": 0.382, "obs": 1, "own": 1.299, "comp": {"cins": -0.2133, "dshield": 4.0646, "crowdsec": -1.879, "vulncheck": -0.4341, "blocklist_de": -1.1058}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.795, "det": {"blocklist_de": {"bots": 3}}, "oid": "WL-113-ARIN", "org": "Web2Objects LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Selective", "web": "http://web2objects.de"}, "pfx": 131, "reg": "2013-11-04", "rir": "arin", "s24": 423, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 109312, "abuse": "abuse@web2objects.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03141628010614}, {"a": 62904, "h": "AS62904", "n": "Eonix N.A. Region", "t": "Hosting & VPS", "w": 16, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2025-55182": 1}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.0244, "hi": 2.54, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}, "crowdsec": {"n": 4, "p": 0.0005, "hi": 1.74, "lo": 0.37, "ips": 5, "mean": 0.95, "above": false}, "vulncheck": {"n": 1, "p": 0.0260, "hi": 2.57, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "phishing_db": {"n": 3, "p": 0.2188, "hi": 4.34, "lo": 0.77, "ips": 9, "mean": 2.24, "above": false}}, "h2": [["2026-10-05", 0.227, 0.302, 0, false], ["2026-10-12", 0.256, 0.315, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.315, "se": 1.045, "ts": 1.000, "map": 1.038, "obs": 3, "own": 0.454, "comp": {"urlhaus": -0.8523, "threatfox": -0.4477, "phishing_db": 2.9638}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.256, "se": 0.570, "ts": 0.667, "map": 0.543, "obs": 6, "own": 0.108, "comp": {"cins": -0.9514, "dshield": 1.248, "crowdsec": 4.9707, "vulncheck": 0.2283, "blocklist_de": -4.7118}, "mass": 4.9, "listed": false}}, "abq": true, "bot": 0.842, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "EONIX-ARIN", "org": "Eonix Corporation", "pdb": {"t": "Content", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.serverhub.com"}, "pfx": 677, "reg": "2013-11-13", "rir": "arin", "s24": 1606, "sib": 1, "tor": 0, "w24": 9, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 424960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 63018, "h": "DEDICATED", "n": "US Dedicated", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.7648, "hi": 7.64, "lo": 1.90, "ips": 5, "mean": 4.36, "above": false}, "dshield": {"n": 3, "p": 0.5837, "hi": 7.08, "lo": 1.25, "ips": 3, "mean": 3.65, "above": false}, "crowdsec": {"n": 1, "p": 0.0661, "hi": 3.23, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}}, "h2": [["2026-10-05", 1.148, 0.010, 0, false], ["2026-10-12", 1.283, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.176, "obs": 0, "own": 0.179, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.283, "se": 0.656, "ts": 0.750, "map": 3.246, "obs": 4, "own": 0.644, "comp": {"cins": -0.6723, "dshield": 8.9405, "crowdsec": -1.5736, "vulncheck": -0.7368, "blocklist_de": -3.3866}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.827, "det": {"shodan": {"c2": 4, "compromised": 1}}, "oid": "UDL-17-ARIN", "org": "Dedicated.com", "pdb": {"t": "Content", "sc": "North America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://dedicated.com"}, "pfx": 154, "reg": "2013-12-30", "rir": "arin", "s24": 176, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 45312, "abuse": "admin@dedicated.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028344011171}, {"a": 63023, "h": "AS-GLOBALTELEHOST", "n": "GTHost", "t": "Hosting & VPS", "w": 87, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.41, "waf": 0.36}, "cs": {"c": {"http_flood": 15, "data_centre": 12, "web_exploit": 21, "bad_crawling": 12, "proxy_or_vpn": 3, "first_seen_30d": 3, "ssh_bruteforce": 5, "web_bruteforce": 20, "mail_bruteforce": 1, "cve:CVE-2017-9841": 6, "cve:CVE-2021-3129": 4, "cve:CVE-2025-4396": 4, "cve:CVE-2018-20062": 6, "cve:CVE-2020-11738": 3}, "n": 23}, "ev": {"cins": {"n": 3, "p": 0.5508, "hi": 6.77, "lo": 1.19, "ips": 3, "mean": 3.49, "above": false}, "shodan": {"n": 8, "p": 0.9182, "hi": 8.33, "lo": 2.71, "ips": 8, "mean": 5.19, "above": true}, "dshield": {"n": 9, "p": 0.9963, "hi": 13.25, "lo": 4.58, "ips": 15, "mean": 8.44, "above": true}, "crowdsec": {"n": 18, "p": 1.0000, "hi": 13.96, "lo": 6.51, "ips": 23, "mean": 9.94, "above": true}, "threatfox": {"n": 1, "p": 0.1768, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "vulncheck": {"n": 20, "p": 1.0000, "hi": 24.63, "lo": 11.93, "ips": 46, "mean": 17.80, "above": true}, "blocklist_de": {"n": 2, "p": 0.2234, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}}, "h2": [["2026-10-05", 8.501, 0.955, 0, false], ["2026-10-12", 10.408, 0.162, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.162, "se": 1.392, "ts": 1.000, "map": 1.126, "obs": 1, "own": 0.525, "comp": {"urlhaus": -0.2478, "threatfox": 2.4526, "phishing_db": -0.4601}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 9, "crowdsec": 18, "vulncheck": 20, "blocklist_de": 2}, "lo": 10.408, "se": 0.386, "ts": 0.385, "map": 16.181, "obs": 52, "own": 3.159, "comp": {"cins": 2.947, "dshield": 4.533, "crowdsec": 3.0521, "vulncheck": 2.9608, "blocklist_de": -9.3153}, "mass": 30.6, "listed": false}}, "abq": false, "bot": 0.349, "det": {"shodan": {"compromised": 8}, "threatfox": {"family:PureRAT": 1}, "vulncheck": {"c2_server": 25, "botnet_node": 21}, "blocklist_de": {"ssh": 2}}, "oid": "GC-852-ARIN", "org": "GTHost", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "https://gthost.com/"}, "pfx": 327, "reg": "2017-10-25", "rir": "arin", "s24": 343, "sib": 1, "tor": 0, "w24": 45, "drop": 1, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.9970]], "ipv4": 88064, "abuse": "abuse@globaltelehost.com", "score": 0.9970, "groups": ["sensors", "vulncheck", "shodan"], "sensors": ["crowdsec", "dshield"], "traffic": 0.176753}, {"a": 63060, "h": "ALTIUS-IN-AS", "n": "BridgeMAXX", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.898, 0.011, 0, false], ["2026-10-12", 2.040, 0.012, 0, false]], "sh": false, "uc": 2234.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 1.835, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.040, "se": 0.959, "ts": 0.500, "map": 9.112, "obs": 2, "own": 14.664, "comp": {"cins": -0.2947, "dshield": -0.6352, "crowdsec": 1.7757, "vulncheck": -0.5206, "blocklist_de": 3.2781}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.421, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ALTIU-ARIN", "org": "ALTIUS Broadband, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.bridgemaxx.com"}, "pfx": 5, "reg": "2014-01-15", "rir": "arin", "s24": 25, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "abuse@altiusbb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 63099, "h": "MADEALA-TELECOM-TECHNOLOGY", "n": "MADEALA TELECOM TECHNOLOGY INC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.992, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.663, "ts": null, "map": 0.103, "obs": 0, "own": 0.254, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.442, "det": null, "oid": "MTT-59-ARIN", "org": "MADEALA TELECOM TECHNOLOGY INC", "pdb": null, "pfx": 229, "reg": "2025-11-07", "rir": "arin", "s24": 293, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 75008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009639314083}, {"a": 63179, "h": "XAI", "n": "xAI", "t": "CDN & platforms", "w": 0, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 9.47}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 5.679, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 1.854, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.974, "det": null, "oid": "TWITT-ARIN", "org": "Twitter Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://x.ai/"}, "pfx": 12, "reg": "2014-09-02", "rir": "arin", "s24": 11, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02230101993714}, {"a": 63199, "h": "CDSC-AS1", "n": "CDS Global Cloud Co., LTD", "t": "Hosting & VPS", "w": 21, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-22965": 1}, "n": 11}, "ev": {"cins": {"n": 3, "p": 0.4866, "hi": 6.23, "lo": 1.10, "ips": 12, "mean": 3.21, "above": false}, "shodan": {"n": 2, "p": 0.0365, "hi": 2.81, "lo": 0.36, "ips": 2, "mean": 1.34, "above": false}, "dshield": {"n": 1, "p": 0.0960, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "crowdsec": {"n": 8, "p": 0.6437, "hi": 5.67, "lo": 1.85, "ips": 11, "mean": 3.54, "above": false}, "threatfox": {"n": 1, "p": 0.1626, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 3, "p": 0.2841, "hi": 4.78, "lo": 0.84, "ips": 3, "mean": 2.47, "above": false}}, "h2": [["2026-10-05", 3.082, 0.009, 0, false], ["2026-10-12", 2.774, 0.123, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.123, "se": 1.372, "ts": 1.000, "map": 0.801, "obs": 1, "own": 0.382, "comp": {"urlhaus": -0.2941, "threatfox": 2.2139, "phishing_db": -0.515}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.774, "se": 0.448, "ts": 0.533, "map": 4.850, "obs": 15, "own": 0.952, "comp": {"cins": 6.2992, "dshield": -1.1785, "crowdsec": 1.06, "vulncheck": -0.9439, "blocklist_de": -2.2641}, "mass": 15.6, "listed": false}}, "abq": false, "bot": 0.908, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:DanaBot": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "CDSC-1-ARIN", "org": "CDS Global Cloud Co., Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.cdsglobalcloud.com/"}, "pfx": 488, "reg": "2014-09-08", "rir": "arin", "s24": 581, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 171008, "abuse": "abuse@urbanconnectedcloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02696493727664}, {"a": 63410, "h": "PRIVATESYSTEMS", "n": "PrivateSystems Networks", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 3, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.3967, "hi": 5.22, "lo": 1.12, "ips": 4, "mean": 2.85, "above": false}, "phishing_db": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 1.393, 0.178, 0, false], ["2026-10-12", 0.831, 0.188, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.188, "se": 1.402, "ts": 1.000, "map": 1.358, "obs": 1, "own": 1.622, "comp": {"urlhaus": -0.2467, "threatfox": -0.2452, "phishing_db": 2.4242}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.831, "se": 0.652, "ts": 1.000, "map": 2.074, "obs": 4, "own": 1.182, "comp": {"cins": -0.6879, "dshield": -1.2796, "crowdsec": 8.2948, "vulncheck": -0.7422, "blocklist_de": -3.4618}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.989, "det": null, "oid": "KNOWN-1-ARIN", "org": "PrivateSystems Networks", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "http://privatesystems.net"}, "pfx": 40, "reg": "2015-02-26", "rir": "arin", "s24": 283, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72448, "abuse": "abuse@privatesystems.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 63473, "h": "HOSTHATCH", "n": "HostHatch", "t": "Hosting & VPS", "w": 20, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 1, "web_exploit": 8, "bad_crawling": 5, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 11, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2021-43798": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-87902": 2}, "n": 12}, "ev": {"shodan": {"n": 14, "p": 1.0000, "hi": 17.36, "lo": 7.33, "ips": 14, "mean": 11.90, "above": true}, "dshield": {"n": 1, "p": 0.1715, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 12, "p": 0.9997, "hi": 14.68, "lo": 5.81, "ips": 12, "mean": 9.82, "above": true}, "threatfox": {"n": 1, "p": 0.1909, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 4, "p": 0.7820, "hi": 8.60, "lo": 1.85, "ips": 4, "mean": 4.70, "above": false}, "blocklist_de": {"n": 3, "p": 0.5601, "hi": 6.86, "lo": 1.21, "ips": 3, "mean": 3.54, "above": false}}, "h2": [["2026-10-05", 6.633, 0.258, 0, false], ["2026-10-12", 12.332, 0.266, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.266, "se": 1.446, "ts": 1.000, "map": 2.149, "obs": 1, "own": 0.978, "comp": {"urlhaus": -0.1725, "threatfox": 2.919, "phishing_db": -0.3551}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 12, "vulncheck": 4, "blocklist_de": 3}, "lo": 12.332, "se": 0.428, "ts": 0.600, "map": 20.945, "obs": 20, "own": 4.093, "comp": {"cins": -1.9754, "dshield": -1.0034, "crowdsec": 8.1471, "vulncheck": 0.7019, "blocklist_de": -1.4345}, "mass": 14.1, "listed": false}}, "abq": false, "bot": 0.887, "det": {"shodan": {"compromised": 14}, "threatfox": {"family:AdaptixC2": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 3}, "blocklist_de": {"ftp": 2, "ssh": 1}}, "oid": "HOSTH-2-ARIN", "org": "HostHatch, LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://hosthatch.com"}, "pfx": 100, "reg": "2015-04-14", "rir": "arin", "s24": 122, "sib": 0, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 31744, "abuse": "abuse@hosthatch.com", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00534407292388}, {"a": 63491, "h": "IDNIC-WIMA-AS-ID", "n": "Universitas Katolik Widya Mandala", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.368, 0.011, 0, false], ["2026-10-12", 5.886, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.886, "se": 1.031, "ts": 0.500, "map": 30.211, "obs": 2, "own": 17.995, "comp": {"cins": -0.2377, "dshield": -0.5244, "crowdsec": 2.3761, "vulncheck": -0.4627, "blocklist_de": 3.6506}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.191, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-63491-APNIC", "org": "Universitas Katolik Widya Mandala", "pdb": null, "pfx": 6, "reg": "2014-05-23", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 63501, "h": "MEGAHUB-AS-ID", "n": "Mega Mentari Mandiri", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2019-8318": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 16.974, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.345, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-63501-APNIC", "org": "PT Mega Mentari Mandiri", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.megahub.id"}, "pfx": 6, "reg": "2014-05-23", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@megahub.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001001909579}, {"a": 63526, "h": "SSDTL-BD", "n": "Systems Solutions & Development Technologies Limited", "t": "Broadband & mobile", "w": 7, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 4, "router_or_botnet": 3, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1904, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 1, "p": 0.1584, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 4, "p": 0.7489, "hi": 8.14, "lo": 1.75, "ips": 4, "mean": 4.44, "above": false}, "blocklist_de": {"n": 4, "p": 0.7893, "hi": 8.71, "lo": 1.88, "ips": 4, "mean": 4.76, "above": false}}, "h2": [["2026-10-05", 14.687, 0.011, 1, false], ["2026-10-12", 17.442, 0.012, 1, false]], "sh": false, "uc": 640, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 1.619, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 4}, "lo": 17.442, "se": 0.503, "ts": 0.444, "map": 33.246, "obs": 9, "own": 51.026, "comp": {"cins": 2.0683, "dshield": -2.1386, "crowdsec": -0.0317, "vulncheck": -0.8926, "blocklist_de": 5.8923}, "mass": 8.6, "listed": false}}, "abq": true, "bot": 0.180, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SSDT2-AP-APNIC", "org": "Systems Solutions & development Technologies Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.carnival.com.bd"}, "pfx": 47, "reg": "2014-08-11", "rir": "apnic", "s24": 47, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00478118941027}, {"a": 63718, "h": "HZ-YOUYUN", "n": "Hangzhou YouYun Technology Co., Ltd.", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.305, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.501, "det": null, "oid": "@aut-63718-APNIC", "org": "Hangzhou YouYun Technology Co., Ltd.", "pdb": null, "pfx": 7, "reg": "2014-08-25", "rir": "apnic", "s24": 36, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000574392481}, {"a": 63730, "h": "VNSO-VN", "n": "VNSO TECHNOLOGY JOINT STOCK COMPANY", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.935, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-63730-APNIC", "org": "VNSO TECHNOLOGY JOINT STOCK COMPANY", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://vnso.vn"}, "pfx": 3, "reg": "2015-12-30", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004978316658}, {"a": 63731, "h": "TPTECO-AS-VN", "n": "TIEN PHAT TECHNOLOGY CORPORATION", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4034, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.458, 0.011, 0, false], ["2026-10-12", 0.494, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.494, "se": 1.386, "ts": 1.000, "map": 4.926, "obs": 1, "own": 3.368, "comp": {"cins": -0.0935, "dshield": -0.2194, "crowdsec": 4.0349, "vulncheck": -0.2452, "blocklist_de": -0.4885}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.256, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-63731-APNIC", "org": "TIEN PHAT TECHNOLOGY CORPORATION", "pdb": null, "pfx": 18, "reg": "2015-12-30", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015968611666}, {"a": 63734, "h": "GREENCLOUDVPS-AS-VN", "n": "365 Online technology joint stock company", "t": "Hosting & VPS", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.9135, "hi": 10.42, "lo": 2.59, "ips": 5, "mean": 5.95, "above": true}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 8.796, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.781, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-63734-APNIC", "org": "365 Online technology joint stock company", "pdb": null, "pfx": 1, "reg": "2014-08-25", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0001042297683}, {"a": 63737, "h": "VIETSERVER-AS-VN", "n": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED", "t": "Hosting & VPS", "w": 9, "cc": "VN", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 3}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 3, "p": 0.5174, "hi": 6.48, "lo": 1.14, "ips": 3, "mean": 3.34, "above": false}, "crowdsec": {"n": 3, "p": 0.4872, "hi": 6.23, "lo": 1.10, "ips": 3, "mean": 3.21, "above": false}, "vulncheck": {"n": 1, "p": 0.1785, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "phishing_db": {"n": 2, "p": 0.3937, "hi": 6.02, "lo": 0.78, "ips": 3, "mean": 2.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1591, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 8.718, 1.396, 0, false], ["2026-10-12", 4.154, 1.431, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.431, "se": 1.148, "ts": 1.000, "map": 6.511, "obs": 2, "own": 2.542, "comp": {"urlhaus": -0.3688, "threatfox": -0.3107, "phishing_db": 4.1792}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 4.154, "se": 0.585, "ts": 0.500, "map": 9.168, "obs": 6, "own": 1.816, "comp": {"cins": 3.2233, "dshield": -1.5908, "crowdsec": 2.3915, "vulncheck": 0.2625, "blocklist_de": -0.6771}, "mass": 4.7, "listed": false}}, "abq": true, "bot": 0.799, "det": {"shodan": {"malware": 3}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-63737-APNIC", "org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED", "pdb": null, "pfx": 43, "reg": "2014-08-25", "rir": "apnic", "s24": 92, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 23552, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075975462976}, {"a": 63746, "h": "IOIT-AS-VN", "n": "Institute of Information Technology (IOIT)", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-63746-APNIC", "org": "Institute of Information Technology (IOIT)", "pdb": null, "pfx": 5, "reg": "2014-08-25", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 63759, "h": "TADU-AS-VN", "n": "TaDu Joint Stock Company", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.637, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"sip": 1}}, "oid": "@aut-63759-APNIC", "org": "TaDu Joint Stock Company", "pdb": null, "pfx": 1, "reg": "2014-08-25", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000589240309}, {"a": 63760, "h": "AZDIGI-AS-VN", "n": "AZDIGI Corporation", "t": "Other", "w": 5, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"shodan": {"n": 8, "p": 0.9952, "hi": 13.90, "lo": 4.52, "ips": 8, "mean": 8.67, "above": true}, "crowdsec": {"n": 5, "p": 0.9009, "hi": 10.03, "lo": 2.49, "ips": 5, "mean": 5.73, "above": true}, "blocklist_de": {"n": 2, "p": 0.4104, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 5.718, 0.011, 0, false], ["2026-10-12", 26.153, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 26.153, "se": 0.546, "ts": 0.714, "map": 54.598, "obs": 7, "own": 30.697, "comp": {"cins": -1.0435, "dshield": -1.7271, "crowdsec": 6.615, "vulncheck": -0.8327, "blocklist_de": 2.3819}, "mass": 5.4, "listed": false}}, "abq": true, "bot": 0.919, "det": {"shodan": {"compromised": 8}, "blocklist_de": {"ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-63760-APNIC", "org": "AZDIGI Corporation", "pdb": null, "pfx": 5, "reg": "2014-08-25", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 4608, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00031128097406}, {"a": 63765, "h": "HOSTVN-VN", "n": "HOSTVN-VN", "t": "Hosting & VPS", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4062, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 3.259, 0.011, 0, false], ["2026-10-12", 9.429, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 9.429, "se": 0.799, "ts": 0.667, "map": 31.210, "obs": 3, "own": 6.238, "comp": {"cins": -0.4648, "dshield": -0.9375, "crowdsec": 0.1443, "vulncheck": -0.6436, "blocklist_de": 6.736}, "mass": 2.1, "listed": false}}, "abq": true, "bot": 0.493, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-63765-APNIC", "org": "HOSTVN Technology Solutions Joint Stock Company", "pdb": null, "pfx": 12, "reg": "2014-08-25", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001834815934}, {"a": 63835, "h": "CT-HuNan-Changsha-IDC", "n": "China Telecom Changsha IDC Network", "t": "Broadband & mobile", "w": 14, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 9, "cve:CVE-2024-6387": 6, "cve:CVE-2025-63387": 1}, "n": 10}, "ev": {"cins": {"n": 2, "p": 0.2760, "hi": 5.03, "lo": 0.65, "ips": 2, "mean": 2.40, "above": false}, "shodan": {"n": 16, "p": 0.9993, "hi": 10.68, "lo": 4.76, "ips": 16, "mean": 7.47, "above": true}, "crowdsec": {"n": 9, "p": 0.7459, "hi": 6.07, "lo": 2.10, "ips": 10, "mean": 3.87, "above": false}, "blocklist_de": {"n": 4, "p": 0.4548, "hi": 5.58, "lo": 1.20, "ips": 4, "mean": 3.05, "above": false}}, "h2": [["2026-10-05", 2.816, 0.009, 0, false], ["2026-10-12", 2.666, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.147, "obs": 0, "own": 0.782, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 4}, "lo": 2.666, "se": 0.447, "ts": 0.600, "map": 4.662, "obs": 15, "own": 7.177, "comp": {"cins": 3.5506, "dshield": -2.5991, "crowdsec": 2.6039, "vulncheck": -0.9431, "blocklist_de": 0.3209}, "mass": 15.4, "listed": false}}, "abq": true, "bot": 0.599, "det": {"shodan": {"compromised": 16}, "blocklist_de": {"ftp": 1, "ssh": 3}}, "oid": null, "org": null, "pdb": null, "pfx": 250, "reg": "2014-10-15", "rir": "apnic", "s24": 597, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 244224, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00105636434878}, {"a": 63859, "h": "MYREPUBLIC-AS-ID", "n": "PT. Ekamas Mora Republik", "t": "Broadband & mobile", "w": 43, "cc": "ID", "cf": {"rb": "", "wb": "hi", "rep": 1.93, "waf": 0.73}, "cs": {"c": {"http_flood": 23, "web_exploit": 30, "bad_crawling": 7, "proxy_or_vpn": 9, "ssh_bruteforce": 5, "web_bruteforce": 33, "home_connection": 17, "mail_bruteforce": 5, "router_or_botnet": 5, "cve:CVE-2017-9841": 4, "cve:CVE-2024-28000": 5, "cve:CVE-2026-60137": 7, "cve:CVE-2026-63030": 11, "cve:CVE-2026-87902": 2}, "n": 35}, "ev": {"shodan": {"n": 3, "p": 0.2651, "hi": 4.65, "lo": 0.82, "ips": 3, "mean": 2.40, "above": false}, "dshield": {"n": 4, "p": 0.7245, "hi": 7.83, "lo": 1.69, "ips": 5, "mean": 4.28, "above": false}, "crowdsec": {"n": 22, "p": 1.0000, "hi": 17.17, "lo": 8.59, "ips": 35, "mean": 12.57, "above": true}, "phishing_db": {"n": 1, "p": 0.1405, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "blocklist_de": {"n": 5, "p": 0.7847, "hi": 7.88, "lo": 1.96, "ips": 5, "mean": 4.50, "above": false}}, "h2": [["2026-10-05", 8.214, 0.170, 0, false], ["2026-10-12", 9.295, 0.179, 0, false]], "sh": false, "uc": 165.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.179, "se": 1.398, "ts": 1.000, "map": 1.276, "obs": 1, "own": 3.792, "comp": {"urlhaus": -0.255, "threatfox": -0.2504, "phishing_db": 2.3755}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 22, "vulncheck": 0, "blocklist_de": 5}, "lo": 9.295, "se": 0.395, "ts": 0.710, "map": 14.936, "obs": 31, "own": 22.874, "comp": {"cins": -2.6413, "dshield": 0.9524, "crowdsec": 9.468, "vulncheck": -0.9714, "blocklist_de": -2.7103}, "mass": 25.7, "listed": false}}, "abq": false, "bot": 0.127, "det": {"shodan": {"compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 2, "bots": 1, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-63859-APNIC", "org": "PT. Eka Mas Republik", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.myrepublic.co.id/"}, "pfx": 335, "reg": "2014-11-18", "rir": "apnic", "s24": 312, "sib": 1, "tor": 0, "w24": 25, "drop": 1, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 118272, "abuse": "abuse-id@myrepublic.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.087387}, {"a": 63879, "h": "IDNIC-UINSGD-AS-ID", "n": "UIN Sunan Gunung Djati Bandung", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.255, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-63879-APNIC", "org": "UIN Sunan Gunung Djati Bandung", "pdb": null, "pfx": 2, "reg": "2014-11-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 63885, "h": "MYNET-AS-ID", "n": "Inovasi Tjaraka Buana", "t": "Enterprise, edu & gov", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.812, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 3.865, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.812, "se": 1.514, "ts": 1.000, "map": 10.069, "obs": 1, "own": 75.098, "comp": {"cins": -0.0687, "dshield": -0.1629, "crowdsec": -0.6454, "vulncheck": -0.1914, "blocklist_de": 4.7715}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.235, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-63885-APNIC", "org": "PT Inovasi Tjaraka Buana", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.mynet.co.id"}, "pfx": 5, "reg": "2014-11-18", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "info@mynet.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005292652178}, {"a": 63888, "h": "DATAWINGLIMITED-AS", "n": "TISP LIMITED", "t": "Broadband & mobile", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.222, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 1.533, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.870, "ts": null, "map": 0.180, "obs": 0, "own": 0.641, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.148, "det": null, "oid": "ORG-DWL2-AP-APNIC", "org": "DATA WING LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.tisp.com"}, "pfx": 60, "reg": "2014-11-18", "rir": "apnic", "s24": 60, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00096033943646}, {"a": 63902, "h": "SHINETEL-AS-TW", "n": "SHINE TELECOM CO., LTD.", "t": "Broadband & mobile", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.645, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-63902-APNIC", "org": "SHINE TELECOM CO., LTD.", "pdb": null, "pfx": 21, "reg": "2014-11-19", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000008933795}, {"a": 63949, "h": "AKAMAI-LINODE-AP", "n": "Linode AS63949", "t": "Hosting & VPS", "w": 939, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.67, "waf": 2.30}, "cs": {"c": {"http_flood": 205, "data_centre": 307, "web_exploit": 250, "bad_crawling": 141, "proxy_or_vpn": 18, "first_seen_30d": 19, "ssh_bruteforce": 228, "web_bruteforce": 106, "home_connection": 4, "mail_bruteforce": 30, "cve:CVE-2019-8318": 92, "cve:CVE-2023-1389": 14, "cve:CVE-2017-12149": 15, "cve:CVE-2024-36401": 88, "cve:CVE-2025-26399": 64}, "n": 371}, "ev": {"cins": {"n": 101, "p": 1.0000, "hi": 36.60, "lo": 26.40, "ips": 360, "mean": 31.33, "above": true}, "shodan": {"n": 541, "p": 1.0000, "hi": 46.80, "lo": 40.63, "ips": 541, "mean": 43.67, "above": true}, "dshield": {"n": 90, "p": 1.0000, "hi": 27.63, "lo": 19.55, "ips": 121, "mean": 23.44, "above": true}, "urlhaus": {"n": 3, "p": 0.3453, "hi": 5.19, "lo": 0.91, "ips": 3, "mean": 2.68, "above": false}, "crowdsec": {"n": 252, "p": 1.0000, "hi": 18.41, "lo": 14.97, "ips": 371, "mean": 16.65, "above": true}, "threatfox": {"n": 11, "p": 0.9896, "hi": 10.01, "lo": 3.81, "ips": 11, "mean": 6.59, "above": true}, "vulncheck": {"n": 64, "p": 1.0000, "hi": 20.73, "lo": 13.77, "ips": 67, "mean": 17.10, "above": true}, "phishing_db": {"n": 44, "p": 1.0000, "hi": 15.67, "lo": 9.57, "ips": 46, "mean": 12.47, "above": true}, "blocklist_de": {"n": 55, "p": 1.0000, "hi": 10.24, "lo": 6.59, "ips": 63, "mean": 8.33, "above": true}}, "h2": [["2026-10-05", 14.937, 2.514, 2, false], ["2026-10-12", 12.006, 2.445, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 3, "threatfox": 11, "phishing_db": 44}, "lo": 2.445, "se": 0.779, "ts": 0.759, "map": 5.040, "obs": 58, "own": 1.919, "comp": {"urlhaus": -0.7207, "threatfox": 0.4266, "phishing_db": 3.5376}, "mass": 37.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 101, "dshield": 90, "crowdsec": 252, "vulncheck": 64, "blocklist_de": 55}, "lo": 12.006, "se": 0.348, "ts": 0.448, "map": 17.876, "obs": 562, "own": 3.485, "comp": {"cins": 12.9632, "dshield": 1.6177, "crowdsec": 0.3705, "vulncheck": -0.2546, "blocklist_de": -10.4197}, "mass": 525.6, "listed": true}}, "abq": false, "bot": 0.814, "det": {"shodan": {"c2": 100, "malware": 9, "compromised": 418, "doublepulsar": 14}, "threatfox": {"family:Chaos": 2, "family:Havoc": 1, "family:PureRAT": 1, "family:Evilginx": 2, "family:Unknown malware": 4}, "vulncheck": {"c2_server": 37, "botnet_node": 13, "attack_tooling": 16, "other_infrastructure": 1}, "blocklist_de": {"ftp": 2, "ssh": 37, "bots": 1, "imap": 11, "mail": 12, "apache": 11, "bruteforcelogin": 8}}, "oid": "ORG-ATI1-AP-APNIC", "org": "Akamai Technologies, Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.linode.com/"}, "pfx": 354, "reg": "2015-02-16", "rir": "apnic", "s24": 5341, "sib": 6, "tor": 12, "w24": 498, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 1385472, "abuse": "abuse@linode.com", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": 0.174682}, {"a": 63961, "h": "BDREN-UGC-AS-AP", "n": "BdREN", "t": "Enterprise, edu & gov", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.3965, "hi": 6.05, "lo": 0.79, "ips": 2, "mean": 2.88, "above": false}, "dshield": {"n": 1, "p": 0.1946, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.3901, "hi": 5.99, "lo": 0.78, "ips": 3, "mean": 2.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 9.703, 0.011, 0, false], ["2026-10-12", 10.123, 0.012, 1, false]], "sh": false, "uc": 1418.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 3.245, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 10.123, "se": 0.683, "ts": 0.500, "map": 26.917, "obs": 4, "own": 151.699, "comp": {"cins": -0.6114, "dshield": 2.3605, "crowdsec": 2.3954, "vulncheck": -0.7137, "blocklist_de": 1.2557}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.204, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BRAE1-AP-APNIC", "org": "Bangladesh Research and Education Network (BdREN)", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.bdren.net.bd"}, "pfx": 11, "reg": "2015-03-16", "rir": "apnic", "s24": 19, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@bdren.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033922827412}, {"a": 63962, "h": "ITOOLS-AS", "n": "iTools JSC", "t": "Other", "w": 0, "cc": "MN", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6300, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 0.507, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.901, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-IT3-AP-APNIC", "org": "Intelligent Tools", "pdb": null, "pfx": 5, "reg": "2015-03-17", "rir": "apnic", "s24": 12, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "admin@itools.mn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010021273128}, {"a": 63969, "h": "RACEONLINE-BD", "n": "Race Online", "t": "Broadband & mobile", "w": 18, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 11, "bad_crawling": 2, "proxy_or_vpn": 6, "first_seen_30d": 2, "ssh_bruteforce": 6, "web_bruteforce": 9, "home_connection": 8, "mail_bruteforce": 1, "router_or_botnet": 11, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 15}, "ev": {"shodan": {"n": 6, "p": 0.9367, "hi": 10.23, "lo": 2.84, "ips": 6, "mean": 6.04, "above": true}, "crowdsec": {"n": 14, "p": 1.0000, "hi": 18.29, "lo": 7.73, "ips": 15, "mean": 12.53, "above": true}, "blocklist_de": {"n": 5, "p": 0.8902, "hi": 9.74, "lo": 2.42, "ips": 5, "mean": 5.56, "above": true}}, "h2": [["2026-10-05", 16.206, 0.011, 1, false], ["2026-10-12", 23.864, 0.012, 1, false]], "sh": false, "uc": 1156, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.023, "ts": null, "map": 0.187, "obs": 0, "own": 1.459, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 5}, "lo": 23.864, "se": 0.422, "ts": 0.737, "map": 39.901, "obs": 19, "own": 61.018, "comp": {"cins": -2.1359, "dshield": -2.6408, "crowdsec": 8.6544, "vulncheck": -0.947, "blocklist_de": 2.1494}, "mass": 16.2, "listed": false}}, "abq": true, "bot": 0.174, "det": {"shodan": {"compromised": 6}, "blocklist_de": {"ssh": 4, "bots": 1}}, "oid": "ORG-ROL1-AP-APNIC", "org": "Race Online Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.race.net.bd"}, "pfx": 77, "reg": "2015-03-31", "rir": "apnic", "s24": 74, "sib": 2, "tor": 0, "w24": 16, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8212]], "ipv4": 20480, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.01153708902331}, {"a": 63996, "h": "MNL-AS-AP", "n": "Mazeda Networks", "t": "Broadband & mobile", "w": 14, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 6, "bad_crawling": 1, "ssh_bruteforce": 11, "web_bruteforce": 11, "home_connection": 11, "cve:CVE-2026-63030": 1}, "n": 11}, "ev": {"crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 11, "mean": 1.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 10, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 2.254, 0.012, 0, false]], "sh": false, "uc": 2574.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.254, "se": 0.965, "ts": 0.500, "map": 10.157, "obs": 2, "own": 16.359, "comp": {"cins": -0.2895, "dshield": -0.6252, "crowdsec": 1.8299, "vulncheck": -0.5157, "blocklist_de": 3.3123}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.169, "det": {"blocklist_de": {"ssh": 9, "bots": 1}}, "oid": "ORG-MNL1-AP-APNIC", "org": "Mazeda Networks Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://mazedanetworks.net"}, "pfx": 36, "reg": "2015-06-15", "rir": "apnic", "s24": 22, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "abuse@mazedanetworks.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0020255433378}, {"a": 64037, "h": "FIRSTNFASTITLTD-AS-AP", "n": "First n Fast IT Ltd", "t": "Other", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6383, "hi": 7.65, "lo": 1.35, "ips": 4, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 5.824, 0.011, 0, false], ["2026-10-12", 17.361, 0.013, 1, false]], "sh": false, "uc": 3906.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 17.361, "se": 0.815, "ts": 1.000, "map": 58.864, "obs": 3, "own": 33.736, "comp": {"cins": -0.3736, "dshield": -0.7804, "crowdsec": 9.125, "vulncheck": -0.5851, "blocklist_de": -1.917}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.186, "det": null, "oid": "ORG-FNFI1-AP-APNIC", "org": "First n Fast IT Ltd", "pdb": null, "pfx": 5, "reg": "2015-09-29", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "info@fnfbd.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009483083079}, {"a": 64043, "h": "EUROTELBD-ONLINE-LTD-BD", "n": "EUROtelbd Online", "t": "Other", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2026-8181": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}}, "h2": [["2026-10-12", 20.460, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.460, "se": 0.692, "ts": 0.750, "map": 55.681, "obs": 4, "own": 31.550, "comp": {"cins": -0.5421, "dshield": 2.6213, "crowdsec": 6.7706, "vulncheck": -0.6836, "blocklist_de": -2.753}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.167, "det": null, "oid": "ORG-EOL5-AP-APNIC", "org": "EUROtelbd Online Ltd.", "pdb": null, "pfx": 12, "reg": "2015-10-12", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "info@eurotelbd.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00167062897917}, {"a": 64050, "h": "BGNL-HK", "n": "BGP Network Limited", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 0.199, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.780, "ts": null, "map": 0.147, "obs": 0, "own": 0.056, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.870, "det": null, "oid": "ORG-BCPL4-AP-APNIC", "org": "BGP Network Limited", "pdb": {"t": "Network Services", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.bgp.net"}, "pfx": 112, "reg": "2015-10-20", "rir": "apnic", "s24": 120, "sib": 0, "tor": 0, "w24": 0, "drop": 7, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 77056, "abuse": "abuse@bgp.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00195412009461}, {"a": 64073, "h": "VETTA", "n": "Vetta Group", "t": "Transit & backbone", "w": 1, "cc": "NZ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1885, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.268, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 2.324, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.268, "se": 1.272, "ts": 1.000, "map": 2.165, "obs": 1, "own": 7.763, "comp": {"cins": -0.131, "dshield": 4.4905, "crowdsec": -1.1964, "vulncheck": -0.3149, "blocklist_de": -0.6824}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.424, "det": null, "oid": "ORG-VOL1-AP-APNIC", "org": "VETTA TRADING LIMITED", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://vetta.nz"}, "pfx": 56, "reg": "2015-12-11", "rir": "apnic", "s24": 45, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": "noc@vetta.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006477397875}, {"a": 64079, "h": "CTGL-IPX", "n": "China Telecom Global Limited", "t": "Broadband & mobile", "w": 2, "cc": "HK", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 2.417, 0.011, 0, false], ["2026-10-12", 2.564, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.564, "se": 0.972, "ts": 1.000, "map": 11.735, "obs": 2, "own": 18.886, "comp": {"cins": -0.2602, "dshield": -0.5688, "crowdsec": 6.5171, "vulncheck": -0.4869, "blocklist_de": -1.3449}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CTGL1-AP-APNIC", "org": "China Telecom Global Limited", "pdb": null, "pfx": 17, "reg": "2016-01-06", "rir": "apnic", "s24": 17, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008154974604}, {"a": 64099, "h": "", "n": "COOP DE GRAL VIAMONTE", "t": "Broadband & mobile", "w": 1, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": 7656.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 19.293, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.188, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-64099-LACNIC", "org": "COOP DE GRAL VIAMONTE", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.coegv.com.ar"}, "pfx": 5, "reg": "2015-10-13", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 64107, "h": "", "n": "RACK SPHERE HOSTING S.A.", "t": "Hosting & VPS", "w": 4, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "threatfox": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.191, 0.999, 0, false], ["2026-10-12", 20.312, 1.030, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 1.030, "se": 1.880, "ts": 1.000, "map": 16.185, "obs": 1, "own": 11.843, "comp": {"urlhaus": -0.0112, "threatfox": 4.4516, "phishing_db": -0.0301}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.312, "se": 1.147, "ts": 0.500, "map": 130.482, "obs": 2, "own": 27.856, "comp": {"cins": 4.8566, "dshield": -0.3936, "crowdsec": 3.0863, "vulncheck": -0.3817, "blocklist_de": -0.9027}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.921, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-64107-LACNIC", "org": "RACK SPHERE HOSTING S.A.", "pdb": null, "pfx": 1, "reg": "2017-11-15", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000012701472}, {"a": 64123, "h": "", "n": "Dodolink Internacional SRL", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2020-5902": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2020-13640": 1, "cve:CVE-2021-34427": 1, "cve:CVE-2021-43798": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3969, "hi": 6.05, "lo": 0.79, "ips": 3, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 2.632, 0.011, 0, false], ["2026-10-12", 2.816, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.816, "se": 0.978, "ts": 1.000, "map": 13.046, "obs": 2, "own": 21.013, "comp": {"cins": -0.2555, "dshield": -0.5597, "crowdsec": 6.5804, "vulncheck": -0.482, "blocklist_de": -1.3211}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.252, "det": null, "oid": "@aut-64123-LACNIC", "org": "DODOLINK INTERNACIONAL SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Selective", "web": "https://dodoLink.com.ar"}, "pfx": 16, "reg": "2020-04-29", "rir": "lacnic", "s24": 15, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "noc@dodolink.com.ar", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00087900270297}, {"a": 64126, "h": "", "n": "DOMINICAN TELECOM PRIME DTP", "t": "Broadband & mobile", "w": 13, "cc": "DO", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.3983, "hi": 6.07, "lo": 0.79, "ips": 12, "mean": 2.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.169, 0.011, 0, false], ["2026-10-12", 1.258, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 1.469, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 1}, "lo": 1.258, "se": 0.786, "ts": 0.667, "map": 3.912, "obs": 3, "own": 6.379, "comp": {"cins": -0.3588, "dshield": -0.754, "crowdsec": -2.9723, "vulncheck": 3.9809, "blocklist_de": 2.8621}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.264, "det": {"vulncheck": {"botnet_node": 12}, "blocklist_de": {"bots": 1}}, "oid": "@aut-64126-LACNIC", "org": "DOMINICAN TELECOM PRIME, DTP, S.R.L.", "pdb": {"t": "NSP", "sc": null, "tr": "1-5Tbps", "pol": "Selective", "web": "https://dtp.do"}, "pfx": 5, "reg": "2020-07-08", "rir": "lacnic", "s24": 72, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67072, "abuse": "abuse@dtp.do", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00062775610648}, {"a": 64200, "h": "VIVIDHOSTING", "n": "Vivid-Hosting, LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.014, "ts": null, "map": 0.186, "obs": 0, "own": 0.217, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.164, "obs": 0, "own": 0.067, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.776, "det": null, "oid": "VL-426-ARIN", "org": "VIVID-HOSTING LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.vivid-hosting.net"}, "pfx": 56, "reg": "2015-08-20", "rir": "arin", "s24": 86, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22784, "abuse": "abuse@vivid-hosting.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001012242048}, {"a": 64236, "h": "UNREAL-SERVERS", "n": "UnReal Servers", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "web_bruteforce": 2, "cve:CVE-2026-4020": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1849, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "shodan": {"n": 2, "p": 0.3209, "hi": 5.40, "lo": 0.70, "ips": 2, "mean": 2.57, "above": false}, "crowdsec": {"n": 2, "p": 0.2989, "hi": 5.21, "lo": 0.68, "ips": 2, "mean": 2.48, "above": false}, "threatfox": {"n": 1, "p": 0.1938, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.677, 0.011, 0, false], ["2026-10-12", 1.809, 0.325, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.325, "se": 1.475, "ts": 1.000, "map": 2.810, "obs": 1, "own": 1.274, "comp": {"urlhaus": -0.1455, "threatfox": 3.1162, "phishing_db": -0.3116}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.809, "se": 0.757, "ts": 0.667, "map": 5.465, "obs": 3, "own": 1.093, "comp": {"cins": 4.1017, "dshield": -1.0298, "crowdsec": 3.3452, "vulncheck": -0.6736, "blocklist_de": -2.6515}, "mass": 2.4, "listed": false}}, "abq": true, "bot": 0.917, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Remcos": 1}}, "oid": "USL-37-ARIN", "org": "UnReal Servers, LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://UnRealServers.net/"}, "pfx": 24, "reg": "2016-01-15", "rir": "arin", "s24": 78, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0046269278795}, {"a": 64245, "h": "AS-DIGITALFYRE", "n": "DigitalFyre Internet Solutions", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.147, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.899, "det": {"shodan": {"compromised": 1}}, "oid": "DISL-4-ARIN", "org": "DigitalFyre Internet Solutions, LLC.", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.digitalfyre.com/"}, "pfx": 18, "reg": "2016-03-29", "rir": "arin", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@digitalfyre.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 64267, "h": "AS-SPRIOUS", "n": "Sprious LLC", "t": "Hosting & VPS", "w": 186, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 159, "data_centre": 173, "web_exploit": 164, "bad_crawling": 56, "proxy_or_vpn": 167, "web_bruteforce": 14, "router_or_botnet": 167, "cve:CVE-2022-39290": 5, "cve:CVE-2026-21859": 1}, "n": 186}, "ev": {"crowdsec": {"n": 30, "p": 1.0000, "hi": 20.11, "lo": 11.09, "ips": 186, "mean": 15.32, "above": true}}, "h2": [["2026-10-05", 9.904, 0.010, 0, false], ["2026-10-12", 6.580, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.911, "ts": null, "map": 0.160, "obs": 0, "own": 0.140, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 30, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.580, "se": 0.396, "ts": 1.000, "map": 10.342, "obs": 30, "own": 2.020, "comp": {"cins": -2.4692, "dshield": -2.8341, "crowdsec": 21.1973, "vulncheck": -0.9641, "blocklist_de": -11.2001}, "mass": 22.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "SL-1146-ARIN", "org": "Sprious LLC", "pdb": null, "pfx": 375, "reg": "2017-04-07", "rir": "arin", "s24": 385, "sib": 1, "tor": 0, "w24": 30, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 98560, "abuse": "hostmaster@sprious.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00578209243688}, {"a": 64286, "h": "LOGICWEB", "n": "LogicWeb", "t": "Enterprise, edu & gov", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 2, "first_seen_30d": 1, "ssh_bruteforce": 4, "home_connection": 2}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1366, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "crowdsec": {"n": 1, "p": 0.0159, "hi": 2.33, "lo": 0.17, "ips": 4, "mean": 0.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.0749, "hi": 3.35, "lo": 0.25, "ips": 4, "mean": 1.41, "above": false}}, "h2": [["2026-10-05", 0.677, 0.010, 0, false], ["2026-10-12", 0.477, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.910, "ts": null, "map": 0.159, "obs": 0, "own": 1.526, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.477, "se": 0.731, "ts": 0.333, "map": 1.379, "obs": 3, "own": 7.873, "comp": {"cins": 3.8507, "dshield": -1.2065, "crowdsec": -1.3007, "vulncheck": -0.7238, "blocklist_de": 1.0953}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.805, "det": {"blocklist_de": {"ssh": 4}}, "oid": "LOGIC-25-ARIN", "org": "LogicWeb Inc.", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.logicweb.com/"}, "pfx": 172, "reg": "2018-03-19", "rir": "arin", "s24": 389, "sib": 0, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 99840, "abuse": "abuse@logicweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00678202671193}, {"a": 64315, "h": "IDNIC-CLOUD-INDO-AS-ID", "n": "Mitra Visioner Pratama (MVNET)", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3644, "hi": 5.77, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "crowdsec": {"n": 1, "p": 0.1535, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 0.260, 0.011, 0, false], ["2026-10-12", 0.274, 0.012, 0, false]], "sh": false, "uc": 463.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 0.255, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.274, "se": 1.276, "ts": 1.000, "map": 2.230, "obs": 1, "own": 0.503, "comp": {"cins": -0.129, "dshield": -0.298, "crowdsec": 3.6067, "vulncheck": -0.3116, "blocklist_de": -0.6723}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.308, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-64315-APNIC", "org": "PT MITRA VISIONER PRATAMA", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://mvnet.co.id"}, "pfx": 35, "reg": "2016-08-23", "rir": "apnic", "s24": 43, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": "NOC@CLOUD-INDO.COM", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 64458, "h": "OnlineServer", "n": "Mizban Dade Pasargad LLC", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.501, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MDP5-RIPE", "org": "Mizban Dade Pasargad LLC", "pdb": null, "pfx": 7, "reg": "2021-11-16", "rir": "ripencc", "s24": 7, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@onlineserver.ir", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000156501435}, {"a": 64466, "h": "UMS-AS", "n": "UNIVERSAL MOBILE SYSTEMS LLC", "t": "Broadband & mobile", "w": 0, "cc": "UZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2864.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 1.372, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1, "apache": 2}}, "oid": "ORG-UMSL2-RIPE", "org": "UNIVERSAL MOBILE SYSTEMS LLC", "pdb": null, "pfx": 7, "reg": "2016-08-12", "rir": "ripencc", "s24": 12, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@mobi.uz", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0074084762976}, {"a": 65536, "h": null, "n": "Private Documentation ASN", "t": "Other", "w": 6, "cc": null, "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 6}, "ev": {"crowdsec": {"n": 5, "p": 0.7806, "hi": 7.83, "lo": 1.95, "ips": 6, "mean": 4.47, "above": false}, "blocklist_de": {"n": 2, "p": 0.3369, "hi": 5.53, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}}, "h2": [["2026-10-05", 5.715, 0.010, 0, false], ["2026-10-12", 4.133, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 0.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.133, "se": 0.541, "ts": 0.714, "map": 8.460, "obs": 7, "own": 4.777, "comp": {"cins": -1.1296, "dshield": -1.821, "crowdsec": 5.5682, "vulncheck": -0.848, "blocklist_de": 1.7594}, "mass": 6.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": null, "org": null, "pdb": null, "pfx": 2, "reg": null, "rir": null, "s24": 129, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131090, "h": "NTPCL-AS-AP", "n": "NT(CAT) Broadband", "t": "Broadband & mobile", "w": 11, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0018, "hi": 1.66, "lo": 0.12, "ips": 1, "mean": 0.70, "above": false}, "dshield": {"n": 5, "p": 0.7191, "hi": 7.16, "lo": 1.78, "ips": 5, "mean": 4.09, "above": false}, "crowdsec": {"n": 4, "p": 0.0308, "hi": 2.77, "lo": 0.60, "ips": 4, "mean": 1.51, "above": false}, "phishing_db": {"n": 1, "p": 0.0735, "hi": 3.33, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}, "blocklist_de": {"n": 3, "p": 0.1709, "hi": 4.02, "lo": 0.71, "ips": 3, "mean": 2.07, "above": false}}, "h2": [["2026-10-05", 0.550, 0.099, 0, false], ["2026-10-12", 1.299, 0.104, 0, false]], "sh": false, "uc": 270, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.104, "se": 1.358, "ts": 1.000, "map": 0.658, "obs": 1, "own": 2.034, "comp": {"urlhaus": -0.3533, "threatfox": -0.3035, "phishing_db": 1.8639}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.299, "se": 0.468, "ts": 0.417, "map": 2.348, "obs": 12, "own": 3.623, "comp": {"cins": -1.7303, "dshield": 6.5854, "crowdsec": -2.1681, "vulncheck": -0.9188, "blocklist_de": 0.4791}, "mass": 11.3, "listed": false}}, "abq": true, "bot": 0.154, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"ftp": 1, "ssh": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.cinternetbycat.com/"}, "pfx": 653, "reg": "2007-06-13", "rir": "apnic", "s24": 868, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 387072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01083294986298}, {"a": 131111, "h": "CEPATNET-AS-ID", "n": "PT Ekamas Mora Republik Tbk - Domestic (ISP)", "t": "Broadband & mobile", "w": 16, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 1, "web_exploit": 7, "bad_crawling": 2, "proxy_or_vpn": 4, "ssh_bruteforce": 7, "web_bruteforce": 8, "home_connection": 8, "mail_bruteforce": 1, "router_or_botnet": 7, "cve:CVE-2017-9841": 3, "cve:CVE-2021-3129": 2, "cve:CVE-2022-39290": 1, "cve:CVE-2026-53787": 1, "cve:CVE-2026-60137": 1}, "n": 14}, "ev": {"cins": {"n": 1, "p": 0.1324, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "shodan": {"n": 5, "p": 0.4953, "hi": 5.53, "lo": 1.38, "ips": 5, "mean": 3.16, "above": false}, "crowdsec": {"n": 13, "p": 0.9941, "hi": 9.75, "lo": 3.99, "ips": 14, "mean": 6.61, "above": true}, "phishing_db": {"n": 1, "p": 0.1240, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "blocklist_de": {"n": 1, "p": 0.0689, "hi": 3.27, "lo": 0.24, "ips": 1, "mean": 1.38, "above": false}}, "h2": [["2026-10-05", 2.991, 0.460, 0, false], ["2026-10-12", 3.187, 0.154, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.154, "se": 1.384, "ts": 1.000, "map": 1.053, "obs": 1, "own": 3.161, "comp": {"urlhaus": -0.2814, "threatfox": -0.2661, "phishing_db": 2.2257}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.187, "se": 0.446, "ts": 0.867, "map": 5.496, "obs": 15, "own": 8.457, "comp": {"cins": 1.182, "dshield": -2.4613, "crowdsec": 11.343, "vulncheck": -0.9294, "blocklist_de": -6.0367}, "mass": 12.8, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"compromised": 4, "doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-138121-APNIC", "org": "PT Mora Telematika Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Restrictive", "web": "https://www.morarepublic.co.id"}, "pfx": 429, "reg": "2008-07-29", "rir": "apnic", "s24": 421, "sib": 2, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 119808, "abuse": "abuse@idnic.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0235038020426}, {"a": 131149, "h": "YUANJHEN-AS-TW", "n": "Yuan-Jhen Info", "t": "Enterprise, edu & gov", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1756, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 3.073, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.211, "obs": 0, "own": 3.544, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.920, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131149-APNIC", "org": "Yuan-Jhen Info., Co., Ltd", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://host.com.tw"}, "pfx": 15, "reg": "2008-09-11", "rir": "apnic", "s24": 26, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": "abuse@yuanjhen.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000723362509}, {"a": 131210, "h": "YASHTEL1-AS-AP", "n": "Yashash Cable Network Pvt Ltd", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1692, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1866, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.786, 0.011, 0, false], ["2026-10-12", 1.932, 0.012, 0, false]], "sh": false, "uc": 1591.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 1.809, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.932, "se": 0.956, "ts": 0.500, "map": 8.535, "obs": 2, "own": 13.729, "comp": {"cins": -0.2979, "dshield": -0.6413, "crowdsec": 1.7431, "vulncheck": -0.5235, "blocklist_de": 3.2574}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.119, "det": {"blocklist_de": {"mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.yashtel.in"}, "pfx": 27, "reg": "2010-02-12", "rir": "apnic", "s24": 27, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00084863365434}, {"a": 131240, "h": "UltranetLLC-AS-AP", "n": "Ultranet Zone LLC", "t": "Other", "w": 0, "cc": "MN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.178, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UZL1-AP-APNIC", "org": "Ultranet Zone LLC", "pdb": null, "pfx": 1, "reg": "2016-07-01", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "info@ultranet.mn", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000665732602}, {"a": 131267, "h": "UNITEL-LA", "n": "Star Telecom", "t": "Broadband & mobile", "w": 4, "cc": "LA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.4046, "hi": 6.12, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "crowdsec": {"n": 2, "p": 0.3369, "hi": 5.53, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}}, "h2": [["2026-10-05", 3.904, 0.011, 0, false], ["2026-10-12", 3.886, 0.012, 0, false]], "sh": false, "uc": 398.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.886, "se": 0.669, "ts": 0.500, "map": 9.981, "obs": 4, "own": 15.495, "comp": {"cins": -0.6193, "dshield": 5.844, "crowdsec": 2.316, "vulncheck": -0.7168, "blocklist_de": -3.1296}, "mass": 2.9, "listed": false}}, "abq": true, "bot": 0.099, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-ST8-AP-APNIC", "org": "Star Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.unitel.com.la"}, "pfx": 79, "reg": "2009-12-08", "rir": "apnic", "s24": 52, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 51968, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01467538147488}, {"a": 131269, "h": "CABLELITE-AS-AP", "n": "ACTFIBERNET", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2}, "n": 3}, "ev": {"urlhaus": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.4659, "hi": 6.06, "lo": 1.07, "ips": 3, "mean": 3.13, "above": false}, "blocklist_de": {"n": 1, "p": 0.1541, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 3.809, 0.409, 0, false], ["2026-10-12", 2.167, 0.440, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.440, "se": 1.542, "ts": 1.000, "map": 4.396, "obs": 1, "own": 13.139, "comp": {"urlhaus": 3.8914, "threatfox": -0.272, "phishing_db": -0.5125}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.167, "se": 0.663, "ts": 0.750, "map": 5.556, "obs": 4, "own": 8.644, "comp": {"cins": -0.6844, "dshield": -1.2746, "crowdsec": 5.0073, "vulncheck": -0.741, "blocklist_de": 0.8013}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.115, "det": {"blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.actcorp.in"}, "pfx": 64, "reg": "2009-12-14", "rir": "apnic", "s24": 105, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": "abuse@actcorp.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00700510230597}, {"a": 131274, "h": "CYPRESSTEL-HK", "n": "Cypress Telecom", "t": "Broadband & mobile", "w": 3, "cc": "HK", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.3081, "hi": 5.29, "lo": 0.69, "ips": 3, "mean": 2.52, "above": false}}, "h2": [["2026-10-05", 0.006, 0.506, 0, false], ["2026-10-12", 0.006, 0.523, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.523, "se": 1.135, "ts": 1.000, "map": 2.187, "obs": 2, "own": 5.909, "comp": {"urlhaus": -0.4995, "threatfox": -0.3618, "phishing_db": 3.2698}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.626, "ts": null, "map": 0.090, "obs": 0, "own": 0.212, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.623, "det": null, "oid": "ORG-CTL2-AP-APNIC", "org": "Cypress Telecom Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.cypresstel.com"}, "pfx": 50, "reg": "2009-12-15", "rir": "apnic", "s24": 389, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 106752, "abuse": "hostmaster@cypresstel.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018054438662}, {"a": 131275, "h": "LBPL-AS-AP", "n": "Logon Broadband Pakistan", "t": "Broadband & mobile", "w": 12, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 9, "home_connection": 4, "router_or_botnet": 6, "cve:CVE-2019-8318": 5, "cve:CVE-2018-10562": 7, "cve:CVE-2024-12847": 9}, "n": 9}, "ev": {"crowdsec": {"n": 6, "p": 0.9592, "hi": 11.33, "lo": 3.14, "ips": 9, "mean": 6.70, "above": true}, "blocklist_de": {"n": 2, "p": 0.4111, "hi": 6.18, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 24.439, 0.011, 1, false], ["2026-10-12", 32.867, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 2}, "lo": 32.867, "se": 0.522, "ts": 0.750, "map": 65.830, "obs": 8, "own": 100.984, "comp": {"cins": -1.151, "dshield": -1.8435, "crowdsec": 7.8206, "vulncheck": -0.8515, "blocklist_de": 1.6061}, "mass": 6.2, "listed": false}}, "abq": true, "bot": 0.146, "det": {"blocklist_de": {"bots": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-LBPL1-AP-APNIC", "org": "Logon Broadband Pvt. Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.logon.com.pk"}, "pfx": 17, "reg": "2018-08-22", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00212536792578}, {"a": 131279, "h": "STAR-KP", "n": "Ryugyong-dong (DPRK)", "t": "Other", "w": 768, "cc": "KP", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 768, "mean": 3.99, "above": false}}, "h2": [["2026-10-12", 20.958, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.958, "se": 0.821, "ts": 1.000, "map": 72.450, "obs": 3, "own": 41.520, "comp": {"cins": -0.3683, "dshield": 11.5558, "crowdsec": -3.039, "vulncheck": -0.5813, "blocklist_de": -1.8907}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.218, "det": null, "oid": "ORG-SJVC1-AP-APNIC", "org": "Star Joint Venture Co. Ltd.", "pdb": null, "pfx": 4, "reg": "2009-12-21", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000090400788}, {"a": 131284, "h": "ETISALATAFG-AS-AP", "n": "Etisalat Afghan", "t": "Broadband & mobile", "w": 1, "cc": "AF", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-12", 0.264, 0.012, 0, false]], "sh": false, "uc": 1265.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 1.626, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.264, "se": 1.270, "ts": 1.000, "map": 2.123, "obs": 1, "own": 3.744, "comp": {"cins": -0.1313, "dshield": -0.3029, "crowdsec": 3.5799, "vulncheck": -0.3154, "blocklist_de": -0.684}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.214, "det": null, "oid": "ORG-EA2-AP-APNIC", "org": "Etisalat Afghan", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://etisalat.af"}, "pfx": 46, "reg": "2009-12-31", "rir": "apnic", "s24": 46, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00155839362471}, {"a": 131285, "h": "CHINATELECOM-HUBEI-SHENGJI-5G-NETWORK", "n": "Blueberry Telecom Global Pte Ltd", "t": "Broadband & mobile", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1050, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "crowdsec": {"n": 1, "p": 0.0068, "hi": 2.01, "lo": 0.15, "ips": 1, "mean": 0.85, "above": false}}, "h2": [["2026-10-05", 0.309, 0.009, 0, false], ["2026-10-12", 0.172, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.152, "obs": 0, "own": 0.825, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.172, "se": 0.846, "ts": 0.500, "map": 0.617, "obs": 2, "own": 0.982, "comp": {"cins": -0.3988, "dshield": 3.2054, "crowdsec": 0.7508, "vulncheck": -0.6028, "blocklist_de": -2.0432}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.blueberrytelecom.com"}, "pfx": 12, "reg": "2020-04-02", "rir": "apnic", "s24": 512, "sib": 281, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 287744, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00273844252344}, {"a": 131293, "h": "TOT-LLI-AS-AP", "n": "National Telecom Public Company Limited (NT)", "t": "Broadband & mobile", "w": 4, "cc": "TH", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"shodan": {"n": 3, "p": 0.2350, "hi": 4.45, "lo": 0.78, "ips": 3, "mean": 2.30, "above": false}, "crowdsec": {"n": 3, "p": 0.1733, "hi": 4.03, "lo": 0.71, "ips": 3, "mean": 2.08, "above": false}, "phishing_db": {"n": 1, "p": 0.1350, "hi": 4.06, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 1.004, 0.161, 0, false], ["2026-10-12", 0.451, 0.169, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.169, "se": 1.393, "ts": 1.000, "map": 1.193, "obs": 1, "own": 3.555, "comp": {"urlhaus": -0.2641, "threatfox": -0.2559, "phishing_db": 2.3224}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.451, "se": 0.727, "ts": 1.000, "map": 1.294, "obs": 3, "own": 2.029, "comp": {"cins": -0.5459, "dshield": -1.0683, "crowdsec": 6.722, "vulncheck": -0.6853, "blocklist_de": -2.7713}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.330, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": null}, "pfx": 279, "reg": "2011-04-21", "rir": "apnic", "s24": 347, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 142592, "abuse": "abuse@totisp.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007859549253}, {"a": 131353, "h": "NHANHOA-AS-VN", "n": "NhanHoa Software company", "t": "Other", "w": 13, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 5, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 7, "web_bruteforce": 5, "home_connection": 3, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2026-8181": 3, "cve:CVE-2025-13801": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 12}, "ev": {"cins": {"n": 1, "p": 0.1932, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 11, "p": 0.9999, "hi": 17.04, "lo": 6.48, "ips": 11, "mean": 11.23, "above": true}, "dshield": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 8, "p": 0.9936, "hi": 13.30, "lo": 4.33, "ips": 12, "mean": 8.29, "above": true}, "blocklist_de": {"n": 5, "p": 0.9054, "hi": 10.16, "lo": 2.53, "ips": 5, "mean": 5.80, "above": true}}, "h2": [["2026-10-05", 29.666, 0.011, 1, false], ["2026-10-12", 44.533, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 5}, "lo": 44.533, "se": 0.442, "ts": 0.533, "map": 77.404, "obs": 15, "own": 43.280, "comp": {"cins": 1.0202, "dshield": -0.9461, "crowdsec": 2.5065, "vulncheck": -0.9347, "blocklist_de": 4.0968}, "mass": 13.6, "listed": false}}, "abq": true, "bot": 0.797, "det": {"shodan": {"c2": 1, "compromised": 10}, "blocklist_de": {"ssh": 5}}, "oid": "@aut-131353-APNIC", "org": "NhanHoa Software company", "pdb": null, "pfx": 29, "reg": "2011-06-24", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8212]], "ipv4": 10240, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.000243800669}, {"a": 131366, "h": "LANIT-AS-VN", "n": "Lanit Technology and Communication Joint Stock Company", "t": "Other", "w": 7, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "crowdsec": {"n": 5, "p": 0.9095, "hi": 10.29, "lo": 2.56, "ips": 7, "mean": 5.88, "above": true}, "blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 51.440, 0.011, 1, false], ["2026-10-12", 56.031, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 56.031, "se": 0.548, "ts": 0.714, "map": 117.597, "obs": 7, "own": 66.008, "comp": {"cins": -1.0089, "dshield": -1.688, "crowdsec": 7.0508, "vulncheck": -0.8261, "blocklist_de": 2.6331}, "mass": 5.2, "listed": false}}, "abq": true, "bot": 0.894, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "@aut-131366-APNIC", "org": "Lanit Technology and Communication Joint Stock Company", "pdb": null, "pfx": 7, "reg": "2011-06-24", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00015386678734}, {"a": 131374, "h": "HQG-AS-VN", "n": "HQG Technology Solutions Joint Stock Company", "t": "Other", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2024-28000": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": null, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-131374-APNIC", "org": "HQG Technology Solutions Joint Stock Company", "pdb": null, "pfx": 1, "reg": "2011-06-24", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131378, "h": "CLOUDVIET-AS-VN", "n": "Cloud Viet Technology Company Limited", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.957, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131378-APNIC", "org": "Cloud Viet Technology Company Limited", "pdb": null, "pfx": 4, "reg": "2011-06-24", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005642623658}, {"a": 131386, "h": "LVSS-AS-VN", "n": "Long Van System Solution JSC", "t": "Other", "w": 8, "cc": "VN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 7, "mail_bruteforce": 1}, "n": 8}, "ev": {"shodan": {"n": 4, "p": 0.7797, "hi": 8.57, "lo": 1.84, "ips": 4, "mean": 4.68, "above": false}, "crowdsec": {"n": 6, "p": 0.9519, "hi": 10.91, "lo": 3.03, "ips": 8, "mean": 6.45, "above": true}, "blocklist_de": {"n": 3, "p": 0.6242, "hi": 7.50, "lo": 1.32, "ips": 5, "mean": 3.87, "above": false}}, "h2": [["2026-10-05", 23.013, 0.011, 1, false], ["2026-10-12", 22.344, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 3}, "lo": 22.344, "se": 0.503, "ts": 0.667, "map": 42.576, "obs": 9, "own": 23.903, "comp": {"cins": -1.3269, "dshield": -2.0188, "crowdsec": 5.6183, "vulncheck": -0.8769, "blocklist_de": 3.7493}, "mass": 7.5, "listed": false}}, "abq": true, "bot": 0.845, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 5}}, "oid": "@aut-131386-APNIC", "org": "Long Van System Solution JSC", "pdb": null, "pfx": 36, "reg": "2011-06-24", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00012669663104}, {"a": 131392, "h": "RUNSYSTEM-AS-VN", "n": "GMO Vietnam", "t": "Broadband & mobile", "w": 7, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 4, "bad_crawling": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2024-28000": 2}, "n": 5}, "ev": {"shodan": {"n": 4, "p": 0.7279, "hi": 7.87, "lo": 1.69, "ips": 4, "mean": 4.30, "above": false}, "crowdsec": {"n": 4, "p": 0.7053, "hi": 7.62, "lo": 1.64, "ips": 5, "mean": 4.16, "above": false}, "phishing_db": {"n": 2, "p": 0.3987, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1655, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 3.626, 1.585, 0, false], ["2026-10-12", 4.075, 1.619, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.619, "se": 1.151, "ts": 1.000, "map": 7.521, "obs": 2, "own": 18.866, "comp": {"urlhaus": -0.3537, "threatfox": -0.3037, "phishing_db": 4.3013}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.075, "se": 0.610, "ts": 0.800, "map": 9.421, "obs": 5, "own": 14.587, "comp": {"cins": -0.8117, "dshield": -1.4474, "crowdsec": 6.6583, "vulncheck": -0.7802, "blocklist_de": 0.0176}, "mass": 4.0, "listed": false}}, "abq": true, "bot": 0.983, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-131392-APNIC", "org": "GMO-Z.com Runsystem Joint Stock Company", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://z.com/vn/en"}, "pfx": 12, "reg": "2011-06-24", "rir": "apnic", "s24": 76, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009502247328}, {"a": 131414, "h": "LVSOFT-AS-VN", "n": "Long Van Soft Solution JSC", "t": "Other", "w": 3, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1969, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 2, "p": 0.4062, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 29.557, 0.011, 1, false], ["2026-10-12", 25.330, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 25.330, "se": 0.626, "ts": 0.400, "map": 61.115, "obs": 5, "own": 34.525, "comp": {"cins": 3.4371, "dshield": -1.4681, "crowdsec": 0.3525, "vulncheck": -0.7845, "blocklist_de": 3.9695}, "mass": 4.1, "listed": false}}, "abq": true, "bot": 0.719, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-131414-APNIC", "org": "Long Van Soft Solution JSC", "pdb": null, "pfx": 11, "reg": "2011-06-24", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004728537226}, {"a": 131423, "h": "LVHN-AS-VN", "n": "Branch of Long Van System Solution JSC - Hanoi", "t": "Other", "w": 12, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 7, "web_bruteforce": 1, "cve:CVE-2023-1389": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 11, "p": 0.9999, "hi": 17.32, "lo": 6.59, "ips": 11, "mean": 11.41, "above": true}, "dshield": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 8, "p": 0.9944, "hi": 13.57, "lo": 4.41, "ips": 8, "mean": 8.46, "above": true}, "threatfox": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1936, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 6, "p": 0.9625, "hi": 11.55, "lo": 3.20, "ips": 7, "mean": 6.82, "above": true}}, "h2": [["2026-10-05", 74.368, 0.491, 1, false], ["2026-10-12", 66.162, 0.508, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.508, "se": 1.567, "ts": 1.000, "map": 5.403, "obs": 1, "own": 6.543, "comp": {"urlhaus": -0.0877, "threatfox": 3.6064, "phishing_db": -0.2056}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 6}, "lo": 66.162, "se": 0.433, "ts": 0.471, "map": 113.404, "obs": 17, "own": 63.337, "comp": {"cins": 0.7943, "dshield": -1.1172, "crowdsec": 1.4416, "vulncheck": -0.555, "blocklist_de": 5.5608}, "mass": 14.9, "listed": false}}, "abq": true, "bot": 0.911, "det": {"shodan": {"c2": 1, "compromised": 10}, "threatfox": {"family:AsyncRAT": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 6, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-131423-APNIC", "org": "Branch of Long Van System Solution JSC - Hanoi", "pdb": null, "pfx": 27, "reg": "2011-06-24", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 11264, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00034355300812}, {"a": 131427, "h": "AOHOAVIET-VN-AS", "n": "AOHOAVIET-VN", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.559, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131427-APNIC", "org": "AOHOAVIET-VN", "pdb": null, "pfx": 8, "reg": "2011-06-24", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131429, "h": "MOBIFONE-AS-VN", "n": "Mobifone", "t": "Broadband & mobile", "w": 12, "cc": "VN", "cf": {"rb": "hi", "wb": "hi", "rep": 1.39, "waf": 1.21}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 7, "web_bruteforce": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"shodan": {"n": 7, "p": 0.9265, "hi": 9.10, "lo": 2.76, "ips": 7, "mean": 5.54, "above": true}, "crowdsec": {"n": 4, "p": 0.5023, "hi": 5.89, "lo": 1.27, "ips": 8, "mean": 3.22, "above": false}, "vulncheck": {"n": 2, "p": 0.3540, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}, "blocklist_de": {"n": 4, "p": 0.6933, "hi": 7.49, "lo": 1.61, "ips": 5, "mean": 4.09, "above": false}}, "h2": [["2026-10-05", 4.116, 0.010, 0, false], ["2026-10-12", 3.818, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.102, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 4}, "lo": 3.818, "se": 0.502, "ts": 0.400, "map": 7.252, "obs": 10, "own": 11.198, "comp": {"cins": -1.4239, "dshield": -2.1081, "crowdsec": 0.2619, "vulncheck": 0.4278, "blocklist_de": 6.2173}, "mass": 8.4, "listed": false}}, "abq": true, "bot": 0.094, "det": {"shodan": {"compromised": 7}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"sip": 1, "ssh": 2, "bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-131429-APNIC", "org": "MOBIFONE Corporation", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "http://mobifone.vn"}, "pfx": 228, "reg": "2011-06-24", "rir": "apnic", "s24": 208, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 84992, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.052814}, {"a": 131445, "h": "AIS3G-2100-AS-AP", "n": "Advance Wireless Network", "t": "Broadband & mobile", "w": 0, "cc": "TH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.35, "waf": 0.31}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.880, "ts": null, "map": 0.148, "obs": 0, "own": 0.791, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.575, "ts": null, "map": 0.074, "obs": 0, "own": 0.163, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.050, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 282, "reg": "2011-06-29", "rir": "apnic", "s24": 578, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 147968, "abuse": "abuseIPv4@ais.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.209771}, {"a": 131447, "h": "POP-IDC-TH", "n": "POPIDC", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.410, 0.583, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.783, "det": {"shodan": {"c2": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.pop-nix.com"}, "pfx": 8, "reg": "2011-06-30", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023829778614}, {"a": 131464, "h": "DJBL-AS-AP", "n": "Digi Jadoo Broadband", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.391, 0.011, 0, false], ["2026-10-12", 0.394, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.394, "se": 1.339, "ts": 1.000, "map": 3.608, "obs": 1, "own": 6.572, "comp": {"cins": -0.1073, "dshield": -0.2502, "crowdsec": 3.8668, "vulncheck": -0.2723, "blocklist_de": -0.56}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.265, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DJBL1-AP-APNIC", "org": "Digi Jadoo Broadband Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "https://jadoobroadband.com/"}, "pfx": 32, "reg": "2016-07-16", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": "noc@digijadoo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00301024731087}, {"a": 131596, "h": "TBCOM-NET", "n": "TBC", "t": "Broadband & mobile", "w": 4, "cc": "TW", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.1058, "hi": 3.60, "lo": 0.47, "ips": 2, "mean": 1.72, "above": false}, "crowdsec": {"n": 2, "p": 0.0001, "hi": 1.35, "lo": 0.17, "ips": 2, "mean": 0.64, "above": false}}, "h2": [["2026-10-05", 0.077, 0.008, 0, false], ["2026-10-12", 0.199, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.119, "obs": 0, "own": 0.574, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.199, "se": 0.638, "ts": 0.500, "map": 0.479, "obs": 4, "own": 0.748, "comp": {"cins": -0.7616, "dshield": 5.0562, "crowdsec": 0.944, "vulncheck": -0.7658, "blocklist_de": -3.8154}, "mass": 3.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ftp": 1}}, "oid": "@aut-131596-APNIC", "org": "TBC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.tbc.net.tw"}, "pfx": 649, "reg": "2011-07-21", "rir": "apnic", "s24": 1384, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 907520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0140068298743}, {"a": 131602, "h": "HYA", "n": "Hsin Yeong An Cable TV", "t": "Broadband & mobile", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.006, 0.011, 0, false]], "sh": false, "uc": 122.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.923, "ts": null, "map": 0.163, "obs": 0, "own": 0.955, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.647, "ts": null, "map": 0.098, "obs": 0, "own": 0.235, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.201, "det": null, "oid": "@aut-131602-APNIC", "org": "Hsin Yeong An Cable TV Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.hya.com.tw"}, "pfx": 267, "reg": "2011-07-21", "rir": "apnic", "s24": 330, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 168704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00171768702035}, {"a": 131611, "h": "GLOBALTRANSIT-AS-SDTV", "n": "San Da Cable TV", "t": "Broadband & mobile", "w": 1, "cc": "TW", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1111, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "blocklist_de": {"n": 1, "p": 0.1579, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.680, 0.011, 0, false], ["2026-10-12", 0.724, 0.012, 0, false]], "sh": false, "uc": 588, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 1.371, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.724, "se": 0.905, "ts": 0.500, "map": 2.898, "obs": 2, "own": 4.635, "comp": {"cins": -0.3513, "dshield": -0.7404, "crowdsec": 1.2072, "vulncheck": -0.5685, "blocklist_de": 2.9106}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.194, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-131611-APNIC", "org": "San Da Cable TV Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.sdtv.com.tw"}, "pfx": 92, "reg": "2011-07-21", "rir": "apnic", "s24": 95, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002519742519}, {"a": 131642, "h": "PNI-AS-TW", "n": "Pittqiao Network Information Co.", "t": "Enterprise, edu & gov", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1616, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 2.783, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.912, "ts": null, "map": 0.194, "obs": 0, "own": 2.769, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.351, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-18178-APNIC", "org": "Pittqiao Network Information Co.,Ltd.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.pni.com.tw"}, "pfx": 54, "reg": "2011-07-21", "rir": "apnic", "s24": 43, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": "noc@pni.com.tw", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00193945487771}, {"a": 131644, "h": "TWNIC-AS", "n": "Taiwan Network Information Center AS131644", "t": "Enterprise, edu & gov", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {"shodan": {"n": 11, "p": 0.9999, "hi": 17.86, "lo": 6.79, "ips": 11, "mean": 11.77, "above": true}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 3.617, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 5.590, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.061, "det": {"shodan": {"doublepulsar": 11}}, "oid": "@aut-131644-APNIC", "org": "Taiwan Network Information Center", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.twnic.tw"}, "pfx": 6, "reg": "2011-07-21", "rir": "apnic", "s24": 9, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0690]], "ipv4": 2304, "abuse": "hostmaster@twnic.tw", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00000358039015}, {"a": 131686, "h": "CCN-AS-AP", "n": "CCN", "t": "Hosting & VPS", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 4736.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 1.763, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.202, "det": null, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "0-20Mbps", "pol": "Selective", "web": "https://ccnetbd.com"}, "pfx": 9, "reg": "2016-10-08", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@ccnetbd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00065047015755}, {"a": 131699, "h": "MMS-AS-ID", "n": "PT Maxindo Mitra Solusi", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.318, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@family-34098", "org": "PT Maxindo Mitra Solusi", "pdb": null, "pfx": 5, "reg": "2011-07-25", "rir": "apnic", "s24": 5, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@maxindo.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131706, "h": "TERABIT-AS-ID", "n": "TERABIT", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "router_or_botnet": 4, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-87902": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 3, "p": 0.6258, "hi": 7.51, "lo": 1.32, "ips": 4, "mean": 3.88, "above": false}}, "h2": [["2026-10-05", 7.746, 0.011, 0, false], ["2026-10-12", 8.329, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.329, "se": 0.793, "ts": 1.000, "map": 26.960, "obs": 3, "own": 42.204, "comp": {"cins": -0.4073, "dshield": -0.8397, "crowdsec": 8.629, "vulncheck": -0.6084, "blocklist_de": -2.0855}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.618, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131706-APNIC", "org": "PT SELARAS CITRA TERABIT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.terabit.net.id"}, "pfx": 17, "reg": "2011-07-25", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "abuse@terabit.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0040696800914}, {"a": 131711, "h": "ORANGE-ISP-AS-ID", "n": "PT Global Teknologi Teraindo", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.210, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131711-APNIC", "org": "PT Global Teknologi Teraindo", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.globalnetwork.net.id"}, "pfx": 14, "reg": "2011-07-25", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131745, "h": "IDNIC-CYBERTECHTONIC-AS-ID", "n": "Cybertechtonic Pratama AS131745", "t": "Enterprise, edu & gov", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.8962, "hi": 9.90, "lo": 2.46, "ips": 5, "mean": 5.65, "above": true}, "crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.321, 0.011, 0, false], ["2026-10-12", 0.341, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 3.011, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.341, "se": 1.312, "ts": 1.000, "map": 2.967, "obs": 1, "own": 19.373, "comp": {"cins": -0.1161, "dshield": -0.2697, "crowdsec": 3.761, "vulncheck": -0.2886, "blocklist_de": -0.6054}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"compromised": 5}}, "oid": "@aut-140405-APNIC", "org": "PT. Cybertechtonic Pratama", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://cbtp.co.id"}, "pfx": 29, "reg": "2011-07-25", "rir": "apnic", "s24": 29, "sib": 1, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 7424, "abuse": "abuse@cbtp.co.id", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 131775, "h": "IDNIC-JALANET-AS-ID", "n": "Jupiter Jala Arta", "t": "Hosting & VPS", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4048, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 3.341, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.341, "se": 0.990, "ts": 0.500, "map": 15.842, "obs": 2, "own": 3.264, "comp": {"cins": -0.2681, "dshield": -0.5842, "crowdsec": 2.0521, "vulncheck": -0.495, "blocklist_de": 3.4515}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.946, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-131775-APNIC", "org": "PT. Jupiter Jala Arta", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "http://jalanet.co.id"}, "pfx": 13, "reg": "2011-07-25", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse@jalanet.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131866, "h": "DEK-AS-KR", "n": "Digital Edge Korea Internet Access", "t": "Transit & backbone", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1493, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 2.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.873, "ts": null, "map": 0.181, "obs": 0, "own": 1.313, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.826, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131866-APNIC", "org": "Digital Edge Korea", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.digitaledgedc.com/"}, "pfx": 61, "reg": "2011-08-01", "rir": "apnic", "s24": 59, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": "hostmaster@nic.or.kr", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000357188972}, {"a": 131896, "h": "SSI-Lab", "n": "SSI Lab", "t": "Transit & backbone", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 2.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 2.057, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.640, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-131896-JPNIC", "org": "SSI Lab Inc.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "http://ssilab.co.jp"}, "pfx": 13, "reg": "2011-08-04", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131904, "h": "CYBERFEELINC-JP", "n": "Cyber Feel Inc.", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CFI1-AP-APNIC", "org": "Cyber Feel Inc", "pdb": null, "pfx": 7, "reg": "2011-08-04", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "admin@cyberfeel.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 131921, "h": "GMOCL", "n": "GMO CLOUD", "t": "Hosting & VPS", "w": 5, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0308, "hi": 2.67, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}, "crowdsec": {"n": 2, "p": 0.0668, "hi": 3.20, "lo": 0.42, "ips": 3, "mean": 1.53, "above": false}, "vulncheck": {"n": 2, "p": 0.3079, "hi": 5.29, "lo": 0.69, "ips": 2, "mean": 2.52, "above": false}}, "h2": [["2026-10-05", 0.219, 0.010, 0, false], ["2026-10-12", 0.473, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.916, "ts": null, "map": 0.161, "obs": 0, "own": 0.143, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.473, "se": 0.677, "ts": 0.500, "map": 1.218, "obs": 4, "own": 0.247, "comp": {"cins": -0.5387, "dshield": -1.057, "crowdsec": 3.1586, "vulncheck": 2.7641, "blocklist_de": -2.736}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.523, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 2}}, "oid": "@aut-131921-JPNIC", "org": "GMO GlobalSign Holdings K.K.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.gmogshd.com/"}, "pfx": 55, "reg": "2011-08-04", "rir": "apnic", "s24": 363, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 180224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041286108175}, {"a": 131923, "h": "MCAT", "n": "MCAT Ltd.", "t": "Broadband & mobile", "w": 2, "cc": "JP", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2851, "hi": 5.10, "lo": 0.66, "ips": 2, "mean": 2.43, "above": false}, "blocklist_de": {"n": 1, "p": 0.1607, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 1.500, 0.011, 0, false], ["2026-10-12", 1.597, 0.012, 0, false]], "sh": false, "uc": 625.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 1.398, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.597, "se": 0.753, "ts": 0.667, "map": 4.830, "obs": 3, "own": 7.573, "comp": {"cins": -0.5202, "dshield": -1.0277, "crowdsec": 3.3593, "vulncheck": -0.673, "blocklist_de": 1.8302}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.088, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-131923-JPNIC", "org": "MCAT Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.mcat.co.jp/"}, "pfx": 10, "reg": "2011-08-04", "rir": "apnic", "s24": 88, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036527039315}, {"a": 131965, "h": "XSERVER", "n": "XSERVER", "t": "Hosting & VPS", "w": 3, "cc": "JP", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0065, "hi": 1.99, "lo": 0.15, "ips": 1, "mean": 0.84, "above": false}, "crowdsec": {"n": 2, "p": 0.0123, "hi": 2.32, "lo": 0.30, "ips": 2, "mean": 1.11, "above": false}, "phishing_db": {"n": 1, "p": 0.0957, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 0.137, 0.117, 0, false], ["2026-10-12", 0.142, 0.123, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.123, "se": 1.368, "ts": 1.000, "map": 0.799, "obs": 1, "own": 0.377, "comp": {"urlhaus": -0.3223, "threatfox": -0.2883, "phishing_db": 2.0121}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.142, "se": 0.839, "ts": 1.000, "map": 0.502, "obs": 2, "own": 0.102, "comp": {"cins": -0.4075, "dshield": -0.8401, "crowdsec": 4.6472, "vulncheck": -0.6086, "blocklist_de": -2.0867}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.961, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-131965-JPNIC", "org": "XServer Cloud Inc.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.xserver.co.jp/"}, "pfx": 60, "reg": "2011-08-04", "rir": "apnic", "s24": 645, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 217856, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00347890305295}, {"a": 131981, "h": "TAKUSHOKUNET", "n": "Takushoku University", "t": "Other", "w": 4, "cc": "JP", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 4, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.093, 0.010, 0, false], ["2026-10-12", 0.093, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.093, "se": 1.134, "ts": 1.000, "map": 0.571, "obs": 1, "own": 0.352, "comp": {"cins": -0.1937, "dshield": 4.1632, "crowdsec": -1.7211, "vulncheck": -0.4092, "blocklist_de": -1.0055}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.087, "det": null, "oid": "@aut-131981-APNIC", "org": "Takushoku University", "pdb": null, "pfx": 6, "reg": "2011-08-04", "rir": "apnic", "s24": 256, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 131072, "abuse": "hostmaster@nic.ad.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132020, "h": "NINEWIRE-AS-AP", "n": "NineWire Pty Ltd", "t": "Broadband & mobile", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.117, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NPL32-AP-APNIC", "org": "NineWire Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Australia", "tr": "20-100Mbps", "pol": "Open", "web": "http://www.ninewire.com.au"}, "pfx": 1, "reg": "2011-09-01", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@ninewire.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132073, "h": "WAVENET-AS-AP", "n": "Wave Net", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.268, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-WN5-AP-APNIC", "org": "Wave Net", "pdb": null, "pfx": 1, "reg": "2022-04-09", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132080, "h": "MATCORP-AS-AP", "n": "M.A.T Co., Ltd.", "t": "Other", "w": 3, "cc": "KH", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2011-3600": 3, "cve:CVE-2012-3153": 3, "cve:CVE-2013-3827": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.155, "det": null, "oid": "ORG-MCL6-AP-APNIC", "org": "M.A.T Co., Ltd.", "pdb": null, "pfx": 10, "reg": "2011-11-16", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "noc@monorom.com.kh", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024367380968}, {"a": 132116, "h": "ANINETWORK-IN", "n": "Anonet Communications Pvt Ltd", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1767, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "dshield": {"n": 1, "p": 0.1709, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 2, "p": 0.2386, "hi": 4.73, "lo": 0.61, "ips": 2, "mean": 2.25, "above": false}, "blocklist_de": {"n": 2, "p": 0.3394, "hi": 5.55, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}}, "h2": [["2026-10-05", 1.112, 0.010, 0, false], ["2026-10-12", 3.789, 0.011, 0, false]], "sh": false, "uc": 294.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.991, "ts": null, "map": 0.181, "obs": 0, "own": 1.275, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.789, "se": 0.571, "ts": 0.333, "map": 8.166, "obs": 6, "own": 12.626, "comp": {"cins": 2.9023, "dshield": 0.9037, "crowdsec": -1.6341, "vulncheck": -0.8384, "blocklist_de": 2.16}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.160, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-132116-APNIC", "org": "Anonet Network Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://anonet.in"}, "pfx": 125, "reg": "2012-01-13", "rir": "apnic", "s24": 125, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33536, "abuse": "abuseinfo@anonet.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01005320350275}, {"a": 132153, "h": "CT-SHANXI-MAN-2", "n": "CT SHANXI MAN 2", "t": "Other", "w": 4, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1937, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 3, "p": 0.5956, "hi": 7.20, "lo": 1.27, "ips": 3, "mean": 3.71, "above": false}, "blocklist_de": {"n": 2, "p": 0.4026, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 6.756, 0.011, 0, false], ["2026-10-12", 14.665, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.720, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 14.665, "se": 0.577, "ts": 0.500, "map": 32.210, "obs": 6, "own": 18.171, "comp": {"cins": 3.0557, "dshield": -1.6816, "crowdsec": 1.643, "vulncheck": -0.8249, "blocklist_de": 2.6737}, "mass": 5.2, "listed": false}}, "abq": true, "bot": 0.657, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": null, "org": null, "pdb": null, "pfx": 5, "reg": "2012-02-20", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004211572248}, {"a": 132165, "h": "CONNECT-AS-AP", "n": "Connect Communications", "t": "Transit & backbone", "w": 22, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 1, "mail_bruteforce": 5, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"dshield": {"n": 8, "p": 0.9939, "hi": 13.40, "lo": 4.36, "ips": 10, "mean": 8.36, "above": true}, "crowdsec": {"n": 6, "p": 0.8742, "hi": 8.58, "lo": 2.38, "ips": 7, "mean": 5.07, "above": true}, "blocklist_de": {"n": 9, "p": 0.9969, "hi": 13.62, "lo": 4.70, "ips": 10, "mean": 8.67, "above": true}}, "h2": [["2026-10-05", 12.869, 0.010, 1, false], ["2026-10-12", 17.331, 0.011, 1, false]], "sh": false, "uc": 1653.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.180, "obs": 0, "own": 1.747, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 9}, "lo": 17.331, "se": 0.410, "ts": 0.391, "map": 28.081, "obs": 23, "own": 87.248, "comp": {"cins": -2.4785, "dshield": 5.8969, "crowdsec": -4.5996, "vulncheck": -0.9645, "blocklist_de": 6.8744}, "mass": 22.1, "listed": false}}, "abq": false, "bot": 0.127, "det": {"blocklist_de": {"bots": 4, "imap": 5, "mail": 5, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CC1-AP-APNIC", "org": "Connect Communication", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.connect.net.pk"}, "pfx": 142, "reg": "2012-02-27", "rir": "apnic", "s24": 143, "sib": 3, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 37120, "abuse": "abuse@connect.net.pk", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.01766595353116}, {"a": 132199, "h": "GLOBE-MOBILE-5TH-GEN-AS", "n": "Globe Telecom Inc.", "t": "Broadband & mobile", "w": 42, "cc": "PH", "cf": {"rb": "", "wb": "hi", "rep": 2.88, "waf": 0.93}, "cs": {"c": {"http_flood": 2, "web_exploit": 15, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "mail_bruteforce": 3, "router_or_botnet": 8, "cve:CVE-2019-8318": 6, "cve:CVE-2018-10562": 8, "cve:CVE-2024-12847": 13, "cve:CVE-2024-28000": 1}, "n": 19}, "ev": {"dshield": {"n": 4, "p": 0.4469, "hi": 5.53, "lo": 1.19, "ips": 4, "mean": 3.02, "above": false}, "urlhaus": {"n": 13, "p": 1.0000, "hi": 18.58, "lo": 7.61, "ips": 13, "mean": 12.59, "above": true}, "crowdsec": {"n": 19, "p": 0.9656, "hi": 6.60, "lo": 3.14, "ips": 19, "mean": 4.73, "above": true}, "blocklist_de": {"n": 8, "p": 0.7421, "hi": 6.28, "lo": 2.04, "ips": 8, "mean": 3.91, "above": false}}, "h2": [["2026-10-05", 2.973, 18.229, 1, false], ["2026-10-12", 2.669, 9.774, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 13, "threatfox": 0, "phishing_db": 0}, "lo": 9.774, "se": 0.755, "ts": 1.000, "map": 21.043, "obs": 13, "own": 47.568, "comp": {"urlhaus": 6.4534, "threatfox": -0.5823, "phishing_db": -1.1984}, "mass": 32.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 19, "vulncheck": 0, "blocklist_de": 8}, "lo": 2.669, "se": 0.400, "ts": 0.613, "map": 4.306, "obs": 31, "own": 6.616, "comp": {"cins": -2.7631, "dshield": 0.5457, "crowdsec": 4.7946, "vulncheck": -0.9761, "blocklist_de": 1.2525}, "mass": 28.9, "listed": false}}, "abq": true, "bot": 0.130, "det": {"blocklist_de": {"ssh": 1, "bots": 5, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-GTI1-AP-APNIC", "org": "Globe Telecom Inc.", "pdb": null, "pfx": 542, "reg": "2012-03-12", "rir": "apnic", "s24": 1213, "sib": 1, "tor": 0, "w24": 40, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 318208, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.069016}, {"a": 132203, "h": "TENCENT-NET-AP-CN", "n": "Tencent Global", "t": "Hyperscale cloud", "w": 1164, "cc": "CN", "cf": {"rb": "", "wb": "", "rep": 1.37, "waf": 1.84}, "cs": {"c": {"http_flood": 612, "data_centre": 1, "web_exploit": 578, "bad_crawling": 338, "proxy_or_vpn": 87, "first_seen_30d": 79, "ssh_bruteforce": 224, "web_bruteforce": 429, "mail_bruteforce": 13, "cve:CVE-2017-9841": 44, "cve:CVE-2025-4396": 81, "cve:CVE-2018-20062": 26, "cve:CVE-2022-39290": 107, "cve:CVE-2024-28000": 32}, "n": 810}, "ev": {"cins": {"n": 13, "p": 0.4811, "hi": 4.48, "lo": 1.83, "ips": 13, "mean": 3.03, "above": false}, "shodan": {"n": 376, "p": 1.0000, "hi": 21.24, "lo": 17.93, "ips": 376, "mean": 19.55, "above": true}, "dshield": {"n": 20, "p": 0.8157, "hi": 5.17, "lo": 2.51, "ips": 20, "mean": 3.74, "above": true}, "urlhaus": {"n": 3, "p": 0.2164, "hi": 4.33, "lo": 0.76, "ips": 3, "mean": 2.23, "above": false}, "crowdsec": {"n": 670, "p": 1.0000, "hi": 30.08, "lo": 26.49, "ips": 810, "mean": 28.26, "above": true}, "threatfox": {"n": 31, "p": 1.0000, "hi": 18.09, "lo": 10.07, "ips": 31, "mean": 13.83, "above": true}, "vulncheck": {"n": 72, "p": 1.0000, "hi": 15.96, "lo": 10.85, "ips": 79, "mean": 13.30, "above": true}, "phishing_db": {"n": 138, "p": 1.0000, "hi": 30.68, "lo": 23.20, "ips": 146, "mean": 26.83, "above": true}, "blocklist_de": {"n": 136, "p": 1.0000, "hi": 15.42, "lo": 11.64, "ips": 138, "mean": 13.47, "above": true}}, "h2": [["2026-10-05", 11.558, 4.049, 2, false], ["2026-10-12", 10.231, 3.777, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 3, "threatfox": 31, "phishing_db": 138}, "lo": 3.777, "se": 0.749, "ts": 0.802, "map": 7.504, "obs": 172, "own": 5.170, "comp": {"urlhaus": -2.0729, "threatfox": 0.6168, "phishing_db": 5.0978}, "mass": 87.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 13, "dshield": 20, "crowdsec": 670, "vulncheck": 72, "blocklist_de": 136}, "lo": 10.231, "se": 0.347, "ts": 0.735, "map": 14.994, "obs": 911, "own": 6.136, "comp": {"cins": -2.6915, "dshield": -2.7016, "crowdsec": 14.1295, "vulncheck": -0.3785, "blocklist_de": -4.2566}, "mass": 706.6, "listed": true}}, "abq": false, "bot": 0.895, "det": {"shodan": {"c2": 57, "malware": 6, "compromised": 312, "doublepulsar": 1}, "threatfox": {"family:Sliver": 1, "family:Jackskid": 6, "family:AdaptixC2": 5, "family:Cobalt Strike": 12, "family:Unknown malware": 5}, "vulncheck": {"c2_server": 67, "attack_tooling": 11, "other_infrastructure": 1}, "blocklist_de": {"ftp": 4, "ssh": 127, "bots": 2, "imap": 1, "mail": 1, "apache": 4, "bruteforcelogin": 4}}, "oid": "ORG-STCS1-AP-APNIC", "org": "Shenzhen Tencent Computer Systems Company Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.tencent.com"}, "pfx": 1130, "reg": "2012-03-13", "rir": "apnic", "s24": 8557, "sib": 1, "tor": 1, "w24": 927, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 2716928, "abuse": "abuse@tencent.com", "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.313981}, {"a": 132298, "h": "ADCL-AS-AP", "n": "Antaranga Dot Com", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.6098, "hi": 7.34, "lo": 1.29, "ips": 3, "mean": 3.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 14.312, 0.012, 1, false]], "sh": false, "uc": 1636.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 14.312, "se": 0.621, "ts": 0.600, "map": 33.899, "obs": 5, "own": 19.178, "comp": {"cins": 3.4802, "dshield": -1.4424, "crowdsec": 3.6172, "vulncheck": -0.7791, "blocklist_de": 0.0411}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.166, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ADCL2-AP-APNIC", "org": "Antaranga Dot Com Ltd", "pdb": null, "pfx": 21, "reg": "2016-08-28", "rir": "apnic", "s24": 21, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "info@antbd.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00605628049836}, {"a": 132300, "h": "NIPA-AS-TH", "n": "NIPA Cloud Space", "t": "Hosting & VPS", "w": 1, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3842, "hi": 5.94, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 1.719, 0.011, 0, false], ["2026-10-12", 0.347, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.347, "se": 1.316, "ts": 1.000, "map": 3.042, "obs": 1, "own": 0.698, "comp": {"cins": -0.115, "dshield": -0.2672, "crowdsec": 3.7746, "vulncheck": -0.2866, "blocklist_de": -0.5996}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.949, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-NTCL1-AP-APNIC", "org": "NIPA Technology Co., Ltd", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.nipa.cloud/"}, "pfx": 31, "reg": "2012-06-13", "rir": "apnic", "s24": 28, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": "noc@nipa.cloud", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006577935384}, {"a": 132335, "h": "LEAPSWITCH-IN-AS-AP", "n": "LeapSwitch Networks", "t": "Broadband & mobile", "w": 14, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2026-8181": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 17, "p": 1.0000, "hi": 22.52, "lo": 10.27, "ips": 17, "mean": 15.89, "above": true}, "crowdsec": {"n": 5, "p": 0.8584, "hi": 9.03, "lo": 2.24, "ips": 6, "mean": 5.15, "above": true}, "vulncheck": {"n": 3, "p": 0.6254, "hi": 7.51, "lo": 1.32, "ips": 6, "mean": 3.87, "above": false}, "blocklist_de": {"n": 2, "p": 0.3800, "hi": 5.90, "lo": 0.77, "ips": 3, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 5.178, 0.011, 0, false], ["2026-10-12", 12.022, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 1.522, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 2}, "lo": 12.022, "se": 0.495, "ts": 0.455, "map": 22.841, "obs": 11, "own": 35.219, "comp": {"cins": 2.2745, "dshield": -2.0529, "crowdsec": 2.9926, "vulncheck": 1.205, "blocklist_de": 0.103}, "mass": 7.9, "listed": false}}, "abq": true, "bot": 0.838, "det": {"shodan": {"compromised": 17}, "vulncheck": {"c2_server": 1, "botnet_node": 5}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-LNPL10-AP-APNIC", "org": "LEAPSWITCH NETWORKS PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://leapswitch.com"}, "pfx": 44, "reg": "2012-07-19", "rir": "apnic", "s24": 62, "sib": 0, "tor": 0, "w24": 9, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 15872, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00119980586487}, {"a": 132359, "h": "MSROBITRADERS-AS-AP", "n": "M/S ROBI TRADERS", "t": "Other", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 20.312, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.312, "se": 1.147, "ts": 0.500, "map": 130.482, "obs": 2, "own": 79.978, "comp": {"cins": 4.8566, "dshield": -0.3936, "crowdsec": 3.0863, "vulncheck": -0.3817, "blocklist_de": -0.9027}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-RT25-AP-APNIC", "org": "M/S ROBI TRADERS", "pdb": null, "pfx": 1, "reg": "2025-06-01", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@robitraders.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004611531022}, {"a": 132372, "h": "GBNETWORK-AS-AP", "n": "GB Network Solutions", "t": "Hosting & VPS", "w": 1, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1421, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "phishing_db": {"n": 1, "p": 0.1845, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.902, 0.341, 0, false], ["2026-10-12", 0.009, 0.355, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.355, "se": 1.489, "ts": 1.000, "map": 3.210, "obs": 1, "own": 1.445, "comp": {"urlhaus": -0.147, "threatfox": -0.1712, "phishing_db": 3.1107}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.852, "ts": null, "map": 0.174, "obs": 0, "own": 0.076, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.365, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-GNS2-AP-APNIC", "org": "GB Network Solutions Sdn. Bhd.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.gbnetwork.my"}, "pfx": 69, "reg": "2016-08-18", "rir": "apnic", "s24": 69, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": "abuse@gbnetwork.my", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00069637029935}, {"a": 132386, "h": "USMANISP-AS-AP", "n": "Usman Internet Service Provider", "t": "Broadband & mobile", "w": 4, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "web_bruteforce": 2, "cve:CVE-2024-12847": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.419, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.419, "se": 1.048, "ts": 0.500, "map": 39.454, "obs": 2, "own": 64.301, "comp": {"cins": -0.2084, "dshield": 4.0893, "crowdsec": 2.6964, "vulncheck": -0.428, "blocklist_de": -1.0806}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.146, "det": null, "oid": "ORG-UISP1-AP-APNIC", "org": "Usman Internet Service Provider Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.usmanisp.com"}, "pfx": 4, "reg": "2016-08-18", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068915096492}, {"a": 132420, "h": "E2E-NETWORKS-IN", "n": "E2E Networks Limited", "t": "Other", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2020-37123": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 8, "p": 0.9799, "hi": 10.95, "lo": 3.56, "ips": 8, "mean": 6.83, "above": true}, "crowdsec": {"n": 2, "p": 0.2118, "hi": 4.51, "lo": 0.59, "ips": 2, "mean": 2.15, "above": false}, "vulncheck": {"n": 2, "p": 0.3728, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 2.372, 0.010, 0, false], ["2026-10-12", 1.056, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.980, "ts": null, "map": 0.179, "obs": 0, "own": 0.490, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.056, "se": 0.685, "ts": 0.500, "map": 2.757, "obs": 4, "own": 1.605, "comp": {"cins": -0.5047, "dshield": -1.0028, "crowdsec": 3.5301, "vulncheck": 2.9536, "blocklist_de": -2.5686}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.875, "det": {"shodan": {"compromised": 8}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}}, "oid": "ORG-ENPL1-AP-APNIC", "org": "E2E Networks Limited", "pdb": null, "pfx": 56, "reg": "2012-09-21", "rir": "apnic", "s24": 149, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 45056, "abuse": "abuse@e2enetworks.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00164162833962}, {"a": 132453, "h": "TRIPLE-PLAY-IN", "n": "Tripleplay Broadband", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1386, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "vulncheck": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1663, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.872, 0.011, 0, false], ["2026-10-12", 0.694, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.023, "ts": null, "map": 0.187, "obs": 0, "own": 1.459, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.694, "se": 0.927, "ts": 0.500, "map": 2.810, "obs": 2, "own": 4.647, "comp": {"cins": -0.2705, "dshield": -0.5889, "crowdsec": -2.325, "vulncheck": 2.1756, "blocklist_de": 3.4357}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.131, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-132453-APNIC", "org": "TRIPLE PLAY BROADBAND PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.tripleplay.in"}, "pfx": 22, "reg": "2012-10-16", "rir": "apnic", "s24": 74, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0041071371249}, {"a": 132482, "h": "RMUTR-AS-AP", "n": "Rajamangala University of Technology Rattanakosin", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OOIA1-AP-APNIC", "org": "Office of Info.Tech. Admin. for Educational Development", "pdb": null, "pfx": 12, "reg": "2012-11-15", "rir": "apnic", "s24": 8, "sib": 47, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "noc@uni.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000295149297}, {"a": 132490, "h": "MBSM-AS-AP", "n": "Mbsm Enterprise", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.190, "det": null, "oid": "ORG-ME5-AP-APNIC", "org": "Mbsm Enterprise", "pdb": null, "pfx": 9, "reg": "2022-03-10", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@mbsm.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024952547466}, {"a": 132510, "h": "ShanXiMCC-IDC", "n": "IDC ShanXi China Mobile communications corporation", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0621, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "crowdsec": {"n": 1, "p": 0.0461, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}, "blocklist_de": {"n": 1, "p": 0.1124, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}}, "h2": [["2026-10-05", 0.335, 0.010, 0, false], ["2026-10-12", 0.354, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.949, "ts": null, "map": 0.171, "obs": 0, "own": 1.068, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.354, "se": 0.874, "ts": 0.500, "map": 1.338, "obs": 2, "own": 2.135, "comp": {"cins": -0.3907, "dshield": -0.8108, "crowdsec": 0.8272, "vulncheck": -0.5973, "blocklist_de": 2.6566}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.824, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 25, "reg": "2012-12-04", "rir": "apnic", "s24": 231, "sib": 28, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67584, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017133964692}, {"a": 132525, "h": "CMNET-HEILONGJIANG-CN", "n": "China Mobile Heilongjiang Province Network", "t": "Broadband & mobile", "w": 14, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 3, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"cins": {"n": 5, "p": 0.6022, "hi": 6.21, "lo": 1.54, "ips": 5, "mean": 3.54, "above": false}, "dshield": {"n": 4, "p": 0.3339, "hi": 4.86, "lo": 1.05, "ips": 4, "mean": 2.65, "above": false}, "crowdsec": {"n": 4, "p": 0.0004, "hi": 1.71, "lo": 0.37, "ips": 4, "mean": 0.93, "above": false}, "blocklist_de": {"n": 3, "p": 0.0352, "hi": 2.81, "lo": 0.50, "ips": 3, "mean": 1.45, "above": false}}, "h2": [["2026-10-05", 0.534, 0.008, 0, false], ["2026-10-12", 1.202, 0.008, 0, false]], "sh": false, "uc": 66.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.799, "ts": null, "map": 0.113, "obs": 0, "own": 0.538, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 4, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.202, "se": 0.445, "ts": 0.313, "map": 2.075, "obs": 16, "own": 3.200, "comp": {"cins": 10.4453, "dshield": 2.2317, "crowdsec": -5.7517, "vulncheck": -0.9557, "blocklist_de": -3.8461}, "mass": 18.9, "listed": false}}, "abq": false, "bot": 0.407, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 2}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 582, "reg": "2012-12-12", "rir": "apnic", "s24": 1640, "sib": 28, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 934400, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00756619694246}, {"a": 132559, "h": "GATIK-AS-IN", "n": "Deshkal Network Pvt Ltd", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 3, "mean": 2.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 6.066, 0.011, 0, false], ["2026-10-12", 6.606, 0.012, 0, false]], "sh": false, "uc": 4159, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.606, "se": 0.788, "ts": 0.667, "map": 21.200, "obs": 3, "own": 33.226, "comp": {"cins": -0.449, "dshield": -0.9111, "crowdsec": 4.1594, "vulncheck": -0.6345, "blocklist_de": 2.2828}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.134, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-132559-APNIC", "org": "Gatik Business Solutions", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.ginternet.in/"}, "pfx": 19, "reg": "2013-01-14", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@gatikbs.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00317671753107}, {"a": 132566, "h": "SKYNET-AS-IN", "n": "Skynet Internet Broadband", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.163, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-132566-APNIC", "org": "Skynet Broadband Plus Solution", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.skynetmp.com/"}, "pfx": 11, "reg": "2013-01-14", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132585, "h": "SIA-HK-AS", "n": "SkyExchange Internet Access", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1251, "hi": 3.95, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}, "blocklist_de": {"n": 1, "p": 0.1655, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.804, 0.011, 0, false], ["2026-10-12", 0.867, 0.012, 0, false]], "sh": false, "uc": 420.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.584, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.867, "se": 0.913, "ts": 0.500, "map": 3.514, "obs": 2, "own": 2.059, "comp": {"cins": -0.3417, "dshield": -0.7227, "crowdsec": 1.3025, "vulncheck": -0.5609, "blocklist_de": 2.9732}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.367, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PILB1-AP-APNIC", "org": "PCCW IMS Ltd (PCCW Business Internet Access)", "pdb": null, "pfx": 21, "reg": "2013-01-22", "rir": "apnic", "s24": 76, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": "noc@imsbiz.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021011242126}, {"a": 132599, "h": "NICTDA-AS-AP", "n": "Ministry of Posts and Telecommunication", "t": "Broadband & mobile", "w": 1, "cc": "KH", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2022-39290": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 2490.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.360, "det": null, "oid": "ORG-NICT1-AP-APNIC", "org": "Ministry of Post and Telecommunication", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.mptc.gov.kh"}, "pfx": 14, "reg": "2013-02-01", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "noc@mptc.gov.kh", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005121521352}, {"a": 132608, "h": "MTSL-ISP-AP", "n": "Mango Teleservices Limited-ISP", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.4068, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-12", 5.440, 0.012, 0, false]], "sh": false, "uc": 1307.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 1.862, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.440, "se": 0.784, "ts": 0.667, "map": 17.440, "obs": 3, "own": 27.342, "comp": {"cins": -0.4941, "dshield": -0.9857, "crowdsec": -0.1156, "vulncheck": -0.6597, "blocklist_de": 6.5075}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.192, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-MTL10-AP-APNIC", "org": "Mango Teleservices Limited (ISP)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://mango.com.bd/"}, "pfx": 21, "reg": "2013-02-12", "rir": "apnic", "s24": 23, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@mango.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00232248713161}, {"a": 132618, "h": "REALFUTURE-AS-AP", "n": "Real Future Company Limited", "t": "Other", "w": 0, "cc": "TH", "cf": {"rb": "hi", "wb": "hi", "rep": 0.43, "waf": 0.38}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.883, "ts": null, "map": 0.150, "obs": 0, "own": 0.324, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.581, "ts": null, "map": 0.075, "obs": 0, "own": 0.062, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.057, "det": null, "oid": "ORG-RCL16-AP-APNIC", "org": "Realmove Company Limited", "pdb": null, "pfx": 636, "reg": "2013-02-21", "rir": "apnic", "s24": 552, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 277760, "abuse": "abuse@trueinternet.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.168502}, {"a": 132644, "h": "IDNIC-CBNCLOUD-AS-ID", "n": "PT Cyberindo Mega Persada", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2014-8739": 1, "cve:CVE-2015-4455": 1, "cve:CVE-2015-9415": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 1.063, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"c2": 1}}, "oid": "@family-32569", "org": "PT. Cyberindo Aditama", "pdb": null, "pfx": 9, "reg": "2013-03-01", "rir": "apnic", "s24": 16, "sib": 17, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "noc@cbncloud.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132645, "h": "IDNIC-PPNS-AS-ID", "n": "Politeknik Perkapalan Negeri Surabaya", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.138, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-132645-APNIC", "org": "Politeknik Perkapalan Negeri Surabaya", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Selective", "web": "https://ppns.ac.id/"}, "pfx": 4, "reg": "2013-03-01", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "admin.jsi@ppns.ac.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132652, "h": "IDNIC-UNINA-AS-ID", "n": "Cahaya Buana Raksa", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-132652-APNIC", "org": "PT. Cahaya Buana Raksa", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.cbr.net.id/"}, "pfx": 8, "reg": "2013-03-01", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007210889114}, {"a": 132653, "h": "B-LINK-AS-ID", "n": "Transdata Sejahtera", "t": "Transit & backbone", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-132653-APNIC", "org": "PT Transdata Sejahtera", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.transdata.net.id"}, "pfx": 7, "reg": "2013-03-01", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@b-link.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132658, "h": "IDNIC-DISKOMINFOPROVSU-AS-ID", "n": "Dinas Komunikasi dan Informatika Provinsi Sumatera Utara", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.422, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-132658-APNIC", "org": "Dinas Komunikasi dan Informatika Provinsi Sumatera Utara", "pdb": null, "pfx": 2, "reg": "2013-03-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132673, "h": "IDNIC-ARANANETWORK-AS-ID", "n": "PT Arana Teknologi Indonesia", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 16406.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.136, "det": null, "oid": "@aut-132673-APNIC", "org": "PT Arana Teknologi Indonesia", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://arana.net.id"}, "pfx": 2, "reg": "2013-03-01", "rir": "apnic", "s24": 2, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@arana.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132717, "h": "NDCTPL-IN", "n": "NXTGEN CLOUD TECHNOLOGIES PRIVATE LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.937, "ts": null, "map": 0.201, "obs": 0, "own": 0.108, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.833, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NDCT1-AP-APNIC", "org": "NXTGEN CLOUD TECHNOLOGIES PRIVATE LIMITED", "pdb": null, "pfx": 35, "reg": "2013-03-28", "rir": "apnic", "s24": 35, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "support@nxtgen.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132760, "h": "PROGRESSIONINFONET-AS", "n": "Progression Infonet Pvt Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.771, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-132760-APNIC", "org": "Progression Infonet Pvt Ltd", "pdb": null, "pfx": 3, "reg": "2013-04-17", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abusedesk@progression.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132768, "h": "FIVENETWORK-AS-IN", "n": "Five network Broadband Solution", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 2, "p": 0.3415, "hi": 5.57, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "blocklist_de": {"n": 1, "p": 0.1768, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 1.078, 0.011, 0, false], ["2026-10-12", 4.315, 0.012, 0, false]], "sh": false, "uc": 661.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.315, "se": 0.672, "ts": 0.500, "map": 11.255, "obs": 4, "own": 17.486, "comp": {"cins": -0.6524, "dshield": 2.2124, "crowdsec": 1.9839, "vulncheck": -0.7295, "blocklist_de": 1.0001}, "mass": 3.1, "listed": false}}, "abq": true, "bot": 0.168, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-132768-APNIC", "org": "Five network Broadband Solution Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.fivenetwork.co.in"}, "pfx": 59, "reg": "2013-04-17", "rir": "apnic", "s24": 49, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00110965735488}, {"a": 132770, "h": "GAZON-AS-IN", "n": "Gazon Communications India Limited", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2018-20062": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.4611, "hi": 6.02, "lo": 1.06, "ips": 3, "mean": 3.11, "above": false}}, "h2": [["2026-10-05", 2.625, 0.011, 0, false], ["2026-10-12", 1.248, 0.012, 0, false]], "sh": false, "uc": 510, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.001, "ts": null, "map": 0.183, "obs": 0, "own": 1.326, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.248, "se": 0.747, "ts": 1.000, "map": 3.731, "obs": 3, "own": 5.845, "comp": {"cins": -0.4961, "dshield": -0.989, "crowdsec": 7.3827, "vulncheck": -0.6607, "blocklist_de": -2.5266}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.155, "det": null, "oid": "@aut-132770-APNIC", "org": "Gazon Communications India Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "https://gazonfiber.com/"}, "pfx": 108, "reg": "2013-04-17", "rir": "apnic", "s24": 108, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27648, "abuse": "abuse@gazonindia.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00483757978284}, {"a": 132774, "h": "NISSBROADBAND-AS-IN", "n": "Niss Internet Services Pvt. Ltd.", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 3, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 3, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 6.431, 0.011, 0, false], ["2026-10-12", 2.680, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.680, "se": 0.975, "ts": 1.000, "map": 12.353, "obs": 2, "own": 19.888, "comp": {"cins": -0.2579, "dshield": -0.5644, "crowdsec": 6.5478, "vulncheck": -0.4845, "blocklist_de": -1.3334}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.258, "det": null, "oid": "@aut-132774-APNIC", "org": "Niss Internet services private limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Tbps", "pol": "Selective", "web": "http://www.nissbroadband.com"}, "pfx": 9, "reg": "2013-04-17", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@nissbroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00076918923459}, {"a": 132778, "h": "RVSMNEW-AS-IN", "n": "Rvsm Solutions", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 5.886, 0.013, 0, false]], "sh": false, "uc": 5143.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.886, "se": 1.031, "ts": 0.500, "map": 30.211, "obs": 2, "own": 49.175, "comp": {"cins": -0.2377, "dshield": -0.5244, "crowdsec": 2.3761, "vulncheck": -0.4627, "blocklist_de": 3.6506}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.191, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-132778-APNIC", "org": "Rvsm Solutions Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "http://rvsm.co.in"}, "pfx": 6, "reg": "2013-04-17", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132816, "h": "SIMPLERCLOUD-AS-AP", "n": "SimplerCloud", "t": "Hosting & VPS", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.837, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SPL11-AP-APNIC", "org": "SimplerCloud Pte Ltd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.simplercloud.com/"}, "pfx": 2, "reg": "2013-05-06", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@simplercloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132825, "h": "MYTEK-AS-AP", "n": "Defense Australia Network", "t": "Transit & backbone", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1501, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 2.197, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.181, "obs": 0, "own": 1.325, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.391, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MTPL6-AP-APNIC", "org": "MYTEK TRADING PTY LTD", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "http://7bull.net"}, "pfx": 57, "reg": "2013-05-10", "rir": "apnic", "s24": 58, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": "noc@cnc-int.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040358393445}, {"a": 132827, "h": "GATEWAY-AS-AP", "n": "GATEWAY INC", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 0.572, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.829, "ts": null, "map": 0.165, "obs": 0, "own": 0.197, "comp": null, "mass": 0.2, "listed": false}}, "abq": true, "bot": 0.970, "det": null, "oid": "ORG-GI2-AP-APNIC", "org": "GATEWAY INC", "pdb": null, "pfx": 46, "reg": "2013-05-13", "rir": "apnic", "s24": 83, "sib": 0, "tor": 0, "w24": 0, "drop": 9, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21248, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132839, "h": "POWERLINE-AS-AP", "n": "POWER LINE (HK", "t": "Transit & backbone", "w": 8, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0000, "hi": 0.96, "lo": 0.13, "ips": 2, "mean": 0.46, "above": false}, "vulncheck": {"n": 1, "p": 0.0137, "hi": 2.27, "lo": 0.17, "ips": 1, "mean": 0.96, "above": false}, "phishing_db": {"n": 3, "p": 0.1470, "hi": 3.85, "lo": 0.68, "ips": 4, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.0007, "hi": 1.47, "lo": 0.11, "ips": 2, "mean": 0.62, "above": false}}, "h2": [["2026-10-05", 0.143, 0.251, 0, false], ["2026-10-12", 0.124, 0.257, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 0.257, "se": 1.052, "ts": 1.000, "map": 0.847, "obs": 3, "own": 3.467, "comp": {"urlhaus": -0.8869, "threatfox": -0.4536, "phishing_db": 2.8008}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.124, "se": 0.654, "ts": 0.500, "map": 0.305, "obs": 4, "own": 0.977, "comp": {"cins": -0.7334, "dshield": -1.3429, "crowdsec": 1.2049, "vulncheck": 0.5785, "blocklist_de": 0.4981}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.806, "det": {"vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-PLCL1-AP-APNIC", "org": "POWER LINE (HK) CO., LIMITED", "pdb": {"t": "NSP", "sc": "Australia", "tr": "1-5Gbps", "pol": "Open", "web": null}, "pfx": 268, "reg": "2017-07-24", "rir": "apnic", "s24": 2079, "sib": 0, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 765696, "abuse": "abuse@powerline.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007300422449}, {"a": 132883, "h": "TOPWAY-AS-AP", "n": "TOPWAY GLOBAL LIMITED", "t": "Other", "w": 17, "cc": "HK", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1926, "hi": 4.67, "lo": 0.35, "ips": 11, "mean": 1.97, "above": false}, "shodan": {"n": 2, "p": 0.3749, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "threatfox": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "phishing_db": {"n": 4, "p": 0.8066, "hi": 9.00, "lo": 1.94, "ips": 4, "mean": 4.92, "above": true}, "blocklist_de": {"n": 1, "p": 0.1830, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.042, 14.290, 1, false], ["2026-10-12", 1.716, 14.273, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 4}, "lo": 14.273, "se": 0.862, "ts": 0.800, "map": 38.674, "obs": 5, "own": 35.005, "comp": {"urlhaus": -0.7281, "threatfox": 0.9022, "phishing_db": 5.1073}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.716, "se": 0.951, "ts": 0.500, "map": 7.526, "obs": 2, "own": 4.436, "comp": {"cins": 4.5015, "dshield": -0.7148, "crowdsec": -2.8188, "vulncheck": -0.5574, "blocklist_de": 3.0015}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.840, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 35, "reg": "2013-06-26", "rir": "apnic", "s24": 35, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 8960, "abuse": "info@topidc.hk", "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00010665106204}, {"a": 132892, "h": "CLOUDFLARE", "n": "Cloudflare, Inc.", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.56, "waf": 0.49}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1747, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.161, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.001, "ts": null, "map": 0.183, "obs": 0, "own": 0.205, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.161, "se": 1.199, "ts": 1.000, "map": 1.129, "obs": 1, "own": 0.247, "comp": {"cins": -0.1612, "dshield": 4.3306, "crowdsec": -1.4529, "vulncheck": -0.3634, "blocklist_de": -0.8384}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.686, "det": null, "oid": "ORG-CI4-AP-APNIC", "org": "Cloudflare, Inc.", "pdb": null, "pfx": 20, "reg": "2013-07-03", "rir": "apnic", "s24": 107, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29440, "abuse": "abuse@cloudflare.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.130119}, {"a": 132924, "h": "EROWIDECOMM-AS-IN", "n": "Ero Wide Comm Private Limited", "t": "Broadband & mobile", "w": 7, "cc": "IN", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 6, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 22.585, 0.941, 1, false], ["2026-10-12", 25.453, 0.984, 1, false]], "sh": false, "uc": 15039.1, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.984, "se": 1.853, "ts": 1.000, "map": 15.037, "obs": 1, "own": 67.852, "comp": {"urlhaus": 4.5003, "threatfox": -0.0588, "phishing_db": -0.1048}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 25.453, "se": 0.831, "ts": 1.000, "map": 89.676, "obs": 3, "own": 140.758, "comp": {"cins": -0.4471, "dshield": -0.9079, "crowdsec": -3.5744, "vulncheck": -0.6334, "blocklist_de": 11.4527}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"imap": 5, "mail": 6}}, "oid": "@aut-132924-APNIC", "org": "Ero Wide Comm Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://widecom.in"}, "pfx": 5, "reg": "2013-07-22", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@widecom.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 132934, "h": "SKYMAX-AS", "n": "Skymax Broadband Services", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 9.949, 0.011, 0, false], ["2026-10-12", 5.129, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 5.129, "se": 0.805, "ts": 0.333, "map": 16.655, "obs": 3, "own": 26.719, "comp": {"cins": 4.4089, "dshield": -0.7917, "crowdsec": 0.93, "vulncheck": 1.6081, "blocklist_de": -1.9489}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"other_infrastructure": 1}}, "oid": "@aut-132934-APNIC", "org": "Skymax Broadband Services Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.skymaxbroadband.com"}, "pfx": 7, "reg": "2013-07-22", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00106438797324}, {"a": 132937, "h": "Diadem-AS", "n": "Diadem Technologies Pvt. Ltd.", "t": "Other", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4090, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 3.545, 0.011, 0, false], ["2026-10-12", 3.827, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.827, "se": 0.998, "ts": 1.000, "map": 18.356, "obs": 2, "own": 10.851, "comp": {"cins": -0.2405, "dshield": -0.5301, "crowdsec": 6.7848, "vulncheck": -0.4658, "blocklist_de": -1.2448}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.858, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-132937-APNIC", "org": "Diadem Technologies Pvt. Ltd.", "pdb": null, "pfx": 10, "reg": "2013-07-22", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@diadem-tech.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133001, "h": "AIRNETNETWORKS-AS-IN", "n": "Airnet Cable And Datacom Pvt Ltd", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3329, "hi": 5.50, "lo": 0.71, "ips": 2, "mean": 2.62, "above": false}, "crowdsec": {"n": 1, "p": 0.1315, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}}, "h2": [["2026-10-05", 0.836, 0.011, 0, false], ["2026-10-12", 0.210, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.210, "se": 1.235, "ts": 1.000, "map": 1.587, "obs": 1, "own": 2.762, "comp": {"cins": -0.1446, "dshield": -0.3318, "crowdsec": 3.4224, "vulncheck": -0.3376, "blocklist_de": -0.7529}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.134, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-133001-APNIC", "org": "Airnet Cable And Datacom Pvt Ltd", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.airnetnetworks.com"}, "pfx": 68, "reg": "2013-07-22", "rir": "apnic", "s24": 68, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17920, "abuse": "abuse-support@airnetnetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00233639069676}, {"a": 133003, "h": "EDGETELECOMMUNICATIONS-AS-IN", "n": "Edge Telecommunications Pvt. Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.121, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 4, "reg": "2013-07-22", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133007, "h": "UCN-AS", "n": "UCN CABLE NETWORK", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1960, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 6.424, 0.011, 0, false], ["2026-10-12", 7.120, 0.012, 0, false]], "sh": false, "uc": 1148.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.120, "se": 0.792, "ts": 0.333, "map": 23.203, "obs": 3, "own": 36.428, "comp": {"cins": 4.1769, "dshield": -0.9738, "crowdsec": -0.0513, "vulncheck": -0.6558, "blocklist_de": 2.0419}, "mass": 2.2, "listed": false}}, "abq": true, "bot": 0.148, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-133007-APNIC", "org": "UCN CABLE NETWORK PVT. LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ucnindia.com"}, "pfx": 17, "reg": "2013-07-22", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00101844958596}, {"a": 133014, "h": "UTM-AS-AP", "n": "Universiti Teknologi Malaysia", "t": "Other", "w": 1, "cc": "MY", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2025-55182": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0562, "hi": 3.09, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "blocklist_de": {"n": 1, "p": 0.1212, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.372, 0.010, 0, false], ["2026-10-12", 0.398, 0.011, 0, false]], "sh": false, "uc": 260.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.959, "ts": null, "map": 0.174, "obs": 0, "own": 0.449, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.398, "se": 0.879, "ts": 0.500, "map": 1.511, "obs": 2, "own": 0.883, "comp": {"cins": -0.3845, "dshield": -0.7997, "crowdsec": 0.8867, "vulncheck": -0.5929, "blocklist_de": 2.6968}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.206, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-UTM4-AP-APNIC", "org": "Universiti Teknologi Malaysia", "pdb": null, "pfx": 21, "reg": "2013-07-24", "rir": "apnic", "s24": 201, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 100608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011230951379}, {"a": 133042, "h": "OBEC-AS-AP", "n": "Office of the basic education commission", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.250, "det": {"shodan": {"malware": 1}}, "oid": "ORG-OOIA1-AP-APNIC", "org": "Office of Info.Tech. Admin. for Educational Development", "pdb": null, "pfx": 6, "reg": "2013-08-09", "rir": "apnic", "s24": 11, "sib": 47, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "noc@uni.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001443579162}, {"a": 133054, "h": "RSHL-AS", "n": "Reasonable Software House Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.371, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.858, "det": {"shodan": {"c2": 1}}, "oid": "ORG-RSHL1-AP-APNIC", "org": "Reasonable Software House Limited", "pdb": null, "pfx": 8, "reg": "2013-08-21", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": "abuse@reasonables.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133070, "h": "EHL-AS-AP", "n": "EBN HOST LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.883, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-EHL5-AP-APNIC", "org": "EBN HOST LIMITED", "pdb": null, "pfx": 2, "reg": "2023-11-12", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@ebnhost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133076, "h": "UAT-AF", "n": "Unique Atlantic Telecommunication", "t": "Broadband & mobile", "w": 0, "cc": "AF", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2636.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.161, "det": null, "oid": "ORG-UAT1-AP-APNIC", "org": "Unique Atlantic Telecommunication", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.uatelecom.af"}, "pfx": 8, "reg": "2013-09-16", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "info@uatelecom.af", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000703682186}, {"a": 133115, "h": "HKKFGL-AS-AP", "n": "HK Kwaifong Group Limited", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.010, 0.346, 0, false], ["2026-10-12", 0.010, 0.356, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.356, "se": 1.491, "ts": 1.000, "map": 3.212, "obs": 1, "own": 3.803, "comp": {"urlhaus": -0.1327, "threatfox": 3.2156, "phishing_db": -0.2898}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.866, "ts": null, "map": 0.179, "obs": 0, "own": 0.230, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-HKIS1-AP-APNIC", "org": "HK Kwaifong Group Limited", "pdb": null, "pfx": 61, "reg": "2013-10-09", "rir": "apnic", "s24": 61, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011291162556}, {"a": 133119, "h": "UNICOM-CN", "n": "China Unicom IP network", "t": "Broadband & mobile", "w": 5, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0088, "hi": 2.10, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}, "crowdsec": {"n": 1, "p": 0.0039, "hi": 1.85, "lo": 0.14, "ips": 1, "mean": 0.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.0439, "hi": 2.90, "lo": 0.22, "ips": 4, "mean": 1.22, "above": false}}, "h2": [["2026-10-05", 0.163, 0.009, 0, false], ["2026-10-12", 0.164, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.878, "ts": null, "map": 0.148, "obs": 0, "own": 0.785, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.164, "se": 0.845, "ts": 0.500, "map": 0.587, "obs": 2, "own": 0.935, "comp": {"cins": -0.4338, "dshield": -0.8853, "crowdsec": 0.4251, "vulncheck": -0.6253, "blocklist_de": 2.3802}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.950, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 4}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 19, "reg": "2013-10-10", "rir": "apnic", "s24": 591, "sib": 25, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 153856, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000607954646}, {"a": 133150, "h": "GTISI-AS-AP", "n": "GGS Technical Information Services Inc.", "t": "Other", "w": 5, "cc": "PH", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 5, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 3.184, 0.011, 0, false], ["2026-10-12", 6.536, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 6.536, "se": 0.824, "ts": 1.000, "map": 21.420, "obs": 3, "own": 12.917, "comp": {"cins": -0.2254, "dshield": -0.4998, "crowdsec": -1.9747, "vulncheck": 8.3252, "blocklist_de": -1.1674}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.902, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-GTIS1-AP-APNIC", "org": "GGS Technical Information Services Inc.", "pdb": null, "pfx": 5, "reg": "2022-04-21", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "support@ggsinc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000017397688}, {"a": 133159, "h": "MAMMOTHMEDIA-AS-AP", "n": "Mammoth Media", "t": "Hosting & VPS", "w": 3, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 14, "p": 1.0000, "hi": 18.46, "lo": 7.80, "ips": 14, "mean": 12.65, "above": true}, "vulncheck": {"n": 2, "p": 0.3932, "hi": 6.02, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "phishing_db": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 1.014, 0.316, 0, false], ["2026-10-12", 0.464, 0.324, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.324, "se": 1.472, "ts": 1.000, "map": 2.803, "obs": 1, "own": 1.261, "comp": {"urlhaus": -0.1611, "threatfox": -0.1832, "phishing_db": 3.0013}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.464, "se": 0.917, "ts": 1.000, "map": 1.827, "obs": 2, "own": 0.391, "comp": {"cins": -0.2098, "dshield": -0.4683, "crowdsec": -1.8507, "vulncheck": 5.6127, "blocklist_de": -1.0877}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.841, "det": {"shodan": {"c2": 4, "compromised": 10}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}}, "oid": "ORG-MMPL2-AP-APNIC", "org": "Mammoth Media Pty Ltd", "pdb": {"t": "Content", "sc": "Australia", "tr": null, "pol": "Open", "web": "https://www.mammoth.com.au/"}, "pfx": 40, "reg": "2013-11-13", "rir": "apnic", "s24": 87, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 24576, "abuse": "abuse@mammothmedia.com.au", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0012186984832}, {"a": 133199, "h": "SONDERCLOUDLIMITED-AS-AP", "n": "SonderCloud Limited", "t": "Hosting & VPS", "w": 13, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.8822, "hi": 8.14, "lo": 2.46, "ips": 7, "mean": 4.95, "above": true}, "threatfox": {"n": 4, "p": 0.7925, "hi": 8.77, "lo": 1.89, "ips": 5, "mean": 4.79, "above": true}, "phishing_db": {"n": 8, "p": 0.9914, "hi": 12.65, "lo": 4.12, "ips": 8, "mean": 7.89, "above": true}}, "h2": [["2026-10-05", 0.007, 6.260, 0, false], ["2026-10-12", 0.007, 6.224, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 8}, "lo": 6.224, "se": 0.787, "ts": 0.667, "map": 13.886, "obs": 12, "own": 4.998, "comp": {"urlhaus": -1.4914, "threatfox": 1.6942, "phishing_db": 4.0542}, "mass": 5.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.665, "ts": null, "map": 0.104, "obs": 0, "own": 0.033, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.929, "det": {"shodan": {"malware": 2, "compromised": 5}, "threatfox": {"family:Remcos": 1, "family:VShell": 1, "family:Cobalt Strike": 3}}, "oid": "ORG-SL6-AP-APNIC", "org": "SonderCloud Limited", "pdb": null, "pfx": 255, "reg": "2013-12-23", "rir": "apnic", "s24": 288, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.7990], ["2026-10-12", 0.9980]], "ipv4": 134400, "abuse": "noc@sondercloud.com", "score": 0.9980, "groups": ["abusech", "phishing", "shodan"], "sensors": [], "traffic": 0.0014162310142}, {"a": 133201, "h": "COMING-AS", "n": "ABCDE GROUP", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.549, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AGCL1-AP-APNIC", "org": "ABCDE GROUP COMPANY LIMITED", "pdb": null, "pfx": 6, "reg": "2013-12-24", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000003399975}, {"a": 133210, "h": "ENTECHNOLOGIES-AS-AP", "n": "EN Technologies", "t": "Broadband & mobile", "w": 35, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 26, "data_centre": 9, "web_exploit": 33, "bad_crawling": 22, "proxy_or_vpn": 11, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 33, "home_connection": 21, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 6, "cve:CVE-2021-3129": 2, "cve:CVE-2022-46604": 4, "cve:CVE-2024-28000": 14, "cve:CVE-2026-63030": 7}, "n": 35}, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 4, "p": 0.7920, "hi": 8.76, "lo": 1.88, "ips": 35, "mean": 4.78, "above": false}}, "h2": [["2026-10-05", 18.052, 0.011, 1, false], ["2026-10-12", 10.519, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.519, "se": 0.682, "ts": 1.000, "map": 27.785, "obs": 4, "own": 43.070, "comp": {"cins": -0.5707, "dshield": -1.1068, "crowdsec": 9.9851, "vulncheck": -0.6966, "blocklist_de": -2.8929}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.891, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ETPL9-AP-APNIC", "org": "EN Technologies Pte Ltd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.en.com.sg"}, "pfx": 17, "reg": "2014-01-10", "rir": "apnic", "s24": 17, "sib": 0, "tor": 2, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse@en.net.sg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00305537942931}, {"a": 133211, "h": "ALONIANETBD-AS-AP", "n": "Alonia Net BD", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 87890.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.302, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": "2023-03-12", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133255, "h": "ELXER-AS-IN", "n": "Elxer Communications Private Limited", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1955, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.011, 0.587, 0, false]], "sh": false, "uc": 1233.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.587, "se": 1.606, "ts": 1.000, "map": 6.763, "obs": 1, "own": 20.700, "comp": {"urlhaus": -0.078, "threatfox": -0.1032, "phishing_db": 3.7188}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 1.184, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.147, "det": null, "oid": "@aut-133255-APNIC", "org": "Elxer Communications Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.elxer.com"}, "pfx": 13, "reg": "2014-01-22", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042191955696}, {"a": 133271, "h": "WILLOPL-AS-IN", "n": "Willaegis Online", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 5.283, 0.013, 0, false]], "sh": false, "uc": 4352.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.283, "se": 1.022, "ts": 0.500, "map": 26.583, "obs": 2, "own": 43.203, "comp": {"cins": -0.2437, "dshield": -0.5363, "crowdsec": 2.3118, "vulncheck": -0.4693, "blocklist_de": 3.6115}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.228, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-133271-APNIC", "org": "Willaegis Online Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.willaegis.in"}, "pfx": 7, "reg": "2014-01-22", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058186765539}, {"a": 133275, "h": "Gigantic-AS", "n": "Gigantic Infotel Pvt Ltd", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2592, "hi": 4.89, "lo": 0.64, "ips": 2, "mean": 2.33, "above": false}}, "h2": [["2026-10-12", 0.608, 0.435, 0, false]], "sh": false, "uc": 437.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.435, "se": 1.539, "ts": 1.000, "map": 4.332, "obs": 1, "own": 12.930, "comp": {"urlhaus": 3.8827, "threatfox": -0.274, "phishing_db": -0.5165}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.608, "se": 0.896, "ts": 1.000, "map": 2.401, "obs": 2, "own": 3.832, "comp": {"cins": -0.3324, "dshield": -0.7058, "crowdsec": 5.5716, "vulncheck": -0.5534, "blocklist_de": -1.7104}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.157, "det": null, "oid": "@aut-133275-APNIC", "org": "Gigantic Infotel Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.gtel.in"}, "pfx": 105, "reg": "2014-01-22", "rir": "apnic", "s24": 108, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 27648, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00327266408994}, {"a": 133278, "h": "ENETSOLS-AS-IN", "n": "Dehradun E-net Solutions", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 2, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.309, 0.011, 0, false], ["2026-10-12", 0.329, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.272, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.329, "se": 1.306, "ts": 1.000, "map": 2.829, "obs": 1, "own": 0.646, "comp": {"cins": -0.1182, "dshield": -0.2744, "crowdsec": 3.7352, "vulncheck": -0.2925, "blocklist_de": -0.6166}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-133278-APNIC", "org": "Dehradun Enet Solutions Private Ltd", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://Enet.net.in"}, "pfx": 31, "reg": "2014-01-22", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "admin@enet.net.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00060511560138}, {"a": 133279, "h": "SPEED4NET-AS", "n": "SPEED4NET", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6379, "hi": 7.65, "lo": 1.35, "ips": 5, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 23.061, 0.011, 1, false], ["2026-10-12", 9.488, 0.012, 0, false]], "sh": false, "uc": 1502.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 9.488, "se": 0.799, "ts": 1.000, "map": 31.457, "obs": 3, "own": 49.304, "comp": {"cins": -0.5027, "dshield": -0.9996, "crowdsec": -3.9323, "vulncheck": -0.6641, "blocklist_de": 10.9411}, "mass": 2.3, "listed": false}}, "abq": true, "bot": 0.139, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "@aut-133279-APNIC", "org": "SPEED4NET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.stplnet.com"}, "pfx": 13, "reg": "2014-01-22", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133285, "h": "CNSINFOTEL-AS", "n": "CNS Infotel Services", "t": "Other", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.682, 0.906, 0, false]], "sh": false, "uc": 24162.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.906, "se": 1.798, "ts": 1.000, "map": 13.214, "obs": 1, "own": 21.476, "comp": {"urlhaus": 4.4474, "threatfox": -0.0859, "phishing_db": -0.1541}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 5.568, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.172, "det": null, "oid": "@aut-133285-APNIC", "org": "CNS Infotel Services Pvt. Ltd.", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.cns24x7.net"}, "pfx": 7, "reg": "2014-01-22", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133296, "h": "WEBWERKS-AS-IN", "n": "Web Werks DataCenter", "t": "Hosting & VPS", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"shodan": {"n": 11, "p": 0.9966, "hi": 11.61, "lo": 4.42, "ips": 11, "mean": 7.65, "above": true}, "crowdsec": {"n": 3, "p": 0.2485, "hi": 4.54, "lo": 0.80, "ips": 3, "mean": 2.34, "above": false}, "phishing_db": {"n": 1, "p": 0.1480, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 2.093, 0.184, 0, false], ["2026-10-12", 0.570, 0.194, 0, false]], "sh": false, "uc": 156.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.194, "se": 1.406, "ts": 1.000, "map": 1.412, "obs": 1, "own": 0.645, "comp": {"urlhaus": -0.2416, "threatfox": -0.242, "phishing_db": 2.4551}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.570, "se": 0.731, "ts": 1.000, "map": 1.647, "obs": 3, "own": 0.329, "comp": {"cins": -0.5344, "dshield": -1.0502, "crowdsec": 6.8723, "vulncheck": -0.6799, "blocklist_de": -2.7149}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.879, "det": {"shodan": {"compromised": 11}}, "oid": "@aut-132969-APNIC", "org": "Web Werks India Pvt. Ltd.", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.webwerks.in/mumbai-dc-facility"}, "pfx": 238, "reg": "2014-01-22", "rir": "apnic", "s24": 266, "sib": 7, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 68096, "abuse": "netops@webwerks.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00063655886646}, {"a": 133320, "h": "ALPHA-AS-AP", "n": "Alpha InfoLab Private limited", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.093, "det": null, "oid": "ORG-AIPL17-AP-APNIC", "org": "Alpha InfoLab Private Limited", "pdb": null, "pfx": 1, "reg": "2014-01-22", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@alphainfolab.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133322, "h": "XIM-HK", "n": "XIMBO Internet Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.834, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-XIL1-AP-APNIC", "org": "XIMBO Internet Limited", "pdb": null, "pfx": 5, "reg": "2014-01-22", "rir": "apnic", "s24": 5, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "ipadmin@layerstack.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001485257826}, {"a": 133360, "h": "IDNIC-AWINET-AS-ID", "n": "Awinet Global Mandiri", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 2, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.8031, "hi": 8.94, "lo": 1.92, "ips": 4, "mean": 4.88, "above": true}}, "h2": [["2026-10-05", 26.539, 0.011, 1, false], ["2026-10-12", 18.466, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 18.466, "se": 0.690, "ts": 1.000, "map": 49.835, "obs": 4, "own": 77.184, "comp": {"cins": -0.5454, "dshield": -1.0676, "crowdsec": 10.3695, "vulncheck": -0.6851, "blocklist_de": -2.769}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.238, "det": null, "oid": "@aut-133360-APNIC", "org": "PT Awinet Global Mandiri", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://awi.net.id"}, "pfx": 10, "reg": "2014-02-05", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "admin@awi.net.id", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0019741108156}, {"a": 133380, "h": "LAYER-AS", "n": "Layerstack", "t": "Broadband & mobile", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9381, "hi": 10.28, "lo": 2.85, "ips": 6, "mean": 6.08, "above": true}}, "h2": [["2026-10-05", 1.788, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": 275.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.187, "obs": 0, "own": 1.474, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.849, "ts": null, "map": 0.172, "obs": 0, "own": 0.585, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.888, "det": {"shodan": {"compromised": 6}}, "oid": "ORG-PHL1-AP-APNIC", "org": "Layerstack Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.layerstack.com"}, "pfx": 71, "reg": "2014-02-18", "rir": "apnic", "s24": 71, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 18176, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00045486537688}, {"a": 133398, "h": "TELE-AS", "n": "Tele Asia", "t": "Other", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 6, "p": 0.9574, "hi": 11.22, "lo": 3.11, "ips": 6, "mean": 6.63, "above": true}, "crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 2, "mean": 1.87, "above": false}, "threatfox": {"n": 1, "p": 0.1974, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.339, 7.233, 0, false], ["2026-10-12", 0.360, 0.494, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.494, "se": 1.560, "ts": 1.000, "map": 5.183, "obs": 1, "own": 6.257, "comp": {"urlhaus": -0.091, "threatfox": 3.575, "phishing_db": -0.2123}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.360, "se": 1.323, "ts": 1.000, "map": 3.207, "obs": 1, "own": 2.120, "comp": {"cins": -0.1126, "dshield": -0.2619, "crowdsec": 3.8031, "vulncheck": -0.2822, "blocklist_de": -0.5873}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.902, "det": {"shodan": {"c2": 6}, "threatfox": {"family:Sliver": 1, "family:AdaptixC2": 1}}, "oid": "ORG-TAL2-AP-APNIC", "org": "Tele Asia Limited", "pdb": null, "pfx": 23, "reg": "2014-03-05", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 6656, "abuse": "abuse@tele-asia.net", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00038909075826}, {"a": 133450, "h": "CU-AS-AP", "n": "University Of Chittagong", "t": "Other", "w": 9, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 6, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 6, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.147, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 7}}, "oid": "ORG-UOC2-AP-APNIC", "org": "University Of Chittagong", "pdb": null, "pfx": 4, "reg": "2017-06-05", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133480, "h": "INT-5GN-AS-AP", "n": "Intergrid", "t": "Transit & backbone", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 2.447, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.937, "ts": null, "map": 0.201, "obs": 0, "own": 1.717, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.867, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NOPL2-AP-APNIC", "org": "5G NETWORK OPERATIONS PTY LTD", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://intergrid.com.au"}, "pfx": 35, "reg": "2014-05-11", "rir": "apnic", "s24": 35, "sib": 17, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@5gn.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003325905354}, {"a": 133481, "h": "AIS-Fibre-AS-AP", "n": "Advanced Wireless Network Co. Ltd.(ฺBroadband)", "t": "Broadband & mobile", "w": 25, "cc": "TH", "cf": {"rb": "", "wb": "", "rep": 1.40, "waf": 0.47}, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0001, "hi": 1.20, "lo": 0.09, "ips": 1, "mean": 0.51, "above": false}, "dshield": {"n": 16, "p": 1.0000, "hi": 13.92, "lo": 6.21, "ips": 17, "mean": 9.74, "above": true}, "crowdsec": {"n": 4, "p": 0.0018, "hi": 1.96, "lo": 0.42, "ips": 4, "mean": 1.07, "above": false}, "blocklist_de": {"n": 5, "p": 0.2478, "hi": 4.24, "lo": 1.05, "ips": 5, "mean": 2.42, "above": false}}, "h2": [["2026-10-05", 0.551, 0.008, 0, false], ["2026-10-12", 1.860, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.119, "obs": 0, "own": 0.574, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 16, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 5}, "lo": 1.860, "se": 0.411, "ts": 0.640, "map": 2.980, "obs": 25, "own": 4.586, "comp": {"cins": -2.5065, "dshield": 14.2701, "crowdsec": -6.8714, "vulncheck": -0.9657, "blocklist_de": -1.4408}, "mass": 22.8, "listed": false}}, "abq": false, "bot": 0.120, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 3, "imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Restrictive", "web": "http://www.ais.co.th"}, "pfx": 585, "reg": "2014-05-12", "rir": "apnic", "s24": 1382, "sib": 0, "tor": 0, "w24": 24, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 505856, "abuse": "abuseIPv4@ais.co.th", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.170907}, {"a": 133524, "h": "GTCL-AS-AP", "n": "Global Technology Co., Ltd.", "t": "Transit & backbone", "w": 2, "cc": "MM", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1622, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-12", 0.313, 0.633, 0, false]], "sh": false, "uc": 792.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.633, "se": 1.642, "ts": 1.000, "map": 7.560, "obs": 1, "own": 34.802, "comp": {"urlhaus": 4.1891, "threatfox": -0.1899, "phishing_db": -0.3501}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.313, "se": 1.297, "ts": 1.000, "map": 2.646, "obs": 1, "own": 9.597, "comp": {"cins": -0.1212, "dshield": -0.281, "crowdsec": 3.6992, "vulncheck": -0.2979, "blocklist_de": -0.6321}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.271, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-GTCL1-AP-APNIC", "org": "Global Technology Co., Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.globalnet.com.mm/"}, "pfx": 34, "reg": "2014-06-06", "rir": "apnic", "s24": 34, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00292964680176}, {"a": 133593, "h": "VBCBROADBAND-AS", "n": "VIZAG BROADCASTING COMPANY", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 1.256, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.791, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.128, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-133593-APNIC", "org": "VIZAG BROADCASTING COMPANY PVT. LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.vbctv.in"}, "pfx": 31, "reg": "2014-08-27", "rir": "apnic", "s24": 40, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16896, "abuse": "noc@vbctv.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050972654721}, {"a": 133594, "h": "WPIS-AS", "n": "World Phone Infrastructure services private ltd", "t": "Other", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "mail_bruteforce": 3, "router_or_botnet": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.8947, "hi": 9.86, "lo": 2.45, "ips": 5, "mean": 5.63, "above": true}, "blocklist_de": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 10.500, 0.011, 1, false], ["2026-10-12", 14.717, 0.012, 1, false]], "sh": false, "uc": 3602.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.740, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 14.717, "se": 0.575, "ts": 0.833, "map": 32.229, "obs": 6, "own": 18.167, "comp": {"cins": -0.893, "dshield": -1.5504, "crowdsec": 8.5879, "vulncheck": -0.8009, "blocklist_de": -0.477}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.196, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-133594-APNIC", "org": "World Phone Infrastructure services private ltd", "pdb": null, "pfx": 27, "reg": "2014-08-27", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "admin@worldphone.in", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00049584468018}, {"a": 133612, "h": "VODAFONE-AS-AP", "n": "Vodafone Hutchison Australia", "t": "Broadband & mobile", "w": 4, "cc": "AU", "cf": {"rb": "hi", "wb": "hi", "rep": 1.43, "waf": 1.25}, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.0306, "hi": 2.77, "lo": 0.60, "ips": 4, "mean": 1.51, "above": false}}, "h2": [["2026-10-05", 0.002, 0.006, 0, false], ["2026-10-12", 0.071, 0.007, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.007, "se": 1.730, "ts": null, "map": 0.081, "obs": 0, "own": 0.366, "comp": null, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.071, "se": 0.630, "ts": 1.000, "map": 0.169, "obs": 4, "own": 0.264, "comp": {"cins": -0.8172, "dshield": 10.9922, "crowdsec": -5.6992, "vulncheck": -0.7817, "blocklist_de": -4.0801}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.051, "det": null, "oid": "ORG-VAPL1-AP-APNIC", "org": "Vodafone Australia Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Australia", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.vodafone.com.au"}, "pfx": 148, "reg": "2014-07-24", "rir": "apnic", "s24": 4280, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2341632, "abuse": "ipadmin@tpgtelecom.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.051122}, {"a": 133619, "h": "DESIVPS-AS-AP", "n": "DESIVPS", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1978, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 5.337, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.337, "se": 1.024, "ts": 0.500, "map": 26.930, "obs": 2, "own": 5.588, "comp": {"cins": 4.6982, "dshield": -0.5422, "crowdsec": 2.2796, "vulncheck": -0.4726, "blocklist_de": -1.276}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.648, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 7, "reg": "2023-09-06", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@desivps.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133643, "h": "EWEBGURU-AS", "n": "BASIS Technologies", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.812, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.812, "se": 1.514, "ts": 1.000, "map": 10.069, "obs": 1, "own": 7.565, "comp": {"cins": -0.0687, "dshield": -0.1629, "crowdsec": -0.6454, "vulncheck": -0.1914, "blocklist_de": 4.7715}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.818, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-133643-APNIC", "org": "EWEBGURU", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://basistech.in"}, "pfx": 5, "reg": "2014-09-15", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@ewebguru.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133648, "h": "MAGNUS-TELELINKS-AS", "n": "MNR Broadband Services", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 4.076, 0.011, 0, false], ["2026-10-12", 0.341, 0.012, 0, false]], "sh": false, "uc": 1104.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.341, "se": 1.312, "ts": 1.000, "map": 2.967, "obs": 1, "own": 5.333, "comp": {"cins": -0.1161, "dshield": -0.2697, "crowdsec": 3.761, "vulncheck": -0.2886, "blocklist_de": -0.6054}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.193, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 2}}, "oid": "@aut-133648-APNIC", "org": "MNR Broadband Services Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.conexiaworld.com"}, "pfx": 15, "reg": "2014-09-15", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00433900332963}, {"a": 133661, "h": "NETPLUS-AS", "n": "Netplus Broadband Services", "t": "Broadband & mobile", "w": 58, "cc": "IN", "cf": {"rb": "lo", "wb": null, "rep": 1.78, "waf": null}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 31}, "n": 35}, "ev": {"dshield": {"n": 5, "p": 0.8440, "hi": 8.76, "lo": 2.18, "ips": 5, "mean": 5.00, "above": true}, "crowdsec": {"n": 8, "p": 0.8515, "hi": 7.27, "lo": 2.36, "ips": 35, "mean": 4.53, "above": true}, "vulncheck": {"n": 2, "p": 0.3056, "hi": 5.27, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}, "blocklist_de": {"n": 8, "p": 0.9723, "hi": 10.33, "lo": 3.36, "ips": 24, "mean": 6.44, "above": true}}, "h2": [["2026-10-05", 4.808, 0.010, 0, false], ["2026-10-12", 6.244, 0.010, 0, false]], "sh": false, "uc": 997.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.161, "obs": 0, "own": 0.919, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 8, "vulncheck": 2, "blocklist_de": 8}, "lo": 6.244, "se": 0.416, "ts": 0.348, "map": 10.259, "obs": 23, "own": 15.737, "comp": {"cins": -2.4192, "dshield": 2.8881, "crowdsec": -1.9786, "vulncheck": -0.3971, "blocklist_de": 5.6286}, "mass": 21.0, "listed": false}}, "abq": true, "bot": 0.137, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1, "bots": 1, "imap": 20, "mail": 21, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-133661-APNIC", "org": "Netplus Broadband Services Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.netplus.co.in"}, "pfx": 374, "reg": "2014-09-15", "rir": "apnic", "s24": 371, "sib": 0, "tor": 0, "w24": 18, "drop": 1, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 172544, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.02207852413128}, {"a": 133676, "h": "PNPL-AS", "n": "Precious netcom", "t": "Broadband & mobile", "w": 9, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 2}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1819, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "dshield": {"n": 2, "p": 0.3896, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "crowdsec": {"n": 5, "p": 0.8218, "hi": 8.39, "lo": 2.09, "ips": 5, "mean": 4.79, "above": true}, "vulncheck": {"n": 1, "p": 0.1779, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 3, "p": 0.5791, "hi": 7.04, "lo": 1.24, "ips": 4, "mean": 3.63, "above": false}}, "h2": [["2026-10-05", 7.974, 0.011, 0, false], ["2026-10-12", 10.925, 0.012, 1, false]], "sh": false, "uc": 1698.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 1.371, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 3}, "lo": 10.925, "se": 0.472, "ts": 0.417, "map": 19.673, "obs": 12, "own": 30.224, "comp": {"cins": 1.6752, "dshield": 1.495, "crowdsec": 0.3661, "vulncheck": -0.3663, "blocklist_de": 1.2029}, "mass": 10.3, "listed": false}}, "abq": true, "bot": 0.162, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2, "imap": 2, "mail": 2}}, "oid": "@aut-133676-APNIC", "org": "Precious netcom pvt ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.preciousnetcom.in"}, "pfx": 94, "reg": "2014-09-15", "rir": "apnic", "s24": 95, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24832, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00505255359516}, {"a": 133685, "h": "SDNTELE-AS", "n": "SDN TELECOM", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 2.912, 0.011, 0, false], ["2026-10-12", 8.374, 0.012, 0, false]], "sh": false, "uc": 4129.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.374, "se": 0.795, "ts": 0.667, "map": 27.195, "obs": 3, "own": 42.646, "comp": {"cins": -0.4717, "dshield": -0.9489, "crowdsec": 0.0826, "vulncheck": -0.6475, "blocklist_de": 6.6822}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.112, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-133685-APNIC", "org": "SDN TELECOM PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://fiberx.co.in/"}, "pfx": 14, "reg": "2014-09-15", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@signumtv.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00066794638107}, {"a": 133692, "h": "Fastnet-AS-IN", "n": "Fastnet Communication", "t": "Broadband & mobile", "w": 13, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 1, "web_exploit": 9, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 13, "cve:CVE-2024-28000": 1}, "n": 13}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 13, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 5.153, 0.011, 0, false], ["2026-10-12", 5.536, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 45.634, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.276, "det": null, "oid": "@aut-133692-APNIC", "org": "Fastnet Communication Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://fonexiabroadband.com"}, "pfx": 8, "reg": "2014-09-15", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133694, "h": "EMAXGLOBAL-AS", "n": "EMAXGLOBAL", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2166.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.822, "det": null, "oid": "@aut-133694-APNIC", "org": "EMAX GLOBAL MEDIA PVT. LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://emaxglobal.com"}, "pfx": 11, "reg": "2014-09-15", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133711, "h": "HBSGZB-AS", "n": "Home Broadband Services", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 3, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 2.912, 0.011, 0, false], ["2026-10-12", 8.374, 0.012, 0, false]], "sh": false, "uc": 2790.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.374, "se": 0.795, "ts": 0.667, "map": 27.195, "obs": 3, "own": 42.646, "comp": {"cins": -0.4717, "dshield": -0.9489, "crowdsec": 0.0826, "vulncheck": -0.6475, "blocklist_de": 6.6822}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.244, "det": {"blocklist_de": {"bots": 3}}, "oid": "@aut-133711-APNIC", "org": "Home Broadband Services LLP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://hbsnetwork.net/"}, "pfx": 14, "reg": "2014-09-15", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "abuse@homebroadband.tv", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00096576539181}, {"a": 133712, "h": "SPECTRACLOUD-AS", "n": "Spectra Technologies India Private Limited", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3856, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.84, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.279, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.209, "obs": 0, "own": 0.122, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.642, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-134035-APNIC", "org": "Spectra Technologies India Private Limited", "pdb": null, "pfx": 27, "reg": "2014-09-15", "rir": "apnic", "s24": 27, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": "abuse@spectracloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133719, "h": "IDIGITAL-AS", "n": "IDIGITALCAMP WEB SERVICES", "t": "Other", "w": 3, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 10.098, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 10.098, "se": 1.096, "ts": 0.500, "map": 56.731, "obs": 2, "own": 35.559, "comp": {"cins": -0.1518, "dshield": -0.3473, "crowdsec": -1.374, "vulncheck": 3.0879, "blocklist_de": 4.2171}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.538, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-133719-APNIC", "org": "IDIGITALCAMP WEB SERVICES", "pdb": null, "pfx": 1, "reg": "2014-09-15", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@idigitalcamp.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133720, "h": "ZESSNPL-AS-IN", "n": "ZESS NETWORKS PVT LTD", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1331, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1696, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-12", 0.962, 0.012, 0, false]], "sh": false, "uc": 550.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 1.500, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.962, "se": 0.919, "ts": 0.500, "map": 3.969, "obs": 2, "own": 6.357, "comp": {"cins": -0.3356, "dshield": -0.7116, "crowdsec": 1.3627, "vulncheck": -0.556, "blocklist_de": 3.0126}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.158, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-149581-APNIC", "org": "Zess Networks Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://zessnetworks.com/"}, "pfx": 66, "reg": "2014-09-15", "rir": "apnic", "s24": 66, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00299190472302}, {"a": 133731, "h": "CLOUDIE-AS-AP", "n": "Royal Network Technology", "t": "Hosting & VPS", "w": 2, "cc": "HK", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "threatfox": {"n": 1, "p": 0.1983, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 7.009, 0, false], ["2026-10-12", 0.012, 6.862, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 6.862, "se": 1.254, "ts": 0.500, "map": 40.218, "obs": 2, "own": 15.523, "comp": {"urlhaus": 3.8069, "threatfox": 2.0637, "phishing_db": -0.55}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.169, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.930, "det": {"threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-CL18-AP-APNIC", "org": "Cloudie Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://xyisp.hk"}, "pfx": 6, "reg": "2014-09-19", "rir": "apnic", "s24": 13, "sib": 3, "tor": 0, "w24": 2, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "abuse@cloudie.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030537227462}, {"a": 133752, "h": "LEASEWEB-APAC-HKG-10", "n": "Leaseweb Hong Kong", "t": "Hosting & VPS", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3415, "hi": 5.57, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "phishing_db": {"n": 1, "p": 0.1862, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.811, 0.358, 0, false], ["2026-10-12", 0.010, 0.373, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.373, "se": 1.498, "ts": 1.000, "map": 3.446, "obs": 1, "own": 1.553, "comp": {"urlhaus": -0.1398, "threatfox": -0.1649, "phishing_db": 3.168}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.868, "ts": null, "map": 0.179, "obs": 0, "own": 0.081, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.910, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-LHKL5-AP-APNIC", "org": "LEASEWEB HONG KONG LIMITED", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.leaseweb.com/"}, "pfx": 40, "reg": "2014-10-03", "rir": "apnic", "s24": 61, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": "abuse@hk.leaseweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009577997739}, {"a": 133774, "h": "CHINATELECOM-FUJIAN-FUZHOU-IDC1", "n": "China Telecome Fuzhou", "t": "Broadband & mobile", "w": 26, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 7, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 6, "cve:CVE-2018-20062": 1}, "n": 7}, "ev": {"cins": {"n": 15, "p": 1.0000, "hi": 17.73, "lo": 7.70, "ips": 19, "mean": 12.28, "above": true}, "shodan": {"n": 4, "p": 0.1253, "hi": 3.62, "lo": 0.78, "ips": 4, "mean": 1.97, "above": false}, "urlhaus": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 7, "p": 0.3581, "hi": 4.52, "lo": 1.37, "ips": 7, "mean": 2.75, "above": false}, "blocklist_de": {"n": 5, "p": 0.5626, "hi": 5.95, "lo": 1.48, "ips": 5, "mean": 3.39, "above": false}}, "h2": [["2026-10-05", 2.157, 0.176, 0, false], ["2026-10-12", 6.034, 0.194, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.194, "se": 1.410, "ts": 1.000, "map": 1.462, "obs": 1, "own": 4.200, "comp": {"urlhaus": 3.1568, "threatfox": -0.3906, "phishing_db": -0.7605}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 15, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 5}, "lo": 6.034, "se": 0.403, "ts": 0.556, "map": 9.779, "obs": 27, "own": 14.985, "comp": {"cins": 21.6878, "dshield": -3.117, "crowdsec": -7.3602, "vulncheck": -0.9861, "blocklist_de": -6.5506}, "mass": 38.7, "listed": false}}, "abq": true, "bot": 0.476, "det": {"shodan": {"c2": 2, "compromised": 2}, "blocklist_de": {"ssh": 5}}, "oid": "@aut-133774-APNIC", "org": "Fuzhou", "pdb": null, "pfx": 248, "reg": "2014-10-28", "rir": "apnic", "s24": 717, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 208640, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["cins"], "traffic": 0.00056789101018}, {"a": 133776, "h": "CHINATELECOM-Fujian-Quanzhou-IDC1", "n": "Quanzhou", "t": "Broadband & mobile", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"shodan": {"n": 7, "p": 0.9405, "hi": 9.54, "lo": 2.89, "ips": 7, "mean": 5.80, "above": true}, "crowdsec": {"n": 2, "p": 0.1838, "hi": 4.28, "lo": 0.56, "ips": 3, "mean": 2.04, "above": false}}, "h2": [["2026-10-05", 0.392, 0.010, 0, false], ["2026-10-12", 0.413, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.176, "obs": 0, "own": 1.156, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.413, "se": 0.879, "ts": 1.000, "map": 1.562, "obs": 2, "own": 2.490, "comp": {"cins": -0.3527, "dshield": -0.7428, "crowdsec": 5.3168, "vulncheck": -0.5695, "blocklist_de": -1.8122}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.666, "det": {"shodan": {"compromised": 7}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-133776-APNIC", "org": "Quanzhou", "pdb": null, "pfx": 43, "reg": "2014-10-28", "rir": "apnic", "s24": 177, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 45312, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00023746670116}, {"a": 133797, "h": "ACSATA-AS-ID", "n": "Rekajasa Akses", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.532, 0.011, 0, false], ["2026-10-12", 0.012, 0.887, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.887, "se": 1.784, "ts": 1.000, "map": 12.743, "obs": 1, "own": 50.146, "comp": {"urlhaus": 4.4321, "threatfox": -0.0933, "phishing_db": -0.1677}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.246, "det": {"shodan": {"malware": 1}}, "oid": "@aut-133797-APNIC", "org": "PT Rekajasa Akses", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.acsata.com"}, "pfx": 10, "reg": "2014-11-18", "rir": "apnic", "s24": 8, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "hostmaster@acsata.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133800, "h": "IDNIC-BIZNETGIO-AS-ID", "n": "Biznet Gio Nusantara", "t": "Enterprise, edu & gov", "w": 8, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 4, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 2}, "n": 4}, "ev": {"shodan": {"n": 114, "p": 1.0000, "hi": 100.38, "lo": 73.82, "ips": 114, "mean": 86.67, "above": true}, "urlhaus": {"n": 1, "p": 0.1929, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 4, "p": 0.5859, "hi": 6.51, "lo": 1.40, "ips": 4, "mean": 3.55, "above": false}, "vulncheck": {"n": 2, "p": 0.3715, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "phishing_db": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 2, "p": 0.3224, "hi": 5.41, "lo": 0.70, "ips": 2, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 0.464, 1.499, 0, false], ["2026-10-12", 3.390, 1.507, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 1.507, "se": 1.176, "ts": 0.500, "map": 7.247, "obs": 2, "own": 31.348, "comp": {"urlhaus": 3.0893, "threatfox": -0.3981, "phishing_db": 0.9154}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 2}, "lo": 3.390, "se": 0.537, "ts": 0.500, "map": 6.901, "obs": 8, "own": 38.868, "comp": {"cins": -1.102, "dshield": -1.7914, "crowdsec": 3.3188, "vulncheck": 0.9414, "blocklist_de": 1.9585}, "mass": 5.9, "listed": false}}, "abq": false, "bot": 0.804, "det": {"shodan": {"malware": 2, "compromised": 112}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-136080-APNIC", "org": "PT Biznet Gio Nusantara", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.biznetgio.com"}, "pfx": 79, "reg": "2014-11-18", "rir": "apnic", "s24": 153, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 39168, "abuse": "abuse@biznetgio.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0017061594946}, {"a": 133866, "h": "UTURN-AS-AP", "n": "U-Turn Technology", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 3, "mean": 2.94, "above": false}}, "h2": [["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 13.105, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.176, "det": null, "oid": "ORG-UT1-AP-APNIC", "org": "U-Turn Technology", "pdb": null, "pfx": 8, "reg": "2016-09-27", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "info.uturnbd@gmail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0010173596018}, {"a": 133905, "h": "LAYER-AS", "n": "Layerstack Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.879, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PHL1-AP-APNIC", "org": "Layerstack Limited", "pdb": null, "pfx": 2, "reg": "2015-12-14", "rir": "apnic", "s24": 2, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002649213825}, {"a": 133947, "h": "MEA-AS-AP", "n": "Metropolitan Electricity Authority", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.260, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-MEA2-AP-APNIC", "org": "Metropolitan Electricity Authority", "pdb": null, "pfx": 6, "reg": "2015-02-03", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003991005408}, {"a": 133948, "h": "DIL-AS-AP", "n": "DONGFONG INC LIMITED", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.950, "det": null, "oid": "ORG-DIL5-AP-APNIC", "org": "DONGFONG INC LIMITED", "pdb": null, "pfx": 16, "reg": "2015-02-03", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003567333065}, {"a": 133957, "h": "SOL-BD", "n": "SOL-BD", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.171, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-SA3-AP-APNIC", "org": "SOL-BD", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.sol-bd.com"}, "pfx": 7, "reg": "2015-02-10", "rir": "apnic", "s24": 7, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086290887335}, {"a": 133971, "h": "RAMX-AS", "n": "Rmax Broadband", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 13769.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.157, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-133971-APNIC", "org": "Rmax Broadband Pvt ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.rmaxisp.com"}, "pfx": 5, "reg": "2015-02-11", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "support@rmax.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 133982, "h": "EXCITEL-AS-IN", "n": "Excitel", "t": "Broadband & mobile", "w": 22, "cc": "IN", "cf": {"rb": "lo", "wb": null, "rep": 3.63, "waf": null}, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "router_or_botnet": 1}, "n": 4}, "ev": {"dshield": {"n": 2, "p": 0.3582, "hi": 5.71, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "crowdsec": {"n": 2, "p": 0.1728, "hi": 4.19, "lo": 0.54, "ips": 4, "mean": 2.00, "above": false}, "vulncheck": {"n": 2, "p": 0.3599, "hi": 5.73, "lo": 0.74, "ips": 3, "mean": 2.73, "above": false}, "blocklist_de": {"n": 12, "p": 0.9999, "hi": 16.17, "lo": 6.39, "ips": 14, "mean": 10.81, "above": true}}, "h2": [["2026-10-05", 2.958, 0.010, 0, false], ["2026-10-12", 10.977, 0.011, 1, false]], "sh": false, "uc": 256.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.963, "ts": null, "map": 0.175, "obs": 0, "own": 1.134, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 12}, "lo": 10.977, "se": 0.432, "ts": 0.667, "map": 18.506, "obs": 18, "own": 28.335, "comp": {"cins": -2.3251, "dshield": -0.3218, "crowdsec": -8.2945, "vulncheck": -0.3457, "blocklist_de": 15.5989}, "mass": 19.3, "listed": false}}, "abq": false, "bot": 0.105, "det": {"vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 2, "bots": 8, "imap": 2, "mail": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "@aut-133982-APNIC", "org": "Excitel Broadband Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.excitel.com"}, "pfx": 188, "reg": "2015-02-11", "rir": "apnic", "s24": 189, "sib": 0, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 48640, "abuse": "abuse@excitel.com", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.04766592709389}, {"a": 133989, "h": "SBRTELECOM-AS", "n": "SBR Telecom", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 28.186, 0.011, 1, false], ["2026-10-12", 12.540, 0.012, 1, false]], "sh": false, "uc": 1684.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 12.540, "se": 0.687, "ts": 0.500, "map": 33.719, "obs": 4, "own": 52.321, "comp": {"cins": -0.6402, "dshield": -1.211, "crowdsec": 2.1048, "vulncheck": -0.725, "blocklist_de": 5.3832}, "mass": 3.0, "listed": false}}, "abq": true, "bot": 0.176, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-133989-APNIC", "org": "SBR Telecom Pvt. Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.sbrtelecom.com"}, "pfx": 12, "reg": "2015-02-11", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00075798339012}, {"a": 134016, "h": "VELOCITY-AS-IN", "n": "Velocity Internet India Private Ltd", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 12597.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.556, "det": null, "oid": "@aut-134016-APNIC", "org": "Velocity Internet India Private Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.velocityinternetservices.com"}, "pfx": 5, "reg": "2015-02-11", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134026, "h": "ULTRANET-AS", "n": "UltraNet Services", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6169, "hi": 7.42, "lo": 1.31, "ips": 3, "mean": 3.83, "above": false}, "blocklist_de": {"n": 2, "p": 0.4111, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 6.066, 0.011, 0, false], ["2026-10-12", 17.186, 0.012, 1, false]], "sh": false, "uc": 3952.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 17.186, "se": 0.622, "ts": 0.600, "map": 40.690, "obs": 5, "own": 62.825, "comp": {"cins": -0.789, "dshield": -1.4177, "crowdsec": 3.8215, "vulncheck": -0.7738, "blocklist_de": 4.2587}, "mass": 3.8, "listed": false}}, "abq": true, "bot": 0.157, "det": {"blocklist_de": {"bots": 1, "mail": 1}}, "oid": "@aut-134026-APNIC", "org": "Ultranet services private limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Restrictive", "web": "https://www.ultranet.co.in"}, "pfx": 13, "reg": "2015-02-11", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00093008509101}, {"a": 134032, "h": "ICENET-AS-IN", "n": "Infonet Comm Enterprises", "t": "Broadband & mobile", "w": 22, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 5, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 8, "mail_bruteforce": 9, "cve:CVE-2024-28000": 1}, "n": 10}, "ev": {"crowdsec": {"n": 8, "p": 0.9938, "hi": 13.37, "lo": 4.35, "ips": 10, "mean": 8.34, "above": true}, "blocklist_de": {"n": 8, "p": 0.9954, "hi": 13.99, "lo": 4.55, "ips": 16, "mean": 8.72, "above": true}}, "h2": [["2026-10-05", 48.806, 0.011, 1, false], ["2026-10-12", 53.558, 0.012, 1, false]], "sh": false, "uc": 9362, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 8}, "lo": 53.558, "se": 0.434, "ts": 0.500, "map": 92.470, "obs": 16, "own": 141.120, "comp": {"cins": -2.0664, "dshield": -2.5966, "crowdsec": 1.2314, "vulncheck": -0.9429, "blocklist_de": 10.295}, "mass": 15.2, "listed": false}}, "abq": true, "bot": 0.408, "det": {"blocklist_de": {"imap": 15, "mail": 16}}, "oid": "@aut-134032-APNIC", "org": "INFONET COMM ENTERPRISES", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.infonetcomm.com"}, "pfx": 26, "reg": "2015-02-11", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 7680, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": null}, {"a": 134044, "h": "WEBBERSTOPINDIA-AS", "n": "Webberstop India", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.834, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-134044-APNIC", "org": "Webberstop India", "pdb": null, "pfx": 3, "reg": "2015-02-11", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134058, "h": "BROBAN-AS", "n": "BROBAN INTERNET SERVICES", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 25195.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.175, "det": null, "oid": "@aut-134058-APNIC", "org": "BROBAN INTERNET SERVICES PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://brobaninternetservices.com"}, "pfx": 3, "reg": "2015-02-11", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134073, "h": "RD-TH-AS-AP", "n": "The Revenue Department", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.203, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TRD1-AP-APNIC", "org": "The Revenue Department", "pdb": null, "pfx": 4, "reg": "2015-02-18", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008452669542}, {"a": 134113, "h": "MCN-BD", "n": "Millennium Computers & Networking", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 25781.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.198, "det": null, "oid": "ORG-MCN1-AP-APNIC", "org": "Millennium Computers & Networking", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.mcnbd.com/"}, "pfx": 12, "reg": "2015-03-26", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014696484806}, {"a": 134143, "h": "PDKPL-AS-AP", "n": "Kinetix Networks - Australia", "t": "Broadband & mobile", "w": 1, "cc": "AU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1293, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "crowdsec": {"n": 1, "p": 0.1160, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}}, "h2": [["2026-10-05", 0.719, 0.011, 0, false], ["2026-10-12", 0.180, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 1.398, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.180, "se": 1.214, "ts": 1.000, "map": 1.306, "obs": 1, "own": 2.255, "comp": {"cins": -0.1537, "dshield": -0.3512, "crowdsec": 3.3169, "vulncheck": -0.3519, "blocklist_de": -0.7996}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.150, "det": {"shodan": {"c2": 1}}, "oid": "ORG-PDKP2-AP-APNIC", "org": "Kinetix Networks", "pdb": {"t": "Cable/DSL/ISP", "sc": "Australia", "tr": "20-50Gbps", "pol": "Open", "web": "https://kinetix.net.au"}, "pfx": 55, "reg": "2015-04-16", "rir": "apnic", "s24": 88, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38144, "abuse": "abuse@pdk.net.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014159282761}, {"a": 134146, "h": "SAMONLINE-AS-AP", "n": "SAM ONLINE", "t": "Other", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.513, 0.012, 0, false]], "sh": false, "uc": 1532.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 3.557, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SO1-AP-APNIC", "org": "SAM ONLINE", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.sambd.com"}, "pfx": 14, "reg": "2015-04-20", "rir": "apnic", "s24": 13, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00172069552288}, {"a": 134153, "h": "XPLORECYBERNET-AS-AP", "n": "Xplore Net", "t": "Other", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 1, "router_or_botnet": 5, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.6347, "hi": 7.61, "lo": 1.34, "ips": 5, "mean": 3.93, "above": false}}, "h2": [["2026-10-12", 13.030, 0.013, 1, false]], "sh": false, "uc": 3125, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 13.030, "se": 0.806, "ts": 1.000, "map": 43.627, "obs": 3, "own": 24.997, "comp": {"cins": -0.3864, "dshield": -0.8032, "crowdsec": 8.9345, "vulncheck": -0.5943, "blocklist_de": -1.9813}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.171, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "ORG-MMHT1-AP-APNIC", "org": "Xplore Net BD", "pdb": null, "pfx": 9, "reg": "2017-07-04", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0017381296679}, {"a": 134166, "h": "TOT-IDC-AS-AP", "n": "Internet Data Center Service", "t": "Hosting & VPS", "w": 1, "cc": "TH", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6000, "hi": 7.24, "lo": 1.28, "ips": 3, "mean": 3.74, "above": false}, "crowdsec": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.315, 0.011, 0, false], ["2026-10-12", 1.648, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.269, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.648, "se": 0.947, "ts": 0.500, "map": 7.193, "obs": 2, "own": 1.473, "comp": {"cins": -0.3062, "dshield": -0.657, "crowdsec": 1.6579, "vulncheck": -0.531, "blocklist_de": 3.2031}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.436, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-IDCS1-AP-APNIC", "org": "Internet Data Center Service", "pdb": null, "pfx": 30, "reg": "2015-04-28", "rir": "apnic", "s24": 33, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": "abuse@totisp.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000232507668}, {"a": 134176, "h": "CLOUDIE-AS-AP", "n": "Rainbow network", "t": "Hosting & VPS", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.361, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 0.281, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.361, "se": 1.323, "ts": 1.000, "map": 3.218, "obs": 1, "own": 0.741, "comp": {"cins": -0.1129, "dshield": 4.5876, "crowdsec": -1.0403, "vulncheck": -0.2828, "blocklist_de": -0.5892}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.440, "det": null, "oid": "ORG-CL18-AP-APNIC", "org": "Cloudie Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://nexon.com.au/"}, "pfx": 25, "reg": "2015-05-08", "rir": "apnic", "s24": 26, "sib": 3, "tor": 0, "w24": 1, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@cloudie.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049146161906}, {"a": 134196, "h": "ANYUN-INTERNET-TECHNOLOGY-HK-CO-LIMITED", "n": "ANYUN INTERNET TECHNOLOGY (HK) CO.,LIMITED", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.433, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.193, "det": null, "oid": "ORG-AITC3-AP-APNIC", "org": "ANYUN INTERNET TECHNOLOGY (HK) CO.,LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://cloudie.hk"}, "pfx": 14, "reg": "2015-05-20", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": "abuse@cloudie.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029140814466}, {"a": 134204, "h": "BUSINESSNETWORK-AS-AP", "n": "Business Network", "t": "Transit & backbone", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 4434.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 2.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 2.404, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.217, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BN4-AP-APNIC", "org": "Business Network", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.bnet-bd.com/"}, "pfx": 17, "reg": "2015-05-22", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00409193670094}, {"a": 134238, "h": "CT-Jiangxi-IDC", "n": "China Telecom Jiangxi Province IDC Network", "t": "Broadband & mobile", "w": 5, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 5, "cve:CVE-2024-6387": 3}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.2527, "hi": 4.57, "lo": 0.81, "ips": 3, "mean": 2.36, "above": false}, "urlhaus": {"n": 1, "p": 0.1860, "hi": 4.61, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 4, "p": 0.3422, "hi": 4.90, "lo": 1.06, "ips": 5, "mean": 2.68, "above": false}, "blocklist_de": {"n": 2, "p": 0.2312, "hi": 4.67, "lo": 0.61, "ips": 2, "mean": 2.22, "above": false}}, "h2": [["2026-10-05", 1.308, 0.256, 0, false], ["2026-10-12", 1.444, 0.278, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.278, "se": 1.457, "ts": 1.000, "map": 2.346, "obs": 1, "own": 6.766, "comp": {"urlhaus": 3.4918, "threatfox": -0.3465, "phishing_db": -0.6665}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.444, "se": 0.566, "ts": 0.667, "map": 3.054, "obs": 6, "own": 4.731, "comp": {"cins": -1.0538, "dshield": -1.7386, "crowdsec": 3.8302, "vulncheck": -0.8347, "blocklist_de": 2.3069}, "mass": 5.6, "listed": false}}, "abq": true, "bot": 0.806, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-134238-APNIC", "org": "CHINANET Jiangx province IDC network", "pdb": null, "pfx": 106, "reg": "2015-06-11", "rir": "apnic", "s24": 326, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 120576, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005803377788}, {"a": 134286, "h": "NETFORCHOICE-AS", "n": "Net for Choice", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "cve:CVE-2022-35914": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6300, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.492, 0.011, 0, false], ["2026-10-12", 0.534, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 3.772, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.869, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-134286-APNIC", "org": "Net for Choice", "pdb": null, "pfx": 12, "reg": "2015-06-17", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "info@netforchoice.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134290, "h": "ARROW46-AS", "n": "Arrow Touch Wireless Internet Private Limited", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 12.854, 0.011, 1, false], ["2026-10-12", 5.282, 0.012, 0, false]], "sh": false, "uc": 2450.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.282, "se": 0.782, "ts": 0.667, "map": 16.826, "obs": 3, "own": 26.370, "comp": {"cins": -0.4599, "dshield": -0.9294, "crowdsec": 4.0337, "vulncheck": -0.6409, "blocklist_de": 2.2131}, "mass": 2.1, "listed": false}}, "abq": true, "bot": 0.286, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-134290-APNIC", "org": "Arrow Touch Wireless Internet Private Limited", "pdb": null, "pfx": 22, "reg": "2015-06-17", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134316, "h": "IAXN-AS", "n": "IAXN TELECOM", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7693, "hi": 8.42, "lo": 1.81, "ips": 4, "mean": 4.60, "above": false}, "urlhaus": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 2.875, 0.011, 0, false], ["2026-10-12", 0.281, 0.599, 0, false]], "sh": false, "uc": 1171.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.599, "se": 1.624, "ts": 1.000, "map": 6.958, "obs": 1, "own": 22.147, "comp": {"urlhaus": 4.1466, "threatfox": -0.2037, "phishing_db": -0.3768}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.281, "se": 1.280, "ts": 1.000, "map": 2.310, "obs": 1, "own": 4.092, "comp": {"cins": -0.1274, "dshield": -0.2945, "crowdsec": 3.6255, "vulncheck": -0.3088, "blocklist_de": -0.6641}, "mass": 0.6, "listed": false}}, "abq": true, "bot": 0.147, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-134316-APNIC", "org": "IAXN Telecom Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://iaxntelecom.com/"}, "pfx": 41, "reg": "2015-06-17", "rir": "apnic", "s24": 41, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00110480706399}, {"a": 134319, "h": "ELYZIUM-AS", "n": "Elyzium Technologies", "t": "Other", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 5, "mail_bruteforce": 3, "router_or_botnet": 4, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"crowdsec": {"n": 4, "p": 0.7836, "hi": 8.63, "lo": 1.86, "ips": 6, "mean": 4.71, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 14.831, 0.011, 1, false], ["2026-10-12", 12.110, 0.012, 1, false]], "sh": false, "uc": 13383.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.110, "se": 0.618, "ts": 0.800, "map": 28.747, "obs": 5, "own": 16.249, "comp": {"cins": -0.7601, "dshield": -1.3792, "crowdsec": 7.3231, "vulncheck": -0.7654, "blocklist_de": 0.3337}, "mass": 3.7, "listed": false}}, "abq": true, "bot": 0.196, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-134319-APNIC", "org": "Elyzium Technologies Pvt. Ltd.", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.elyzium.co.in"}, "pfx": 23, "reg": "2015-06-17", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134326, "h": "AIRDESIGNBROADCAST-AS", "n": "Airdesign Broadcast Media", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 3}, "n": 4}, "ev": {"dshield": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 2, "p": 0.3556, "hi": 5.69, "lo": 0.74, "ips": 4, "mean": 2.71, "above": false}, "blocklist_de": {"n": 2, "p": 0.3950, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 3.112, 0.011, 0, false], ["2026-10-12", 7.818, 0.012, 0, false]], "sh": false, "uc": 1044.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.818, "se": 0.615, "ts": 0.400, "map": 18.373, "obs": 5, "own": 28.408, "comp": {"cins": -0.8291, "dshield": 1.6193, "crowdsec": 0.3401, "vulncheck": -0.7848, "blocklist_de": 3.959}, "mass": 4.1, "listed": false}}, "abq": true, "bot": 0.159, "det": {"blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-134326-APNIC", "org": "Airdesign Broadcast Media Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.airwebb.com"}, "pfx": 13, "reg": "2015-06-17", "rir": "apnic", "s24": 40, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051312732588}, {"a": 134333, "h": "SSBROADBAND-AS", "n": "SS BROADBAND SERVICES PVT LTD", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 38867.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.168, "det": {"blocklist_de": {"mail": 2}}, "oid": "@aut-134333-APNIC", "org": "SS BROADBAND SERVICES PVT LTD", "pdb": null, "pfx": 2, "reg": "2015-06-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "info@ssbroadbandservices.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134365, "h": "ANSHENG-AS-AP", "n": "Ansheng Network Technology Co., Limited", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 6.513, 0.011, 0, false], ["2026-10-12", 0.329, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.329, "se": 1.306, "ts": 1.000, "map": 2.829, "obs": 1, "own": 1.855, "comp": {"cins": -0.1182, "dshield": -0.2744, "crowdsec": 3.7352, "vulncheck": -0.2925, "blocklist_de": -0.6166}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-LCCL3-AP-APNIC", "org": "Ansheng Network Technology Co., Limited", "pdb": null, "pfx": 35, "reg": "2015-06-30", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021426926302}, {"a": 134366, "h": "CCHL-AS-AP", "n": "Yunify Technologies (HK) Limited", "t": "Hosting & VPS", "w": 2, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3901, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "blocklist_de": {"n": 2, "p": 0.4096, "hi": 6.17, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 14.162, 0.011, 1, false], ["2026-10-12", 10.867, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 10.867, "se": 0.685, "ts": 0.500, "map": 28.796, "obs": 4, "own": 5.696, "comp": {"cins": -0.648, "dshield": -1.2223, "crowdsec": 2.0278, "vulncheck": -0.7279, "blocklist_de": 5.3242}, "mass": 3.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-CCHL1-AP-APNIC", "org": "Cloud Computing HK Limited", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.qingcloud.com"}, "pfx": 19, "reg": "2015-06-30", "rir": "apnic", "s24": 19, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134371, "h": "CIRCLENETWORK-BD", "n": "CIRCLE NETWORK BANGLADESH", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1237, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 1.154, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.169, "det": null, "oid": "ORG-CN2-AP-APNIC", "org": "CIRCLE NETWORK", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.circlenetworkbd.net"}, "pfx": 20, "reg": "2015-07-05", "rir": "apnic", "s24": 18, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00125477641811}, {"a": 134375, "h": "FWSPL-AS-AP", "n": "Fusionnet Web Services", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5156, "hi": 6.46, "lo": 1.14, "ips": 3, "mean": 3.34, "above": false}, "blocklist_de": {"n": 2, "p": 0.3714, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 6.099, 0.011, 0, false], ["2026-10-12", 4.360, 0.012, 0, false]], "sh": false, "uc": 1859.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 1.454, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.360, "se": 0.611, "ts": 0.600, "map": 10.191, "obs": 5, "own": 15.778, "comp": {"cins": -0.8559, "dshield": -1.5041, "crowdsec": 3.1074, "vulncheck": -0.7918, "blocklist_de": 3.7595}, "mass": 4.3, "listed": false}}, "abq": true, "bot": 0.154, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "ORG-FWSP1-AP-APNIC", "org": "Fusionnet Web Services Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://fusionnet.in"}, "pfx": 58, "reg": "2015-07-09", "rir": "apnic", "s24": 75, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 37376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00579849488376}, {"a": 134420, "h": "CHINATELECOM-Chongqing-IDC", "n": "Chongqing Telecom", "t": "Broadband & mobile", "w": 14, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 8, "web_bruteforce": 4, "mail_bruteforce": 2, "cve:CVE-2024-6387": 4, "cve:CVE-2026-63030": 1}, "n": 11}, "ev": {"cins": {"n": 3, "p": 0.4602, "hi": 6.02, "lo": 1.06, "ips": 3, "mean": 3.10, "above": false}, "shodan": {"n": 23, "p": 1.0000, "hi": 13.25, "lo": 6.73, "ips": 23, "mean": 9.76, "above": true}, "crowdsec": {"n": 11, "p": 0.8532, "hi": 6.47, "lo": 2.46, "ips": 11, "mean": 4.26, "above": true}, "threatfox": {"n": 1, "p": 0.1568, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "blocklist_de": {"n": 3, "p": 0.2386, "hi": 4.48, "lo": 0.79, "ips": 3, "mean": 2.31, "above": false}}, "h2": [["2026-10-05", 2.446, 0.108, 0, false], ["2026-10-12", 2.656, 0.113, 0, false]], "sh": false, "uc": 89.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.113, "se": 1.366, "ts": 1.000, "map": 0.721, "obs": 1, "own": 2.240, "comp": {"urlhaus": -0.3095, "threatfox": 2.1409, "phishing_db": -0.532}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 3}, "lo": 2.656, "se": 0.438, "ts": 0.647, "map": 4.566, "obs": 17, "own": 7.027, "comp": {"cins": 5.7893, "dshield": -2.6783, "crowdsec": 3.8697, "vulncheck": -0.9505, "blocklist_de": -3.118}, "mass": 17.3, "listed": false}}, "abq": true, "bot": 0.764, "det": {"shodan": {"c2": 1, "compromised": 22}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "@aut-134420-APNIC", "org": "Chongqing Telecom", "pdb": null, "pfx": 185, "reg": "2015-07-22", "rir": "apnic", "s24": 683, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 182272, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00114218759928}, {"a": 134451, "h": "NME-INDONESIA-AS-AP", "n": "NewMedia Express Pte Ltd", "t": "Other", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.360, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-NEPL1-AP-APNIC", "org": "NewMedia Express Pte Ltd", "pdb": null, "pfx": 8, "reg": "2015-08-07", "rir": "apnic", "s24": 9, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "support@newmediaexpress.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134465, "h": "HARVILMEDIA-AS-AP", "n": "M/S HARVIL MEDIA", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.8077, "hi": 9.02, "lo": 1.94, "ips": 4, "mean": 4.93, "above": true}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 5.568, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.667, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-HH2-AP-APNIC", "org": "M/S HARVIL MEDIA", "pdb": null, "pfx": 6, "reg": "2020-12-17", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1792, "abuse": "abuse@hapihhost.in", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 134475, "h": "HSPL-AS-AP", "n": "HTS Solutions Private Limited", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.114, "det": null, "oid": "ORG-HSPL2-AP-APNIC", "org": "HTS Solutions Private Limited", "pdb": null, "pfx": 3, "reg": "2020-12-23", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@htssolutions.org", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134489, "h": "SBLINKNETWORK-AS-AP", "n": "S. B Link Network", "t": "Broadband & mobile", "w": 15, "cc": "PK", "cf": null, "cs": {"c": {"web_exploit": 12, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 11, "mail_bruteforce": 1, "router_or_botnet": 11, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 4, "cve:CVE-2024-12847": 11}, "n": 12}, "ev": {"cins": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3987, "hi": 6.07, "lo": 0.79, "ips": 12, "mean": 2.89, "above": false}, "blocklist_de": {"n": 4, "p": 0.8076, "hi": 9.02, "lo": 1.94, "ips": 4, "mean": 4.93, "above": true}}, "h2": [["2026-10-05", 19.929, 0.011, 1, false], ["2026-10-12", 40.115, 0.012, 1, false]], "sh": false, "uc": 4101.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 40.115, "se": 0.548, "ts": 0.571, "map": 84.025, "obs": 7, "own": 128.898, "comp": {"cins": 2.6417, "dshield": -1.8882, "crowdsec": -2.4938, "vulncheck": -0.8583, "blocklist_de": 8.4233}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.123, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 2, "apache": 1}}, "oid": "ORG-SBLN1-AP-APNIC", "org": "S. B Link Network", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.sblinknetwork.com/"}, "pfx": 14, "reg": "2020-12-29", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": "noc@sblinknetwork.com", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00332129828536}, {"a": 134540, "h": "TTML-AS-AP", "n": "Tata Tele Business Services (Broadband)", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 3, "ssh_bruteforce": 3, "web_bruteforce": 4, "mail_bruteforce": 3}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.2517, "hi": 4.56, "lo": 0.80, "ips": 4, "mean": 2.35, "above": false}, "blocklist_de": {"n": 1, "p": 0.1036, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.579, 0.010, 0, false], ["2026-10-12", 0.946, 0.011, 0, false]], "sh": false, "uc": 213.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.940, "ts": null, "map": 0.169, "obs": 0, "own": 1.026, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.946, "se": 0.654, "ts": 0.750, "map": 2.378, "obs": 4, "own": 3.706, "comp": {"cins": -0.7257, "dshield": -1.3324, "crowdsec": 4.5278, "vulncheck": -0.7548, "blocklist_de": 0.5452}, "mass": 3.5, "listed": false}}, "abq": true, "bot": 0.145, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TTL2-AP-APNIC", "org": "Tata Teleservices (Maharashtra) Ltd", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.tatateleservices.com"}, "pfx": 138, "reg": "2017-11-15", "rir": "apnic", "s24": 263, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00118308072387}, {"a": 134543, "h": "UNICOM-DongGuan-IDC", "n": "China Unicom Guangdong IP network", "t": "Broadband & mobile", "w": 10, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 4, "bad_crawling": 2, "web_bruteforce": 5, "cve:CVE-2019-8318": 1, "cve:CVE-2025-31324": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1648, "hi": 4.38, "lo": 0.33, "ips": 3, "mean": 1.85, "above": false}, "dshield": {"n": 1, "p": 0.1563, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 3, "p": 0.3305, "hi": 5.09, "lo": 0.90, "ips": 6, "mean": 2.63, "above": false}}, "h2": [["2026-10-05", 2.861, 0.010, 0, false], ["2026-10-12", 1.710, 0.011, 0, false]], "sh": false, "uc": 297.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.174, "obs": 0, "own": 1.120, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.710, "se": 0.605, "ts": 0.600, "map": 3.934, "obs": 5, "own": 6.109, "comp": {"cins": 3.3548, "dshield": 1.5054, "crowdsec": 3.0065, "vulncheck": -0.7942, "blocklist_de": -4.3091}, "mass": 4.3, "listed": false}}, "abq": true, "bot": 0.541, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 159, "reg": "2015-08-25", "rir": "apnic", "s24": 197, "sib": 25, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0015192153717}, {"a": 134548, "h": "DXTL-HK", "n": "DXTL Tseung Kwan O Service", "t": "Broadband & mobile", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "cve:CVE-2011-3600": 1, "cve:CVE-2012-0392": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2021-43798": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.0081, "hi": 2.25, "lo": 0.40, "ips": 3, "mean": 1.16, "above": false}, "crowdsec": {"n": 2, "p": 0.0005, "hi": 1.56, "lo": 0.20, "ips": 2, "mean": 0.74, "above": false}, "phishing_db": {"n": 1, "p": 0.0529, "hi": 3.04, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}}, "h2": [["2026-10-05", 0.134, 0.085, 0, false], ["2026-10-12", 0.089, 0.090, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.090, "se": 1.350, "ts": 1.000, "map": 0.549, "obs": 1, "own": 1.720, "comp": {"urlhaus": -0.384, "threatfox": -0.3174, "phishing_db": 1.7272}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.089, "se": 0.823, "ts": 1.000, "map": 0.303, "obs": 2, "own": 0.481, "comp": {"cins": -0.4326, "dshield": -0.8833, "crowdsec": 4.3504, "vulncheck": -0.6246, "blocklist_de": -2.2118}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.796, "det": {"shodan": {"compromised": 3}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "HTTP://666666999999999.com"}, "pfx": 186, "reg": "2015-08-28", "rir": "apnic", "s24": 1143, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 583936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026757264582}, {"a": 134612, "h": "IDNIC-CLOUDMATIKA--AS-ID", "n": "Atria Teknologi Indonesia", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2115.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.559, "det": null, "oid": "@aut-134612-APNIC", "org": "PT Atria Teknologi Indonesia", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://atriatek.co.id"}, "pfx": 6, "reg": "2015-09-04", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134674, "h": "TATAPLAYBROADBAND-AS-AP", "n": "TATA PLAY FIBER", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 2.251, 0.011, 0, false], ["2026-10-12", 0.231, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 1.545, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.231, "se": 1.250, "ts": 1.000, "map": 1.794, "obs": 1, "own": 3.139, "comp": {"cins": -0.1396, "dshield": 4.4444, "crowdsec": -1.2704, "vulncheck": -0.3294, "blocklist_de": -0.727}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TSBP1-AP-APNIC", "org": "Tata Play Broadband Private Limited", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.tataplayfiber.com/"}, "pfx": 58, "reg": "2015-09-11", "rir": "apnic", "s24": 58, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02670107435133}, {"a": 134677, "h": "IDC-AS-AP", "n": "Dromatics Systems Pte Ltd", "t": "Broadband & mobile", "w": 7, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2002-1131": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2012-0392": 1}, "n": 1}, "ev": {"shodan": {"n": 10, "p": 0.9996, "hi": 16.20, "lo": 5.89, "ips": 10, "mean": 10.51, "above": true}, "crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "threatfox": {"n": 3, "p": 0.6450, "hi": 7.73, "lo": 1.36, "ips": 4, "mean": 3.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4155, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 3.556, 13.907, 1, false], ["2026-10-12", 3.291, 8.218, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 8.218, "se": 1.005, "ts": 1.000, "map": 29.347, "obs": 3, "own": 67.982, "comp": {"urlhaus": -0.3939, "threatfox": 6.0139, "phishing_db": -0.6146}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 3.291, "se": 0.802, "ts": 0.667, "map": 10.567, "obs": 3, "own": 17.173, "comp": {"cins": -0.3003, "dshield": -0.6459, "crowdsec": 1.7179, "vulncheck": 4.5281, "blocklist_de": -1.5484}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.895, "det": {"shodan": {"c2": 1, "compromised": 9}, "threatfox": {"family:Evilginx": 3, "family:AdaptixC2": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}}, "oid": "ORG-DSPL1-AP-APNIC", "org": "Dromatics Systems Pte Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://drosys.com"}, "pfx": 23, "reg": "2015-09-13", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.0690]], "ipv4": 6656, "abuse": "abusedept@drosys.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00049791701065}, {"a": 134707, "h": "RCC-AS-AP", "n": "RoyalCable", "t": "Broadband & mobile", "w": 2, "cc": "PH", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1608, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "dshield": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1525, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 2.846, 0.011, 0, false], ["2026-10-12", 1.238, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.238, "se": 0.930, "ts": 0.500, "map": 5.232, "obs": 2, "own": 8.377, "comp": {"cins": -0.2976, "dshield": 3.6581, "crowdsec": 1.7458, "vulncheck": -0.5233, "blocklist_de": -1.5346}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.098, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RCC2-AP-APNIC", "org": "Royal Cablevision Corp.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://royalcable.com.ph"}, "pfx": 4, "reg": "2015-10-02", "rir": "apnic", "s24": 44, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": "abuse@royalcable.com.ph", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00965204163562}, {"a": 134732, "h": "DOTINTERNET-AS-AP", "n": "Dot Internet", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 2, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 8.905, 0.011, 0, false], ["2026-10-12", 1.648, 0.012, 0, false]], "sh": false, "uc": 1290.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 1.741, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.648, "se": 0.947, "ts": 0.500, "map": 7.193, "obs": 2, "own": 11.557, "comp": {"cins": -0.3062, "dshield": -0.657, "crowdsec": 1.6579, "vulncheck": -0.531, "blocklist_de": 3.2031}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.141, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-DI3-AP-APNIC", "org": "Dot Internet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.dotinternetbd.com"}, "pfx": 51, "reg": "2015-10-16", "rir": "apnic", "s24": 33, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": "admin@dotinternetbd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00726013666879}, {"a": 134756, "h": "ChinaNet-NANJING-JISHAN-IDC", "n": "CHINANET Nanjing Jishan IDC network", "t": "Other", "w": 105, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 85, "web_exploit": 82, "bad_crawling": 19, "proxy_or_vpn": 4, "first_seen_30d": 2, "ssh_bruteforce": 13, "web_bruteforce": 22, "mail_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 9, "cve:CVE-2025-4396": 78, "cve:CVE-2018-20062": 1, "cve:CVE-2026-75650": 3}, "n": 103}, "ev": {"shodan": {"n": 23, "p": 1.0000, "hi": 16.65, "lo": 8.46, "ips": 23, "mean": 12.26, "above": true}, "urlhaus": {"n": 1, "p": 0.1813, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 18, "p": 0.9999, "hi": 12.18, "lo": 5.68, "ips": 103, "mean": 8.67, "above": true}, "threatfox": {"n": 1, "p": 0.1704, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "blocklist_de": {"n": 7, "p": 0.9183, "hi": 8.88, "lo": 2.69, "ips": 7, "mean": 5.41, "above": true}}, "h2": [["2026-10-05", 5.794, 0.135, 0, false], ["2026-10-12", 5.659, 0.694, 0, false]], "sh": false, "uc": 245.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 0.694, "se": 1.167, "ts": 0.500, "map": 3.163, "obs": 2, "own": 3.406, "comp": {"urlhaus": 2.7678, "threatfox": 0.854, "phishing_db": -0.8443}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 18, "vulncheck": 0, "blocklist_de": 7}, "lo": 5.659, "se": 0.408, "ts": 0.720, "map": 9.285, "obs": 25, "own": 5.212, "comp": {"cins": -2.5174, "dshield": -2.8598, "crowdsec": 7.5712, "vulncheck": -0.9662, "blocklist_de": 2.3942}, "mass": 23.0, "listed": false}}, "abq": true, "bot": 0.901, "det": {"shodan": {"compromised": 23}, "threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"ssh": 5, "imap": 2, "mail": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 200, "reg": "2015-10-27", "rir": "apnic", "s24": 448, "sib": 281, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 119296, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00961293283444}, {"a": 134760, "h": "ChinaNet-Hebei-Shijiazhuang-IDC", "n": "Shijiazhuang IDC network, CHINANET Hebei province", "t": "Other", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1538, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "shodan": {"n": 6, "p": 0.8022, "hi": 7.53, "lo": 2.09, "ips": 6, "mean": 4.45, "above": true}, "crowdsec": {"n": 3, "p": 0.2463, "hi": 4.53, "lo": 0.80, "ips": 3, "mean": 2.34, "above": false}}, "h2": [["2026-10-05", 0.280, 0.010, 0, false], ["2026-10-12", 0.943, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.938, "ts": null, "map": 0.168, "obs": 0, "own": 0.411, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.943, "se": 0.656, "ts": 0.750, "map": 2.372, "obs": 4, "own": 1.354, "comp": {"cins": 3.6369, "dshield": -1.346, "crowdsec": 4.4155, "vulncheck": -0.7579, "blocklist_de": -3.6911}, "mass": 3.6, "listed": false}}, "abq": true, "bot": 0.681, "det": {"shodan": {"compromised": 6}}, "oid": "@aut-134760-APNIC", "org": "Shijiazhuang IDC network, CHINANET Hebei province", "pdb": null, "pfx": 30, "reg": "2015-10-27", "rir": "apnic", "s24": 268, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 69120, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00049033364146}, {"a": 134761, "h": "CHINANET-NINGXIA-ZHONGWEI-IDC", "n": "CHINANET NINGXIA province ZHONGWEI IDC network", "t": "Other", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "cve:CVE-2024-6387": 2}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0944, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "crowdsec": {"n": 3, "p": 0.3961, "hi": 5.54, "lo": 0.98, "ips": 3, "mean": 2.86, "above": false}, "blocklist_de": {"n": 2, "p": 0.3242, "hi": 5.42, "lo": 0.70, "ips": 2, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 3.964, 0.010, 0, false], ["2026-10-12", 2.326, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 0.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.326, "se": 0.607, "ts": 0.600, "map": 5.333, "obs": 5, "own": 3.026, "comp": {"cins": -0.8879, "dshield": -1.5441, "crowdsec": 2.7771, "vulncheck": -0.7997, "blocklist_de": 3.5222}, "mass": 4.5, "listed": false}}, "abq": true, "bot": 0.925, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-134761-APNIC", "org": "CHINANET NINGXIA province ZHONGWEI IDC network", "pdb": null, "pfx": 53, "reg": "2015-10-27", "rir": "apnic", "s24": 150, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001350157952}, {"a": 134762, "h": "CHINANET-LIAONING-DALIAN-MAN", "n": "CHINANET Liaoning province Dalian MAN network", "t": "Other", "w": 17, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 2, "ssh_bruteforce": 12, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 5}, "n": 12}, "ev": {"cins": {"n": 1, "p": 0.0961, "hi": 3.61, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}, "shodan": {"n": 2, "p": 0.0166, "hi": 2.44, "lo": 0.32, "ips": 2, "mean": 1.16, "above": false}, "dshield": {"n": 1, "p": 0.0779, "hi": 3.39, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "urlhaus": {"n": 1, "p": 0.1704, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 8, "p": 0.4667, "hi": 4.86, "lo": 1.58, "ips": 12, "mean": 3.03, "above": false}, "blocklist_de": {"n": 6, "p": 0.7040, "hi": 6.60, "lo": 1.83, "ips": 7, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 1.298, 0.173, 0, false], ["2026-10-12", 2.409, 0.190, 0, false]], "sh": false, "uc": 76.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.190, "se": 1.408, "ts": 1.000, "map": 1.431, "obs": 1, "own": 1.658, "comp": {"urlhaus": 3.1413, "threatfox": -0.3923, "phishing_db": -0.7643}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 6}, "lo": 2.409, "se": 0.441, "ts": 0.500, "map": 4.084, "obs": 16, "own": 2.300, "comp": {"cins": 0.5349, "dshield": -1.3035, "crowdsec": 0.2831, "vulncheck": -0.9487, "blocklist_de": 4.2348}, "mass": 16.8, "listed": false}}, "abq": true, "bot": 0.536, "det": {"shodan": {"malware": 1, "compromised": 1}, "blocklist_de": {"ssh": 6, "imap": 1, "mail": 1}}, "oid": "@aut-134762-APNIC", "org": "CHINANET Liaoning province Dalian MAN network", "pdb": null, "pfx": 45, "reg": "2015-10-27", "rir": "apnic", "s24": 742, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 222720, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00103148998992}, {"a": 134763, "h": "CT-DongGuan-IDC", "n": "CHINANET Guangdong province network", "t": "Other", "w": 13, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 5, "bad_crawling": 4, "web_bruteforce": 7, "mail_bruteforce": 1, "cve:CVE-2019-8318": 1}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1255, "hi": 3.95, "lo": 0.30, "ips": 2, "mean": 1.67, "above": false}, "shodan": {"n": 2, "p": 0.0600, "hi": 3.12, "lo": 0.41, "ips": 2, "mean": 1.49, "above": false}, "dshield": {"n": 2, "p": 0.2740, "hi": 5.01, "lo": 0.65, "ips": 4, "mean": 2.39, "above": false}, "crowdsec": {"n": 4, "p": 0.1933, "hi": 4.05, "lo": 0.87, "ips": 8, "mean": 2.21, "above": false}, "threatfox": {"n": 1, "p": 0.1688, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.944, 0.131, 0, false], ["2026-10-12", 1.168, 0.137, 0, false]], "sh": false, "uc": 52.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.137, "se": 1.379, "ts": 1.000, "map": 0.913, "obs": 1, "own": 1.125, "comp": {"urlhaus": -0.2757, "threatfox": 2.305, "phishing_db": -0.494}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.168, "se": 0.539, "ts": 0.571, "map": 2.364, "obs": 7, "own": 1.340, "comp": {"cins": 2.7295, "dshield": 3.2339, "crowdsec": 2.7867, "vulncheck": -0.8519, "blocklist_de": -5.6444}, "mass": 6.3, "listed": false}}, "abq": true, "bot": 0.918, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@family-36574", "org": "CHINANET Guangdong province network", "pdb": null, "pfx": 57, "reg": "2015-10-27", "rir": "apnic", "s24": 475, "sib": 2, "tor": 0, "w24": 7, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 122624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0026234106002}, {"a": 134765, "h": "CHINANET-YUNNAN-IDC1", "n": "CHINANET Yunnan province IDC1 network", "t": "Other", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "home_connection": 1, "cve:CVE-2024-6387": 2}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.2325, "hi": 4.68, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}, "crowdsec": {"n": 2, "p": 0.1984, "hi": 4.40, "lo": 0.57, "ips": 2, "mean": 2.10, "above": false}, "blocklist_de": {"n": 1, "p": 0.1337, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 2.534, 0.010, 0, false], ["2026-10-12", 0.942, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 0.478, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.942, "se": 0.742, "ts": 0.667, "map": 2.781, "obs": 3, "own": 1.596, "comp": {"cins": -0.5475, "dshield": -1.0709, "crowdsec": 3.0635, "vulncheck": -0.6861, "blocklist_de": 1.6574}, "mass": 2.5, "listed": false}}, "abq": true, "bot": 0.561, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-134765-APNIC", "org": "CHINANET Yunnan province IDC1 network", "pdb": null, "pfx": 75, "reg": "2015-10-27", "rir": "apnic", "s24": 162, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001145908205}, {"a": 134768, "h": "CHINANET-SHAANXI-CLOUD-BASE", "n": "CHINANET SHAANXI province Cloud Base network", "t": "Hosting & VPS", "w": 19, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 10, "web_bruteforce": 3, "cve:CVE-2024-6387": 10, "cve:CVE-2026-4020": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.2510, "hi": 4.83, "lo": 0.63, "ips": 2, "mean": 2.30, "above": false}, "crowdsec": {"n": 14, "p": 0.9661, "hi": 7.50, "lo": 3.17, "ips": 14, "mean": 5.14, "above": true}, "threatfox": {"n": 1, "p": 0.1548, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "blocklist_de": {"n": 9, "p": 0.9551, "hi": 8.86, "lo": 3.06, "ips": 9, "mean": 5.64, "above": true}}, "h2": [["2026-10-05", 3.211, 0.009, 0, false], ["2026-10-12", 4.104, 0.109, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.109, "se": 1.365, "ts": 1.000, "map": 0.696, "obs": 1, "own": 0.335, "comp": {"urlhaus": -0.3148, "threatfox": 2.1166, "phishing_db": -0.5377}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 9}, "lo": 4.104, "se": 0.410, "ts": 0.560, "map": 6.667, "obs": 25, "own": 1.304, "comp": {"cins": 1.5306, "dshield": -2.9401, "crowdsec": 1.5171, "vulncheck": -0.9727, "blocklist_de": 4.156}, "mass": 26.6, "listed": false}}, "abq": true, "bot": 0.743, "det": {"threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 1, "ssh": 8}}, "oid": "@aut-134768-APNIC", "org": "CHINANET SHAANXI province Cloud Base network", "pdb": null, "pfx": 86, "reg": "2015-10-27", "rir": "apnic", "s24": 721, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 205056, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00289106407148}, {"a": 134771, "h": "CHINATELECOM-ZHEJIANG-WENZHOU-IDC", "n": "China Telecom Wenzhou IDC Network", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0522, "hi": 3.03, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "vulncheck": {"n": 1, "p": 0.1451, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.087, 0.010, 0, false], ["2026-10-12", 0.071, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.939, "ts": null, "map": 0.169, "obs": 0, "own": 1.025, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.071, "se": 1.128, "ts": 1.000, "map": 0.419, "obs": 1, "own": 0.733, "comp": {"cins": -0.1481, "dshield": -0.3393, "crowdsec": -1.3424, "vulncheck": 3.124, "blocklist_de": -0.7708}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.602, "det": {"shodan": {"compromised": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "@aut-134771-APNIC", "org": "WENZHOU, ZHEJIANG Province, P.R.China.", "pdb": null, "pfx": 82, "reg": "2015-10-27", "rir": "apnic", "s24": 264, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 69632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000438225983}, {"a": 134773, "h": "ChinaNet-Guangdong-Guangzhou-MAN", "n": "CHINANET Guangdong province Guangzhou MAN network", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0295, "hi": 2.65, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}}, "h2": [["2026-10-05", 0.070, 0.010, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.161, "obs": 0, "own": 0.371, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.632, "ts": null, "map": 0.092, "obs": 0, "own": 0.080, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.638, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-134773-APNIC", "org": "CHINANET Guangdong province Guangzhou MAN network", "pdb": null, "pfx": 31, "reg": "2015-10-27", "rir": "apnic", "s24": 371, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 103936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005185833952}, {"a": 134774, "h": "ChinaNet-Guangdong-Shenzhen-MAN", "n": "CHINANET Guangdong province Shenzhen MAN network", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0105, "hi": 2.26, "lo": 0.29, "ips": 2, "mean": 1.08, "above": false}}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.851, "ts": null, "map": 0.137, "obs": 0, "own": 0.280, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.529, "ts": null, "map": 0.060, "obs": 0, "own": 0.047, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.418, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-134774-APNIC", "org": "CHINANET Guangdong province Shenzhen MAN network", "pdb": null, "pfx": 22, "reg": "2015-10-27", "rir": "apnic", "s24": 833, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 213248, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00659893534716}, {"a": 134781, "h": "HSBN-AS-AP", "n": "Hi-Speed Broadband Network", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 9082, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.236, "det": null, "oid": "ORG-HBN3-AP-APNIC", "org": "HI-SPEED BROADBAND NETWORK", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://hsbnbd.com"}, "pfx": 4, "reg": "2018-11-08", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030735665924}, {"a": 134806, "h": "SKYVIEWONLINE-AS-AP", "n": "Sky View Online", "t": "Other", "w": 9, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 9, "proxy_or_vpn": 2, "ssh_bruteforce": 7, "web_bruteforce": 4, "home_connection": 3, "router_or_botnet": 2, "cve:CVE-2017-9841": 6, "cve:CVE-2019-9082": 5, "cve:CVE-2025-4396": 2, "cve:CVE-2018-20062": 6, "cve:CVE-2026-60137": 2}, "n": 9}, "ev": {"crowdsec": {"n": 4, "p": 0.7920, "hi": 8.76, "lo": 1.88, "ips": 9, "mean": 4.78, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 4, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 10.370, 0.011, 1, false], ["2026-10-12", 15.991, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 15.991, "se": 0.620, "ts": 0.800, "map": 38.106, "obs": 5, "own": 21.526, "comp": {"cins": -0.7473, "dshield": -1.3619, "crowdsec": 7.492, "vulncheck": -0.7615, "blocklist_de": 0.4126}, "mass": 3.6, "listed": false}}, "abq": true, "bot": 0.191, "det": {"blocklist_de": {"ftp": 4}}, "oid": "ORG-SVO1-AP-APNIC", "org": "Sky View Online Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.skyviewonline.com"}, "pfx": 20, "reg": "2015-11-11", "rir": "apnic", "s24": 17, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00370895464648}, {"a": 134810, "h": "CMNET-JILIN-AS-AP", "n": "China Mobile Group JiLin communications corporation", "t": "Broadband & mobile", "w": 39, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 23, "web_bruteforce": 23, "mail_bruteforce": 31, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 34}, "ev": {"cins": {"n": 2, "p": 0.1981, "hi": 4.40, "lo": 0.57, "ips": 2, "mean": 2.10, "above": false}, "dshield": {"n": 2, "p": 0.1571, "hi": 4.06, "lo": 0.53, "ips": 2, "mean": 1.93, "above": false}, "crowdsec": {"n": 21, "p": 0.9974, "hi": 8.14, "lo": 4.01, "ips": 34, "mean": 5.92, "above": true}, "blocklist_de": {"n": 17, "p": 0.9999, "hi": 12.18, "lo": 5.56, "ips": 27, "mean": 8.60, "above": true}}, "h2": [["2026-10-05", 3.956, 0.008, 0, false], ["2026-10-12", 5.195, 0.009, 0, false]], "sh": false, "uc": 1596.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.836, "ts": null, "map": 0.130, "obs": 0, "own": 0.644, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 21, "vulncheck": 0, "blocklist_de": 17}, "lo": 5.195, "se": 0.385, "ts": 0.500, "map": 8.058, "obs": 42, "own": 12.354, "comp": {"cins": -0.2613, "dshield": -1.9852, "crowdsec": -0.0817, "vulncheck": -0.9905, "blocklist_de": 6.799}, "mass": 45.4, "listed": false}}, "abq": false, "bot": 0.463, "det": {"blocklist_de": {"imap": 23, "mail": 27}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 344, "reg": "2017-01-03", "rir": "apnic", "s24": 1021, "sib": 28, "tor": 0, "w24": 25, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 654336, "abuse": "abuse@chinamobile.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00537504784908}, {"a": 134823, "h": "SDCL-AS-AP", "n": "Sky Digital Co.", "t": "Broadband & mobile", "w": 0, "cc": "TW", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 1.398, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.821, "ts": null, "map": 0.162, "obs": 0, "own": 0.520, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.553, "det": null, "oid": "@aut-131613-APNIC", "org": "Sky Digital Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://telecom.tw"}, "pfx": 35, "reg": "2015-11-20", "rir": "apnic", "s24": 88, "sib": 3, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": "soc@imcloud.tw", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018849620235}, {"a": 134824, "h": "TEKKI-AS-AP", "n": "Tekki Pvt Ltd", "t": "Other", "w": 0, "cc": "LK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.998, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HYIP1-AP-APNIC", "org": "Tekki Pvt Ltd", "pdb": null, "pfx": 2, "reg": "2025-01-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@wetekki.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000068397258}, {"a": 134840, "h": "MCCL-AS-AP", "n": "Myanmar Country Co.", "t": "Broadband & mobile", "w": 2, "cc": "MM", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "web_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3734, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 6.756, 0.011, 0, false], ["2026-10-12", 1.706, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.706, "se": 0.948, "ts": 1.000, "map": 7.451, "obs": 2, "own": 11.954, "comp": {"cins": -0.2805, "dshield": -0.6081, "crowdsec": 6.2457, "vulncheck": -0.5072, "blocklist_de": -1.4479}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-MCCL1-AP-APNIC", "org": "Myanmar Country Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.myanmarcountry.net"}, "pfx": 29, "reg": "2015-11-27", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01050228055968}, {"a": 134855, "h": "IPNETBROADBANDPVTLTD-AS-IN", "n": "ucom digital", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.349, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-134855-APNIC", "org": "IPNET BROADBAND PRIVATE LIMITED", "pdb": null, "pfx": 1, "reg": "2015-12-07", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134863, "h": "SPINTER-AS-IN", "n": "SP INTERNET TECHNOLOGIES", "t": "Broadband & mobile", "w": 11, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 5, "p": 0.9108, "hi": 10.34, "lo": 2.57, "ips": 11, "mean": 5.90, "above": true}}, "h2": [["2026-10-05", 25.662, 0.011, 1, false], ["2026-10-12", 22.299, 0.012, 1, false]], "sh": false, "uc": 10424.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 5}, "lo": 22.299, "se": 0.623, "ts": 1.000, "map": 53.007, "obs": 5, "own": 81.604, "comp": {"cins": -0.9302, "dshield": -1.5957, "crowdsec": -6.2442, "vulncheck": -0.8095, "blocklist_de": 14.9436}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.153, "det": {"blocklist_de": {"imap": 11, "mail": 11}}, "oid": "@aut-134863-APNIC", "org": "SP INTERNET TECHNOLOGIES PRIVATE LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.spit.co.in"}, "pfx": 21, "reg": "2015-12-07", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": "info@spcomm.in", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 134877, "h": "SRIVARI-AS", "n": "Sri Vari Network Private Limited", "t": "Broadband & mobile", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 3, "ssh_bruteforce": 3, "web_bruteforce": 9, "mail_bruteforce": 9, "router_or_botnet": 1}, "n": 10}, "ev": {"dshield": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 6, "p": 0.9504, "hi": 10.83, "lo": 3.01, "ips": 10, "mean": 6.40, "above": true}, "blocklist_de": {"n": 2, "p": 0.3985, "hi": 6.07, "lo": 0.79, "ips": 3, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 12.412, 0.011, 1, false], ["2026-10-12", 19.259, 0.012, 1, false]], "sh": false, "uc": 3504.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 1.721, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 2}, "lo": 19.259, "se": 0.502, "ts": 0.667, "map": 37.161, "obs": 9, "own": 57.030, "comp": {"cins": -1.2841, "dshield": 0.3708, "crowdsec": 6.1339, "vulncheck": -0.8712, "blocklist_de": 0.6596}, "mass": 7.2, "listed": false}}, "abq": false, "bot": 0.205, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-134877-APNIC", "org": "Sri Vari Network Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.srivarigroups.com"}, "pfx": 16, "reg": "2015-12-07", "rir": "apnic", "s24": 35, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": "abuse@srivarigroups.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00070646995584}, {"a": 134907, "h": "BHARATVOIP-AS-IN", "n": "Bharat VoIP Communications Pvt Ltd", "t": "Other", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 4.075, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.075, "se": 1.003, "ts": 0.500, "map": 19.743, "obs": 2, "own": 11.703, "comp": {"cins": -0.2577, "dshield": -0.5638, "crowdsec": 2.1624, "vulncheck": -0.4843, "blocklist_de": 3.5198}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-134907-APNIC", "org": "Bharat VoIP Communications Pvt Ltd", "pdb": null, "pfx": 11, "reg": "2015-12-07", "rir": "apnic", "s24": 10, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@bharatvoip.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00048776086203}, {"a": 134916, "h": "SOLITON14-AS", "n": "Soliton NetLink Pvt. Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 6152.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.185, "det": null, "oid": "@aut-134916-APNIC", "org": "Soliton NetLink Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://solitonnetlink.in"}, "pfx": 3, "reg": "2015-12-07", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134926, "h": "MICROHOST-AS", "n": "Micro Hosting Private Limited", "t": "Hosting & VPS", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 4, "web_exploit": 2, "first_seen_30d": 3, "ssh_bruteforce": 7, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.1722, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 6, "p": 0.9530, "hi": 10.97, "lo": 3.04, "ips": 7, "mean": 6.48, "above": true}, "blocklist_de": {"n": 6, "p": 0.9614, "hi": 11.47, "lo": 3.18, "ips": 7, "mean": 6.78, "above": true}}, "h2": [["2026-10-05", 28.794, 0.011, 1, false], ["2026-10-12", 37.887, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.274, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 6}, "lo": 37.887, "se": 0.465, "ts": 0.500, "map": 67.551, "obs": 12, "own": 13.166, "comp": {"cins": -1.7243, "dshield": -2.3565, "crowdsec": 1.3941, "vulncheck": -0.9183, "blocklist_de": 9.2116}, "mass": 11.2, "listed": false}}, "abq": false, "bot": 0.864, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 7}}, "oid": "@aut-134926-APNIC", "org": "Micro Hosting Private Limited", "pdb": null, "pfx": 30, "reg": "2015-12-07", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 8704, "abuse": "abuse@microhost.com", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": null}, {"a": 134928, "h": "SPIDERLINK-AS", "n": "Spiderlink Networks", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 2.009, 0.011, 0, false], ["2026-10-12", 2.174, 0.012, 0, false]], "sh": false, "uc": 1902.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 1.862, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.174, "se": 0.963, "ts": 0.500, "map": 9.781, "obs": 2, "own": 15.749, "comp": {"cins": -0.2913, "dshield": -0.6287, "crowdsec": 1.8111, "vulncheck": -0.5174, "blocklist_de": 3.3004}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.142, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-134928-APNIC", "org": "Spiderlink Networks Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.spiderlink.in"}, "pfx": 23, "reg": "2015-12-07", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00085627146873}, {"a": 134930, "h": "HSSOL-AS-IN", "n": "HOSTING SERVER SOLUTIONS", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.935, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-134930-APNIC", "org": "HOSTING SERVER SOLUTIONS", "pdb": null, "pfx": 2, "reg": "2015-12-07", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "support@hostingserversolutions.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 134972, "h": "IKUUU-AS-AP", "n": "IKUUU NETWORK", "t": "Other", "w": 5, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 3, "ssh_bruteforce": 1, "web_bruteforce": 5, "cve:CVE-2011-3600": 1, "cve:CVE-2018-9206": 1, "cve:CVE-2021-44228": 2, "cve:CVE-2022-42889": 1, "cve:CVE-2025-55182": 4}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.3263, "hi": 5.44, "lo": 0.71, "ips": 5, "mean": 2.59, "above": false}}, "h2": [["2026-10-05", 0.933, 0.011, 0, false], ["2026-10-12", 0.981, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.036, "ts": null, "map": 0.189, "obs": 0, "own": 0.620, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.981, "se": 0.918, "ts": 1.000, "map": 4.051, "obs": 2, "own": 2.371, "comp": {"cins": -0.3082, "dshield": -0.6607, "crowdsec": 5.8825, "vulncheck": -0.5328, "blocklist_de": -1.5881}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.343, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 57, "reg": "2023-02-14", "rir": "apnic", "s24": 59, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27392, "abuse": "abuse@biz.nearoute.io", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02925554217737}, {"a": 135038, "h": "SYNESISITLIMITED-AS-AP", "n": "Synesis IT Limited", "t": "Other", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.203, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SIL2-AP-APNIC", "org": "Synesis IT Limited", "pdb": null, "pfx": 2, "reg": "2017-05-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@synesisit.info", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135061, "h": "UNICOM-ShenZhen-IDC", "n": "China Unicom Guangdong IP network", "t": "Broadband & mobile", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0267, "hi": 2.59, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}, "dshield": {"n": 1, "p": 0.1228, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "crowdsec": {"n": 1, "p": 0.0159, "hi": 2.33, "lo": 0.17, "ips": 1, "mean": 0.98, "above": false}}, "h2": [["2026-10-05", 0.432, 0.010, 0, false], ["2026-10-12", 0.216, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.910, "ts": null, "map": 0.159, "obs": 0, "own": 0.905, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.216, "se": 0.854, "ts": 0.500, "map": 0.786, "obs": 2, "own": 1.252, "comp": {"cins": -0.387, "dshield": 3.2564, "crowdsec": 0.8627, "vulncheck": -0.5947, "blocklist_de": -1.9842}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.381, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 244, "reg": "2016-01-29", "rir": "apnic", "s24": 389, "sib": 25, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 162304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007078740058}, {"a": 135063, "h": "POPNIXCO-AS-AP", "n": "POP NIX COMPANY", "t": "Hosting & VPS", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.966, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PNCL1-AP-APNIC", "org": "POP NIX COMPANY LIMITED", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.pop-nix.com/"}, "pfx": 5, "reg": "2016-01-31", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000913100502}, {"a": 135089, "h": "CHINANET-Guangzhou-Southbase-IDC", "n": "China Telecom", "t": "Broadband & mobile", "w": 13, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 10, "cve:CVE-2024-6387": 7}, "n": 10}, "ev": {"cins": {"n": 3, "p": 0.5574, "hi": 6.83, "lo": 1.20, "ips": 3, "mean": 3.52, "above": false}, "shodan": {"n": 14, "p": 0.9998, "hi": 13.02, "lo": 5.50, "ips": 14, "mean": 8.92, "above": true}, "crowdsec": {"n": 8, "p": 0.8906, "hi": 7.81, "lo": 2.54, "ips": 10, "mean": 4.87, "above": true}, "threatfox": {"n": 1, "p": 0.1783, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1357, "hi": 4.06, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "blocklist_de": {"n": 6, "p": 0.8867, "hi": 8.83, "lo": 2.45, "ips": 7, "mean": 5.22, "above": true}}, "h2": [["2026-10-05", 5.399, 0.161, 0, false], ["2026-10-12", 6.365, 0.168, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.168, "se": 1.395, "ts": 1.000, "map": 1.179, "obs": 1, "own": 3.553, "comp": {"urlhaus": -0.2419, "threatfox": 2.4856, "phishing_db": -0.4526}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 8, "vulncheck": 1, "blocklist_de": 6}, "lo": 6.365, "se": 0.433, "ts": 0.444, "map": 10.713, "obs": 18, "own": 16.441, "comp": {"cins": 5.3277, "dshield": -2.7391, "crowdsec": -0.9446, "vulncheck": -0.6434, "blocklist_de": 2.7645}, "mass": 18.9, "listed": false}}, "abq": true, "bot": 0.665, "det": {"shodan": {"c2": 1, "compromised": 13}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 7}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 136, "reg": "2022-06-22", "rir": "apnic", "s24": 319, "sib": 281, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 125440, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0005871461037}, {"a": 135097, "h": "MYCLOUD-AS-AP", "n": "LUOGELANG (FRANCE) LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.858, "ts": null, "map": 0.140, "obs": 0, "own": 0.111, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.540, "ts": null, "map": 0.063, "obs": 0, "own": 0.017, "comp": null, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.894, "det": null, "oid": "ORG-LL6-AP-APNIC", "org": "LUOGELANG (FRANCE) LIMITED", "pdb": null, "pfx": 44, "reg": "2016-02-16", "rir": "apnic", "s24": 763, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 204032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034022619016}, {"a": 135129, "h": "UNINET-AS-RMUTTO-BP", "n": "Rajamangala University of Technology Tawan-ok(Bangpra Campus)", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.275, "det": {"shodan": {"malware": 1}}, "oid": "ORG-OOIA1-AP-APNIC", "org": "Office of Info.Tech. Admin. for Educational Development", "pdb": null, "pfx": 1, "reg": "2020-03-02", "rir": "apnic", "s24": 4, "sib": 47, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "noc@uni.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002117399928}, {"a": 135130, "h": "ACN-AS-AP", "n": "Anik Computer & Networking", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 3580.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.213, "det": null, "oid": "ORG-ACN1-AP-APNIC", "org": "Anik Computer & Networking", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.aniknetwork.net"}, "pfx": 6, "reg": "2016-02-25", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@aniknetwork.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00080339931838}, {"a": 135133, "h": "PDPL-AS-AP", "n": "Pi Datacenters", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.137, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.897, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PDCP1-AP-APNIC", "org": "PI DATA CENTERS PRIVATE LIMITED", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.pidatacenters.com"}, "pfx": 17, "reg": "2016-02-26", "rir": "apnic", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135139, "h": "SKYNTPL-AS-AP", "n": "Skylink Fibernet Private Limited", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 3, "ssh_bruteforce": 3, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5832, "hi": 7.08, "lo": 1.25, "ips": 3, "mean": 3.65, "above": false}, "vulncheck": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.195, 0.011, 0, false], ["2026-10-12", 6.929, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 6.929, "se": 0.629, "ts": 0.600, "map": 16.612, "obs": 5, "own": 25.880, "comp": {"cins": -0.6988, "dshield": -1.295, "crowdsec": 4.8382, "vulncheck": 0.6477, "blocklist_de": 0.7117}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.149, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SFPL1-AP-APNIC", "org": "SKYLINK NETWORKS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.skylink.net.in"}, "pfx": 55, "reg": "2018-05-03", "rir": "apnic", "s24": 36, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": "support@skylink.net.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00177024467391}, {"a": 135149, "h": "MTGCL-AS-AP", "n": "Myanmar Technology Gateway Co., Ltd", "t": "Other", "w": 0, "cc": "MM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.783, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MTGC1-AP-APNIC", "org": "Myanmar Technology Gateway Co., Ltd", "pdb": null, "pfx": 1, "reg": "2016-03-07", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "support@mtg.com.mm", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135152, "h": "GNTL-AS-AP", "n": "Global Network Transit Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.585, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GNTL1-AP-APNIC", "org": "Global Network Transit Limited", "pdb": null, "pfx": 4, "reg": "2016-03-08", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135161, "h": "GMO-Z-COM-TH", "n": "GMO Thailand", "t": "Hosting & VPS", "w": 10, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 7, "web_exploit": 3, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 8}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 20.38, "lo": 9.09, "ips": 16, "mean": 14.26, "above": true}, "urlhaus": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 7, "p": 0.9639, "hi": 10.61, "lo": 3.21, "ips": 8, "mean": 6.46, "above": true}, "phishing_db": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 4, "p": 0.7645, "hi": 8.35, "lo": 1.80, "ips": 4, "mean": 4.56, "above": false}}, "h2": [["2026-10-05", 3.861, 2.035, 0, false], ["2026-10-12", 10.964, 2.135, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 2.135, "se": 1.187, "ts": 0.500, "map": 10.665, "obs": 2, "own": 4.175, "comp": {"urlhaus": 3.2574, "threatfox": -0.3786, "phishing_db": 1.1143}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 4}, "lo": 10.964, "se": 0.476, "ts": 0.636, "map": 19.932, "obs": 11, "own": 3.900, "comp": {"cins": -1.5971, "dshield": -2.2561, "crowdsec": 4.5519, "vulncheck": -0.9069, "blocklist_de": 4.5941}, "mass": 9.9, "listed": false}}, "abq": false, "bot": 0.648, "det": {"shodan": {"malware": 1, "compromised": 15}, "blocklist_de": {"ftp": 1, "ssh": 3}}, "oid": "ORG-GPL2-AP-APNIC", "org": "GMO-Z.COM PTE. LTD.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://z.com/th/en/"}, "pfx": 24, "reg": "2016-03-15", "rir": "apnic", "s24": 90, "sib": 1, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 29440, "abuse": "abuse@internet.gmo", "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00021403120914}, {"a": 135175, "h": "FACTS-AS-IN", "n": "Facts Online Pvt Ltd", "t": "Other", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 2}, "ev": {"cins": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "shodan": {"n": 3, "p": 0.6257, "hi": 7.51, "lo": 1.32, "ips": 3, "mean": 3.88, "above": false}, "crowdsec": {"n": 2, "p": 0.3969, "hi": 6.05, "lo": 0.79, "ips": 2, "mean": 2.88, "above": false}, "vulncheck": {"n": 3, "p": 0.6419, "hi": 7.69, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 25.516, 0.011, 1, false], ["2026-10-12", 29.693, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.805, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 1}, "lo": 29.693, "se": 0.555, "ts": 0.375, "map": 61.598, "obs": 8, "own": 35.001, "comp": {"cins": 7.143, "dshield": -1.6719, "crowdsec": -1.0307, "vulncheck": 2.1633, "blocklist_de": -1.0895}, "mass": 5.2, "listed": false}}, "abq": true, "bot": 0.921, "det": {"shodan": {"compromised": 3}, "vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-135175-APNIC", "org": "Facts Online Pvt Ltd", "pdb": null, "pfx": 15, "reg": "2016-03-18", "rir": "apnic", "s24": 15, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00084679388883}, {"a": 135181, "h": "KANGLA-AS-IN", "n": "KANGLA ENTERPRISES PRIVATE LIMITED", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": 34765.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.325, "det": null, "oid": "@aut-135181-APNIC", "org": "KANGLA ENTERPRISES PRIVATE LIMITED", "pdb": null, "pfx": 1, "reg": "2016-03-18", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@kanglaenterprises.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135182, "h": "MISPLMBD-AS-IN", "n": "MORADABAD INTERNET SERVICES PRIVATE LIMITED", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8496.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.211, "det": null, "oid": "@aut-135182-APNIC", "org": "MORADABAD INTERNET SERVICES PRIVATE LIMITED", "pdb": null, "pfx": 6, "reg": "2016-03-18", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135192, "h": "ASN23GAI-AS-IN", "n": "Rv Broadband Services", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.322, "det": {"shodan": {"compromised": 2}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.rvbroadband.net"}, "pfx": 2, "reg": "2016-03-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135198, "h": "BULLION-AS", "n": "Bombay Bullion Commmunication", "t": "Other", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 4, "first_seen_30d": 4, "ssh_bruteforce": 4, "web_bruteforce": 1, "router_or_botnet": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.888, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135198-APNIC", "org": "Bombay Bullion Commmunication", "pdb": null, "pfx": 3, "reg": "2016-03-18", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135202, "h": "NETFIRE-AS-IN", "n": "Netfirre Communications", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 13671.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.174, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-135202-APNIC", "org": "Netfirre Communications Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.netfire.co.in"}, "pfx": 4, "reg": "2016-03-18", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "info@netfire.co.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135208, "h": "PMINPL-AS", "n": "Megahertz Internet Network", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1269.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.137, "det": null, "oid": "@aut-135208-APNIC", "org": "Megahertz Internet Network Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.megahertzinternet.com"}, "pfx": 10, "reg": "2016-03-18", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "admin@megahertz.net.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135218, "h": "GTELCOMM-AS", "n": "Gtel Communications", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": 9375, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 32.074, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.281, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-135218-APNIC", "org": "Gtel Communications Private Limited", "pdb": null, "pfx": 3, "reg": "2016-03-18", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135222, "h": "MWNASHIK-AS", "n": "MilesWeb Internet Services Pvt Ltd", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 7, "p": 0.9871, "hi": 12.95, "lo": 3.92, "ips": 7, "mean": 7.88, "above": true}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 19.129, 0.011, 1, false], ["2026-10-12", 3.969, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.969, "se": 1.020, "ts": 0.500, "map": 19.242, "obs": 2, "own": 32.196, "comp": {"cins": -0.1791, "dshield": -0.4049, "crowdsec": 3.025, "vulncheck": 2.8401, "blocklist_de": -0.9303}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.808, "det": {"shodan": {"compromised": 7}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-135222-APNIC", "org": "MilesWeb Internet Services Pvt Ltd", "pdb": null, "pfx": 7, "reg": "2016-03-18", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1792, "abuse": "abuse@milesweb.com", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 135225, "h": "SMARTNET16-AS", "n": "SMART NET INDIA", "t": "Broadband & mobile", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 2, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "blocklist_de": {"n": 5, "p": 0.9121, "hi": 10.38, "lo": 2.58, "ips": 10, "mean": 5.92, "above": true}}, "h2": [["2026-10-05", 30.819, 0.011, 1, false], ["2026-10-12", 45.957, 0.012, 1, false]], "sh": false, "uc": 12141.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 5}, "lo": 45.957, "se": 0.548, "ts": 0.714, "map": 95.799, "obs": 7, "own": 146.844, "comp": {"cins": -1.1741, "dshield": -1.8676, "crowdsec": -2.3547, "vulncheck": -0.8552, "blocklist_de": 12.2075}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.357, "det": {"blocklist_de": {"imap": 10, "mail": 10}}, "oid": "@aut-135225-APNIC", "org": "SMART NET INDIA PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.smartnetisp.com"}, "pfx": 12, "reg": "2016-03-18", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "info@smartnetisp.com", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 135241, "h": "PACKENET-AS", "n": "Packenet Solutions", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5761.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.127, "det": null, "oid": "@aut-135241-APNIC", "org": "Packenet Solutions Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Restrictive", "web": "http://www.packetnet.in"}, "pfx": 4, "reg": "2016-03-18", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135303, "h": "NSPL-AS-AP", "n": "N.I.T.V Streamz Pvt. Ltd", "t": "Other", "w": 1, "cc": "NP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.118, 0.012, 0, false], ["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 16.363, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.670, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": "2016-04-04", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@nettv.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000038240748}, {"a": 135307, "h": "GTMH-AS-AP", "n": "Golden TMH Telecom Co.", "t": "Broadband & mobile", "w": 0, "cc": "MM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.194, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GTTC1-AP-APNIC", "org": "Golden TMH Telecom Co. Ltd", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://gtmh-telecom.com/"}, "pfx": 8, "reg": "2016-04-05", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000026391792}, {"a": 135341, "h": "ORANGE2-AS-AP", "n": "Orange Communication AS135341", "t": "Broadband & mobile", "w": 6, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 3, "web_bruteforce": 4, "router_or_botnet": 4, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6009, "hi": 7.25, "lo": 1.28, "ips": 4, "mean": 3.74, "above": false}, "vulncheck": {"n": 1, "p": 0.1931, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 4.053, 0.011, 0, false], ["2026-10-12", 9.299, 0.012, 0, false]], "sh": false, "uc": 1787.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 1.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 9.299, "se": 0.632, "ts": 0.600, "map": 22.476, "obs": 5, "own": 35.001, "comp": {"cins": -0.6853, "dshield": -1.276, "crowdsec": 4.996, "vulncheck": 0.676, "blocklist_de": 0.7954}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.239, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-OC4-AP-APNIC", "org": "Orange Communication", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.orangebd.online"}, "pfx": 26, "reg": "2016-04-12", "rir": "apnic", "s24": 26, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "admin@orangebd.online", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00433985930284}, {"a": 135354, "h": "NBPAP-AS-AP", "n": "NAVER BUSINESS PLATFORM ASIA PACIFIC", "t": "Hosting & VPS", "w": 2, "cc": "SG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 18, "p": 0.9873, "hi": 7.54, "lo": 3.52, "ips": 18, "mean": 5.37, "above": true}, "crowdsec": {"n": 1, "p": 0.0001, "hi": 1.14, "lo": 0.09, "ips": 1, "mean": 0.48, "above": false}, "vulncheck": {"n": 1, "p": 0.0451, "hi": 2.92, "lo": 0.22, "ips": 1, "mean": 1.23, "above": false}, "blocklist_de": {"n": 1, "p": 0.0085, "hi": 2.09, "lo": 0.16, "ips": 1, "mean": 0.88, "above": false}}, "h2": [["2026-10-05", 0.181, 0.008, 0, false], ["2026-10-12", 0.134, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.824, "ts": null, "map": 0.125, "obs": 0, "own": 0.094, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.134, "se": 0.730, "ts": 0.333, "map": 0.381, "obs": 3, "own": 0.078, "comp": {"cins": -0.5501, "dshield": -1.0749, "crowdsec": -0.5949, "vulncheck": 1.0082, "blocklist_de": 1.6411}, "mass": 2.6, "listed": false}}, "abq": true, "bot": 0.962, "det": {"shodan": {"c2": 1, "compromised": 17}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-NBPA1-AP-APNIC", "org": "NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": null}, "pfx": 125, "reg": "2016-04-15", "rir": "apnic", "s24": 1188, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 449536, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0005843767272}, {"a": 135360, "h": "ARGONDATANETWORK-AS-AP", "n": "Argon Data Network", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 4.045, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 8.137, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.812, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CADN1-AP-APNIC", "org": "CV. Argon Data Network", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.argon.sg/"}, "pfx": 3, "reg": "2016-04-19", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "admin@argon.sg", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015385457022}, {"a": 135375, "h": "TCC-AS-AP", "n": "Today Communication", "t": "Broadband & mobile", "w": 6, "cc": "KH", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 5, "router_or_botnet": 4}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.6214, "hi": 7.47, "lo": 1.32, "ips": 3, "mean": 3.85, "above": false}, "crowdsec": {"n": 4, "p": 0.7906, "hi": 8.74, "lo": 1.88, "ips": 5, "mean": 4.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 9.339, 0.011, 0, false], ["2026-10-12", 15.170, 0.012, 1, false]], "sh": false, "uc": 26475.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 15.170, "se": 0.620, "ts": 0.800, "map": 36.129, "obs": 5, "own": 55.780, "comp": {"cins": -0.7497, "dshield": -1.3651, "crowdsec": 7.4601, "vulncheck": -0.7622, "blocklist_de": 0.3977}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.242, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"mail": 1}}, "oid": "ORG-TCC2-AP-APNIC", "org": "Today Communication Co.,Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.today.com.kh/"}, "pfx": 22, "reg": "2016-04-26", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "abuse@today.com.kh", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068659522194}, {"a": 135377, "h": "UCLOUD-HK-AS-AP", "n": "UCloud Information Technology (HK) Limited", "t": "Hyperscale cloud", "w": 875, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 211, "data_centre": 37, "web_exploit": 293, "bad_crawling": 122, "proxy_or_vpn": 33, "first_seen_30d": 14, "ssh_bruteforce": 516, "web_bruteforce": 143, "home_connection": 5, "mail_bruteforce": 160, "cve:CVE-2017-9841": 26, "cve:CVE-2019-9082": 20, "cve:CVE-2023-1389": 4, "cve:CVE-2024-6387": 14, "cve:CVE-2018-20062": 21}, "n": 750}, "ev": {"cins": {"n": 192, "p": 1.0000, "hi": 163.92, "lo": 129.32, "ips": 417, "mean": 146.19, "above": true}, "shodan": {"n": 16, "p": 0.9969, "hi": 9.28, "lo": 4.14, "ips": 16, "mean": 6.49, "above": true}, "dshield": {"n": 10, "p": 0.9957, "hi": 12.04, "lo": 4.38, "ips": 11, "mean": 7.81, "above": true}, "urlhaus": {"n": 2, "p": 0.3778, "hi": 5.88, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "crowdsec": {"n": 306, "p": 1.0000, "hi": 111.58, "lo": 92.47, "ips": 750, "mean": 101.84, "above": true}, "threatfox": {"n": 6, "p": 0.9457, "hi": 10.61, "lo": 2.94, "ips": 6, "mean": 6.27, "above": true}, "vulncheck": {"n": 8, "p": 0.9723, "hi": 10.33, "lo": 3.36, "ips": 9, "mean": 6.44, "above": true}, "phishing_db": {"n": 12, "p": 0.9996, "hi": 14.19, "lo": 5.61, "ips": 14, "mean": 9.49, "above": true}, "blocklist_de": {"n": 129, "p": 1.0000, "hi": 82.39, "lo": 61.71, "ips": 157, "mean": 71.73, "above": true}}, "h2": [["2026-10-05", 106.155, 6.264, 2, false], ["2026-10-12", 125.836, 5.703, 2, false]], "sh": false, "uc": 206.1, "v2": {"band": 2, "host": {"n": {"urlhaus": 2, "threatfox": 6, "phishing_db": 12}, "lo": 5.703, "se": 0.779, "ts": 0.600, "map": 12.530, "obs": 20, "own": 8.386, "comp": {"urlhaus": 0.8507, "threatfox": 0.9431, "phishing_db": 2.3605}, "mass": 12.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 192, "dshield": 10, "crowdsec": 306, "vulncheck": 8, "blocklist_de": 129}, "lo": 125.836, "se": 0.339, "ts": 0.474, "map": 182.576, "obs": 645, "own": 74.242, "comp": {"cins": 18.5361, "dshield": -3.1631, "crowdsec": -1.9111, "vulncheck": -0.9495, "blocklist_de": -5.9115}, "mass": 757.4, "listed": true}}, "abq": true, "bot": 0.938, "det": {"shodan": {"c2": 2, "malware": 2, "compromised": 12}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 5}, "vulncheck": {"c2_server": 7, "attack_tooling": 2}, "blocklist_de": {"ftp": 4, "ssh": 94, "bots": 2, "imap": 21, "mail": 53, "apache": 4, "bruteforcelogin": 4}}, "oid": "ORG-UITL1-AP-APNIC", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "pdb": {"t": null, "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.ucloud.cn"}, "pfx": 746, "reg": "2016-04-27", "rir": "apnic", "s24": 758, "sib": 1, "tor": 0, "w24": 323, "drop": 1, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 194816, "abuse": null, "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de", "cins"], "traffic": 0.01965766586628}, {"a": 135381, "h": "SIS-AS-AP", "n": "SiS Distribution (Thailand) Public Company Limited descr: (@Genesis Data Center)", "t": "Hosting & VPS", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.120, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.919, "det": {"shodan": {"compromised": 1}}, "oid": "@family-28355", "org": "Symphony Communication Public Company Limited", "pdb": null, "pfx": 28, "reg": "2020-03-03", "rir": "apnic", "s24": 28, "sib": 18, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002837496492}, {"a": 135388, "h": "RPL-HK", "n": "RMP Protection Limited", "t": "Other", "w": 8, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "threatfox": {"n": 2, "p": 0.4230, "hi": 6.29, "lo": 0.82, "ips": 6, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.979, 14.461, 1, false], ["2026-10-12", 1.097, 14.381, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 14.381, "se": 1.292, "ts": 1.000, "map": 97.757, "obs": 2, "own": 91.671, "comp": {"urlhaus": -0.1304, "threatfox": 6.6249, "phishing_db": -0.2858}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.494, "det": {"threatfox": {"family:Havoc": 1, "family:Tsundere": 5}}, "oid": "ORG-RPL10-AP-APNIC", "org": "RMP Protection Limited", "pdb": null, "pfx": 2, "reg": "2016-04-29", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "support@hosthongkong.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049569582405}, {"a": 135391, "h": "AOFEI-HK", "n": "AOFEI DATA INTERNATIONAL", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1248, "hi": 3.94, "lo": 0.30, "ips": 1, "mean": 1.66, "above": false}}, "h2": [["2026-10-05", 0.170, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 0.212, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.811, "ts": null, "map": 0.159, "obs": 0, "own": 0.063, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.374, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ADIC1-AP-APNIC", "org": "AOFEI DATA INTERNATIONAL COMPANY LIMITED", "pdb": {"t": "Content", "sc": "Global", "tr": "500-1000Gbps", "pol": "Selective", "web": "http://www.aofidc.com/"}, "pfx": 72, "reg": "2016-05-03", "rir": "apnic", "s24": 95, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27648, "abuse": "support@aofidc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00059044045486}, {"a": 135392, "h": "MILLENIALHOSTLIMITED-AS-GB", "n": "MillenialHost Limited", "t": "Hosting & VPS", "w": 6, "cc": "GB", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "threatfox": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1938, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 1.598, 3.212, 0, false], ["2026-10-12", 0.316, 4.863, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 4.863, "se": 1.232, "ts": 0.500, "map": 26.931, "obs": 2, "own": 10.453, "comp": {"urlhaus": 3.6776, "threatfox": 1.8437, "phishing_db": -0.6019}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.316, "se": 1.315, "ts": 1.000, "map": 2.658, "obs": 1, "own": 0.634, "comp": {"cins": -0.0831, "dshield": -0.1958, "crowdsec": -0.7758, "vulncheck": 3.8601, "blocklist_de": -0.4343}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.598, "det": {"threatfox": {"family:PureRAT": 2, "family:Evilginx": 1}, "vulncheck": {"attack_tooling": 2}}, "oid": "ORG-ML59-AP-APNIC", "org": "MillenialHost Limited", "pdb": null, "pfx": 23, "reg": "2016-05-04", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@tele-asia.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000219002159}, {"a": 135407, "h": "TES-PL-AS-AP", "n": "TransWorldEnterpriseServices", "t": "Broadband & mobile", "w": 17, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 2, "p": 0.3057, "hi": 5.27, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}, "crowdsec": {"n": 4, "p": 0.6823, "hi": 7.37, "lo": 1.59, "ips": 4, "mean": 4.03, "above": false}, "vulncheck": {"n": 2, "p": 0.3919, "hi": 6.01, "lo": 0.78, "ips": 10, "mean": 2.86, "above": false}, "blocklist_de": {"n": 3, "p": 0.5820, "hi": 7.06, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}}, "h2": [["2026-10-05", 5.670, 0.011, 0, false], ["2026-10-12", 8.512, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.011, "ts": null, "map": 0.185, "obs": 0, "own": 1.386, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 3}, "lo": 8.512, "se": 0.503, "ts": 0.400, "map": 16.176, "obs": 10, "own": 24.941, "comp": {"cins": 2.1943, "dshield": -2.0868, "crowdsec": 0.4673, "vulncheck": 0.459, "blocklist_de": 3.1434}, "mass": 8.2, "listed": false}}, "abq": false, "bot": 0.106, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 10}, "blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "ORG-TWES1-AP-APNIC", "org": "Trans World Enterprise Services (Private) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "https://transworld-home.com/"}, "pfx": 92, "reg": "2016-05-06", "rir": "apnic", "s24": 91, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24320, "abuse": "abuse@tes.com.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01390546952817}, {"a": 135444, "h": "IDNIC-IKUBARU-AS-ID", "n": "PT Ikubaru Indonesia", "t": "Broadband & mobile", "w": 10, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 8, "bad_crawling": 5, "proxy_or_vpn": 2, "first_seen_30d": 8, "web_bruteforce": 3, "home_connection": 7, "cve:CVE-2017-9841": 1, "cve:CVE-2022-46604": 1, "cve:CVE-2026-87902": 2}, "n": 8}, "ev": {"shodan": {"n": 5, "p": 0.9095, "hi": 10.29, "lo": 2.56, "ips": 5, "mean": 5.87, "above": true}, "urlhaus": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 8, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 4.032, 0.821, 0, false], ["2026-10-12", 3.050, 0.849, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.849, "se": 1.762, "ts": 1.000, "map": 11.936, "obs": 1, "own": 45.215, "comp": {"urlhaus": 4.404, "threatfox": -0.1064, "phishing_db": -0.1919}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.050, "se": 1.002, "ts": 0.500, "map": 14.304, "obs": 2, "own": 23.852, "comp": {"cins": -0.1897, "dshield": -0.427, "crowdsec": 2.905, "vulncheck": 2.7508, "blocklist_de": -0.9848}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.961, "det": {"shodan": {"compromised": 5}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-135444-APNIC", "org": "PT Ikubaru Indonesia", "pdb": null, "pfx": 10, "reg": "2016-05-19", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 135449, "h": "BIPNET-AS-ID", "n": "Broadband Indonesia Pratama", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-135449-APNIC", "org": "PT. Broadband Indonesia Pratama", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://bipnet.co.id"}, "pfx": 4, "reg": "2016-05-19", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000967228504}, {"a": 135450, "h": "IDNIC-BSTI-AS-ID", "n": "Berkah Solusi Teknologi Informasi", "t": "Other", "w": 12, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 1, "web_exploit": 11, "bad_crawling": 8, "proxy_or_vpn": 3, "web_bruteforce": 10, "home_connection": 5, "cve:CVE-2026-4020": 1, "cve:CVE-2022-39290": 1, "cve:CVE-2022-46604": 3, "cve:CVE-2024-28000": 2, "cve:CVE-2026-63030": 6}, "n": 11}, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 11, "mean": 3.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 55.391, 0.011, 1, false], ["2026-10-12", 40.262, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 40.262, "se": 0.704, "ts": 0.750, "map": 112.006, "obs": 4, "own": 63.485, "comp": {"cins": -0.5449, "dshield": -1.0668, "crowdsec": 6.7347, "vulncheck": -0.6849, "blocklist_de": 1.6741}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.972, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-135450-APNIC", "org": "PT Berkah Solusi Teknologi Informasi", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ptbsti.com"}, "pfx": 4, "reg": "2016-05-19", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@ptbsti.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006390068102}, {"a": 135468, "h": "BNET-AS-ID", "n": "BNET ID", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.211, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135468-APNIC", "org": "BNET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://bnet.id"}, "pfx": 5, "reg": "2016-05-19", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@bnet.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135473, "h": "IDNIC-BPJSKETENAGAKERJAAN-AS-ID", "n": "BPJS Ketenagakerjaan", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.983, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-135473-APNIC", "org": "BPJS Ketenagakerjaan", "pdb": null, "pfx": 2, "reg": "2016-05-19", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135477, "h": "JAVADIGITAL-AS-ID", "n": "Java Digital Nusantara", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 2.632, 0.011, 0, false], ["2026-10-12", 0.477, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.477, "se": 1.379, "ts": 1.000, "map": 4.701, "obs": 1, "own": 8.746, "comp": {"cins": -0.0956, "dshield": -0.224, "crowdsec": 4.0096, "vulncheck": -0.2493, "blocklist_de": -0.4992}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-135477-APNIC", "org": "PT. Java Digital Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://nusantara.net.id"}, "pfx": 15, "reg": "2016-05-19", "rir": "apnic", "s24": 15, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002248294059}, {"a": 135523, "h": "MULTINET-IE-AS-AP", "n": "Multinet Broadband", "t": "Broadband & mobile", "w": 66, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 65, "proxy_or_vpn": 1, "ssh_bruteforce": 8, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 54, "cve:CVE-2019-8318": 15, "cve:CVE-2018-10562": 23, "cve:CVE-2024-12847": 64, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 66}, "ev": {"shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "dshield": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 4, "p": 0.7722, "hi": 8.46, "lo": 1.82, "ips": 66, "mean": 4.62, "above": false}}, "h2": [["2026-10-05", 4.463, 0.011, 0, false], ["2026-10-12", 8.740, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.740, "se": 0.614, "ts": 0.800, "map": 20.469, "obs": 5, "own": 31.612, "comp": {"cins": -0.7345, "dshield": 1.928, "crowdsec": 7.6622, "vulncheck": -0.7575, "blocklist_de": -3.6856}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.140, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MB4-AP-APNIC", "org": "Multinet Broadband", "pdb": null, "pfx": 28, "reg": "2016-06-02", "rir": "apnic", "s24": 31, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@multinet.com.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00043272893015}, {"a": 135581, "h": "ONL-HK-AS", "n": "ONL", "t": "Other", "w": 3, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "threatfox": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 4.014, 0, false], ["2026-10-12", 0.011, 4.043, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 4.043, "se": 1.189, "ts": 0.500, "map": 21.070, "obs": 2, "own": 20.440, "comp": {"urlhaus": -0.2437, "threatfox": 2.4754, "phishing_db": 2.4423}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.422, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.710, "det": {"shodan": {"c2": 2}, "threatfox": {"family:Unknown malware": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 18, "reg": "2019-06-03", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": "network.company11@gmail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012627438496}, {"a": 135607, "h": "INFINIVAN-AS-AP", "n": "Infinivan", "t": "Transit & backbone", "w": 10, "cc": "PH", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 4, "web_exploit": 7, "bad_crawling": 1, "proxy_or_vpn": 4, "web_bruteforce": 7, "router_or_botnet": 5, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.0897, "hi": 3.54, "lo": 0.26, "ips": 1, "mean": 1.49, "above": false}, "dshield": {"n": 2, "p": 0.3677, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}, "crowdsec": {"n": 7, "p": 0.9307, "hi": 9.23, "lo": 2.79, "ips": 7, "mean": 5.61, "above": true}, "blocklist_de": {"n": 1, "p": 0.1344, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 4.625, 0.010, 0, false], ["2026-10-12", 4.949, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.975, "ts": null, "map": 0.178, "obs": 0, "own": 1.693, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.949, "se": 0.486, "ts": 0.700, "map": 9.143, "obs": 10, "own": 28.581, "comp": {"cins": -1.3943, "dshield": 2.3135, "crowdsec": 6.9918, "vulncheck": -0.8853, "blocklist_de": -3.4191}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.156, "det": {"shodan": {"c2": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-II1-AP-APNIC", "org": "Infinivan Inc.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Selective", "web": "https://infinivan.com"}, "pfx": 162, "reg": "2016-10-04", "rir": "apnic", "s24": 160, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41984, "abuse": "noc@infinivan.com", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.01879604699194}, {"a": 135629, "h": "WESTCLOUDDATA", "n": "Amazon Web Service Ningxia (NWCD)", "t": "Hosting & VPS", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0006, "hi": 1.59, "lo": 0.21, "ips": 2, "mean": 0.76, "above": false}, "vulncheck": {"n": 1, "p": 0.0347, "hi": 2.75, "lo": 0.21, "ips": 1, "mean": 1.16, "above": false}}, "h2": [["2026-10-05", 4.287, 0.008, 0, false], ["2026-10-12", 0.022, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.812, "ts": null, "map": 0.119, "obs": 0, "own": 0.089, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.022, "se": 1.035, "ts": 1.000, "map": 0.110, "obs": 1, "own": 0.024, "comp": {"cins": -0.2011, "dshield": -0.4505, "crowdsec": -1.7807, "vulncheck": 2.659, "blocklist_de": -1.0432}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.611, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-135629-APNIC", "org": "Ningxia West Cloud Data Technology Co.Ltd.", "pdb": null, "pfx": 45, "reg": "2016-10-13", "rir": "apnic", "s24": 1386, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 359168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019617564902}, {"a": 135636, "h": "RACKH-AS-AP", "n": "RackH Lintas Asia AS135636", "t": "Transit & backbone", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9194": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1756, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.339, 0.011, 0, false], ["2026-10-12", 0.360, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 2.590, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.360, "se": 1.323, "ts": 1.000, "map": 3.207, "obs": 1, "own": 11.771, "comp": {"cins": -0.1126, "dshield": -0.2619, "crowdsec": 3.8031, "vulncheck": -0.2822, "blocklist_de": -0.5873}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.334, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RLAP1-AP-APNIC", "org": "PT. RACKH LINTAS ASIA", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.rackh.co.id"}, "pfx": 26, "reg": "2016-10-17", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@rackh.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135682, "h": "AWDHPL-AS-IN", "n": "Advika Web Developments Hosting Pvt Ltd", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.492, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.921, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135682-APNIC", "org": "Advika Web Developments Hosting Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.advikaweb.com"}, "pfx": 10, "reg": "2016-06-17", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@awdhpl.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135687, "h": "QWISTELN-AS-IN", "n": "Qwistel Network Service", "t": "Broadband & mobile", "w": 71, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 71, "bad_crawling": 2, "ssh_bruteforce": 1, "web_bruteforce": 13, "router_or_botnet": 42, "cve:CVE-2019-8318": 33, "cve:CVE-2018-10562": 43, "cve:CVE-2021-26294": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-12847": 70}, "n": 71}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 71, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 5.153, 0.011, 0, false], ["2026-10-12", 5.536, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 45.634, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.163, "det": null, "oid": "@aut-135687-APNIC", "org": "Qwistel Network Service Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.qwistel.in/"}, "pfx": 7, "reg": "2016-06-17", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "networkqwistel@gmail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046624118061}, {"a": 135690, "h": "SHINE994-AS-IN", "n": "Shineplus Networks Private Limited", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.132, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135690-APNIC", "org": "Shineplus Networks Private Limited", "pdb": null, "pfx": 8, "reg": "2016-06-17", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "info@shineplusnetworks.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135712, "h": "ECSPL-AS", "n": "Euron Communications", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": 19140.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 64.091, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.159, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-135712-APNIC", "org": "Euron Communications Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.euronetinfocom.com"}, "pfx": 4, "reg": "2016-06-17", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135722, "h": "GLOBAL-AS", "n": "Teleglobal Communications", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3969, "hi": 6.05, "lo": 0.79, "ips": 3, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 2.632, 0.011, 0, false], ["2026-10-12", 2.816, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.816, "se": 0.978, "ts": 1.000, "map": 13.046, "obs": 2, "own": 21.013, "comp": {"cins": -0.2555, "dshield": -0.5597, "crowdsec": 6.5804, "vulncheck": -0.482, "blocklist_de": -1.3211}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.120, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-135722-APNIC", "org": "Teleglobal Communications Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.teleglobal.in"}, "pfx": 17, "reg": "2016-06-17", "rir": "apnic", "s24": 15, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055438267368}, {"a": 135735, "h": "VILITE-AS", "n": "Vilite Multimedia", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 7226.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.196, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-135735-APNIC", "org": "Vilite Multimedia Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://vilite.com"}, "pfx": 4, "reg": "2016-06-17", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "noc@vilite.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135752, "h": "EVOKEDS-AS", "n": "Evoke Digital Solutions", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.801, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.568, "det": null, "oid": "@aut-135752-APNIC", "org": "Evoke Digital Solutions", "pdb": null, "pfx": 4, "reg": "2016-06-17", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135777, "h": "NECONN-AS", "n": "Shreenortheast Connect and Services", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 3.259, 0.011, 0, false], ["2026-10-12", 3.544, 0.012, 0, false]], "sh": false, "uc": 4947.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.544, "se": 0.994, "ts": 0.500, "map": 16.944, "obs": 2, "own": 27.406, "comp": {"cins": -0.2649, "dshield": -0.578, "crowdsec": 2.0858, "vulncheck": -0.4917, "blocklist_de": 3.4724}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-135777-APNIC", "org": "Shreenortheast Connect And Services Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Selective", "web": "https://www.neconnect.in"}, "pfx": 12, "reg": "2016-06-17", "rir": "apnic", "s24": 12, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "info@neconnect.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135817, "h": "ESTO-AS-AP", "n": "Esto Broadband", "t": "Broadband & mobile", "w": 7, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1937, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "dshield": {"n": 1, "p": 0.1922, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 3, "p": 0.5956, "hi": 7.20, "lo": 1.27, "ips": 3, "mean": 3.71, "above": false}, "blocklist_de": {"n": 2, "p": 0.4026, "hi": 6.11, "lo": 0.79, "ips": 3, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 10.024, 0.011, 1, false], ["2026-10-12", 18.161, 0.012, 1, false]], "sh": false, "uc": 1737.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 18.161, "se": 0.546, "ts": 0.429, "map": 37.479, "obs": 7, "own": 57.664, "comp": {"cins": 2.7892, "dshield": 0.7652, "crowdsec": 0.5263, "vulncheck": -0.8474, "blocklist_de": 1.7842}, "mass": 6.0, "listed": false}}, "abq": true, "bot": 0.232, "det": {"blocklist_de": {"bots": 2, "mail": 1}}, "oid": "ORG-EMPL2-AP-APNIC", "org": "ESTO MEDIA PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://esto.network"}, "pfx": 20, "reg": "2016-10-25", "rir": "apnic", "s24": 29, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00093499113237}, {"a": 135822, "h": "HOSRAJA-AS", "n": "Ovi Hosting Pvt Ltd", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 6640.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.999, "det": null, "oid": "@aut-135822-APNIC", "org": "Ovi Hosting Pvt Ltd", "pdb": null, "pfx": 5, "reg": "2016-10-25", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135834, "h": "MULTIFI-AS", "n": "Multicraft Digital Technologies", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1665.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 1.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.173, "det": null, "oid": "@aut-135834-APNIC", "org": "Multicraft Digital Technologies Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.multifi.in"}, "pfx": 19, "reg": "2016-10-25", "rir": "apnic", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "info@multicraft.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058181190492}, {"a": 135837, "h": "ARHANT-AS", "n": "Arihant Communications", "t": "Other", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 9179.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.169, "det": null, "oid": "@aut-135837-APNIC", "org": "Arihant Communications", "pdb": null, "pfx": 4, "reg": "2016-10-25", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuses@arihant-communications.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135849, "h": "CLICKNET-AS-IN", "n": "CCPL", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 6835.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 2.871, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.257, "det": null, "oid": "@aut-135849-APNIC", "org": "Clicknet Communication Pvt. Ltd.", "pdb": {"t": "Content", "sc": null, "tr": "100-200Gbps", "pol": "Open", "web": "https://www.clicknetcommunication.com"}, "pfx": 7, "reg": "2016-10-25", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@clicknetcommunication.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135851, "h": "PARTHIV-AS", "n": "Excogitate Technologies", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 3.796, 0.012, 0, false]], "sh": false, "uc": 3657.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.796, "se": 0.999, "ts": 0.500, "map": 18.227, "obs": 2, "own": 29.503, "comp": {"cins": -0.2615, "dshield": -0.5712, "crowdsec": 2.1224, "vulncheck": -0.4882, "blocklist_de": 3.4951}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.168, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-135851-APNIC", "org": "Excogitate Technologies Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://excogitatesoftware.com"}, "pfx": 11, "reg": "2016-10-25", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135852, "h": "GLXNET-AS", "n": "Galaxynet Connections", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 3, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 22.308, 0.011, 1, false], ["2026-10-12", 13.362, 0.012, 1, false]], "sh": false, "uc": 4248, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 13.362, "se": 0.809, "ts": 0.667, "map": 44.799, "obs": 3, "own": 70.280, "comp": {"cins": -0.4468, "dshield": -0.9073, "crowdsec": 0.3066, "vulncheck": -0.6332, "blocklist_de": 6.8765}, "mass": 2.0, "listed": false}}, "abq": true, "bot": 0.186, "det": {"blocklist_de": {"imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-135852-APNIC", "org": "Galaxynet Connections Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.galaxynet.in"}, "pfx": 8, "reg": "2016-10-25", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135863, "h": "CATLA-AS-IN", "n": "Catla IT and Engg.Co.Pvt.Ltd.", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 15039.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": true, "bot": 0.121, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-135863-APNIC", "org": "Catla IT and Engg.Co.Pvt.Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.catlabroadband.in"}, "pfx": 4, "reg": "2016-10-25", "rir": "apnic", "s24": 4, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135901, "h": "MAYCHUNHO-AS-VN", "n": "Phuong Dong technology solution company limited", "t": "Other", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4062, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 6.776, 0.011, 0, false], ["2026-10-12", 2.641, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.641, "se": 0.994, "ts": 0.500, "map": 12.283, "obs": 2, "own": 7.483, "comp": {"cins": -0.1952, "dshield": -0.4384, "crowdsec": 2.843, "vulncheck": 2.7057, "blocklist_de": -1.0132}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.624, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-135901-APNIC", "org": "Phuong Dong technology solution company limited", "pdb": null, "pfx": 12, "reg": "2016-11-15", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000428478015}, {"a": 135905, "h": "VNPT-AS-VN", "n": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP", "t": "Broadband & mobile", "w": 54, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 3, "web_exploit": 14, "bad_crawling": 5, "proxy_or_vpn": 5, "ssh_bruteforce": 25, "web_bruteforce": 16, "home_connection": 8, "mail_bruteforce": 9, "router_or_botnet": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2026-8181": 6, "cve:CVE-2024-28000": 6, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 2}, "n": 36}, "ev": {"cins": {"n": 4, "p": 0.6937, "hi": 7.49, "lo": 1.61, "ips": 4, "mean": 4.09, "above": false}, "shodan": {"n": 126, "p": 1.0000, "hi": 68.79, "lo": 51.35, "ips": 126, "mean": 59.80, "above": true}, "dshield": {"n": 2, "p": 0.2607, "hi": 4.90, "lo": 0.64, "ips": 2, "mean": 2.34, "above": false}, "urlhaus": {"n": 1, "p": 0.1784, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 28, "p": 1.0000, "hi": 16.01, "lo": 8.65, "ips": 36, "mean": 12.09, "above": true}, "threatfox": {"n": 2, "p": 0.3712, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "vulncheck": {"n": 5, "p": 0.8114, "hi": 8.24, "lo": 2.05, "ips": 7, "mean": 4.70, "above": true}, "phishing_db": {"n": 3, "p": 0.4794, "hi": 6.17, "lo": 1.09, "ips": 3, "mean": 3.18, "above": false}, "blocklist_de": {"n": 12, "p": 0.9988, "hi": 12.43, "lo": 4.92, "ips": 12, "mean": 8.31, "above": true}}, "h2": [["2026-10-05", 11.606, 2.195, 1, false], ["2026-10-12", 10.400, 2.273, 1, false]], "sh": false, "uc": 82.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 3}, "lo": 2.273, "se": 0.903, "ts": 0.500, "map": 6.185, "obs": 6, "own": 15.282, "comp": {"urlhaus": 1.3729, "threatfox": 0.8171, "phishing_db": 1.2583}, "mass": 4.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 2, "crowdsec": 28, "vulncheck": 5, "blocklist_de": 12}, "lo": 10.400, "se": 0.379, "ts": 0.549, "map": 16.016, "obs": 51, "own": 24.514, "comp": {"cins": 2.5673, "dshield": -2.0185, "crowdsec": 3.6095, "vulncheck": -0.3338, "blocklist_de": 0.3429}, "mass": 46.4, "listed": false}}, "abq": true, "bot": 0.841, "det": {"shodan": {"c2": 6, "malware": 1, "compromised": 119}, "threatfox": {"family:Cobalt Strike": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 4, "attack_tooling": 2}, "blocklist_de": {"ftp": 1, "ssh": 11}}, "oid": "@aut-135905-APNIC", "org": "VIETNAM POSTS AND TELECOMMUNICATIONS GROUP", "pdb": null, "pfx": 342, "reg": "2016-11-15", "rir": "apnic", "s24": 526, "sib": 0, "tor": 0, "w24": 44, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.9970]], "ipv4": 190720, "abuse": null, "score": 0.9970, "groups": ["sensors", "vulncheck", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00665983710868}, {"a": 135909, "h": "VNUHCM-AS-VN", "n": "Information Technology Park - Vietnam National University Ho Chi Minh City", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.948, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135909-APNIC", "org": "Information Technology Park - Vietnam National University Ho Chi Minh City", "pdb": null, "pfx": 5, "reg": "2016-11-15", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135918, "h": "DVS-AS-VN", "n": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY", "t": "Other", "w": 22, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 13, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 15}, "ev": {"shodan": {"n": 22, "p": 1.0000, "hi": 23.95, "lo": 11.98, "ips": 22, "mean": 17.53, "above": true}, "dshield": {"n": 1, "p": 0.1665, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 14, "p": 1.0000, "hi": 15.77, "lo": 6.66, "ips": 15, "mean": 10.81, "above": true}, "vulncheck": {"n": 2, "p": 0.3737, "hi": 5.85, "lo": 0.76, "ips": 3, "mean": 2.79, "above": false}, "blocklist_de": {"n": 7, "p": 0.9744, "hi": 11.37, "lo": 3.44, "ips": 8, "mean": 6.92, "above": true}}, "h2": [["2026-10-05", 18.436, 0.010, 1, false], ["2026-10-12", 15.337, 0.011, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.011, "se": 1.981, "ts": null, "map": 0.179, "obs": 0, "own": 0.492, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 14, "vulncheck": 2, "blocklist_de": 7}, "lo": 15.337, "se": 0.411, "ts": 0.583, "map": 25.348, "obs": 24, "own": 14.196, "comp": {"cins": -2.388, "dshield": -1.6254, "crowdsec": 5.1007, "vulncheck": -0.3805, "blocklist_de": 3.9195}, "mass": 20.4, "listed": false}}, "abq": true, "bot": 0.921, "det": {"shodan": {"compromised": 22}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ssh": 7, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-135918-APNIC", "org": "VIET DIGITAL TECHNOLOGY LIABILITY COMPANY", "pdb": null, "pfx": 70, "reg": "2016-11-15", "rir": "apnic", "s24": 146, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 37376, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00267600131582}, {"a": 135921, "h": "MAXSERVER-AS-VN", "n": "Maxserver Company Limited", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.507, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.676, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135921-APNIC", "org": "Maxserver Company Limited", "pdb": null, "pfx": 3, "reg": "2016-11-15", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012378696638}, {"a": 135922, "h": "CLEARSKY-AS-VN", "n": "Clearsky Service Solutions Company Limited", "t": "Other", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 2, "ssh_bruteforce": 2, "home_connection": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 22.308, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 22.308, "se": 0.824, "ts": 0.667, "map": 76.981, "obs": 3, "own": 44.196, "comp": {"cins": -0.3893, "dshield": -0.8083, "crowdsec": 4.8657, "vulncheck": -0.5963, "blocklist_de": 2.6655}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.930, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-135922-APNIC", "org": "Clearsky Service Solutions Company Limited", "pdb": null, "pfx": 5, "reg": "2016-11-15", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135932, "h": "VNDATA-AS-VN", "n": "Viet Storage Technology Joint Stock Company", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6228, "hi": 7.48, "lo": 1.32, "ips": 3, "mean": 3.86, "above": false}}, "h2": [["2026-10-05", 1.826, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.433, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.932, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-135932-APNIC", "org": "Viet Storage Technology Joint Stock Company", "pdb": null, "pfx": 16, "reg": "2016-11-15", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003186016372}, {"a": 135942, "h": "ADSOTA-AS-VN", "n": "Adsota Corporation", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.513, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.691, "det": {"shodan": {"c2": 1}}, "oid": "@aut-135942-APNIC", "org": "Adsota Corporation", "pdb": null, "pfx": 11, "reg": "2016-11-15", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002286544694}, {"a": 135944, "h": "VINACIS-AS-VN", "n": "VinhNam Commercial informatics service corporation", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6057, "hi": 7.30, "lo": 1.29, "ips": 3, "mean": 3.77, "above": false}, "crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.685, 0.459, 0, false], ["2026-10-12", 1.834, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.720, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.834, "se": 0.953, "ts": 0.500, "map": 8.031, "obs": 2, "own": 4.725, "comp": {"cins": -0.3009, "dshield": -0.6469, "crowdsec": 1.7128, "vulncheck": -0.5262, "blocklist_de": 3.2381}, "mass": 1.3, "listed": false}}, "abq": true, "bot": 0.971, "det": {"shodan": {"c2": 1, "compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-135944-APNIC", "org": "VinhNam Commercial informatics service corporation", "pdb": null, "pfx": 25, "reg": "2016-11-15", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002250672116}, {"a": 135951, "h": "WEBICO-AS-VN", "n": "Webico Company Limited", "t": "Other", "w": 4, "cc": "VN", "cf": null, "cs": {"c": {"data_centre": 2, "ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.8947, "hi": 9.86, "lo": 2.45, "ips": 5, "mean": 5.63, "above": true}, "crowdsec": {"n": 2, "p": 0.3701, "hi": 5.82, "lo": 0.76, "ips": 2, "mean": 2.77, "above": false}, "blocklist_de": {"n": 4, "p": 0.7982, "hi": 8.86, "lo": 1.91, "ips": 4, "mean": 4.84, "above": true}}, "h2": [["2026-10-05", 6.513, 0.011, 0, false], ["2026-10-12", 14.506, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 14.506, "se": 0.576, "ts": 0.667, "map": 31.787, "obs": 6, "own": 17.909, "comp": {"cins": -1.0456, "dshield": -1.7295, "crowdsec": -1.4206, "vulncheck": -0.8331, "blocklist_de": 9.8815}, "mass": 5.5, "listed": false}}, "abq": true, "bot": 0.792, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ftp": 1, "ssh": 3}}, "oid": "@aut-135951-APNIC", "org": "Webico Company Limited", "pdb": null, "pfx": 27, "reg": "2016-11-15", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 10496, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["blocklist_de"], "traffic": 0.00023485909678}, {"a": 135953, "h": "BKHOST-AS-VN", "n": "Vietnam Online Network Solution Joint Stock Compnay", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.806, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135953-APNIC", "org": "Vietnam Online Network Solution Joint Stock Compnay", "pdb": null, "pfx": 4, "reg": "2016-11-15", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000766610278}, {"a": 135967, "h": "BKNS-AS-VN", "n": "Bach Kim Network Solutions", "t": "Broadband & mobile", "w": 9, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2026-8181": 2, "cve:CVE-2024-28000": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 15, "p": 1.0000, "hi": 21.66, "lo": 9.41, "ips": 15, "mean": 15.01, "above": true}, "dshield": {"n": 2, "p": 0.4120, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "crowdsec": {"n": 5, "p": 0.8891, "hi": 9.71, "lo": 2.41, "ips": 5, "mean": 5.54, "above": true}, "phishing_db": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 17.750, 0.462, 1, false], ["2026-10-12", 22.189, 0.481, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.481, "se": 1.552, "ts": 1.000, "map": 5.001, "obs": 1, "own": 14.827, "comp": {"urlhaus": -0.1043, "threatfox": -0.1312, "phishing_db": 3.4712}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 22.189, "se": 0.503, "ts": 0.556, "map": 42.351, "obs": 9, "own": 65.012, "comp": {"cins": 2.4279, "dshield": 2.6868, "crowdsec": 3.7339, "vulncheck": -0.8724, "blocklist_de": -2.8365}, "mass": 7.3, "listed": false}}, "abq": true, "bot": 0.933, "det": {"shodan": {"compromised": 15}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-135967-APNIC", "org": "Bach Kim Network solutions Join stock company", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.bkns.vn"}, "pfx": 17, "reg": "2016-11-15", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7936, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00100235954616}, {"a": 135972, "h": "ICTQUANGNAM-AS-VN", "n": "Quang Nam Department of Information and Communications", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.525, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135972-APNIC", "org": "Quang Nam Department of Information and Communications", "pdb": null, "pfx": 3, "reg": "2016-11-15", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 135983, "h": "TINO-AS-VN", "n": "Tino Group Joint Stock Company", "t": "Hosting & VPS", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.464, 0.011, 0, false], ["2026-10-12", 3.796, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.796, "se": 0.999, "ts": 0.500, "map": 18.227, "obs": 2, "own": 3.760, "comp": {"cins": -0.2615, "dshield": -0.5712, "crowdsec": 2.1224, "vulncheck": -0.4882, "blocklist_de": 3.4951}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"sip": 1}}, "oid": "@aut-135983-APNIC", "org": "Tino Group Joint Stock Company", "pdb": {"t": "Network Services", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://tino.vn/"}, "pfx": 8, "reg": "2016-11-15", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012815810644}, {"a": 135986, "h": "ECOCLOUD-AS-VN", "n": "Turbo Technology Solution Joint Stock Company", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.974, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-135986-APNIC", "org": "Turbo Technology Solution Joint Stock Company", "pdb": null, "pfx": 3, "reg": "2016-11-15", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004159890434}, {"a": 135987, "h": "INDRA-RELOAD-AS-VN", "n": "Reload Company Limited", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8000, "hi": 8.89, "lo": 1.91, "ips": 4, "mean": 4.85, "above": true}}, "h2": [["2026-10-05", 0.471, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.959, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-135987-APNIC", "org": "Reload Company Limited", "pdb": null, "pfx": 5, "reg": "2016-11-15", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 3584, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00004327295798}, {"a": 135990, "h": "EVG-AS-VN", "n": "Everest Global Joint Stock Company", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6429, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.895, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-135990-APNIC", "org": "Everest Global Joint Stock Company", "pdb": null, "pfx": 3, "reg": "2016-11-15", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000129539865}, {"a": 136000, "h": "LIGHTNING-AS-AP", "n": "Lightning Broadband Pty Ltd", "t": "Broadband & mobile", "w": 2, "cc": "AU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2975, "hi": 5.20, "lo": 0.68, "ips": 2, "mean": 2.48, "above": false}, "blocklist_de": {"n": 1, "p": 0.1643, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 1.635, 0.011, 0, false], ["2026-10-12", 1.759, 0.012, 0, false]], "sh": false, "uc": 662.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 1.436, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.759, "se": 0.755, "ts": 0.667, "map": 5.324, "obs": 3, "own": 8.347, "comp": {"cins": -0.5154, "dshield": -1.0201, "crowdsec": 3.4116, "vulncheck": -0.6706, "blocklist_de": 1.8604}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.130, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-LBPL4-AP-APNIC", "org": "Lightning Broadband Pty Ltd", "pdb": null, "pfx": 33, "reg": "2016-11-15", "rir": "apnic", "s24": 79, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": "abuse@lightningbroadband.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001074965027}, {"a": 136023, "h": "PTE-AS-AP", "n": "PTE Group Co., Ltd", "t": "Other", "w": 1, "cc": "TH", "cf": null, "cs": {"c": {"first_seen_30d": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.666, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PGCL1-AP-APNIC", "org": "PTE Group Co., Ltd", "pdb": null, "pfx": 1, "reg": "2016-11-24", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@ptegroup.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003669332178}, {"a": 136038, "h": "HDTIDCCLOUD-AS-AP", "n": "HDTIDC LIMITED", "t": "Hosting & VPS", "w": 3, "cc": "HK", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6416, "hi": 7.69, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 0.011, 19.278, 1, false], ["2026-10-12", 0.011, 11.086, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 11.086, "se": 1.003, "ts": 1.000, "map": 40.243, "obs": 3, "own": 14.114, "comp": {"urlhaus": -0.4144, "threatfox": -0.3303, "phishing_db": 6.0658}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.736, "det": null, "oid": "ORG-HL1-AP-APNIC", "org": "HDTIDC LIMITED", "pdb": null, "pfx": 23, "reg": "2016-11-29", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136052, "h": "IDNIC-IDCLOUDHOST-AS-ID", "n": "IDCloudHost", "t": "Hosting & VPS", "w": 56, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 30, "web_exploit": 9, "bad_crawling": 6, "proxy_or_vpn": 4, "first_seen_30d": 1, "ssh_bruteforce": 32, "web_bruteforce": 11, "mail_bruteforce": 3, "cve:CVE-2017-9841": 4, "cve:CVE-2018-20062": 4, "cve:CVE-2019-11510": 1, "cve:CVE-2022-26134": 2, "cve:CVE-2024-28000": 2}, "n": 40}, "ev": {"shodan": {"n": 1, "p": 0.1299, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "crowdsec": {"n": 28, "p": 1.0000, "hi": 31.18, "lo": 16.85, "ips": 40, "mean": 23.55, "above": true}, "phishing_db": {"n": 4, "p": 0.7934, "hi": 8.78, "lo": 1.89, "ips": 4, "mean": 4.80, "above": true}, "blocklist_de": {"n": 18, "p": 1.0000, "hi": 24.42, "lo": 11.38, "ips": 19, "mean": 17.38, "above": true}}, "h2": [["2026-10-05", 51.676, 4.969, 1, false], ["2026-10-12", 59.456, 4.906, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 4.906, "se": 0.924, "ts": 1.000, "map": 14.522, "obs": 4, "own": 5.291, "comp": {"urlhaus": -0.69, "threatfox": -0.4149, "phishing_db": 5.4067}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 28, "vulncheck": 0, "blocklist_de": 18}, "lo": 59.456, "se": 0.374, "ts": 0.609, "map": 91.387, "obs": 46, "own": 17.746, "comp": {"cins": -3.1799, "dshield": -3.1661, "crowdsec": 4.5279, "vulncheck": -0.9896, "blocklist_de": 8.7165}, "mass": 43.6, "listed": false}}, "abq": false, "bot": 0.823, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 2, "ssh": 17}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://idcloudhost.com"}, "pfx": 116, "reg": "2016-12-05", "rir": "apnic", "s24": 87, "sib": 0, "tor": 5, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.8659], ["2026-10-12", 0.8453]], "ipv4": 37120, "abuse": "admin@idcloudhost.com", "score": 0.8453, "groups": ["sensors", "phishing"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0011252461528}, {"a": 136078, "h": "FOXLINE-AS-ID", "n": "Foxline Network AS136078", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 2.240, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.118, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-136078-APNIC", "org": "PT. FOXLINE MEDIADATA INDONUSA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://foxline.net.id"}, "pfx": 3, "reg": "2016-12-05", "rir": "apnic", "s24": 3, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@foxline.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136089, "h": "IDNIC-MMNET-AS-ID", "n": "IDNIC-MMNET-AS-ID", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": null, "org": null, "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://mmnet.id/"}, "pfx": 2, "reg": "2016-12-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004113282206}, {"a": 136093, "h": "FAZNET-AS-ID", "n": "Mitra Lintas Multimedia", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2017-9841": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5867, "hi": 7.11, "lo": 1.25, "ips": 3, "mean": 3.67, "above": false}}, "h2": [["2026-10-05", 3.217, 0.011, 0, false], ["2026-10-12", 3.388, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.388, "se": 0.769, "ts": 1.000, "map": 10.589, "obs": 3, "own": 16.577, "comp": {"cins": -0.4486, "dshield": -0.9104, "crowdsec": 8.0382, "vulncheck": -0.6343, "blocklist_de": -2.2914}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.105, "det": null, "oid": "@aut-136093-APNIC", "org": "PT Mitra Lintas Multimedia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://faznet.co.id"}, "pfx": 34, "reg": "2016-12-05", "rir": "apnic", "s24": 34, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "noc@faznet.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0064135231798}, {"a": 136101, "h": "IDNIC-BANDUNG-AS-ID", "n": "Pemerintah Kota Bandung", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.311, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136101-APNIC", "org": "Pemerintah Kota Bandung", "pdb": null, "pfx": 4, "reg": "2016-12-05", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@bandung.go.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136107, "h": "IDNIC-7ION-AS-ID", "n": "PT Tujuh Ion Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.906, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136107-APNIC", "org": "PT. Tujuh Ion Indonesia", "pdb": null, "pfx": 4, "reg": "2016-12-05", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@7ion.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136119, "h": "BALIFIBERNET-AS-ID", "n": "Bali Towerindo Sentra AS136119", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 3.269, 0.012, 0, false]], "sh": false, "uc": 1367.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.269, "se": 0.789, "ts": 0.333, "map": 10.406, "obs": 3, "own": 16.603, "comp": {"cins": -0.3701, "dshield": 3.33, "crowdsec": 1.0243, "vulncheck": 1.6516, "blocklist_de": -1.8998}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.134, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "@aut-136119-APNIC", "org": "PT Bali Towerindo Sentra, Tbk", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.balifiber.id"}, "pfx": 31, "reg": "2016-12-05", "rir": "apnic", "s24": 28, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@balitower.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0029004263222}, {"a": 136141, "h": "SKTRADERS-AS-AP", "n": "SK Traders", "t": "Broadband & mobile", "w": 6, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2021-44228": 1, "cve:CVE-2022-42889": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6222, "hi": 7.48, "lo": 1.32, "ips": 4, "mean": 3.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 16.408, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 16.408, "se": 0.636, "ts": 0.600, "map": 39.932, "obs": 5, "own": 62.135, "comp": {"cins": -0.66, "dshield": -1.2397, "crowdsec": 5.2965, "vulncheck": 0.7313, "blocklist_de": 0.9528}, "mass": 3.1, "listed": false}}, "abq": true, "bot": 0.192, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ST10-AP-APNIC", "org": "SK Traders", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://sktraderss.com/"}, "pfx": 14, "reg": "2016-12-08", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00292254229485}, {"a": 136160, "h": "M92HOSTLIMITED-AS-AP", "n": "92host Limited", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.754, "det": {"shodan": {"c2": 1, "compromised": 1}}, "oid": "ORG-LA76-AP-APNIC", "org": "92host Limited", "pdb": null, "pfx": 12, "reg": "2016-12-22", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "admin@boydj.xyz", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136170, "h": "EXBCOID-AS-AP", "n": "PT Exabytes Network Indonesia", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.9836, "hi": 12.38, "lo": 3.75, "ips": 7, "mean": 7.53, "above": true}, "phishing_db": {"n": 2, "p": 0.4137, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.331, 3.049, 0, false], ["2026-10-12", 0.011, 3.101, 0, false]], "sh": false, "uc": 956.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 3.101, "se": 1.174, "ts": 1.000, "map": 15.493, "obs": 2, "own": 15.151, "comp": {"urlhaus": -0.2847, "threatfox": -0.268, "phishing_db": 4.9193}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 0.339, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.721, "det": {"shodan": {"compromised": 7}}, "oid": "ORG-PENI1-AP-APNIC", "org": "PT. EXABYTES NETWORK INDONESIA", "pdb": null, "pfx": 14, "reg": "2017-01-04", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 8192, "abuse": "abuse@exabytes.co.id", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 136180, "h": "IPIP-CN", "n": "IPIP-CN", "t": "Broadband & mobile", "w": 6, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "ssh_bruteforce": 2, "home_connection": 4}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6383, "hi": 7.65, "lo": 1.35, "ips": 5, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 179.027, 0.011, 1, false], ["2026-10-12", 49.996, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 49.996, "se": 0.631, "ts": 0.600, "map": 121.010, "obs": 5, "own": 186.591, "comp": {"cins": 3.7018, "dshield": 2.0257, "crowdsec": 4.7579, "vulncheck": -0.7482, "blocklist_de": -3.5477}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 1.000, "det": {"blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 5, "reg": "2017-01-12", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "noc@ipip.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136188, "h": "CHINATELECOM-ZHEJIANG-NINGBO-IDC", "n": "China Telecom Ningbo IDC Network", "t": "Broadband & mobile", "w": 11, "cc": "CN", "cf": {"rb": "lo", "wb": null, "rep": 1.95, "waf": null}, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 4, "web_bruteforce": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"cins": {"n": 4, "p": 0.7167, "hi": 7.74, "lo": 1.67, "ips": 4, "mean": 4.23, "above": false}, "shodan": {"n": 26, "p": 1.0000, "hi": 18.78, "lo": 9.92, "ips": 26, "mean": 14.06, "above": true}, "crowdsec": {"n": 5, "p": 0.3783, "hi": 4.90, "lo": 1.22, "ips": 6, "mean": 2.80, "above": false}, "threatfox": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.1869, "hi": 4.31, "lo": 0.56, "ips": 2, "mean": 2.05, "above": false}}, "h2": [["2026-10-05", 1.127, 0.138, 0, false], ["2026-10-12", 2.793, 0.144, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.144, "se": 1.383, "ts": 1.000, "map": 0.972, "obs": 1, "own": 2.961, "comp": {"urlhaus": -0.2672, "threatfox": 2.349, "phishing_db": -0.4838}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.793, "se": 0.479, "ts": 0.455, "map": 5.153, "obs": 11, "own": 7.941, "comp": {"cins": 10.5797, "dshield": -2.4295, "crowdsec": -1.1694, "vulncheck": -0.9261, "blocklist_de": -3.0213}, "mass": 12.3, "listed": false}}, "abq": true, "bot": 0.810, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 24}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "@aut-136188-APNIC", "org": "NINGBO, ZHEJIANG Province, P.R.China.", "pdb": null, "pfx": 86, "reg": "2017-01-13", "rir": "apnic", "s24": 431, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 161280, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00309147814248}, {"a": 136190, "h": "CHINATELECOM-ZHEJIANG-JINHUA-IDC", "n": "China Telecom Zhejiang Jinhua IDC Network", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1234, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "shodan": {"n": 4, "p": 0.2651, "hi": 4.46, "lo": 0.96, "ips": 4, "mean": 2.44, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.064, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.892, "ts": null, "map": 0.153, "obs": 0, "own": 0.836, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.064, "se": 1.100, "ts": 1.000, "map": 0.371, "obs": 1, "own": 0.622, "comp": {"cins": 4.7145, "dshield": -0.5274, "crowdsec": -2.0833, "vulncheck": -0.4643, "blocklist_de": -1.2378}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.892, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-136190-APNIC", "org": "JINHUA, ZHEJIANG Province, P.R.China.", "pdb": null, "pfx": 202, "reg": "2017-01-13", "rir": "apnic", "s24": 492, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 130816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00071301381164}, {"a": 136191, "h": "CHINATELECOM-HUBEI-YICHANG-IDC", "n": "YICHANG, Hubei Province, P.R.China.", "t": "Broadband & mobile", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1421, "hi": 4.13, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.027, "ts": null, "map": 0.188, "obs": 0, "own": 1.484, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.852, "ts": null, "map": 0.174, "obs": 0, "own": 0.594, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.483, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136191-APNIC", "org": "YICHANG, Hubei Province, P.R.China.", "pdb": null, "pfx": 5, "reg": "2017-01-13", "rir": "apnic", "s24": 69, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006854353012}, {"a": 136195, "h": "CHINATELECOM-QINGDAO-CLOUDBASE", "n": "China Telecom Qingdao Huangdao IDC Network", "t": "Hosting & VPS", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1650, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "shodan": {"n": 2, "p": 0.2029, "hi": 4.44, "lo": 0.58, "ips": 2, "mean": 2.11, "above": false}, "crowdsec": {"n": 1, "p": 0.0580, "hi": 3.12, "lo": 0.23, "ips": 1, "mean": 1.31, "above": false}, "blocklist_de": {"n": 1, "p": 0.1228, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}}, "h2": [["2026-10-05", 0.386, 0.010, 0, false], ["2026-10-12", 0.879, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.961, "ts": null, "map": 0.174, "obs": 0, "own": 0.173, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.879, "se": 0.742, "ts": 0.333, "map": 2.568, "obs": 3, "own": 0.514, "comp": {"cins": 3.9247, "dshield": -1.156, "crowdsec": -1.0299, "vulncheck": -0.7103, "blocklist_de": 1.3083}, "mass": 2.8, "listed": false}}, "abq": true, "bot": 0.911, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-136195-APNIC", "org": "Qingdao, Shandong Province, P.R.China.", "pdb": null, "pfx": 46, "reg": "2017-01-13", "rir": "apnic", "s24": 196, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 86528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000820834664}, {"a": 136197, "h": "CHINATELECOM-HEBEI-XIONGAN", "n": "Xiong'an, Hebei Province, P.R.China.", "t": "Broadband & mobile", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.667, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-136197-APNIC", "org": "Xiong'an, Hebei Province, P.R.China.", "pdb": null, "pfx": 1, "reg": "2017-01-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136199, "h": "ChinaNet-Guangdong-Yuedong-MAN", "n": "China Telecom Guangdong Province Yuedong MAN Network", "t": "Broadband & mobile", "w": 7, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 4, "first_seen_30d": 3, "ssh_bruteforce": 5, "web_bruteforce": 3, "cve:CVE-2017-9841": 4, "cve:CVE-2019-9082": 4, "cve:CVE-2018-20062": 4}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.0300, "hi": 2.66, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}, "dshield": {"n": 1, "p": 0.0172, "hi": 2.37, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}, "crowdsec": {"n": 5, "p": 0.0004, "hi": 1.77, "lo": 0.44, "ips": 5, "mean": 1.01, "above": false}, "blocklist_de": {"n": 1, "p": 0.0013, "hi": 1.59, "lo": 0.12, "ips": 1, "mean": 0.67, "above": false}}, "h2": [["2026-10-05", 0.362, 0.007, 0, false], ["2026-10-12", 0.394, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.790, "ts": null, "map": 0.109, "obs": 0, "own": 0.512, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.394, "se": 0.518, "ts": 0.625, "map": 0.770, "obs": 8, "own": 1.195, "comp": {"cins": 2.2536, "dshield": 0.1642, "crowdsec": 2.8939, "vulncheck": -0.8827, "blocklist_de": -3.2973}, "mass": 8.0, "listed": false}}, "abq": true, "bot": 0.508, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-136199-APNIC", "org": "CHINANET Guangdong province Yuedong MAN network", "pdb": null, "pfx": 72, "reg": "2017-01-13", "rir": "apnic", "s24": 1859, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 476416, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00176097802998}, {"a": 136224, "h": "CITYONLINELTD-AS-AP", "n": "City Online Ltd", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 2.864, 0.012, 0, false]], "sh": false, "uc": 4956.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.864, "se": 0.980, "ts": 0.500, "map": 13.299, "obs": 2, "own": 21.464, "comp": {"cins": -0.2765, "dshield": -0.6004, "crowdsec": 1.9646, "vulncheck": -0.5033, "blocklist_de": 3.3969}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.187, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-COL1-AP-APNIC", "org": "City Online Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.cityonlinebd.net/"}, "pfx": 23, "reg": "2017-01-20", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@cityonline-bd.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00182063696247}, {"a": 136246, "h": "TOMATTOSTL-AS-AP", "n": "Tomattos Technologies Ltd.", "t": "Other", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 14.129, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-TTL4-AP-APNIC", "org": "Tomattos Technologies Ltd.", "pdb": null, "pfx": 8, "reg": "2017-01-30", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136248, "h": "FASTNETBD-AS-AP", "n": "Abdur Rahim Bishas t/a FAST NET BD", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 11523.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.154, "det": null, "oid": "ORG-FNB1-AP-APNIC", "org": "FAST NET BD", "pdb": null, "pfx": 3, "reg": "2017-02-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@fastnetbd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136255, "h": "TIMCL-AS-AP", "n": "Mytel", "t": "Transit & backbone", "w": 3, "cc": "MM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1261, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "dshield": {"n": 1, "p": 0.1778, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1125, "hi": 3.80, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "blocklist_de": {"n": 1, "p": 0.1587, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.167, 0.011, 0, false], ["2026-10-12", 1.532, 0.012, 0, false]], "sh": false, "uc": 415.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 1.960, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.532, "se": 0.752, "ts": 0.333, "map": 4.610, "obs": 3, "own": 14.682, "comp": {"cins": -0.5242, "dshield": 2.6912, "crowdsec": -0.3752, "vulncheck": -0.6749, "blocklist_de": 1.8051}, "mass": 2.4, "listed": false}}, "abq": true, "bot": 0.332, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://mytel.com.mm"}, "pfx": 120, "reg": "2017-02-08", "rir": "apnic", "s24": 93, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 63488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02893092671616}, {"a": 136258, "h": "ONEPROVIDER-AS", "n": "ONEPROVIDER", "t": "Enterprise, edu & gov", "w": 16, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-9206": 1}, "n": 7}, "ev": {"shodan": {"n": 10, "p": 0.9988, "hi": 14.25, "lo": 5.18, "ips": 10, "mean": 9.24, "above": true}, "urlhaus": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 7, "p": 0.9643, "hi": 10.63, "lo": 3.22, "ips": 7, "mean": 6.47, "above": true}, "threatfox": {"n": 1, "p": 0.1931, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 5, "p": 0.9013, "hi": 10.04, "lo": 2.50, "ips": 7, "mean": 5.73, "above": true}, "blocklist_de": {"n": 1, "p": 0.1603, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 8.315, 1.971, 0, false], ["2026-10-12", 8.478, 2.046, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 2.046, "se": 1.192, "ts": 0.500, "map": 10.234, "obs": 2, "own": 44.282, "comp": {"urlhaus": 3.3147, "threatfox": 1.3565, "phishing_db": -0.7193}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 5, "blocklist_de": 1}, "lo": 8.478, "se": 0.478, "ts": 0.538, "map": 15.362, "obs": 13, "own": 86.105, "comp": {"cins": -1.3302, "dshield": -2.0219, "crowdsec": 7.823, "vulncheck": 2.7076, "blocklist_de": -3.0528}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.810, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 7, "doublepulsar": 1}, "threatfox": {"family:AdaptixC2": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 3, "attack_tooling": 1, "other_infrastructure": 2}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Enterprise", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.oneprovider.com"}, "pfx": 89, "reg": "2017-02-09", "rir": "apnic", "s24": 89, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 22784, "abuse": "info@oneprovider.com", "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00422188896635}, {"a": 136267, "h": "INFO-INTERNET-AS-AP", "n": "Info Internet Service", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4980.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.225, "det": null, "oid": "ORG-IIS1-AP-APNIC", "org": "Info Internet Service", "pdb": null, "pfx": 4, "reg": "2017-02-14", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "infoedrish@gmail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136279, "h": "GLO1-AS-IN", "n": "Glo Internet Services", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 122.487, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 2}}, "oid": "@aut-136279-APNIC", "org": "Glo Internet Services Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.globroadband.com"}, "pfx": 2, "reg": "2017-02-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136284, "h": "PTPL-AS-IN", "n": "Paradise Telecom", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 2.519, 0.012, 0, false]], "sh": false, "uc": 2220.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.519, "se": 0.972, "ts": 0.500, "map": 11.501, "obs": 2, "own": 18.540, "comp": {"cins": -0.2835, "dshield": -0.6138, "crowdsec": 1.8919, "vulncheck": -0.51, "blocklist_de": 3.3514}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.117, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-136284-APNIC", "org": "Paradise Telecom Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": null}, "pfx": 19, "reg": "2017-02-16", "rir": "apnic", "s24": 19, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@paradisetele.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00102547414518}, {"a": 136286, "h": "RMCH-AS-IN", "n": "Cybercity Extreme Broadband", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": 3125, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 15.216, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.188, "det": null, "oid": "@aut-136286-APNIC", "org": "Cybercity Extreme Broadband Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://ccebroadband.com"}, "pfx": 7, "reg": "2017-02-16", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "info@ccebroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00054797136963}, {"a": 136287, "h": "FALCONET-AS-IN", "n": "Falconet Internet", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 4.032, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 4.650, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-136287-APNIC", "org": "Falconet Internet Pvt.ltd.", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://falconet.in"}, "pfx": 9, "reg": "2017-02-16", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041394723975}, {"a": 136290, "h": "COUNTRYONLINE-AS-IN", "n": "Country Online Services", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 3776, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.637, "det": null, "oid": "@aut-136290-APNIC", "org": "Country Online Services PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.countryonline.co.in/"}, "pfx": 8, "reg": "2017-02-16", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00136220698398}, {"a": 136297, "h": "VISIONHI-AS-IN", "n": "Vision Hi-speed Technology Pvt.ltd.", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.151, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136297-APNIC", "org": "Vision Hi-speed Technology Pvt.ltd.", "pdb": null, "pfx": 4, "reg": "2017-02-16", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136298, "h": "HYBERNET-AS-IN", "n": "Hyber Networking Private Limited", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 28125, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.166, "det": null, "oid": "@aut-136298-APNIC", "org": "Hyber Networking Private Limited", "pdb": null, "pfx": 2, "reg": "2017-02-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "info@hybernetwork.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136323, "h": "NGCBPL-AS", "n": "Ngc Broadband", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 4.815, 0.011, 0, false], ["2026-10-12", 5.283, 0.013, 0, false]], "sh": false, "uc": 7645.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.283, "se": 1.022, "ts": 0.500, "map": 26.583, "obs": 2, "own": 43.203, "comp": {"cins": -0.2437, "dshield": -0.5363, "crowdsec": 2.3118, "vulncheck": -0.4693, "blocklist_de": 3.6115}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.148, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-136323-APNIC", "org": "Ngc Broadband Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.ngcbroadband.com"}, "pfx": 7, "reg": "2017-02-16", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "support@ngcbroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136334, "h": "VNPL-AS", "n": "VORTEX NETSOL PRIVATE LIMITED", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1111, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "phishing_db": {"n": 1, "p": 0.1793, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 1.405, 0.297, 0, false], ["2026-10-12", 0.172, 0.312, 0, false]], "sh": false, "uc": 781.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.312, "se": 1.466, "ts": 1.000, "map": 2.661, "obs": 1, "own": 1.197, "comp": {"urlhaus": -0.1667, "threatfox": -0.1878, "phishing_db": 2.9594}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.172, "se": 1.208, "ts": 1.000, "map": 1.232, "obs": 1, "own": 0.271, "comp": {"cins": -0.1564, "dshield": -0.357, "crowdsec": 3.2853, "vulncheck": -0.3561, "blocklist_de": -0.8136}, "mass": 0.7, "listed": false}}, "abq": true, "bot": 0.113, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-136334-APNIC", "org": "Vortex Netsol Private Limited", "pdb": {"t": "Content", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.vortexnetsol.com"}, "pfx": 95, "reg": "2017-02-16", "rir": "apnic", "s24": 95, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00444214169913}, {"a": 136337, "h": "WSIPLTD-AS-IN", "n": "WEBBERSTOP INDIA PRIVATE LIMITED", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.846, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136337-APNIC", "org": "WEBBERSTOP INDIA PRIVATE LIMITED", "pdb": null, "pfx": 2, "reg": "2017-02-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@webberstop.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136372, "h": "SSIRINN-AS", "n": "Ss Fiber Net Optical Communication", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 16.974, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.240, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136372-APNIC", "org": "Ss Fiber Net Optical Communication Pvt. Ltd.", "pdb": {"t": "Network Services", "sc": null, "tr": "1-5Gbps", "pol": "Open", "web": "http://www.ssfibernet.com"}, "pfx": 6, "reg": "2017-02-16", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "admin@ssfibernet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136384, "h": "OPTIX-AS-AP", "n": "Optix Pakistan", "t": "Transit & backbone", "w": 2, "cc": "PK", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 13.86}, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1205, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}, "blocklist_de": {"n": 2, "p": 0.3668, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.757, 0.011, 0, false], ["2026-10-12", 1.842, 0.012, 0, false]], "sh": false, "uc": 605, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 2.023, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.842, "se": 0.757, "ts": 0.667, "map": 5.558, "obs": 3, "own": 17.706, "comp": {"cins": -0.5532, "dshield": -1.0797, "crowdsec": -0.6204, "vulncheck": -0.6887, "blocklist_de": 6.0508}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.849, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-OPL13-AP-APNIC", "org": "Optix Pakistan (Pvt.) Limited", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://optix.pk"}, "pfx": 82, "reg": "2017-02-18", "rir": "apnic", "s24": 82, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20992, "abuse": "noc@optix.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02542126109732}, {"a": 136400, "h": "ACG-AFG-AS-AP", "n": "Asia Consultancy Group", "t": "Broadband & mobile", "w": 0, "cc": "AF", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.221, "det": null, "oid": "ORG-ACG2-AP-APNIC", "org": "Asia Consultancy Group", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.acgtelasia.com/"}, "pfx": 4, "reg": "2017-02-23", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003122187192}, {"a": 136429, "h": "BASNETWORK-AS-AP", "n": "BAS Network", "t": "Broadband & mobile", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "proxy_or_vpn": 4, "web_bruteforce": 4, "router_or_botnet": 5}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4073, "hi": 6.15, "lo": 0.80, "ips": 5, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 3.849, 0.011, 0, false], ["2026-10-12", 4.129, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.129, "se": 1.003, "ts": 1.000, "map": 20.050, "obs": 2, "own": 32.420, "comp": {"cins": -0.2367, "dshield": -0.5224, "crowdsec": 6.8377, "vulncheck": -0.4615, "blocklist_de": -1.2252}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.163, "det": null, "oid": "ORG-BN1-AP-APNIC", "org": "BAS Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://basnetbd.com/"}, "pfx": 9, "reg": "2017-03-10", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00180427139929}, {"a": 136435, "h": "ELITE-BD", "n": "ELITE COMMUNICATION", "t": "Other", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": 5859.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 6.211, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.139, "det": null, "oid": "ORG-SN6-AP-APNIC", "org": "ELITE COMMUNICATION", "pdb": null, "pfx": 6, "reg": "2017-03-15", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136501, "h": "HKBNES-AS-AP", "n": "HKBN Enterprise Solutions HK Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.831, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WHL1-AP-APNIC", "org": "HKBN Enterprise Solutions HK Limited", "pdb": null, "pfx": 11, "reg": "2017-04-18", "rir": "apnic", "s24": 11, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": "abuse-wtt@hkbn.com.hk", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136523, "h": "COLODEE-AS-AP", "n": "COLODEE DIGITAL NETWORK", "t": "Hosting & VPS", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6286, "hi": 7.54, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.169, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.761, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-CDNC1-AP-APNIC", "org": "COLODEE DIGITAL NETWORK COMPANY LIMITED", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.colodee.com"}, "pfx": 14, "reg": "2017-04-28", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": "support@colodee.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016502401038}, {"a": 136525, "h": "WANCOMPVTLTD-AS-AP", "n": "Wancom (Pvt) Ltd.", "t": "Transit & backbone", "w": 14, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 4, "p": 0.7908, "hi": 8.74, "lo": 1.88, "ips": 5, "mean": 4.77, "above": false}, "crowdsec": {"n": 2, "p": 0.2851, "hi": 5.10, "lo": 0.66, "ips": 2, "mean": 2.43, "above": false}, "blocklist_de": {"n": 7, "p": 0.9808, "hi": 12.02, "lo": 3.64, "ips": 7, "mean": 7.31, "above": true}}, "h2": [["2026-10-05", 2.504, 0.296, 0, false], ["2026-10-12", 15.081, 0.012, 1, false]], "sh": false, "uc": 1043.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 1.988, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 7}, "lo": 15.081, "se": 0.456, "ts": 0.538, "map": 26.906, "obs": 13, "own": 83.719, "comp": {"cins": -1.8918, "dshield": 3.9894, "crowdsec": -6.4622, "vulncheck": -0.9313, "blocklist_de": 9.9819}, "mass": 13.1, "listed": false}}, "abq": false, "bot": 0.129, "det": {"blocklist_de": {"bots": 4, "imap": 1, "mail": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-WL4-AP-APNIC", "org": "Wancom (Pvt) Ltd.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.wancom.net.pk"}, "pfx": 88, "reg": "2017-05-02", "rir": "apnic", "s24": 88, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": "abuse@wancom.net.pk", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01084665141725}, {"a": 136555, "h": "BKONLINE-AS-AP", "n": "BK Online", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 4, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 4, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 9.067, 0.013, 0, false]], "sh": false, "uc": 22005.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.067, "se": 1.065, "ts": 1.000, "map": 49.793, "obs": 2, "own": 81.439, "comp": {"cins": -0.1977, "dshield": -0.4436, "crowdsec": 7.3833, "vulncheck": -0.4145, "blocklist_de": -1.026}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.279, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BO6-AP-APNIC", "org": "BK Online", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Selective", "web": "http://bkonlinebd.net/"}, "pfx": 3, "reg": "2017-05-10", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@dynamicanalojix.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00126624044285}, {"a": 136557, "h": "HOST-AS-AP", "n": "Host Universal", "t": "Hosting & VPS", "w": 22, "cc": "AU", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 4, "web_exploit": 15, "bad_crawling": 6, "proxy_or_vpn": 3, "ssh_bruteforce": 6, "web_bruteforce": 15, "mail_bruteforce": 4, "cve:CVE-2017-9841": 4, "cve:CVE-2021-3129": 7, "cve:CVE-2025-4396": 3, "cve:CVE-2021-41773": 3, "cve:CVE-2022-35914": 3}, "n": 16}, "ev": {"shodan": {"n": 3, "p": 0.5311, "hi": 6.60, "lo": 1.16, "ips": 3, "mean": 3.40, "above": false}, "dshield": {"n": 1, "p": 0.1802, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 11, "p": 0.9996, "hi": 14.95, "lo": 5.69, "ips": 16, "mean": 9.85, "above": true}, "threatfox": {"n": 2, "p": 0.4148, "hi": 6.22, "lo": 0.81, "ips": 3, "mean": 2.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.3668, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 8.778, 0.306, 0, false], ["2026-10-12", 14.225, 1.421, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.421, "se": 1.152, "ts": 1.000, "map": 6.475, "obs": 2, "own": 2.550, "comp": {"urlhaus": -0.3312, "threatfox": 4.38, "phishing_db": -0.5547}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 2}, "lo": 14.225, "se": 0.448, "ts": 0.786, "map": 24.729, "obs": 14, "own": 4.831, "comp": {"cins": -1.725, "dshield": -0.5618, "crowdsec": 10.1794, "vulncheck": -0.9183, "blocklist_de": -2.3726}, "mass": 11.2, "listed": false}}, "abq": false, "bot": 0.606, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:VShell": 1, "family:PureRAT": 2}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-HUPL1-AP-APNIC", "org": "Host Universal Pty Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.hostuniversal.com.au"}, "pfx": 81, "reg": "2017-05-10", "rir": "apnic", "s24": 82, "sib": 1, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20992, "abuse": "abuse@hostuniversal.com.au", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.01096786079141}, {"a": 136582, "h": "LHPL-AS-AP", "n": "LiftUp Hosting Pty Ltd", "t": "Hosting & VPS", "w": 0, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-LH4-AP-APNIC", "org": "LIFTUP HOSTING PTY LTD", "pdb": {"t": "Content", "sc": "Australia", "tr": "100-1000Mbps", "pol": "Open", "web": "https://liftuphosting.com.au"}, "pfx": 2, "reg": "2023-09-22", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "noc@liftuphosting.com.au", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000701227036}, {"a": 136642, "h": "AEROCAT-AS-IN", "n": "Aerocast Networks", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 4843.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.162, "det": null, "oid": "@aut-136642-APNIC", "org": "Aerocast Networks Private Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://aerocast.in/"}, "pfx": 5, "reg": "2017-06-07", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136664, "h": "DDTPL-AS", "n": "D D Telecom", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 5.886, 0.013, 0, false]], "sh": false, "uc": 4622.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.886, "se": 1.031, "ts": 0.500, "map": 30.211, "obs": 2, "own": 49.175, "comp": {"cins": -0.2377, "dshield": -0.5244, "crowdsec": 2.3761, "vulncheck": -0.4627, "blocklist_de": 3.6506}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.120, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-136664-APNIC", "org": "D D Telecom Pvt. Ltd", "pdb": null, "pfx": 9, "reg": "2017-06-07", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136716, "h": "APPLEBB-AS", "n": "APPLE BROADBAND SERVICES", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.463, 0.012, 0, false]], "sh": false, "uc": 1635.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.463, "se": 1.372, "ts": 1.000, "map": 4.513, "obs": 1, "own": 8.366, "comp": {"cins": -0.0978, "dshield": 4.6704, "crowdsec": -0.9073, "vulncheck": -0.2538, "blocklist_de": -0.5108}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.164, "det": {"blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-136716-APNIC", "org": "APPLE BROADBAND SERVICES PVT. LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.applefibernet.com"}, "pfx": 15, "reg": "2017-06-07", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00063349259061}, {"a": 136744, "h": "DPTL-AS-AP", "n": "DREAM POWER TECHNOLOGY LIMITED", "t": "Transit & backbone", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.241, 0.011, 0, false], ["2026-10-12", 0.256, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 2.281, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.256, "se": 1.264, "ts": 1.000, "map": 2.026, "obs": 1, "own": 7.243, "comp": {"cins": -0.1334, "dshield": -0.3075, "crowdsec": 3.5546, "vulncheck": -0.3191, "blocklist_de": -0.695}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-DPTL1-AP-APNIC", "org": "DREAM POWER TECHNOLOGY LIMITED", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://www.dpunicom.com/"}, "pfx": 54, "reg": "2019-06-28", "rir": "apnic", "s24": 49, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072053135411}, {"a": 136759, "h": "COSMOPOLITAN1-AS-AP", "n": "Cosmopolitan Communications", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 0.513, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 9.720, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.194, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CCL11-AP-APNIC", "org": "Cosmopolitan Communications Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://cosmocom.net"}, "pfx": 13, "reg": "2017-06-19", "rir": "apnic", "s24": 13, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030132265635}, {"a": 136764, "h": "FASTCDN-AS-AP", "n": "ZSL Amusement and Investment", "t": "Hosting & VPS", "w": 0, "cc": "KH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.483, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ZAAI1-AP-APNIC", "org": "ZSL Amusement and Investment Co. Ltd.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.fastcdn.tech"}, "pfx": 1, "reg": "2017-06-21", "rir": "apnic", "s24": 1, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136787, "h": "PACKETHUBSA-AS-AP", "n": "PacketHub S.A.", "t": "Other", "w": 9, "cc": "PA", "cf": {"rb": "hi", "wb": "hi", "rep": 1.06, "waf": 0.93}, "cs": null, "ev": {"dshield": {"n": 8, "p": 0.9580, "hi": 9.54, "lo": 3.10, "ips": 8, "mean": 5.95, "above": true}, "blocklist_de": {"n": 1, "p": 0.0166, "hi": 2.35, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 1.725, 0.008, 0, false], ["2026-10-12", 0.802, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.841, "ts": null, "map": 0.132, "obs": 0, "own": 0.267, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.802, "se": 0.500, "ts": 0.889, "map": 1.530, "obs": 9, "own": 0.866, "comp": {"cins": -1.3884, "dshield": 15.5667, "crowdsec": -8.0894, "vulncheck": -0.8846, "blocklist_de": -3.3852}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.518, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PS10-AP-APNIC", "org": "PacketHub S.A.", "pdb": null, "pfx": 950, "reg": "2017-06-28", "rir": "apnic", "s24": 950, "sib": 2, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 243200, "abuse": "abuse@packethub.tech", "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.068958}, {"a": 136826, "h": "IDNIC-ID", "n": "Indonesia Network Information Center", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 2.519, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.775, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.519, "se": 0.972, "ts": 0.500, "map": 11.501, "obs": 2, "own": 6.785, "comp": {"cins": -0.2835, "dshield": -0.6138, "crowdsec": 1.8919, "vulncheck": -0.51, "blocklist_de": 3.3514}, "mass": 1.3, "listed": false}}, "abq": true, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-136826-APNIC", "org": "Indonesia Network Information Center", "pdb": null, "pfx": 4, "reg": "2017-07-24", "rir": "apnic", "s24": 19, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136853, "h": "IDNIC-UMMGL-AS-ID", "n": "Universitas Muhammadiyah Magelang", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.299, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136853-APNIC", "org": "Universitas Muhammadiyah Magelang", "pdb": null, "pfx": 2, "reg": "2017-07-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136865, "h": "FISNET-AS-ID", "n": "FISNET", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4143, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 16.063, 0.011, 1, false], ["2026-10-12", 6.346, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.346, "se": 1.035, "ts": 1.000, "map": 32.708, "obs": 2, "own": 53.179, "comp": {"cins": -0.2156, "dshield": -0.48, "crowdsec": 7.1311, "vulncheck": -0.4369, "blocklist_de": -1.1174}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "No", "web": "http://www.fisnet.id"}, "pfx": 5, "reg": "2017-07-24", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0012443142866}, {"a": 136866, "h": "IDNIC-ISI-SKA-AS-ID", "n": "Institut Seni Indonesia Surakarta", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 4.322, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 10.754, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.179, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-136866-APNIC", "org": "Institut Seni Indonesia Surakarta", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://isi-ska.ac.id/"}, "pfx": 1, "reg": "2017-07-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 136873, "h": "MEGADATA-AS-ID", "n": "MEGADATA-ISP", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3918, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}}, "h2": [["2026-10-05", 9.339, 0.011, 0, false], ["2026-10-12", 2.465, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.465, "se": 0.969, "ts": 1.000, "map": 11.180, "obs": 2, "own": 17.986, "comp": {"cins": -0.2624, "dshield": -0.573, "crowdsec": 6.4881, "vulncheck": -0.4891, "blocklist_de": -1.3558}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-136873-APNIC", "org": "MEGADATA-ISP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.megadata.net.id"}, "pfx": 23, "reg": "2017-07-24", "rir": "apnic", "s24": 18, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0047496212412}, {"a": 136907, "h": "HWCLOUDS-AS-AP", "n": "Huawei Cloud Global", "t": "Hyperscale cloud", "w": 148, "cc": "SG", "cf": {"rb": "", "wb": "", "rep": 0.87, "waf": 2.32}, "cs": {"c": {"http_flood": 49, "data_centre": 116, "web_exploit": 92, "bad_crawling": 19, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 14, "web_bruteforce": 6, "home_connection": 1, "mail_bruteforce": 4, "cve:CVE-2017-9841": 12, "cve:CVE-2025-4396": 2, "cve:CVE-2018-20062": 13, "cve:CVE-2021-44228": 3, "cve:CVE-2022-39290": 4}, "n": 126}, "ev": {"cins": {"n": 6, "p": 0.2398, "hi": 4.10, "lo": 1.14, "ips": 6, "mean": 2.43, "above": false}, "shodan": {"n": 31, "p": 0.5040, "hi": 3.97, "lo": 2.21, "ips": 31, "mean": 3.04, "above": false}, "dshield": {"n": 2, "p": 0.0023, "hi": 1.85, "lo": 0.24, "ips": 2, "mean": 0.88, "above": false}, "crowdsec": {"n": 40, "p": 0.6297, "hi": 4.05, "lo": 2.41, "ips": 126, "mean": 3.19, "above": false}, "vulncheck": {"n": 9, "p": 0.4548, "hi": 4.70, "lo": 1.62, "ips": 10, "mean": 2.99, "above": false}, "phishing_db": {"n": 2, "p": 0.0040, "hi": 1.98, "lo": 0.26, "ips": 2, "mean": 0.94, "above": false}, "blocklist_de": {"n": 7, "p": 0.0044, "hi": 2.27, "lo": 0.69, "ips": 8, "mean": 1.38, "above": false}}, "h2": [["2026-10-05", 1.630, 0.132, 0, false], ["2026-10-12", 1.457, 0.090, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.090, "se": 1.160, "ts": 1.000, "map": 0.349, "obs": 2, "own": 0.317, "comp": {"urlhaus": -0.8106, "threatfox": -0.4401, "phishing_db": 1.8245}, "mass": 2.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 6, "dshield": 2, "crowdsec": 40, "vulncheck": 9, "blocklist_de": 7}, "lo": 1.457, "se": 0.381, "ts": 0.625, "map": 2.214, "obs": 64, "own": 0.911, "comp": {"cins": 4.3602, "dshield": -2.2279, "crowdsec": 7.1849, "vulncheck": 0.0172, "blocklist_de": -7.1457}, "mass": 54.7, "listed": false}}, "abq": true, "bot": 0.649, "det": {"shodan": {"c2": 3, "compromised": 27, "doublepulsar": 1}, "vulncheck": {"c2_server": 4, "botnet_node": 5, "attack_tooling": 1}, "blocklist_de": {"ssh": 1, "bots": 7}}, "oid": "ORG-HIPL2-AP-APNIC", "org": "HUAWEI INTERNATIONAL PTE. LTD.", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Tbps", "pol": "Selective", "web": "https://www.huaweicloud.com"}, "pfx": 560, "reg": "2017-08-07", "rir": "apnic", "s24": 4464, "sib": 4, "tor": 0, "w24": 57, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1160448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.092441}, {"a": 136958, "h": "UNICOM-GuangZhou-IDC", "n": "China Unicom Guangdong IDC Network", "t": "Broadband & mobile", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "cve:CVE-2024-6387": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1279, "hi": 3.98, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "shodan": {"n": 4, "p": 0.2955, "hi": 4.64, "lo": 1.00, "ips": 4, "mean": 2.53, "above": false}, "crowdsec": {"n": 2, "p": 0.0389, "hi": 2.85, "lo": 0.37, "ips": 2, "mean": 1.36, "above": false}, "blocklist_de": {"n": 2, "p": 0.1774, "hi": 4.23, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}}, "h2": [["2026-10-05", 0.815, 0.009, 0, false], ["2026-10-12", 0.904, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.898, "ts": null, "map": 0.155, "obs": 0, "own": 0.858, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.904, "se": 0.602, "ts": 0.400, "map": 2.050, "obs": 5, "own": 3.187, "comp": {"cins": 3.054, "dshield": -1.6825, "crowdsec": -1.1026, "vulncheck": -0.8251, "blocklist_de": 2.668}, "mass": 5.2, "listed": false}}, "abq": true, "bot": 0.702, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 394, "reg": "2017-09-04", "rir": "apnic", "s24": 456, "sib": 25, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 144384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00481028291484}, {"a": 136969, "h": "KKNETWROK-AS-AP", "n": "KK Networks Private Limited", "t": "Broadband & mobile", "w": 11, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 8, "bad_crawling": 6, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 6, "home_connection": 8, "mail_bruteforce": 4, "router_or_botnet": 7, "cve:CVE-2019-8318": 2, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 4, "cve:CVE-2024-28000": 1}, "n": 9}, "ev": {"dshield": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 5, "p": 0.8928, "hi": 9.81, "lo": 2.44, "ips": 9, "mean": 5.60, "above": true}, "blocklist_de": {"n": 2, "p": 0.4040, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 17.540, 0.011, 1, false], ["2026-10-12", 21.393, 0.012, 1, false]], "sh": false, "uc": 2285.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 1.809, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 21.393, "se": 0.521, "ts": 0.625, "map": 42.489, "obs": 8, "own": 65.241, "comp": {"cins": -1.1723, "dshield": 0.6462, "crowdsec": 5.0704, "vulncheck": -0.8549, "blocklist_de": 1.4536}, "mass": 6.3, "listed": false}}, "abq": true, "bot": 0.147, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-KNL1-AP-APNIC", "org": "KK Networks (Pvt) Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.kknetworks.com.pk"}, "pfx": 27, "reg": "2017-09-12", "rir": "apnic", "s24": 27, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00388574437306}, {"a": 136982, "h": "INS-AS-AP", "n": "Integranet Network Services", "t": "Broadband & mobile", "w": 0, "cc": "PH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.089, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-INS1-AP-APNIC", "org": "Integranet Network Services", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.integranet.ph/"}, "pfx": 1, "reg": "2017-09-20", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137035, "h": "PWCS-AS-AP", "n": "Parallel Web Cloud Services", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.830, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PWCS1-AP-APNIC", "org": "Parallel Web Cloud Services", "pdb": null, "pfx": 1, "reg": "2017-10-23", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@parallelweb.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137038, "h": "ZUBAIRITEXPERT-AS-AP", "n": "MD ZUBAIR ISLAM t/a ZUBAIR IT EXPERT", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 17187.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.442, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ZIE1-AP-APNIC", "org": "ZUBAIR IT EXPERT", "pdb": null, "pfx": 2, "reg": "2017-10-23", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137047, "h": "TATMPL-AS-AP", "n": "TELECOMMUNICATION AND TECHNOLOGY MASTERS", "t": "Broadband & mobile", "w": 21, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 1, "web_exploit": 11, "bad_crawling": 1, "proxy_or_vpn": 5, "ssh_bruteforce": 1, "web_bruteforce": 9, "router_or_botnet": 12, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 7}, "n": 12}, "ev": {"dshield": {"n": 1, "p": 0.1967, "hi": 4.72, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 12, "mean": 2.92, "above": false}, "vulncheck": {"n": 2, "p": 0.4197, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 3, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 7.884, 0.011, 0, false], ["2026-10-12", 36.396, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 2}, "lo": 36.396, "se": 0.570, "ts": 0.286, "map": 77.981, "obs": 7, "own": 120.756, "comp": {"cins": -0.8699, "dshield": 1.4922, "crowdsec": -0.0114, "vulncheck": 1.4837, "blocklist_de": 3.6556}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.116, "det": {"vulncheck": {"botnet_node": 2, "other_infrastructure": 1}, "blocklist_de": {"bots": 1, "imap": 2, "mail": 2}}, "oid": "ORG-TATM1-AP-APNIC", "org": "TELECOMMUNICATION AND TECHNOLOGY MASTERS (PVT.) LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.telcomaster.com"}, "pfx": 10, "reg": "2017-10-25", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@telcomaster.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00328045322286}, {"a": 137085, "h": "ANI89-AS-IN", "n": "Anonet Communications Private Limited", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1804, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 3, "p": 0.5891, "hi": 7.13, "lo": 1.26, "ips": 3, "mean": 3.68, "above": false}}, "h2": [["2026-10-12", 3.176, 0.012, 0, false]], "sh": false, "uc": 815, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 1.427, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.176, "se": 0.669, "ts": 0.750, "map": 8.185, "obs": 4, "own": 12.718, "comp": {"cins": -0.7618, "dshield": 1.837, "crowdsec": -5.4161, "vulncheck": -0.7659, "blocklist_de": 8.6027}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"bots": 1, "imap": 2, "mail": 2}}, "oid": "@aut-137085-APNIC", "org": "ANONET COMMUNICATIONS PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "https://anonet.in"}, "pfx": 68, "reg": "2017-11-17", "rir": "apnic", "s24": 81, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": "abuseinfo@anonet.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00291469032207}, {"a": 137109, "h": "GRACETEL-AS-IN", "n": "Grace Teleinfra", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1713, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.898, 0.011, 0, false], ["2026-10-12", 2.040, 0.012, 0, false]], "sh": false, "uc": 3109.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 1.835, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.040, "se": 0.959, "ts": 0.500, "map": 9.112, "obs": 2, "own": 14.664, "comp": {"cins": -0.2947, "dshield": -0.6352, "crowdsec": 1.7757, "vulncheck": -0.5206, "blocklist_de": 3.2781}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.138, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-137109-APNIC", "org": "Grace Teleinfra Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.graceteleinfra.com"}, "pfx": 25, "reg": "2017-11-17", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "Abuse@graceteleinfra.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081479311905}, {"a": 137125, "h": "NETSAT-AS", "n": "NETSAT", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0190, "hi": 2.41, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.155, "obs": 0, "own": 0.861, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.606, "ts": null, "map": 0.084, "obs": 0, "own": 0.192, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.163, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-137125-APNIC", "org": "Netsat Communications Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.netsat.in"}, "pfx": 134, "reg": "2017-11-17", "rir": "apnic", "s24": 452, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 115968, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137127, "h": "NAVKARS-AS", "n": "Navkar Supertech", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 1.566, 0.011, 0, false], ["2026-10-12", 1.689, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.689, "se": 0.948, "ts": 0.500, "map": 7.384, "obs": 2, "own": 11.867, "comp": {"cins": -0.3049, "dshield": -0.6546, "crowdsec": 1.671, "vulncheck": -0.5299, "blocklist_de": 3.2115}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-137127-APNIC", "org": "Navkar Supertech Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://nstplnet.com"}, "pfx": 32, "reg": "2017-11-17", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00170936516067}, {"a": 137135, "h": "AIRWAYG-AS", "n": "Pc Care Airway Infratel Network", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 4003.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 38.610, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.124, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-137135-APNIC", "org": "Pc Care Airway Infratel Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.airwaybroadband.com"}, "pfx": 10, "reg": "2017-11-17", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": "abuse@airwaybroadband.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137156, "h": "BLUEB-AS", "n": "Blueberry Web - Solutions Pvt Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": null, "det": null, "oid": "@aut-137156-APNIC", "org": "Blueberry Web - Solutions Pvt Ltd", "pdb": null, "pfx": 4, "reg": "2017-11-17", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137158, "h": "Anet-AS", "n": "A-net Communication India", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10937.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.160, "det": null, "oid": "@aut-137158-APNIC", "org": "A-net Communication India Pvt.ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.airnetcom.in"}, "pfx": 2, "reg": "2017-11-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137166, "h": "SATNECOM-AS", "n": "Satellite Netcom Private Limited", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3478, "hi": 5.62, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "blocklist_de": {"n": 4, "p": 0.7904, "hi": 8.73, "lo": 1.88, "ips": 4, "mean": 4.77, "above": false}}, "h2": [["2026-10-05", 2.648, 0.011, 0, false], ["2026-10-12", 10.283, 0.012, 1, false]], "sh": false, "uc": 460.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 1.634, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 10.283, "se": 0.574, "ts": 0.667, "map": 22.386, "obs": 6, "own": 34.493, "comp": {"cins": -1.0634, "dshield": -1.7492, "crowdsec": -1.5544, "vulncheck": -0.8364, "blocklist_de": 9.7056}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.121, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 2}}, "oid": "@aut-137166-APNIC", "org": "Satellite Netcom Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.satellitenetcom.in/"}, "pfx": 45, "reg": "2017-11-17", "rir": "apnic", "s24": 45, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": "noc@satellitenetcom.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00447503447643}, {"a": 137213, "h": "ROMANCE-AS-AP", "n": "Romance Cable Network", "t": "Broadband & mobile", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 5, "router_or_botnet": 1}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 43359.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.180, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-RCN3-AP-APNIC", "org": "Romance Cable Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.rcnbd.net"}, "pfx": 2, "reg": "2021-04-15", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "admin@rcnbd.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00129668341027}, {"a": 137263, "h": "NETEASE-AS-AP", "n": "NETEASE", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 1171.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 0.656, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.904, "ts": null, "map": 0.191, "obs": 0, "own": 0.269, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.645, "det": null, "oid": "ORG-NHKL1-AP-APNIC", "org": "NETEASE (HONG KONG) LIMITED", "pdb": {"t": null, "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.netease.com/"}, "pfx": 43, "reg": "2017-12-21", "rir": "apnic", "s24": 46, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": "noc@service.netease.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00335642352094}, {"a": 137266, "h": "CHINATELECOM-HUBEI-WUHAN-5G-NETWORK", "n": "CHINATELECOM Hubei province Wuhan 5G network", "t": "Broadband & mobile", "w": 26, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "first_seen_30d": 1, "ssh_bruteforce": 8, "web_bruteforce": 3, "mail_bruteforce": 3, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 4, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 11}, "ev": {"cins": {"n": 1, "p": 0.0009, "hi": 1.53, "lo": 0.11, "ips": 1, "mean": 0.65, "above": false}, "shodan": {"n": 4, "p": 0.0000, "hi": 0.79, "lo": 0.17, "ips": 4, "mean": 0.43, "above": false}, "dshield": {"n": 13, "p": 0.7779, "hi": 5.62, "lo": 2.30, "ips": 13, "mean": 3.81, "above": false}, "urlhaus": {"n": 1, "p": 0.0675, "hi": 3.25, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}, "crowdsec": {"n": 11, "p": 0.0000, "hi": 1.28, "lo": 0.49, "ips": 11, "mean": 0.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.0000, "hi": 1.00, "lo": 0.13, "ips": 2, "mean": 0.47, "above": false}}, "h2": [["2026-10-05", 0.375, 0.379, 0, false], ["2026-10-12", 0.545, 0.069, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.069, "se": 1.333, "ts": 1.000, "map": 0.421, "obs": 1, "own": 1.276, "comp": {"urlhaus": 2.1697, "threatfox": -0.4711, "phishing_db": -0.9387}, "mass": 3.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 13, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.545, "se": 0.411, "ts": 0.481, "map": 0.874, "obs": 27, "own": 1.350, "comp": {"cins": -0.3325, "dshield": 10.4546, "crowdsec": -0.1566, "vulncheck": -0.9682, "blocklist_de": -7.7378}, "mass": 24.1, "listed": false}}, "abq": true, "bot": 0.569, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 186, "reg": "2020-04-02", "rir": "apnic", "s24": 4965, "sib": 281, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1756928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0080711642758}, {"a": 137280, "h": "KSYUNGLOBAL-AS-AP", "n": "Kingsoft Cloud", "t": "Hosting & VPS", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 2}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1920, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 2, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 7.012, 0.011, 0, false], ["2026-10-12", 1.665, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.274, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.665, "se": 0.946, "ts": 0.500, "map": 7.263, "obs": 2, "own": 1.485, "comp": {"cins": -0.2827, "dshield": 3.728, "crowdsec": 1.8997, "vulncheck": -0.5093, "blocklist_de": -1.4591}, "mass": 1.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-KCCL1-AP-APNIC", "org": "Kingsoft cloud corporation limited", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.ksyun.com"}, "pfx": 19, "reg": "2018-01-02", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056876304459}, {"a": 137302, "h": "IDNIC-DISKOMINFOTIKPROVINSIRIAU-AS-ID", "n": "DINAS KOMUNIKASI INFORMATIKA DAN STATISTIK PROVINSI RIAU", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 4.322, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 10.754, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.194, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "@aut-137302-APNIC", "org": "DINAS KOMUNIKASI INFORMATIKA DAN STATISTIK PROVINSI RIAU", "pdb": {"t": "Government", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://riau.go.id"}, "pfx": 1, "reg": "2018-01-03", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137329, "h": "ALDM-ID", "n": "ARTHA LINTAS DATA MANDIRI", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5761.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.279, "det": null, "oid": "@aut-137329-APNIC", "org": "PT. ARTHA LINTAS DATA MANDIRI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://aldm.net.id"}, "pfx": 4, "reg": "2018-01-03", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@aldm.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007098202298}, {"a": 137331, "h": "IDNIC-CLOUDTEKNOLOGI-AS-ID", "n": "Cloud Teknologi Nusantara", "t": "Hosting & VPS", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2022-39290": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 3.150, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.150, "se": 0.985, "ts": 1.000, "map": 14.721, "obs": 2, "own": 3.025, "comp": {"cins": -0.2502, "dshield": -0.5492, "crowdsec": 6.6527, "vulncheck": -0.4764, "blocklist_de": -1.294}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.834, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-137331-APNIC", "org": "PT Cloud Teknologi Nusantara", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.ctn.co.id/"}, "pfx": 18, "reg": "2018-01-03", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": "abuse@ctn.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137352, "h": "IDNIC-CLOUDATA-AS-ID", "n": "Cloudata Indonesia", "t": "Hosting & VPS", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "home_connection": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 28.273, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 28.273, "se": 0.833, "ts": 0.667, "map": 99.320, "obs": 3, "own": 19.868, "comp": {"cins": -0.3778, "dshield": -0.7879, "crowdsec": 5.0062, "vulncheck": -0.5882, "blocklist_de": 2.7397}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.349, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-137352-APNIC", "org": "PT. Cloudata Indonesia", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.cloudata.co.id"}, "pfx": 4, "reg": "2018-01-03", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@cloudata.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137374, "h": "IDNIC-PROVBALI-AS-ID", "n": "Dinas Komunikasi, Informatika dan Statistik Provinsi Bali", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.192, "det": {"shodan": {"malware": 1}}, "oid": "@aut-137374-APNIC", "org": "Dinas Komunikasi, Informatika dan Statistik Provinsi Bali", "pdb": null, "pfx": 2, "reg": "2018-01-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@baliprov.go.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137378, "h": "PTPNET-AS-ID", "n": "Perdana Teknologi Persada", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 17109.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.319, "det": null, "oid": "@aut-137378-APNIC", "org": "PT. Perdana Teknologi Persada", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Restrictive", "web": "https://www.ptp.net.id"}, "pfx": 5, "reg": "2018-01-03", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@ptp.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137385, "h": "SADDAMHOSSAIN-AS-AP", "n": "Asian Network", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 3955.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": true, "bot": 0.259, "det": null, "oid": "ORG-AN3-AP-APNIC", "org": "Asian Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://asiannetworkbd.net/"}, "pfx": 10, "reg": "2018-01-04", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00112295755613}, {"a": 137409, "h": "GSLNETWORKS-AS-AP", "n": "Global Secure Layer", "t": "Hosting & VPS", "w": 1358, "cc": "AU", "cf": {"rb": "hi", "wb": "", "rep": 0.96, "waf": 1.59}, "cs": {"c": {"http_flood": 824, "data_centre": 2, "web_exploit": 1305, "bad_crawling": 926, "proxy_or_vpn": 234, "first_seen_30d": 1, "ssh_bruteforce": 79, "web_bruteforce": 1148, "mail_bruteforce": 94, "cve:CVE-2017-9841": 529, "cve:CVE-2021-41773": 263, "cve:CVE-2022-35914": 177, "cve:CVE-2022-46604": 407, "cve:CVE-2026-60137": 144}, "n": 1337}, "ev": {"cins": {"n": 1, "p": 0.1143, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "shodan": {"n": 1, "p": 0.0099, "hi": 2.14, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "dshield": {"n": 9, "p": 0.9929, "hi": 12.02, "lo": 4.15, "ips": 10, "mean": 7.65, "above": true}, "crowdsec": {"n": 52, "p": 1.0000, "hi": 26.08, "lo": 16.57, "ips": 1337, "mean": 21.10, "above": true}, "vulncheck": {"n": 2, "p": 0.2538, "hi": 4.85, "lo": 0.63, "ips": 2, "mean": 2.31, "above": false}, "blocklist_de": {"n": 11, "p": 0.9958, "hi": 11.31, "lo": 4.30, "ips": 13, "mean": 7.45, "above": true}}, "h2": [["2026-10-05", 12.091, 0.356, 1, false], ["2026-10-12", 12.603, 0.010, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.149, "obs": 0, "own": 0.123, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 9, "crowdsec": 52, "vulncheck": 2, "blocklist_de": 11}, "lo": 12.603, "se": 0.366, "ts": 0.693, "map": 19.269, "obs": 75, "own": 3.756, "comp": {"cins": -2.2636, "dshield": 0.8763, "crowdsec": 10.6707, "vulncheck": -0.7937, "blocklist_de": -4.1376}, "mass": 60.3, "listed": true}}, "abq": false, "bot": 0.576, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"bots": 3, "imap": 6, "mail": 7, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-GNPL1-AP-APNIC", "org": "GSL Networks Pty LTD", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Tbps", "pol": "Open", "web": "https://globalsecurelayer.com"}, "pfx": 573, "reg": "2018-01-16", "rir": "apnic", "s24": 569, "sib": 1, "tor": 0, "w24": 66, "drop": 8, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 161792, "abuse": "noc@gslnetworks.com.au", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.076458}, {"a": 137427, "h": "KIDC2-AS-AP", "n": "KIDC LIMITED", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.711, "det": null, "oid": "ORG-KL20-AP-APNIC", "org": "KIDC LIMITED", "pdb": null, "pfx": 3, "reg": "2022-04-20", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137443, "h": "CHANGLIAN-AS-AP", "n": "RuiShu Network", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": true, "bot": 0.890, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CNTC6-AP-APNIC", "org": "ChangLian Network Technology Co., Limited", "pdb": {"t": "Network Services", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.51idc.com"}, "pfx": 10, "reg": "2018-02-07", "rir": "apnic", "s24": 10, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137449, "h": "SKYNETCHOWMUHANI-AS-AP", "n": "SKYNET CHOWMUHANI", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.812, 0.013, 0, false]], "sh": false, "uc": 3320.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.812, "se": 1.514, "ts": 1.000, "map": 10.069, "obs": 1, "own": 20.674, "comp": {"cins": -0.0687, "dshield": -0.1629, "crowdsec": -0.6454, "vulncheck": -0.1914, "blocklist_de": 4.7715}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SC16-AP-APNIC", "org": "SKYNET CHOWMUHANI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.skynetchowmuhani.com/"}, "pfx": 5, "reg": "2018-02-08", "rir": "apnic", "s24": 5, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@skynetchowmuhani.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00214915038064}, {"a": 137453, "h": "ORANGE2-AS-AP", "n": "Orange Communication AS137453", "t": "Broadband & mobile", "w": 14, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 8, "bad_crawling": 1, "proxy_or_vpn": 5, "ssh_bruteforce": 2, "web_bruteforce": 11, "mail_bruteforce": 3, "router_or_botnet": 12, "cve:CVE-2011-3600": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 3}, "n": 12}, "ev": {"crowdsec": {"n": 5, "p": 0.8947, "hi": 9.86, "lo": 2.45, "ips": 12, "mean": 5.63, "above": true}, "vulncheck": {"n": 2, "p": 0.4144, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 14.332, 0.011, 1, false], ["2026-10-12", 13.896, 0.012, 1, false]], "sh": false, "uc": 6109.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 1.835, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 0}, "lo": 13.896, "se": 0.562, "ts": 0.714, "map": 29.195, "obs": 7, "own": 45.229, "comp": {"cins": -0.8245, "dshield": -1.464, "crowdsec": 9.5551, "vulncheck": 1.6156, "blocklist_de": -4.1146}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.209, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-OC4-AP-APNIC", "org": "Orange Communication", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://orangecommunication.org/"}, "pfx": 25, "reg": "2018-02-09", "rir": "apnic", "s24": 25, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": "admin@orangebd.online", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00360759408998}, {"a": 137526, "h": "PLUSNETINC-AS-AP", "n": "Plusnet Inc", "t": "Broadband & mobile", "w": 10, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 5, "web_bruteforce": 8, "mail_bruteforce": 3, "router_or_botnet": 6}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.1969, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6258, "hi": 7.51, "lo": 1.32, "ips": 9, "mean": 3.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 14.519, 0.011, 1, false], ["2026-10-12", 23.842, 0.012, 1, false]], "sh": false, "uc": 3873.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 23.842, "se": 0.626, "ts": 0.600, "map": 57.088, "obs": 5, "own": 88.175, "comp": {"cins": 3.5347, "dshield": -1.4094, "crowdsec": 3.8902, "vulncheck": -0.772, "blocklist_de": 0.1948}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.186, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PI8-AP-APNIC", "org": "Plusnet inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.plus.net.bd/"}, "pfx": 12, "reg": "2018-03-20", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@plus.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00388022392389}, {"a": 137535, "h": "JTIP-AS-AP", "n": "JT TELECOM - AS137535", "t": "Broadband & mobile", "w": 3, "cc": "SG", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3126, "hi": 5.33, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}, "crowdsec": {"n": 1, "p": 0.1183, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "threatfox": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 2.175, 0.301, 0, false], ["2026-10-12", 0.184, 0.313, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.313, "se": 1.469, "ts": 1.000, "map": 2.670, "obs": 1, "own": 7.841, "comp": {"urlhaus": -0.1504, "threatfox": 3.0787, "phishing_db": -0.3198}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.184, "se": 1.217, "ts": 1.000, "map": 1.341, "obs": 1, "own": 2.318, "comp": {"cins": -0.1524, "dshield": -0.3486, "crowdsec": 3.3311, "vulncheck": -0.35, "blocklist_de": -0.7933}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.748, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 1}}, "oid": "ORG-AA226-AP-APNIC", "org": "JT TELECOM INTERNATIONAL PTE.LTD.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.jtti.cc"}, "pfx": 117, "reg": "2022-08-05", "rir": "apnic", "s24": 85, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 43264, "abuse": "support@jtti.cc", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00078256062794}, {"a": 137633, "h": "GIGALINE-AS", "n": "Gigaline Teleservices", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 11284.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.345, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-137633-APNIC", "org": "Gigaline Teleservices Opc Private Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.gigalinetele.com"}, "pfx": 7, "reg": "2018-04-12", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "support@gigalinetele.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137643, "h": "MANAGESERVER-AS-IN", "n": "MANAGE SERVER", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8109, "hi": 9.08, "lo": 1.95, "ips": 4, "mean": 4.96, "above": true}}, "h2": [["2026-10-05", 0.708, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"compromised": 4}, "vulncheck": {"botnet_node": 1}}, "oid": "@aut-137643-APNIC", "org": "MANAGE SERVER", "pdb": null, "pfx": 4, "reg": "2018-04-12", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": "info@manageserver.in", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 137645, "h": "MSPL-AS", "n": "Macro Signal Pvt Ltd", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 3, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 3, "mean": 2.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 8.178, 0.011, 0, false], ["2026-10-12", 16.214, 0.012, 1, false]], "sh": false, "uc": 13834.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 16.214, "se": 0.691, "ts": 0.500, "map": 43.908, "obs": 4, "own": 68.108, "comp": {"cins": -0.6274, "dshield": -1.1921, "crowdsec": 2.234, "vulncheck": -0.72, "blocklist_de": 5.4814}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.134, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-137645-APNIC", "org": "Macro Signal Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.macrosignal.net"}, "pfx": 12, "reg": "2018-04-12", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@macrosignal.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068745904557}, {"a": 137668, "h": "SIOPCPL-AS", "n": "Sanavi Infotech Opc Pvt. Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8398.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.409, "det": null, "oid": "@aut-137668-APNIC", "org": "Sanavi Infotech Opc Pvt. Ltd", "pdb": null, "pfx": 4, "reg": "2018-04-12", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137669, "h": "ASGTELE-AS", "n": "Asg Telecom", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": 24023.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 38.309, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.120, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-137669-APNIC", "org": "Asg Telecom Pvt Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://asgtelecom.in"}, "pfx": 2, "reg": "2018-04-12", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@asgtelecom.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137681, "h": "ALIENDNS-AS", "n": "Alien Dns Pvt Ltd", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 3385.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.144, "det": null, "oid": "@aut-137681-APNIC", "org": "Alien Dns Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.alienfiber.net"}, "pfx": 6, "reg": "2018-04-12", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "noc@alienbroadband.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137695, "h": "CHINATELECOM-XINJIANG-WULUMUQI-MAN", "n": "CHINATELECOM Xinjiang Wulumuqi MAN network", "t": "Broadband & mobile", "w": 8, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 7, "cve:CVE-2024-6387": 6}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.0550, "hi": 3.08, "lo": 0.23, "ips": 1, "mean": 1.30, "above": false}, "crowdsec": {"n": 7, "p": 0.8640, "hi": 7.85, "lo": 2.38, "ips": 7, "mean": 4.78, "above": true}, "blocklist_de": {"n": 3, "p": 0.4701, "hi": 6.09, "lo": 1.07, "ips": 3, "mean": 3.14, "above": false}}, "h2": [["2026-10-05", 2.631, 0.010, 0, false], ["2026-10-12", 3.445, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.037, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.445, "se": 0.488, "ts": 0.700, "map": 6.469, "obs": 10, "own": 9.965, "comp": {"cins": -1.5082, "dshield": -2.1818, "crowdsec": 5.5876, "vulncheck": -0.898, "blocklist_de": 2.2611}, "mass": 9.1, "listed": false}}, "abq": true, "bot": 0.765, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 3}}, "oid": "@aut-137695-APNIC", "org": "CHINATELECOM Xinjiang Wulumuqi MAN network", "pdb": null, "pfx": 64, "reg": "2018-04-12", "rir": "apnic", "s24": 254, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 83712, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00004322806852}, {"a": 137697, "h": "CHINATELECOM-JiangSu-YangZhou-IDC", "n": "China Telecom Yangzhou IDC Network", "t": "Broadband & mobile", "w": 7, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 4, "cve:CVE-2024-6387": 3}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1468, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "shodan": {"n": 1, "p": 0.0396, "hi": 2.83, "lo": 0.21, "ips": 1, "mean": 1.19, "above": false}, "dshield": {"n": 1, "p": 0.1347, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "crowdsec": {"n": 5, "p": 0.5256, "hi": 5.71, "lo": 1.42, "ips": 5, "mean": 3.26, "above": false}, "blocklist_de": {"n": 2, "p": 0.2358, "hi": 4.70, "lo": 0.61, "ips": 2, "mean": 2.24, "above": false}}, "h2": [["2026-10-05", 2.453, 0.010, 0, false], ["2026-10-12", 2.541, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.926, "ts": null, "map": 0.164, "obs": 0, "own": 0.968, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.541, "se": 0.503, "ts": 0.556, "map": 4.865, "obs": 9, "own": 7.507, "comp": {"cins": 2.1031, "dshield": 0.0101, "crowdsec": 2.1996, "vulncheck": -0.8909, "blocklist_de": -0.4464}, "mass": 8.5, "listed": false}}, "abq": true, "bot": 0.562, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-137697-APNIC", "org": "CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhou , Jiangsu Province, P.R.China.", "pdb": null, "pfx": 201, "reg": "2018-04-12", "rir": "apnic", "s24": 316, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 86272, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006899422205}, {"a": 137699, "h": "CHINATELECOM-Jiangsu-Suqian-IDC", "n": "CHINATELECOM Jiangsu Suqian IDC network", "t": "Broadband & mobile", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 6, "p": 0.9405, "hi": 10.38, "lo": 2.88, "ips": 6, "mean": 6.13, "above": true}, "crowdsec": {"n": 1, "p": 0.1331, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "threatfox": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1696, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.902, 1.627, 0, false], ["2026-10-12", 0.962, 0.347, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.347, "se": 1.487, "ts": 1.000, "map": 3.098, "obs": 1, "own": 9.097, "comp": {"urlhaus": -0.1361, "threatfox": 3.1887, "phishing_db": -0.2957}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.962, "se": 0.919, "ts": 0.500, "map": 3.969, "obs": 2, "own": 6.357, "comp": {"cins": -0.3356, "dshield": -0.7116, "crowdsec": 1.3627, "vulncheck": -0.556, "blocklist_de": 3.0126}, "mass": 1.5, "listed": false}}, "abq": true, "bot": 0.930, "det": {"shodan": {"c2": 1, "compromised": 5}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-137699-APNIC", "org": "CHINATELECOM Jiangsu Suqian IDC network", "pdb": null, "pfx": 3, "reg": "2018-04-12", "rir": "apnic", "s24": 66, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 16896, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00000836177368}, {"a": 137702, "h": "CHINATELECOM-JIANGSU-NANJING-IDC", "n": "China Telecom Nanjing IDC Network", "t": "Broadband & mobile", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "router_or_botnet": 1, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.1194, "hi": 3.73, "lo": 0.48, "ips": 2, "mean": 1.78, "above": false}, "crowdsec": {"n": 3, "p": 0.1942, "hi": 4.18, "lo": 0.74, "ips": 3, "mean": 2.16, "above": false}, "blocklist_de": {"n": 2, "p": 0.2330, "hi": 4.68, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 1.047, 0.010, 0, false], ["2026-10-12", 1.152, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.925, "ts": null, "map": 0.164, "obs": 0, "own": 0.962, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.152, "se": 0.603, "ts": 0.600, "map": 2.611, "obs": 5, "own": 4.055, "comp": {"cins": -0.9238, "dshield": -1.5879, "crowdsec": 2.4156, "vulncheck": -0.808, "blocklist_de": 3.2574}, "mass": 4.7, "listed": false}}, "abq": true, "bot": 0.993, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 72, "reg": "2018-04-13", "rir": "apnic", "s24": 322, "sib": 281, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 89344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00249583601644}, {"a": 137703, "h": "NBN-AS-AP", "n": "Noakhali Broadband Network", "t": "Broadband & mobile", "w": 2, "cc": "BD", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 17.753, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.200, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-NBN1-AP-APNIC", "org": "Noakhali Broadband Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.noakhalibroadband.net/"}, "pfx": 4, "reg": "2018-04-13", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "support@noakhalibroadband.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034676061459}, {"a": 137718, "h": "VOLCANO-ENGINE", "n": "VOLCANO-ENGINE", "t": "Hosting & VPS", "w": 235, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 12, "bad_crawling": 2, "first_seen_30d": 15, "ssh_bruteforce": 205, "web_bruteforce": 11, "mail_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2017-9841": 10, "cve:CVE-2019-9082": 9, "cve:CVE-2024-6387": 141, "cve:CVE-2018-20062": 9, "cve:CVE-2020-10987": 1}, "n": 207}, "ev": {"cins": {"n": 5, "p": 0.6429, "hi": 6.51, "lo": 1.62, "ips": 5, "mean": 3.71, "above": false}, "shodan": {"n": 307, "p": 1.0000, "hi": 82.04, "lo": 68.01, "ips": 307, "mean": 74.89, "above": true}, "urlhaus": {"n": 2, "p": 0.3389, "hi": 5.55, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}, "crowdsec": {"n": 155, "p": 1.0000, "hi": 36.35, "lo": 27.92, "ips": 207, "mean": 32.02, "above": true}, "threatfox": {"n": 7, "p": 0.9661, "hi": 10.75, "lo": 3.25, "ips": 7, "mean": 6.54, "above": true}, "blocklist_de": {"n": 104, "p": 1.0000, "hi": 47.79, "lo": 34.64, "ips": 125, "mean": 41.00, "above": true}}, "h2": [["2026-10-05", 18.402, 1.878, 2, false], ["2026-10-12", 23.172, 1.647, 2, false]], "sh": false, "uc": 58.5, "v2": {"band": 2, "host": {"n": {"urlhaus": 2, "threatfox": 7, "phishing_db": 0}, "lo": 1.647, "se": 0.880, "ts": 0.778, "map": 4.236, "obs": 9, "own": 1.636, "comp": {"urlhaus": 2.1032, "threatfox": 2.0791, "phishing_db": -1.1124}, "mass": 8.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 0, "crowdsec": 155, "vulncheck": 0, "blocklist_de": 104}, "lo": 23.172, "se": 0.349, "ts": 0.587, "map": 33.818, "obs": 264, "own": 6.582, "comp": {"cins": -2.5872, "dshield": -3.5122, "crowdsec": 3.0301, "vulncheck": -1.0122, "blocklist_de": 8.9961}, "mass": 270.8, "listed": true}}, "abq": true, "bot": 0.906, "det": {"shodan": {"c2": 2, "malware": 1, "compromised": 304}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 6}, "blocklist_de": {"ftp": 1, "ssh": 120, "imap": 2, "mail": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "@aut-137718-APNIC", "org": "Beijing Volcano Engine Technology Co., Ltd.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.volcengine.com/"}, "pfx": 216, "reg": "2018-04-24", "rir": "apnic", "s24": 1457, "sib": 0, "tor": 0, "w24": 172, "drop": 2, "hist": [["2026-10-05", 0.9972], ["2026-10-12", 0.9977]], "ipv4": 472064, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0015777094307}, {"a": 137872, "h": "PEOPLESPHONE-HK", "n": "China Mobile Hong Kong AS137872", "t": "Broadband & mobile", "w": 7, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0060, "hi": 1.97, "lo": 0.15, "ips": 1, "mean": 0.83, "above": false}, "dshield": {"n": 5, "p": 0.7749, "hi": 7.76, "lo": 1.93, "ips": 5, "mean": 4.43, "above": false}, "vulncheck": {"n": 2, "p": 0.2329, "hi": 4.68, "lo": 0.61, "ips": 2, "mean": 2.23, "above": false}}, "h2": [["2026-10-05", 0.276, 0.009, 0, false], ["2026-10-12", 0.650, 0.010, 0, false]], "sh": false, "uc": 104.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.870, "ts": null, "map": 0.144, "obs": 0, "own": 0.756, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.650, "se": 0.554, "ts": 0.714, "map": 1.350, "obs": 7, "own": 2.104, "comp": {"cins": -0.9646, "dshield": 12.5946, "crowdsec": -6.4019, "vulncheck": 1.2387, "blocklist_de": -4.7733}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.259, "det": {"shodan": {"compromised": 1}, "vulncheck": {"attack_tooling": 2}}, "oid": "ORG-CMHK1-AP-APNIC", "org": "China Mobile Hong Kong Company Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.hk.chinamobile.com"}, "pfx": 141, "reg": "2018-05-25", "rir": "apnic", "s24": 658, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 266496, "abuse": "abusehandler@hk.chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00487203254628}, {"a": 137899, "h": "ILAYERLIMITED-AS-AP", "n": "I LAYER LIMITED", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6415, "hi": 7.69, "lo": 1.35, "ips": 3, "mean": 3.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"shodan": {"c2": 1, "compromised": 2}}, "oid": "ORG-ILL2-AP-APNIC", "org": "I LAYER LIMITED", "pdb": null, "pfx": 2, "reg": "2018-06-07", "rir": "apnic", "s24": 4, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@tgtserver.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137910, "h": "WAVECOMM-AS-AP", "n": "Wavecomm", "t": "Broadband & mobile", "w": 1, "cc": "PK", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.534, 0.012, 0, false]], "sh": false, "uc": 2148.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 10.308, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.129, "det": null, "oid": "ORG-WL23-AP-APNIC", "org": "Wavecomm (Private) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.wavecomm.com.pk/"}, "pfx": 12, "reg": "2025-02-14", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@wavecomm.com.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042456645286}, {"a": 137951, "h": "ASLINE-AS-AP", "n": "ASLINE LIMITED", "t": "Other", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1381, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "crowdsec": {"n": 3, "p": 0.1500, "hi": 3.87, "lo": 0.68, "ips": 3, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1303, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "blocklist_de": {"n": 1, "p": 0.0770, "hi": 3.38, "lo": 0.25, "ips": 1, "mean": 1.42, "above": false}}, "h2": [["2026-10-05", 0.927, 0.155, 0, false], ["2026-10-12", 0.995, 0.162, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.162, "se": 1.389, "ts": 1.000, "map": 1.129, "obs": 1, "own": 1.361, "comp": {"urlhaus": -0.2717, "threatfox": -0.2604, "phishing_db": 2.2796}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.995, "se": 0.603, "ts": 0.600, "map": 2.281, "obs": 5, "own": 1.298, "comp": {"cins": 3.1877, "dshield": -1.6105, "crowdsec": 2.2293, "vulncheck": -0.8122, "blocklist_de": -0.7758}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.977, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-AL25-AP-APNIC", "org": "ASLINE LIMITED", "pdb": null, "pfx": 208, "reg": "2018-07-05", "rir": "apnic", "s24": 378, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 203264, "abuse": "abuse@asline.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137959, "h": "VTL-AS-AP", "n": "VTL Network", "t": "Broadband & mobile", "w": 12, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 6, "proxy_or_vpn": 1, "web_bruteforce": 4, "router_or_botnet": 1, "cve:CVE-2025-4396": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 3}, "n": 7}, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 7, "mean": 1.97, "above": false}, "vulncheck": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 12.029, 0.011, 1, false], ["2026-10-12", 18.529, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 18.529, "se": 0.722, "ts": 0.500, "map": 51.798, "obs": 4, "own": 82.390, "comp": {"cins": -0.3926, "dshield": 3.2318, "crowdsec": 0.8089, "vulncheck": 3.7054, "blocklist_de": -2.0125}, "mass": 1.8, "listed": false}}, "abq": true, "bot": 0.185, "det": {"vulncheck": {"botnet_node": 4}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.visiontechnologiesltd.com/"}, "pfx": 6, "reg": "2018-07-10", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00233900949756}, {"a": 137967, "h": "DIGICON-ISP-AS", "n": "Stardust Telecom", "t": "Broadband & mobile", "w": 8, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 5, "proxy_or_vpn": 3, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 1, "router_or_botnet": 4, "cve:CVE-2024-6387": 1}, "n": 6}, "ev": {"crowdsec": {"n": 5, "p": 0.8707, "hi": 9.28, "lo": 2.31, "ips": 6, "mean": 5.30, "above": true}, "blocklist_de": {"n": 2, "p": 0.3882, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 7.607, 0.011, 0, false], ["2026-10-12", 10.059, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 1.597, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 2}, "lo": 10.059, "se": 0.543, "ts": 0.714, "map": 20.757, "obs": 7, "own": 31.964, "comp": {"cins": -1.0877, "dshield": -1.776, "crowdsec": 6.0699, "vulncheck": -0.8408, "blocklist_de": 2.0612}, "mass": 5.8, "listed": false}}, "abq": true, "bot": 0.188, "det": {"blocklist_de": {"bots": 1, "apache": 1}}, "oid": "ORG-DTL2-AP-APNIC", "org": "Digicon Telecommunication Ltd", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.mimebd.com"}, "pfx": 58, "reg": "2018-07-11", "rir": "apnic", "s24": 50, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17920, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00840353666012}, {"a": 137972, "h": "KGISPL-AS-AP", "n": "K G Information Systems Pvt Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.251, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KGIS1-AP-APNIC", "org": "KG INVICTA SERVICES Pvt Ltd", "pdb": null, "pfx": 2, "reg": "2018-07-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@kgis.co", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 137999, "h": "QUINTRON-SYSTEMS-LIMITED", "n": "QUINTRON-SYSTEMS-LIMITED", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 2, "reg": "2018-07-25", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse-desk@hkisl.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138004, "h": "MISL-AS-AP", "n": "MIR INFO SYSTEMS", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3992, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.417, 0.011, 0, false], ["2026-10-12", 6.606, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.606, "se": 0.788, "ts": 0.667, "map": 21.200, "obs": 3, "own": 12.159, "comp": {"cins": -0.449, "dshield": -0.9111, "crowdsec": 4.1594, "vulncheck": -0.6345, "blocklist_de": 2.2828}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.247, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-MISL2-AP-APNIC", "org": "MIR INFO SYSTEMS LTD.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://mirinfosys.com/"}, "pfx": 18, "reg": "2023-11-22", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@mirinfosys.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0024435679076}, {"a": 138026, "h": "RT1-AS-AP", "n": "RT Traders", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 23437.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.240, "det": null, "oid": "ORG-RT24-AP-APNIC", "org": "RT Traders", "pdb": null, "pfx": 3, "reg": "2024-11-20", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@rttraders.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138039, "h": "BBI-AS-AP", "n": "Broadband Business Ideas", "t": "Broadband & mobile", "w": 1, "cc": "PK", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 13378.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.148, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BBI1-AP-APNIC", "org": "Broadband Business Ideas (PVT.) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.bbi.net.pk"}, "pfx": 4, "reg": "2018-08-03", "rir": "apnic", "s24": 4, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@bbi.net.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014154611339}, {"a": 138043, "h": "T2-AS-AP", "n": "T Network", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 13671.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.196, "det": null, "oid": "ORG-TN4-AP-APNIC", "org": "T Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "http://tnetwork.com.bd"}, "pfx": 3, "reg": "2018-08-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138071, "h": "IDNIC-PEMPROV-KALTENG-AS-ID", "n": "Pemerintah Provinsi Kalimantan Tengah", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.963, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-138071-APNIC", "org": "PEMERINTAH PROVINSI KALIMANTAN TENGAH", "pdb": null, "pfx": 2, "reg": "2018-08-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138089, "h": "GMDP-AS-ID", "n": "Global Media Data Prima", "t": "Broadband & mobile", "w": 7, "cc": "ID", "cf": {"rb": "lo", "wb": null, "rep": 2.06, "waf": null}, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 3, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 7, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 4, "cve:CVE-2011-3600": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2020-5902": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"crowdsec": {"n": 5, "p": 0.8983, "hi": 9.96, "lo": 2.47, "ips": 7, "mean": 5.68, "above": true}}, "h2": [["2026-10-05", 11.739, 0.011, 1, false], ["2026-10-12", 12.395, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.395, "se": 0.617, "ts": 1.000, "map": 29.363, "obs": 5, "own": 45.318, "comp": {"cins": -0.7171, "dshield": -1.3204, "crowdsec": 11.165, "vulncheck": -0.752, "blocklist_de": -3.6022}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.231, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-138089-APNIC", "org": "PT.Global Media Data Prima", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://gmdp.net.id"}, "pfx": 27, "reg": "2018-08-14", "rir": "apnic", "s24": 21, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": "abuse@gmdp.net.id", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0107537156562}, {"a": 138096, "h": "INTEK-AS-ID", "n": "INFORMASI NUSANTARA TEKNOLOGI", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "dshield": {"n": 1, "p": 0.1967, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.580, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.580, "se": 1.423, "ts": 1.000, "map": 6.180, "obs": 1, "own": 11.812, "comp": {"cins": -0.084, "dshield": 4.7471, "crowdsec": -0.7839, "vulncheck": -0.2253, "blocklist_de": -0.4389}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.268, "det": {"shodan": {"c2": 1}}, "oid": "@aut-138096-APNIC", "org": "PT INFORMASI NUSANTARA TEKNOLOGI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://intek.net.id"}, "pfx": 10, "reg": "2018-08-14", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@intek.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013698917914}, {"a": 138112, "h": "MEGARAP-AS-ID", "n": "Megarap Mitra Solusi", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-138112-APNIC", "org": "PT. Megarap Mitra Solusi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://mms.net.id"}, "pfx": 4, "reg": "2018-08-14", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0018062330704}, {"a": 138115, "h": "IDNIC-DENEVA-AS-ID", "n": "Deneva", "t": "Hosting & VPS", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 19, "p": 1.0000, "hi": 26.25, "lo": 12.48, "ips": 19, "mean": 18.83, "above": true}, "crowdsec": {"n": 2, "p": 0.3734, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "blocklist_de": {"n": 2, "p": 0.4026, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 16.258, 0.011, 1, false], ["2026-10-12", 7.361, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.361, "se": 0.680, "ts": 0.500, "map": 19.522, "obs": 4, "own": 3.864, "comp": {"cins": -0.6671, "dshield": -1.25, "crowdsec": 1.8388, "vulncheck": -0.7349, "blocklist_de": 5.1784}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.778, "det": {"shodan": {"compromised": 19}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-138115-APNIC", "org": "PT Deneva", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "https://www.domainesia.com/"}, "pfx": 29, "reg": "2018-08-14", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7424, "abuse": "abuse@deneva.co.id", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.000525124831}, {"a": 138117, "h": "IDNIC-SOBAT-AS-ID", "n": "Solusindo Basis Teknologi", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.131, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-138117-APNIC", "org": "PT. Solusindo Basis Teknologi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.sobat.net.id"}, "pfx": 3, "reg": "2018-08-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "abuse@sobat.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138123, "h": "DEXA-AS-ID", "n": "ADEAKSA INDO JAYATAMA", "t": "Broadband & mobile", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 4, "web_bruteforce": 5, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 4}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 5, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 64.091, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.275, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-138123-APNIC", "org": "PT. ADEAKSA INDO JAYATAMA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.dexanet.co.id"}, "pfx": 4, "reg": "2018-08-14", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "noc@dexanet.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0016125312632}, {"a": 138127, "h": "IDNIC-PEMKAB-MADIUN-AS-ID", "n": "Pemerintah Kabupaten Madiun", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 16406.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": true, "bot": 0.478, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-138127-APNIC", "org": "PEMERINTAH KABUPATEN MADIUN", "pdb": null, "pfx": 1, "reg": "2018-08-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138131, "h": "IDNIC-NATANET-AS-ID", "n": "NATANETWORK SOLUTION", "t": "Enterprise, edu & gov", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4076, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 2, "p": 0.4038, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 3.548, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 3.523, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.548, "se": 0.993, "ts": 1.000, "map": 16.944, "obs": 2, "own": 99.357, "comp": {"cins": -0.244, "dshield": -0.537, "crowdsec": 6.7369, "vulncheck": -0.4697, "blocklist_de": -1.2626}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.501, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}}, "oid": "@aut-138131-APNIC", "org": "CV. NATANETWORK SOLUTION", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.natanetwork.co.id"}, "pfx": 12, "reg": "2018-08-14", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "abuse.report@host.natanetwork.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138152, "h": "YISUCLOUDLTD-HK", "n": "YISU CLOUD LTD", "t": "Hosting & VPS", "w": 25, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 16, "web_bruteforce": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 17}, "ev": {"cins": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 2, "p": 0.3631, "hi": 5.75, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}, "dshield": {"n": 2, "p": 0.4074, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 13, "p": 1.0000, "hi": 18.50, "lo": 7.58, "ips": 17, "mean": 12.53, "above": true}, "threatfox": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1890, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "phishing_db": {"n": 4, "p": 0.8043, "hi": 8.96, "lo": 1.93, "ips": 6, "mean": 4.89, "above": true}, "blocklist_de": {"n": 9, "p": 0.9985, "hi": 15.00, "lo": 5.18, "ips": 10, "mean": 9.55, "above": true}}, "h2": [["2026-10-05", 61.853, 11.686, 1, false], ["2026-10-12", 61.239, 11.679, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 4}, "lo": 11.679, "se": 0.865, "ts": 0.800, "map": 31.802, "obs": 5, "own": 11.126, "comp": {"urlhaus": -0.747, "threatfox": 0.867, "phishing_db": 4.9657}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 13, "vulncheck": 1, "blocklist_de": 9}, "lo": 61.239, "se": 0.401, "ts": 0.500, "map": 97.665, "obs": 26, "own": 18.979, "comp": {"cins": -0.3081, "dshield": -0.8093, "crowdsec": 1.9745, "vulncheck": -0.7161, "blocklist_de": 5.8342}, "mass": 23.6, "listed": false}}, "abq": true, "bot": 0.889, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 10}}, "oid": "ORG-YCL1-AP-APNIC", "org": "YISU CLOUD LIMITED", "pdb": null, "pfx": 44, "reg": "2018-08-22", "rir": "apnic", "s24": 44, "sib": 2, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.8659], ["2026-10-12", 0.8453]], "ipv4": 11264, "abuse": null, "score": 0.8453, "groups": ["sensors", "phishing"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00042574693265}, {"a": 138156, "h": "CSNE-NETPLAY-AS", "n": "CSNE Co", "t": "Other", "w": 3, "cc": "TH", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 9.028, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 9.028, "se": 0.819, "ts": 0.333, "map": 30.416, "obs": 3, "own": 17.850, "comp": {"cins": -0.3495, "dshield": -0.737, "crowdsec": 1.2252, "vulncheck": 1.7474, "blocklist_de": 2.9225}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.763, "det": {"shodan": {"malware": 1}, "threatfox": {"family:NjRAT": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CCL23-AP-APNIC", "org": "CSNE Co., Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.code-studio.net/"}, "pfx": 10, "reg": "2018-08-23", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": "support@san-idc.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002643363876}, {"a": 138183, "h": "MSCOMPUTERMATE-AS-AP", "n": "Computer Mate", "t": "Other", "w": 8, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 8, "proxy_or_vpn": 3, "web_bruteforce": 8, "router_or_botnet": 3}, "n": 8}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 8, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.230, "det": null, "oid": "ORG-MCM1-AP-APNIC", "org": "Computer Mate", "pdb": null, "pfx": 1, "reg": "2018-09-06", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "info@computermate.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138191, "h": "WEBLINKLTD-AS-AP", "n": "Weblink Communications Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.488, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-WCL5-AP-APNIC", "org": "Weblink Communications Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://weblinkltd.com/"}, "pfx": 6, "reg": "2018-09-07", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "info@weblinkltd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138195, "h": "MOACKCOLTD-AS-AP", "n": "MOACK", "t": "Other", "w": 7, "cc": "KR", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 3, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-6587": 1}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.0637, "hi": 3.20, "lo": 0.24, "ips": 1, "mean": 1.35, "above": false}, "crowdsec": {"n": 3, "p": 0.2939, "hi": 4.84, "lo": 0.85, "ips": 4, "mean": 2.50, "above": false}, "threatfox": {"n": 1, "p": 0.1841, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1548, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "blocklist_de": {"n": 1, "p": 0.1138, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 1.480, 1.394, 0, false], ["2026-10-12", 1.092, 0.731, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.731, "se": 1.140, "ts": 0.500, "map": 3.154, "obs": 2, "own": 3.368, "comp": {"urlhaus": -0.4294, "threatfox": 1.6633, "phishing_db": 1.5408}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.092, "se": 0.656, "ts": 0.750, "map": 2.736, "obs": 4, "own": 1.560, "comp": {"cins": -0.7188, "dshield": -1.3229, "crowdsec": 4.6068, "vulncheck": -0.7525, "blocklist_de": 0.5879}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.518, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-MA68-AP-APNIC", "org": "MOACK.Co.LTD", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.moack.co.kr"}, "pfx": 173, "reg": "2018-09-07", "rir": "apnic", "s24": 226, "sib": 3, "tor": 0, "w24": 6, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 124416, "abuse": "noc@moack.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0019585662362}, {"a": 138221, "h": "YNETT-AS-IN", "n": "Ynet Telecom Solutions", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.883, 0.011, 0, false], ["2026-10-12", 0.983, 0.013, 0, false]], "sh": false, "uc": 16796.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.983, "se": 1.576, "ts": 1.000, "map": 13.454, "obs": 1, "own": 29.301, "comp": {"cins": -0.0552, "dshield": -0.1318, "crowdsec": -0.5223, "vulncheck": -0.1594, "blocklist_de": 4.8616}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.164, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-138221-APNIC", "org": "Ynet Telecom Solutions", "pdb": null, "pfx": 4, "reg": "2018-09-19", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "info@ynettelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138233, "h": "PROTON-AS-IN", "n": "Proton Internet Llp", "t": "Transit & backbone", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.094, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 3.270, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-138233-APNIC", "org": "Proton Internet Llp", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.hostmycode.in"}, "pfx": 7, "reg": "2018-09-19", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@hostmycode.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138244, "h": "HOSTZOP-AS-IN", "n": "HOSTZOP CLOUD SERVICES", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "home_connection": 1, "cve:CVE-2016-1555": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-26086": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 2.871, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.432, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-138244-APNIC", "org": "HOSTZOP CLOUD SERVICES PRIVATE LIMITED", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.hostzop.com/"}, "pfx": 4, "reg": "2018-09-19", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "network@hostzop.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138246, "h": "NETCLUES-AS-IN", "n": "Netclues Technologies Private Limited", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8088, "hi": 9.04, "lo": 1.95, "ips": 4, "mean": 4.94, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.407, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-138246-APNIC", "org": "Netclues Technologies Private Limited", "pdb": null, "pfx": 5, "reg": "2018-09-19", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 1536, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 138277, "h": "RADINET-AS-IN", "n": "Radinet Info Solutions", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 1.891, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.891, "se": 0.954, "ts": 0.500, "map": 8.305, "obs": 2, "own": 13.354, "comp": {"cins": -0.3004, "dshield": 3.6451, "crowdsec": -2.5494, "vulncheck": -0.5258, "blocklist_de": 3.2409}, "mass": 1.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-138277-APNIC", "org": "Radinet Info Solutions Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.radinet.in"}, "pfx": 28, "reg": "2018-09-19", "rir": "apnic", "s24": 28, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00189880525773}, {"a": 138296, "h": "STARNET7-AS", "n": "Juweriyah Networks", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "mail_bruteforce": 1}, "n": 4}, "ev": {"dshield": {"n": 1, "p": 0.1676, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 4, "p": 0.6046, "hi": 6.66, "lo": 1.43, "ips": 4, "mean": 3.64, "above": false}, "blocklist_de": {"n": 1, "p": 0.1409, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 2.055, 0.010, 0, false], ["2026-10-12", 2.959, 0.011, 0, false]], "sh": false, "uc": 313.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.983, "ts": null, "map": 0.180, "obs": 0, "own": 1.234, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.959, "se": 0.568, "ts": 0.667, "map": 6.337, "obs": 6, "own": 9.798, "comp": {"cins": -0.9693, "dshield": 1.1963, "crowdsec": 4.7667, "vulncheck": -0.8179, "blocklist_de": -0.9358}, "mass": 5.0, "listed": false}}, "abq": true, "bot": 0.158, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-138296-APNIC", "org": "Juweriyah Networks Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.jeebr.net"}, "pfx": 138, "reg": "2018-09-19", "rir": "apnic", "s24": 141, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00570461109228}, {"a": 138298, "h": "A2JDATA-AS-IN", "n": "A2j Data Services", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.545, 0.011, 0, false], ["2026-10-12", 10.321, 0.012, 1, false]], "sh": false, "uc": 4960.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 10.321, "se": 0.800, "ts": 0.667, "map": 34.069, "obs": 3, "own": 53.407, "comp": {"cins": -0.4268, "dshield": -0.8734, "crowdsec": 4.4184, "vulncheck": -0.621, "blocklist_de": 2.4249}, "mass": 1.9, "listed": false}}, "abq": true, "bot": 0.223, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-138298-APNIC", "org": "A2j Data Services Pvt. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.a2jdata.com"}, "pfx": 10, "reg": "2018-09-19", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138320, "h": "FALCONLINK1-AS-AP", "n": "Shamsuzzaman Mamun", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "ORG-FA24-AP-APNIC", "org": "Falcon Link", "pdb": null, "pfx": 7, "reg": "2018-09-19", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": "abuse@falconlink.net.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072408615431}, {"a": 138341, "h": "SHOPEE-AS", "n": "SHOPEE SINGAPORE", "t": "Other", "w": 9, "cc": "SG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 7, "p": 0.9828, "hi": 12.28, "lo": 3.72, "ips": 9, "mean": 7.47, "above": true}}, "h2": [["2026-10-05", 0.673, 0.010, 0, false], ["2026-10-12", 1.555, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 0.503, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 7, "blocklist_de": 0}, "lo": 1.555, "se": 0.586, "ts": 1.000, "map": 3.341, "obs": 7, "own": 1.957, "comp": {"cins": -0.5481, "dshield": -1.0718, "crowdsec": -4.2135, "vulncheck": 11.2155, "blocklist_de": -2.7822}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.996, "det": {"vulncheck": {"c2_server": 9}}, "oid": "ORG-SSPL12-AP-APNIC", "org": "SHOPEE SINGAPORE PRIVATE LIMITED", "pdb": null, "pfx": 134, "reg": "2018-10-08", "rir": "apnic", "s24": 135, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 56832, "abuse": "noc@sea.com", "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00566933872102}, {"a": 138350, "h": "PRABHUTV-AS-AP", "n": "PRABHU DIGITAL PUBLIC LIMITED", "t": "Other", "w": 1, "cc": "NP", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 56640.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 78.899, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.175, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PDPL2-AP-APNIC", "org": "PRABHU DIGITAL PUBLIC LIMITED", "pdb": null, "pfx": 1, "reg": "2018-10-14", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@prabhutv.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001848084924}, {"a": 138384, "h": "RMNI-AS-AP", "n": "Rakuten Mobile", "t": "Broadband & mobile", "w": 0, "cc": "JP", "cf": {"rb": "hi", "wb": "hi", "rep": 0.95, "waf": 0.83}, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 1.05, "lo": 0.08, "ips": 1, "mean": 0.44, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.004, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.799, "ts": null, "map": 0.113, "obs": 0, "own": 0.537, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.448, "ts": null, "map": 0.040, "obs": 0, "own": 0.079, "comp": null, "mass": 0.5, "listed": false}}, "abq": true, "bot": 0.043, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-RMNI1-AP-APNIC", "org": "Rakuten Mobile, Inc.", "pdb": {"t": null, "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://mobile.rakuten.co.jp/corporate/"}, "pfx": 31, "reg": "2018-10-26", "rir": "apnic", "s24": 1644, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 420864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.077185}, {"a": 138407, "h": "CMNET-GZIDC-CN", "n": "The Internet Data Center of Guizhou Mobile Communication Company Limited", "t": "Hosting & VPS", "w": 5, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 5, "cve:CVE-2024-6387": 5}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.0954, "hi": 3.60, "lo": 0.27, "ips": 5, "mean": 1.52, "above": false}, "blocklist_de": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 3, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 1.203, 0.010, 0, false], ["2026-10-12", 0.603, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 0.200, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.603, "se": 0.897, "ts": 0.500, "map": 2.384, "obs": 2, "own": 0.486, "comp": {"cins": -0.3612, "dshield": -0.7582, "crowdsec": 1.111, "vulncheck": -0.576, "blocklist_de": 2.8469}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.766, "det": {"blocklist_de": {"ssh": 3}}, "oid": "ORG-CMCC1-AP-APNIC", "org": "China Mobile Communications Corporation", "pdb": null, "pfx": 104, "reg": "2018-11-04", "rir": "apnic", "s24": 119, "sib": 28, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31744, "abuse": "abuse@chinamobile.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010271940328}, {"a": 138408, "h": "NUSRATECHPTELTD-AS-AP", "n": "GOTIPATH", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6429, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.995, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-GA69-AP-APNIC", "org": "Gotipath", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://gotipath.com"}, "pfx": 4, "reg": "2021-02-22", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@nusratech.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138415, "h": "YANCYLIMITED-AS-HK", "n": "Yancy", "t": "Other", "w": 6, "cc": "HK", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1302, "hi": 4.00, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "vulncheck": {"n": 1, "p": 0.1172, "hi": 3.86, "lo": 0.29, "ips": 5, "mean": 1.63, "above": false}}, "h2": [["2026-10-05", 0.006, 0.137, 0, false], ["2026-10-12", 0.167, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.901, "ts": null, "map": 0.156, "obs": 0, "own": 0.351, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.167, "se": 0.873, "ts": 0.500, "map": 0.614, "obs": 2, "own": 0.369, "comp": {"cins": 4.4877, "dshield": -0.7264, "crowdsec": -2.8645, "vulncheck": 1.7756, "blocklist_de": -1.7669}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.860, "det": {"vulncheck": {"attack_tooling": 5}}, "oid": "ORG-AA393-AP-APNIC", "org": "YANCY LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.yaim.com"}, "pfx": 139, "reg": "2018-11-07", "rir": "apnic", "s24": 438, "sib": 1, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 160256, "abuse": "abusencck@ncck.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057999543714}, {"a": 138423, "h": "CMPAKLIMITED-AS-ENTCORP", "n": "CMPak", "t": "Other", "w": 182, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 165, "web_exploit": 180, "bad_crawling": 15, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 172, "mail_bruteforce": 6, "router_or_botnet": 154, "cve:CVE-2019-8318": 109, "cve:CVE-2018-10562": 122, "cve:CVE-2024-12847": 174, "cve:CVE-2024-28000": 12, "cve:CVE-2026-60137": 1}, "n": 180}, "ev": {"cins": {"n": 5, "p": 0.9054, "hi": 10.17, "lo": 2.53, "ips": 8, "mean": 5.80, "above": true}, "dshield": {"n": 1, "p": 0.1804, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 15, "p": 1.0000, "hi": 19.01, "lo": 8.26, "ips": 180, "mean": 13.17, "above": true}, "vulncheck": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 3, "p": 0.5891, "hi": 7.13, "lo": 1.26, "ips": 4, "mean": 3.68, "above": false}}, "h2": [["2026-10-05", 20.130, 0.011, 1, false], ["2026-10-12", 31.398, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 0.575, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 5, "dshield": 1, "crowdsec": 15, "vulncheck": 1, "blocklist_de": 3}, "lo": 31.398, "se": 0.407, "ts": 0.600, "map": 51.451, "obs": 25, "own": 28.771, "comp": {"cins": 8.9027, "dshield": -1.8006, "crowdsec": 4.4363, "vulncheck": -0.7072, "blocklist_de": -5.4969}, "mass": 22.9, "listed": false}}, "abq": true, "bot": 0.099, "det": {"vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"bots": 2, "apache": 2, "bruteforcelogin": 1}}, "oid": "ORG-CL1-AP-APNIC", "org": "CMPak Limited", "pdb": null, "pfx": 94, "reg": "2018-11-13", "rir": "apnic", "s24": 81, "sib": 1, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 27648, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "cins"], "traffic": 0.01106400596664}, {"a": 138449, "h": "SYUNET-AS-AP", "n": "SIANG YU SCIENCE AND TECHNOLOGY LIMITED", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "@family-34325", "org": "SIANG YU SCIENCE AND TECHNOLOGY LIMITED", "pdb": null, "pfx": 3, "reg": "2018-11-20", "rir": "apnic", "s24": 3, "sib": 4, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "network-abuse@vocom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138524, "h": "AWN-CO-LTD-AS-AP", "n": "Advanced Wireless Network Company Limited", "t": "Broadband & mobile", "w": 6, "cc": "TH", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.4091, "hi": 5.64, "lo": 0.99, "ips": 4, "mean": 2.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.1060, "hi": 3.61, "lo": 0.47, "ips": 2, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.398, 0.009, 0, false], ["2026-10-12", 0.566, 0.010, 0, false]], "sh": false, "uc": 57.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.865, "ts": null, "map": 0.142, "obs": 0, "own": 0.741, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.566, "se": 0.598, "ts": 0.600, "map": 1.279, "obs": 5, "own": 1.989, "comp": {"cins": -0.9665, "dshield": 6.8904, "crowdsec": -6.4103, "vulncheck": -0.8174, "blocklist_de": 2.9436}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.142, "det": {"threatfox": {"family:Mirai": 2}, "blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 139, "reg": "2021-07-27", "rir": "apnic", "s24": 696, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 178176, "abuse": "abuseIPv4@ais.co.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01744651761144}, {"a": 138534, "h": "MATRIXBD-AS-AP", "n": "Matrix BD", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.219, "det": null, "oid": "ORG-MB7-AP-APNIC", "org": "Matrix BD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.mxbd.net"}, "pfx": 4, "reg": "2019-01-02", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "info@matrixbdisp.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138536, "h": "PREMIUM-AS-AP", "n": "Premium Connectivity", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.309, 0.011, 0, false], ["2026-10-12", 0.329, 0.012, 0, false]], "sh": false, "uc": 1386.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.329, "se": 1.306, "ts": 1.000, "map": 2.829, "obs": 1, "own": 5.069, "comp": {"cins": -0.1182, "dshield": -0.2744, "crowdsec": 3.7352, "vulncheck": -0.2925, "blocklist_de": -0.6166}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PCL5-AP-APNIC", "org": "Premium Connectivity Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.pmcon.net"}, "pfx": 31, "reg": "2019-01-03", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@pmcon.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086275207058}, {"a": 138538, "h": "NANBIAN-VPSORGLOBAL-AS", "n": "VPSOR-GLOBAL", "t": "Hosting & VPS", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6057, "hi": 7.30, "lo": 1.29, "ips": 3, "mean": 3.77, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 0.118, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.939, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-NNTX1-AP-APNIC", "org": "Ningbo Nanbian Tuoluo Xinxi Jishu Co., Ltd", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.vpsor.cn"}, "pfx": 13, "reg": "2019-01-04", "rir": "apnic", "s24": 29, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@mail.vpsor.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138544, "h": "HK-ONLINE-AS", "n": "HK Online", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 4, "web_bruteforce": 4, "router_or_botnet": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 4, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 37.467, 0.011, 1, false], ["2026-10-12", 20.762, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.762, "se": 0.821, "ts": 1.000, "map": 71.771, "obs": 3, "own": 112.431, "comp": {"cins": -0.3651, "dshield": -0.7653, "crowdsec": 9.2513, "vulncheck": -0.5789, "blocklist_de": -1.8748}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.323, "det": null, "oid": "ORG-IN4-AP-APNIC", "org": "HK ONLINE", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.hkonline.com.bd"}, "pfx": 4, "reg": "2019-01-09", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "noc@hkonline.com.bd", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024865434816}, {"a": 138590, "h": "PRIMENETWORKS-AS-AP", "n": "Prime Networks", "t": "Broadband & mobile", "w": 2, "cc": "PK", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.233, 0.011, 0, false], ["2026-10-12", 2.433, 0.012, 0, false]], "sh": false, "uc": 2070.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.433, "se": 0.970, "ts": 0.500, "map": 11.012, "obs": 2, "own": 17.746, "comp": {"cins": -0.2856, "dshield": -0.6178, "crowdsec": 1.8703, "vulncheck": -0.512, "blocklist_de": 3.3378}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.128, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-PN8-AP-APNIC", "org": "Prime Networks", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Selective", "web": "http://prime.net.pk"}, "pfx": 20, "reg": "2019-01-31", "rir": "apnic", "s24": 20, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": "abuse@prime.net.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00380583182518}, {"a": 138600, "h": "ABI-AS-AP", "n": "Achiever Broadband Internet", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 6152.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.267, "det": null, "oid": "ORG-ABI1-AP-APNIC", "org": "Achiever Broadband Internet", "pdb": null, "pfx": 5, "reg": "2019-02-04", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "info@abibd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009525477902}, {"a": 138601, "h": "COLOASIA-AS-AP", "n": "Coloasia Limited", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.979, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CL53-AP-APNIC", "org": "Coloasia Limited", "pdb": null, "pfx": 9, "reg": "2019-02-07", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138608, "h": "CLOUDHOST-AS-AP", "n": "Cloud Host Asia", "t": "Hosting & VPS", "w": 27, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 9, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 13, "web_bruteforce": 2, "home_connection": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2025-3248": 1, "cve:CVE-2026-87902": 1}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 7, "p": 0.9838, "hi": 12.42, "lo": 3.76, "ips": 15, "mean": 7.56, "above": true}, "phishing_db": {"n": 3, "p": 0.6400, "hi": 7.67, "lo": 1.35, "ips": 4, "mean": 3.96, "above": false}, "blocklist_de": {"n": 7, "p": 0.9865, "hi": 12.85, "lo": 3.89, "ips": 15, "mean": 7.82, "above": true}}, "h2": [["2026-10-05", 37.486, 8.988, 1, false], ["2026-10-12", 68.742, 9.050, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 9.050, "se": 1.002, "ts": 1.000, "map": 32.657, "obs": 3, "own": 11.554, "comp": {"urlhaus": -0.4324, "threatfox": -0.3374, "phishing_db": 5.8821}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 7}, "lo": 68.742, "se": 0.440, "ts": 0.467, "map": 119.964, "obs": 15, "own": 23.327, "comp": {"cins": 0.8684, "dshield": -2.5605, "crowdsec": 0.3196, "vulncheck": -0.9394, "blocklist_de": 8.4928}, "mass": 14.5, "listed": false}}, "abq": false, "bot": 0.891, "det": {"blocklist_de": {"ftp": 1, "sip": 1, "ssh": 13}}, "oid": "ORG-CHPL7-AP-APNIC", "org": "Cloud Host Pte Ltd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://cloudhost.asia"}, "pfx": 22, "reg": "2019-02-13", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 5632, "abuse": "abuse@cloudhost.asia", "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00024992391866}, {"a": 138621, "h": "CITY-NET-COM-AS-AP", "n": "City Net Communication", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 27.413, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CNC3-AP-APNIC", "org": "City Net Communication", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://citynet.live/"}, "pfx": 4, "reg": "2019-02-19", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00032416940069}, {"a": 138640, "h": "HELLOTECHLIMITED-AS-AP", "n": "HelloTech Limited", "t": "Broadband & mobile", "w": 12, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 8, "bad_crawling": 1, "proxy_or_vpn": 5, "web_bruteforce": 10, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 9, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 10}, "ev": {"crowdsec": {"n": 6, "p": 0.9573, "hi": 11.22, "lo": 3.11, "ips": 10, "mean": 6.63, "above": true}, "blocklist_de": {"n": 2, "p": 0.4082, "hi": 6.16, "lo": 0.80, "ips": 3, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 20.003, 0.011, 1, false], ["2026-10-12", 27.010, 0.012, 1, false]], "sh": false, "uc": 3462.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 2}, "lo": 27.010, "se": 0.521, "ts": 0.750, "map": 53.849, "obs": 8, "own": 82.642, "comp": {"cins": -1.1599, "dshield": -1.8529, "crowdsec": 7.7033, "vulncheck": -0.8529, "blocklist_de": 1.5423}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.186, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-HL31-AP-APNIC", "org": "HelloTech Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://hellotechbd.net"}, "pfx": 25, "reg": "2023-07-15", "rir": "apnic", "s24": 21, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "info@hellotechbd.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00582866675893}, {"a": 138643, "h": "CXICL-AS-AP", "n": "CN XINYUAN INTERCONNECT COMPANY LTD", "t": "Other", "w": 1, "cc": "KH", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.763, 0, false], ["2026-10-12", 0.013, 1.021, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.021, "se": 1.880, "ts": 1.000, "map": 15.849, "obs": 1, "own": 30.727, "comp": {"urlhaus": 4.5211, "threatfox": -0.0475, "phishing_db": -0.0843}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CXIC2-AP-APNIC", "org": "CN XINYUAN INTERCONNECT COMPANY LTD", "pdb": null, "pfx": 5, "reg": "2019-02-25", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000617131584}, {"a": 138655, "h": "TES-PL-AS-AP", "n": "TransWorldEnterpriseServices Net2", "t": "Broadband & mobile", "w": 6, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-12847": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 4, "p": 0.7994, "hi": 8.88, "lo": 1.91, "ips": 5, "mean": 4.85, "above": true}}, "h2": [["2026-10-05", 10.599, 0.011, 1, false], ["2026-10-12", 11.921, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 11.921, "se": 0.619, "ts": 0.800, "map": 28.368, "obs": 5, "own": 43.782, "comp": {"cins": -0.908, "dshield": -1.5688, "crowdsec": -3.2357, "vulncheck": -0.8044, "blocklist_de": 11.2559}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.142, "det": {"blocklist_de": {"bots": 5}}, "oid": "ORG-TWES1-AP-APNIC", "org": "Trans World Enterprise Services (Private) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://transworld-home.com/"}, "pfx": 29, "reg": "2019-02-27", "rir": "apnic", "s24": 29, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@tes.com.pk", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00789387362379}, {"a": 138699, "h": "TIKTOK-AS-AP", "n": "ByteDance AS138699", "t": "Hosting & VPS", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1171.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.288, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 0.132, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.941, "det": null, "oid": "ORG-BP5-AP-APNIC", "org": "TIKTOK PTE. LTD.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.bytedance.com"}, "pfx": 21, "reg": "2019-03-13", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "noc@bytedance.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00842757691354}, {"a": 138754, "h": "KVBPL-AS-IN", "n": "Kerala Vision Broadband Limited", "t": "Broadband & mobile", "w": 13, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "home_connection": 6, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"dshield": {"n": 1, "p": 0.1575, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 7, "p": 0.9115, "hi": 8.72, "lo": 2.64, "ips": 7, "mean": 5.31, "above": true}, "blocklist_de": {"n": 6, "p": 0.9256, "hi": 9.83, "lo": 2.73, "ips": 6, "mean": 5.81, "above": true}}, "h2": [["2026-10-05", 5.182, 0.010, 0, false], ["2026-10-12", 7.329, 0.011, 0, false]], "sh": false, "uc": 274.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.963, "ts": null, "map": 0.175, "obs": 0, "own": 1.131, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 6}, "lo": 7.329, "se": 0.450, "ts": 0.500, "map": 12.932, "obs": 14, "own": 19.847, "comp": {"cins": -1.9381, "dshield": -0.941, "crowdsec": 1.0025, "vulncheck": -0.9345, "blocklist_de": 6.7645}, "mass": 13.6, "listed": false}}, "abq": true, "bot": 0.107, "det": {"blocklist_de": {"bots": 3, "imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-138754-APNIC", "org": "Kerala Vision Broad Band Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.keralavisionisp.com"}, "pfx": 275, "reg": "2019-02-11", "rir": "apnic", "s24": 191, "sib": 3, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 92928, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.02648403777162}, {"a": 138760, "h": "BHARATCO-AS", "n": "Bharat Computers", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 133203.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 215.609, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": true, "bot": 0.312, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-138760-APNIC", "org": "Bharat Computers", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://bharatnetwork.in"}, "pfx": 1, "reg": "2019-02-11", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138774, "h": "SKYNET-AS-IN", "n": "skynet internet", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 4362, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.146, "det": null, "oid": "@aut-138774-APNIC", "org": "skynet internet", "pdb": null, "pfx": 8, "reg": "2019-02-11", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138876, "h": "IDNIC-SARANAINDO-AS-ID", "n": "Saranaindo", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.982, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-138876-APNIC", "org": "CV. Saranaindo", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.saranaindo.com"}, "pfx": 2, "reg": "2019-02-21", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@saranaindo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138915, "h": "KAOPU-HK", "n": "Kaopu Cloud HK", "t": "Hosting & VPS", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1}, "n": 4}, "ev": {"shodan": {"n": 3, "p": 0.1932, "hi": 4.17, "lo": 0.74, "ips": 3, "mean": 2.15, "above": false}, "crowdsec": {"n": 4, "p": 0.2585, "hi": 4.43, "lo": 0.95, "ips": 4, "mean": 2.42, "above": false}, "blocklist_de": {"n": 1, "p": 0.0724, "hi": 3.32, "lo": 0.25, "ips": 1, "mean": 1.40, "above": false}}, "h2": [["2026-10-05", 1.282, 0.143, 0, false], ["2026-10-12", 0.884, 0.010, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.908, "ts": null, "map": 0.158, "obs": 0, "own": 0.138, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.884, "se": 0.600, "ts": 0.800, "map": 1.985, "obs": 5, "own": 0.393, "comp": {"cins": -0.886, "dshield": -1.5417, "crowdsec": 5.7406, "vulncheck": -0.7992, "blocklist_de": -0.4345}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.879, "det": {"shodan": {"c2": 3}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-KCHL2-AP-APNIC", "org": "Kaopu Cloud HK Limited", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "10-20Tbps", "pol": "Open", "web": "https://www.kaopucloud.com/"}, "pfx": 340, "reg": "2019-03-19", "rir": "apnic", "s24": 402, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 108544, "abuse": "abuse@kaopucloud.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00296861799821}, {"a": 138950, "h": "CHINATELECOM-Jiangsu-Wuxi-International-IDC", "n": "China Telecom Wuxi IDC Network", "t": "Broadband & mobile", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "cve:CVE-2024-6387": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1543, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "shodan": {"n": 1, "p": 0.0519, "hi": 3.03, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "crowdsec": {"n": 2, "p": 0.1155, "hi": 3.69, "lo": 0.48, "ips": 2, "mean": 1.76, "above": false}, "blocklist_de": {"n": 2, "p": 0.2606, "hi": 4.90, "lo": 0.64, "ips": 2, "mean": 2.34, "above": false}}, "h2": [["2026-10-12", 1.492, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.939, "ts": null, "map": 0.168, "obs": 0, "own": 1.024, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.492, "se": 0.605, "ts": 0.400, "map": 3.406, "obs": 5, "own": 5.289, "comp": {"cins": 3.113, "dshield": -1.6511, "crowdsec": -0.8896, "vulncheck": -0.8196, "blocklist_de": 2.8665}, "mass": 5.0, "listed": false}}, "abq": true, "bot": 0.828, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 74, "reg": "2019-03-29", "rir": "apnic", "s24": 265, "sib": 281, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 68352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005814884816}, {"a": 138953, "h": "TOPNETWORK-AS-AP", "n": "Top Network", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 54687.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.188, "det": null, "oid": "ORG-TN5-AP-APNIC", "org": "Top Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.topnetbd.com/"}, "pfx": 1, "reg": "2019-03-29", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 138961, "h": "PCTN-AS-AP", "n": "Paradise Cable Television Network Inc.", "t": "Broadband & mobile", "w": 0, "cc": "PH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 38867.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.171, "det": null, "oid": "ORG-PCTN1-AP-APNIC", "org": "Paradise Cable Television Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.pctv.com.ph"}, "pfx": 3, "reg": "2019-04-02", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": "infonet.pctvph@gmail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015738407244}, {"a": 138968, "h": "RAINBOWIDC-AS-AP", "n": "Rainbow Network Japan", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.729, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.209, "obs": 0, "own": 0.351, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.849, "det": {"threatfox": {"family:VShell": 1}}, "oid": "ORG-RNL4-AP-APNIC", "org": "rainbow network limited", "pdb": {"t": "Route Server", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.itsidc.com"}, "pfx": 20, "reg": "2019-04-04", "rir": "apnic", "s24": 27, "sib": 0, "tor": 0, "w24": 0, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": "admin@itsidc.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000000687215}, {"a": 138982, "h": "CHINANET-Hubei-Jiangxia-IDC", "n": "Hubei Jiangxia IDC", "t": "Other", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3268, "hi": 5.45, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}, "crowdsec": {"n": 2, "p": 0.3059, "hi": 5.27, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}, "blocklist_de": {"n": 2, "p": 0.3727, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 4.182, 0.011, 0, false], ["2026-10-12", 3.230, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 0.590, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.230, "se": 0.669, "ts": 0.500, "map": 8.343, "obs": 4, "own": 4.747, "comp": {"cins": -0.7096, "dshield": -1.3101, "crowdsec": 1.4285, "vulncheck": -0.7495, "blocklist_de": 4.8559}, "mass": 3.4, "listed": false}}, "abq": true, "bot": 0.680, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 12, "reg": "2019-04-10", "rir": "apnic", "s24": 73, "sib": 281, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007161207092}, {"a": 138995, "h": "ANTBOX1-AS-AP", "n": "Antbox Networks", "t": "Hosting & VPS", "w": 29, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2026-75650": 1}, "n": 5}, "ev": {"shodan": {"n": 8, "p": 0.9404, "hi": 8.90, "lo": 2.90, "ips": 8, "mean": 5.55, "above": true}, "crowdsec": {"n": 5, "p": 0.5599, "hi": 5.93, "lo": 1.47, "ips": 5, "mean": 3.38, "above": false}, "threatfox": {"n": 9, "p": 0.9985, "hi": 15.03, "lo": 5.19, "ips": 22, "mean": 9.57, "above": true}, "vulncheck": {"n": 1, "p": 0.1404, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "blocklist_de": {"n": 1, "p": 0.0964, "hi": 3.62, "lo": 0.27, "ips": 1, "mean": 1.52, "above": false}}, "h2": [["2026-10-05", 1.421, 4.229, 0, false], ["2026-10-12", 1.622, 4.170, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 9, "phishing_db": 0}, "lo": 4.170, "se": 0.823, "ts": 1.000, "map": 9.847, "obs": 9, "own": 3.629, "comp": {"urlhaus": -1.2303, "threatfox": 6.1466, "phishing_db": -1.0029}, "mass": 3.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.622, "se": 0.549, "ts": 0.714, "map": 3.372, "obs": 7, "own": 0.667, "comp": {"cins": -1.0421, "dshield": -1.7256, "crowdsec": 6.6317, "vulncheck": 0.1156, "blocklist_de": -1.3706}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.809, "det": {"shodan": {"c2": 3, "compromised": 5}, "threatfox": {"family:DCRat": 3, "family:PureRAT": 16, "family:Unknown malware": 3}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-ANL8-AP-APNIC", "org": "Antbox Networks Limited", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.antboxnetworks.com/"}, "pfx": 291, "reg": "2019-04-14", "rir": "apnic", "s24": 291, "sib": 1, "tor": 0, "w24": 15, "drop": 2, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 74496, "abuse": "abuse@antboxnetwork.com", "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.00067244032423}, {"a": 138997, "h": "EDCL-AS-AP", "n": "Eons Data", "t": "Transit & backbone", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 12, "p": 0.9996, "hi": 14.06, "lo": 5.56, "ips": 12, "mean": 9.40, "above": true}, "crowdsec": {"n": 3, "p": 0.3547, "hi": 5.25, "lo": 0.93, "ips": 3, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 0.112, 0.010, 0, false], ["2026-10-12", 0.805, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.967, "ts": null, "map": 0.176, "obs": 0, "own": 1.639, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.805, "se": 0.738, "ts": 1.000, "map": 2.360, "obs": 3, "own": 7.515, "comp": {"cins": -0.5174, "dshield": -1.0233, "crowdsec": 7.0965, "vulncheck": -0.6716, "blocklist_de": -2.6316}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.379, "det": {"shodan": {"c2": 6, "compromised": 6}}, "oid": null, "org": null, "pdb": {"t": "NSP", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://eons.cloud/"}, "pfx": 61, "reg": "2019-04-15", "rir": "apnic", "s24": 179, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 61696, "abuse": "abuse@edcl.io", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.01249444216853}, {"a": 139009, "h": "WSCL-AS-AP", "n": "Windstream Communication Limited", "t": "Transit & backbone", "w": 6, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 4, "ssh_bruteforce": 2, "web_bruteforce": 6, "router_or_botnet": 6, "cve:CVE-2021-41773": 1, "cve:CVE-2026-53787": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 2}, "n": 6}, "ev": {"crowdsec": {"n": 6, "p": 0.9535, "hi": 10.99, "lo": 3.05, "ips": 6, "mean": 6.50, "above": true}}, "h2": [["2026-10-05", 24.294, 0.011, 1, false], ["2026-10-12", 12.058, 0.012, 1, false]], "sh": false, "uc": 767.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 2.538, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.058, "se": 0.573, "ts": 1.000, "map": 26.393, "obs": 6, "own": 82.579, "comp": {"cins": -0.8569, "dshield": -1.5054, "crowdsec": 12.0892, "vulncheck": -0.792, "blocklist_de": -4.2681}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.172, "det": null, "oid": "ORG-WSCL2-AP-APNIC", "org": "Windstream Communication Ltd", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.windstreamcommunication.net/"}, "pfx": 30, "reg": "2021-01-12", "rir": "apnic", "s24": 29, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": "abuse@windstreamcommunication.net", "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00541023566343}, {"a": 139016, "h": "EXONHOST-AS-AP", "n": "ExonHost", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-EA18-AP-APNIC", "org": "ExonHost", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.exonhost.com"}, "pfx": 7, "reg": "2019-04-25", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@exonhost.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139021, "h": "WEST263GO-HK", "n": "WEST263GO-HK", "t": "Broadband & mobile", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2021-43798": 2}, "n": 3}, "ev": {"shodan": {"n": 5, "p": 0.8438, "hi": 8.75, "lo": 2.18, "ips": 5, "mean": 5.00, "above": true}, "crowdsec": {"n": 2, "p": 0.2771, "hi": 5.04, "lo": 0.65, "ips": 3, "mean": 2.40, "above": false}, "blocklist_de": {"n": 1, "p": 0.1583, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 1.421, 0.011, 0, false], ["2026-10-12", 1.515, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.009, "ts": null, "map": 0.185, "obs": 0, "own": 1.375, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.515, "se": 0.752, "ts": 0.667, "map": 4.551, "obs": 3, "own": 7.135, "comp": {"cins": -0.5231, "dshield": -1.0324, "crowdsec": 3.3273, "vulncheck": -0.6744, "blocklist_de": 1.8116}, "mass": 2.4, "listed": false}}, "abq": true, "bot": 0.865, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-WIL4-AP-APNIC", "org": "West263 International Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.hkdns.hk"}, "pfx": 21, "reg": "2019-04-26", "rir": "apnic", "s24": 94, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 24064, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00011864801454}, {"a": 139043, "h": "WELLNETWORKS-AS-AP", "n": "WellNetworks", "t": "Other", "w": 6, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "blocklist_de": {"n": 3, "p": 0.6400, "hi": 7.67, "lo": 1.35, "ips": 4, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 16.523, 0.011, 1, false], ["2026-10-12", 29.823, 0.012, 1, false]], "sh": false, "uc": 3867.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 29.823, "se": 0.627, "ts": 0.600, "map": 71.355, "obs": 5, "own": 40.265, "comp": {"cins": -0.8094, "dshield": -1.4444, "crowdsec": 0.5138, "vulncheck": -0.7795, "blocklist_de": 8.1809}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.190, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-WL9-AP-APNIC", "org": "WellNetworks (Private) Limited", "pdb": null, "pfx": 10, "reg": "2019-05-07", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": "abuse@wellnetworks.com.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00172023718746}, {"a": 139180, "h": "SDYXT", "n": "Shandong eshinton Network Technology Co., Ltd.", "t": "Other", "w": 5, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 2, "p": 0.4142, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}, "urlhaus": {"n": 1, "p": 0.1978, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3685, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 6.536, 0.604, 0, false], ["2026-10-12", 10.605, 0.644, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.644, "se": 1.648, "ts": 1.000, "map": 7.761, "obs": 1, "own": 10.188, "comp": {"urlhaus": 4.2024, "threatfox": -0.1855, "phishing_db": -0.3415}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 10.605, "se": 0.620, "ts": 0.400, "map": 24.888, "obs": 5, "own": 14.095, "comp": {"cins": 7.5111, "dshield": -1.5402, "crowdsec": -0.1371, "vulncheck": -0.7989, "blocklist_de": -0.4269}, "mass": 4.4, "listed": false}}, "abq": true, "bot": 0.637, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-139180-APNIC", "org": "Shandong eshinton Network Technology Co., Ltd.", "pdb": null, "pfx": 7, "reg": "2019-05-27", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056152378802}, {"a": 139197, "h": "THUNDERNETWORK-AS-AP", "n": "Thunder Network", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TN7-AP-APNIC", "org": "Thunder Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.thundernetwork.net.bd"}, "pfx": 2, "reg": "2019-05-28", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139201, "h": "CHINANET-Jiangxi-Jiujiang-IDC", "n": "Jiangxi Jiujiang IDC", "t": "Other", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1100, "hi": 3.78, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "crowdsec": {"n": 1, "p": 0.0948, "hi": 3.60, "lo": 0.27, "ips": 2, "mean": 1.52, "above": false}, "blocklist_de": {"n": 1, "p": 0.1485, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.143, 0.010, 0, false], ["2026-10-12", 0.599, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.994, "ts": null, "map": 0.182, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.599, "se": 0.896, "ts": 0.500, "map": 2.367, "obs": 2, "own": 1.384, "comp": {"cins": -0.3616, "dshield": -0.7589, "crowdsec": 1.1074, "vulncheck": -0.5763, "blocklist_de": 2.8445}, "mass": 1.6, "listed": false}}, "abq": true, "bot": 0.490, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 52, "reg": "2019-05-31", "rir": "apnic", "s24": 120, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000155344878}, {"a": 139203, "h": "CHINANET-Guizhou-Guian-IDC", "n": "Guizhou GuiAn IDC", "t": "Other", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.4512, "hi": 5.95, "lo": 1.05, "ips": 3, "mean": 3.07, "above": false}, "crowdsec": {"n": 1, "p": 0.0824, "hi": 3.44, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}, "blocklist_de": {"n": 1, "p": 0.1406, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}}, "h2": [["2026-10-05", 0.491, 0.010, 0, false], ["2026-10-12", 0.528, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.983, "ts": null, "map": 0.180, "obs": 0, "own": 0.496, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.528, "se": 0.890, "ts": 0.500, "map": 2.045, "obs": 2, "own": 1.195, "comp": {"cins": -0.369, "dshield": -0.7722, "crowdsec": 1.0354, "vulncheck": -0.5818, "blocklist_de": 2.7966}, "mass": 1.7, "listed": false}}, "abq": true, "bot": 0.820, "det": {"shodan": {"c2": 3}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://chinatelecom.cn"}, "pfx": 20, "reg": "2019-05-31", "rir": "apnic", "s24": 142, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 37632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018060280446}, {"a": 139220, "h": "CHINANET-Sichuan-Chuanxi-IDC", "n": "Sichuan Chuanxn IDC", "t": "Other", "w": 7, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 5, "home_connection": 1, "cve:CVE-2024-6387": 4}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 2, "p": 0.3092, "hi": 5.30, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}, "crowdsec": {"n": 5, "p": 0.8298, "hi": 8.52, "lo": 2.12, "ips": 5, "mean": 4.86, "above": true}, "blocklist_de": {"n": 3, "p": 0.5841, "hi": 7.09, "lo": 1.25, "ips": 3, "mean": 3.66, "above": false}}, "h2": [["2026-10-05", 7.044, 0.011, 0, false], ["2026-10-12", 8.994, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.013, "ts": null, "map": 0.185, "obs": 0, "own": 0.564, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 8.994, "se": 0.503, "ts": 0.556, "map": 17.333, "obs": 9, "own": 9.755, "comp": {"cins": 2.1195, "dshield": -2.1177, "crowdsec": 2.2739, "vulncheck": -0.89, "blocklist_de": 2.8606}, "mass": 8.4, "listed": false}}, "abq": true, "bot": 0.700, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 71, "reg": "2019-06-11", "rir": "apnic", "s24": 88, "sib": 281, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00010651672252}, {"a": 139256, "h": "NITC-AS-AP", "n": "National Information Technology Center", "t": "Other", "w": 0, "cc": "NP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.962, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NITC1-AP-APNIC", "org": "National Information Technology Center", "pdb": null, "pfx": 1, "reg": "2019-06-25", "rir": "apnic", "s24": 2, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "info@idmc.gov.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000409535532}, {"a": 139282, "h": "NOVUSNETWORK-AS-AP", "n": "Novus Network", "t": "Other", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-NN7-AP-APNIC", "org": "Novus Network", "pdb": null, "pfx": 3, "reg": "2019-07-04", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051811700465}, {"a": 139293, "h": "UFO-AS-AP", "n": "UFO Network Limited", "t": "Other", "w": 2, "cc": "HK", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.860, 0.864, 0, false], ["2026-10-12", 0.951, 0.895, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.895, "se": 1.780, "ts": 1.000, "map": 13.102, "obs": 1, "own": 20.105, "comp": {"urlhaus": -0.0271, "threatfox": -0.0398, "phishing_db": 4.2659}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.727, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UNL5-AP-APNIC", "org": "UFO Network Limited", "pdb": null, "pfx": 3, "reg": "2019-07-08", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@ufovps.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139367, "h": "IDNIC-DISKOMINFO-JAMBIKOTA-AS-ID", "n": "Dinas Kominfo Kota Jambi", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139367-APNIC", "org": "Dinas Kominfo Kota Jambi", "pdb": null, "pfx": 1, "reg": "2019-07-31", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@jambikota.go.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139381, "h": "IDNIC-CITRA-BERDIKARI-NUSANTARA-AS-ID", "n": "PT.CITRA BERDIKARI NUSANTARA", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 9765.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.213, "det": null, "oid": "@aut-139381-APNIC", "org": "PT.CITRA BERDIKARI NUSANTARA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://citraberdikari.co.id"}, "pfx": 2, "reg": "2019-07-31", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "hostmaster@citraberdikari.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000907683766}, {"a": 139421, "h": "PANDAWANET-AS-ID", "n": "Dharma Sarana Solusindo", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 12890.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.390, "det": null, "oid": "@aut-139421-APNIC", "org": "PT Dharma Sarana Solusindo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://pandawa.net.id"}, "pfx": 2, "reg": "2019-07-31", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@pandawa.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139431, "h": "IJASA-AS-ID", "n": "IJASA", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.130, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139431-APNIC", "org": "PT. Integrasi Jasa Nusantara", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ijasa.id"}, "pfx": 2, "reg": "2019-07-31", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@ijasa.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139432, "h": "IDNIC-BOGORKAB-AS-ID", "n": "Diskominfo Kab. Bogor", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.178, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-139432-APNIC", "org": "Diskominfo Kab. Bogor", "pdb": null, "pfx": 2, "reg": "2019-07-31", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@bogorkab.go.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139449, "h": "LINTASDATA-AS-ID", "n": "Lintasdata Network", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 3, "router_or_botnet": 3, "cve:CVE-2017-9841": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.467, "det": null, "oid": "@aut-139449-APNIC", "org": "PT Lintas Data Multimedia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://ldm.net.id"}, "pfx": 5, "reg": "2019-07-31", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@lintasdata.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006686938104}, {"a": 139457, "h": "IDNIC-ANTMEDIAHOST-AS-ID", "n": "Semut Data Indonesia", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.826, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-139457-APNIC", "org": "PT Semut Data Indonesia", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Selective", "web": "https://semutdata.co.id/"}, "pfx": 6, "reg": "2019-07-31", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "abuse@semutdata.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139468, "h": "DCI-AS-AP", "n": "DC Communications Inc.", "t": "Hosting & VPS", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.290, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.215, "obs": 0, "own": 0.134, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-DCI4-AP-APNIC", "org": "DC Communications Inc.", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://dc-communications.jp"}, "pfx": 12, "reg": "2019-08-01", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": "abuse@dc-communications.jp", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139477, "h": "TICPL-AS-IN", "n": "Trichy Internet Communication Pvt Ltd", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-139477-APNIC", "org": "Trichy Internet Communication Pvt Ltd", "pdb": null, "pfx": 3, "reg": "2019-08-06", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139482, "h": "VILMAX-AS-IN", "n": "Vilas Internet Services", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false]], "sh": false, "uc": null, "v2": null, "abq": false, "bot": null, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139482-APNIC", "org": "Vilas Internet Services Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.vilnet.net"}, "pfx": 5, "reg": "2019-08-06", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139490, "h": "ASPTNPL-AS-IN", "n": "Aspt Networks", "t": "Broadband & mobile", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 3, "web_bruteforce": 7, "home_connection": 7, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 8}, "ev": {"crowdsec": {"n": 5, "p": 0.8901, "hi": 9.74, "lo": 2.42, "ips": 8, "mean": 5.56, "above": true}, "blocklist_de": {"n": 4, "p": 0.7988, "hi": 8.87, "lo": 1.91, "ips": 4, "mean": 4.84, "above": true}}, "h2": [["2026-10-05", 14.425, 0.011, 1, false], ["2026-10-12", 24.675, 0.012, 1, false]], "sh": false, "uc": 3789.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 4}, "lo": 24.675, "se": 0.503, "ts": 0.556, "map": 47.729, "obs": 9, "own": 73.190, "comp": {"cins": -1.3738, "dshield": -2.0626, "crowdsec": 2.8851, "vulncheck": -0.8828, "blocklist_de": 6.6933}, "mass": 7.9, "listed": false}}, "abq": true, "bot": 0.108, "det": {"blocklist_de": {"bots": 2, "imap": 2, "mail": 2}}, "oid": "@aut-139490-APNIC", "org": "Aspt Networks Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.aeronetonline.in"}, "pfx": 30, "reg": "2019-08-06", "rir": "apnic", "s24": 30, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 7680, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00349304569785}, {"a": 139508, "h": "WIDENET-AS-IN", "n": "Wide Netcom India", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 6640.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.191, "det": {"blocklist_de": {"bots": 14}}, "oid": "@aut-139508-APNIC", "org": "Wide Netcom India", "pdb": null, "pfx": 7, "reg": "2019-08-06", "rir": "apnic", "s24": 7, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139549, "h": "CRISPENT-AS", "n": "Crisp Enterprises", "t": "Hosting & VPS", "w": 10, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 9, "web_exploit": 10, "web_bruteforce": 10, "router_or_botnet": 1, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 10, "cve:CVE-2024-28000": 1}, "n": 10}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 10, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 8.372, 0.011, 0, false], ["2026-10-12", 9.067, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.067, "se": 1.065, "ts": 1.000, "map": 49.793, "obs": 2, "own": 10.380, "comp": {"cins": -0.1977, "dshield": -0.4436, "crowdsec": 7.3833, "vulncheck": -0.4145, "blocklist_de": -1.026}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.180, "det": null, "oid": "@aut-139549-APNIC", "org": "Crisp Enterprises", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://crispdelhi.com/"}, "pfx": 2, "reg": "2019-08-06", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abusecrispenterprises2018@gmail.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139560, "h": "PATELINT-AS-IN", "n": "TANGOPLUS BROADBAND", "t": "Broadband & mobile", "w": 7, "cc": "IN", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 7, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.899, 0.011, 0, false], ["2026-10-12", 0.221, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 1.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.221, "se": 1.260, "ts": 1.000, "map": 1.686, "obs": 1, "own": 3.082, "comp": {"cins": -0.0982, "dshield": -0.23, "crowdsec": -0.9109, "vulncheck": 3.6683, "blocklist_de": -0.5129}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.115, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "@aut-139560-APNIC", "org": "TANGOPLUS BROADBAND PRIVATE LIMITED", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://tangoplusbroadband.com/"}, "pfx": 43, "reg": "2019-08-06", "rir": "apnic", "s24": 43, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": "admin@patelinternet.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139568, "h": "BIOCIPHR-AS-IN", "n": "Biocipher Technologies Pvt Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139568-APNIC", "org": "Biocipher Technologies Pvt Ltd", "pdb": null, "pfx": 1, "reg": "2019-08-06", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "info@biocipher.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139577, "h": "HNPL-AS-AP", "n": "Hispar Networks Pvt Ltd", "t": "Other", "w": 0, "cc": "PK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.970, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HNPL5-AP-APNIC", "org": "Hispar Networks Pvt Ltd", "pdb": null, "pfx": 2, "reg": "2019-08-06", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139580, "h": "RIMUHOSTING-AS-AP", "n": "RIMU HOSTING", "t": "Hosting & VPS", "w": 0, "cc": "NZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.973, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RHL1-AP-APNIC", "org": "RIMU HOSTING LIMITED", "pdb": null, "pfx": 6, "reg": "2019-08-11", "rir": "apnic", "s24": 6, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@rimuhosting.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000104817375}, {"a": 139587, "h": "CHINANET-Henan-Zhengzhou-Shujugang-IDC", "n": "China Telecom Henan Zhengzhou Shujugang IDC network", "t": "Broadband & mobile", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5066, "hi": 6.39, "lo": 1.13, "ips": 3, "mean": 3.30, "above": false}, "crowdsec": {"n": 1, "p": 0.1076, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 2, "p": 0.3551, "hi": 5.69, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 0.650, 0.011, 0, false], ["2026-10-12", 1.540, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 1.353, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.540, "se": 0.753, "ts": 0.667, "map": 4.646, "obs": 3, "own": 7.286, "comp": {"cins": -0.5626, "dshield": -1.0943, "crowdsec": -0.6988, "vulncheck": -0.693, "blocklist_de": 5.9783}, "mass": 2.6, "listed": false}}, "abq": true, "bot": 0.665, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 52, "reg": "2019-08-12", "rir": "apnic", "s24": 100, "sib": 281, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009324528356}, {"a": 139628, "h": "MEGATRUENET-AS-AP", "n": "Mega TrueNET", "t": "Broadband & mobile", "w": 2, "cc": "KH", "cf": null, "cs": {"c": {"web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1501, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 2, "p": 0.3278, "hi": 5.45, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}}, "h2": [["2026-10-05", 0.219, 0.011, 0, false], ["2026-10-12", 0.994, 0.012, 0, false]], "sh": false, "uc": 2720.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 1.545, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.994, "se": 0.919, "ts": 1.000, "map": 4.111, "obs": 2, "own": 6.575, "comp": {"cins": -0.3075, "dshield": -0.6595, "crowdsec": 5.8913, "vulncheck": -0.5322, "blocklist_de": -1.5847}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.111, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-TCC4-AP-APNIC", "org": "Mega Truenet Communication Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://megatruenet.com/"}, "pfx": 78, "reg": "2019-09-03", "rir": "apnic", "s24": 58, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29696, "abuse": "abuse@megatruenet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0026216812553}, {"a": 139646, "h": "HONG7-AS-AP", "n": "HONG KONG Megalayer Technology Co.", "t": "Broadband & mobile", "w": 60, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1359, "hi": 4.07, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "threatfox": {"n": 1, "p": 0.1938, "hi": 4.69, "lo": 0.35, "ips": 60, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.325, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.325, "se": 1.475, "ts": 1.000, "map": 2.810, "obs": 1, "own": 8.248, "comp": {"urlhaus": -0.1455, "threatfox": 3.1162, "phishing_db": -0.3116}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.837, "ts": null, "map": 0.168, "obs": 0, "own": 0.556, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.624, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:VShell": 60}}, "oid": "ORG-HKLT4-AP-APNIC", "org": "HONG KONG LIGHTLAYER TECHNOLOGY CO., LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.megalayer.net"}, "pfx": 15, "reg": "2019-09-12", "rir": "apnic", "s24": 78, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": "abuse@lightlayer.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139650, "h": "VIRTUALMONGOLIA-AS-AP", "n": "Virtual Link LLC", "t": "Other", "w": 0, "cc": "MN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.745, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VLL1-AP-APNIC", "org": "Virtual Link LLC", "pdb": null, "pfx": 2, "reg": "2019-09-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000661902178}, {"a": 139659, "h": "LUCID-AS-AP", "n": "LUCIDACLOUD", "t": "Hosting & VPS", "w": 23, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "ssh_bruteforce": 4, "web_bruteforce": 3, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-20062": 3}, "n": 4}, "ev": {"shodan": {"n": 18, "p": 1.0000, "hi": 22.84, "lo": 10.65, "ips": 18, "mean": 16.26, "above": true}, "crowdsec": {"n": 4, "p": 0.7007, "hi": 7.57, "lo": 1.63, "ips": 4, "mean": 4.13, "above": false}, "threatfox": {"n": 9, "p": 0.9988, "hi": 15.52, "lo": 5.36, "ips": 10, "mean": 9.88, "above": true}, "vulncheck": {"n": 8, "p": 0.9951, "hi": 13.86, "lo": 4.51, "ips": 8, "mean": 8.64, "above": true}, "blocklist_de": {"n": 2, "p": 0.3688, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}}, "h2": [["2026-10-05", 5.151, 15.208, 1, false], ["2026-10-12", 8.874, 13.327, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 9, "phishing_db": 0}, "lo": 13.327, "se": 0.789, "ts": 1.000, "map": 30.765, "obs": 9, "own": 10.713, "comp": {"urlhaus": -1.1079, "threatfox": 7.1314, "phishing_db": -0.971}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 8, "blocklist_de": 2}, "lo": 8.874, "se": 0.483, "ts": 0.571, "map": 16.348, "obs": 14, "own": 3.228, "comp": {"cins": -1.2776, "dshield": -1.9715, "crowdsec": 1.5784, "vulncheck": 5.1534, "blocklist_de": 0.705}, "mass": 7.2, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"c2": 5, "malware": 2, "compromised": 11}, "threatfox": {"family:AdaptixC2": 3, "family:Cobalt Strike": 4, "family:Unknown malware": 3}, "vulncheck": {"c2_server": 7, "attack_tooling": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-LL18-AP-APNIC", "org": "LUCIDACLOUD LIMITED", "pdb": {"t": "Network Services", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.yecaoyun.com/"}, "pfx": 96, "reg": "2019-09-18", "rir": "apnic", "s24": 79, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.9967], ["2026-10-12", 0.9980]], "ipv4": 39680, "abuse": "abuse@yecaoyun.com", "score": 0.9980, "groups": ["vulncheck", "abusech", "shodan"], "sensors": [], "traffic": 0.00243949975434}, {"a": 139692, "h": "CHEN-AS-AP", "n": "Chen Guang Network", "t": "Broadband & mobile", "w": 0, "cc": "MM", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 2.240, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.104, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CGCL2-AP-APNIC", "org": "CHEN GUANG COMPANY LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://chenguangnetwork.com/"}, "pfx": 3, "reg": "2023-03-21", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "noc@chenguangnetwork.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068678242416}, {"a": 139704, "h": "AS-AGBC", "n": "AGB Communication AS139704", "t": "Broadband & mobile", "w": 0, "cc": "MM", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.886, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ACC3-AP-APNIC", "org": "AGB Communication Co., Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.agbcommunication.com"}, "pfx": 6, "reg": "2019-10-04", "rir": "apnic", "s24": 4, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": "csirt@agbcommunication.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139753, "h": "UNINET-AS-VRU-AP", "n": "Valaya Alongkorn Rajabhat University Under The Royal Patronage,", "t": "Other", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.154, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 2, "reg": "2019-10-27", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "noc@uni.net.th", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002664808758}, {"a": 139820, "h": "HG1-AS-AP", "n": "HG TELECOMMUNICATION PRIVATE LIMITED", "t": "Broadband & mobile", "w": 2, "cc": "PK", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 1.834, 0.012, 0, false]], "sh": false, "uc": 956.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.834, "se": 0.953, "ts": 0.500, "map": 8.031, "obs": 2, "own": 12.913, "comp": {"cins": -0.3009, "dshield": -0.6469, "crowdsec": 1.7128, "vulncheck": -0.5262, "blocklist_de": 3.2381}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.116, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-HTL16-AP-APNIC", "org": "HG TELECOMMUNICATION PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://hg.com.pk/"}, "pfx": 29, "reg": "2023-02-14", "rir": "apnic", "s24": 29, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": "abuse@hg.com.pk", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00262816084234}, {"a": 139831, "h": "DTC-AS-AP", "n": "DITO Telecommunity Corporation", "t": "Broadband & mobile", "w": 1, "cc": "PH", "cf": {"rb": "hi", "wb": "hi", "rep": 1.11, "waf": 0.97}, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0592, "hi": 3.14, "lo": 0.23, "ips": 1, "mean": 1.32, "above": false}}, "h2": [["2026-10-05", 0.385, 0.010, 0, false], ["2026-10-12", 0.110, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 1.127, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.110, "se": 1.153, "ts": 1.000, "map": 0.711, "obs": 1, "own": 1.206, "comp": {"cins": -0.1824, "dshield": -0.4117, "crowdsec": 2.9879, "vulncheck": -0.3939, "blocklist_de": -0.9471}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.084, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-DTC2-AP-APNIC", "org": "DITO TELECOMMUNITY CORPORATION", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.dito.ph/"}, "pfx": 35, "reg": "2019-11-29", "rir": "apnic", "s24": 193, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 75264, "abuse": "noc@dito.ph", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.066057}, {"a": 139841, "h": "STARCOMMUNICATION-AS-AP", "n": "STAR COMMUNICATION", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 3, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 1, "router_or_botnet": 4}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6383, "hi": 7.65, "lo": 1.35, "ips": 4, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 16.063, 0.011, 1, false], ["2026-10-12", 17.361, 0.013, 1, false]], "sh": false, "uc": 10468.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 17.361, "se": 0.815, "ts": 1.000, "map": 58.864, "obs": 3, "own": 92.192, "comp": {"cins": -0.3736, "dshield": -0.7804, "crowdsec": 9.125, "vulncheck": -0.5851, "blocklist_de": -1.917}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.175, "det": null, "oid": "ORG-SC30-AP-APNIC", "org": "STAR COMMUNICATION", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://starcommunicationbd.com"}, "pfx": 5, "reg": "2019-12-02", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "abuse@starcommunicationbd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00138187958197}, {"a": 139879, "h": "GALAXY-AS-AP", "n": "Galaxy Broadband", "t": "Broadband & mobile", "w": 29, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 21, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 13, "home_connection": 19, "router_or_botnet": 1, "cve:CVE-2019-8318": 4, "cve:CVE-2025-4396": 1, "cve:CVE-2018-10562": 7, "cve:CVE-2024-12847": 20}, "n": 22}, "ev": {"dshield": {"n": 2, "p": 0.4117, "hi": 6.19, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}, "crowdsec": {"n": 4, "p": 0.7707, "hi": 8.44, "lo": 1.82, "ips": 22, "mean": 4.61, "above": false}, "blocklist_de": {"n": 4, "p": 0.7977, "hi": 8.85, "lo": 1.90, "ips": 5, "mean": 4.83, "above": true}}, "h2": [["2026-10-05", 30.142, 0.011, 1, false], ["2026-10-12", 26.257, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 4}, "lo": 26.257, "se": 0.488, "ts": 0.400, "map": 49.506, "obs": 10, "own": 75.857, "comp": {"cins": -1.4718, "dshield": 2.0427, "crowdsec": -0.1457, "vulncheck": -0.8941, "blocklist_de": 5.7647}, "mass": 8.7, "listed": false}}, "abq": false, "bot": 0.139, "det": {"blocklist_de": {"bots": 2, "apache": 3, "bruteforcelogin": 2}}, "oid": "ORG-GBL2-AP-APNIC", "org": "Galaxy Broadband (pvt.) Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.galaxy.net.pk/"}, "pfx": 32, "reg": "2019-12-12", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": "support@galaxy.net.pk", "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00463840450876}, {"a": 139880, "h": "OWGELS-AS-AP", "n": "COLOURS Fiber", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.005, 0.009, 0, false], ["2026-10-12", 0.005, 0.010, 0, false]], "sh": false, "uc": 91.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.880, "ts": null, "map": 0.148, "obs": 0, "own": 0.122, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.575, "ts": null, "map": 0.074, "obs": 0, "own": 0.021, "comp": null, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.805, "det": null, "oid": "ORG-OI12-AP-APNIC", "org": "OWGELS INTERNATIONAL CO., LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://coloursfiber.com/"}, "pfx": 21, "reg": "2024-08-26", "rir": "apnic", "s24": 578, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 148480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139922, "h": "DMNPL-AS-AP", "n": "DISH MEDIA NETWORK PUBLIC LIMITED", "t": "Broadband & mobile", "w": 2, "cc": "NP", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.4075, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-12", 2.428, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.428, "se": 0.970, "ts": 1.000, "map": 11.000, "obs": 2, "own": 17.739, "comp": {"cins": -0.3118, "dshield": -0.6675, "crowdsec": -2.6334, "vulncheck": -0.536, "blocklist_de": 7.9401}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.150, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-DMNP1-AP-APNIC", "org": "DISH MEDIA NETWORK PUBLIC LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.dishhome.com.np/"}, "pfx": 31, "reg": "2020-01-02", "rir": "apnic", "s24": 22, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@dishhome.com.np", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00957180848316}, {"a": 139923, "h": "ABCCLOUDSDNBHD-AS-AP", "n": "ABCCLOUD SDN.BHD.", "t": "Hosting & VPS", "w": 9, "cc": "MY", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6228, "hi": 7.48, "lo": 1.32, "ips": 3, "mean": 3.86, "above": false}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 8, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.420, 0.011, 0, false], ["2026-10-12", 2.731, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.731, "se": 0.977, "ts": 0.500, "map": 12.635, "obs": 2, "own": 2.598, "comp": {"cins": -0.2789, "dshield": -0.6051, "crowdsec": 1.939, "vulncheck": -0.5057, "blocklist_de": 3.3809}, "mass": 1.2, "listed": false}}, "abq": true, "bot": 0.711, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ftp": 8}}, "oid": "ORG-AA366-AP-APNIC", "org": "ABCCLOUD SDN.BHD.", "pdb": null, "pfx": 17, "reg": "2024-12-31", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139932, "h": "IDNIC-KOMINFOKRWKAB-AS-ID", "n": "DINAS KOMUNIKASI DAN INFORMATIKA KABUPATEN KARAWANG", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139932-APNIC", "org": "DINAS KOMUNIKASI DAN INFORMATIKA KABUPATEN KARAWANG", "pdb": null, "pfx": 2, "reg": "2019-12-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@karawangkab.go.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139951, "h": "ALFATINDO-AS-ID", "n": "ALFATINDO", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.130, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-139951-APNIC", "org": "PT Alfatih Indo Teknologi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://alfatindo.id"}, "pfx": 4, "reg": "2019-12-13", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139952, "h": "TRIDATA-AS-ID", "n": "Trisari Data Indonusa", "t": "Broadband & mobile", "w": 13, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 12, "web_exploit": 12, "bad_crawling": 12, "proxy_or_vpn": 2, "first_seen_30d": 6, "ssh_bruteforce": 2, "web_bruteforce": 11, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2020-37123": 1, "cve:CVE-2024-28000": 2}, "n": 13}, "ev": {"crowdsec": {"n": 3, "p": 0.6080, "hi": 7.33, "lo": 1.29, "ips": 13, "mean": 3.78, "above": false}}, "h2": [["2026-10-05", 4.641, 4.853, 0, false], ["2026-10-12", 4.959, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.959, "se": 0.779, "ts": 1.000, "map": 15.661, "obs": 3, "own": 24.514, "comp": {"cins": -0.4312, "dshield": -0.8808, "crowdsec": 8.2851, "vulncheck": -0.6237, "blocklist_de": -2.2046}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.536, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-139952-APNIC", "org": "PT Trisari Data Indonusa", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://tridata.co.id"}, "pfx": 22, "reg": "2019-12-13", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": "abuse@tridata.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0039296966016}, {"a": 139959, "h": "IDNIC-UPNVJ-AS-ID", "n": "UPN \"Veteran\" Jakarta", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.409, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-139959-APNIC", "org": "Universitas Pembangunan Nasional 'Veteran' Jakarta", "pdb": null, "pfx": 1, "reg": "2019-12-13", "rir": "apnic", "s24": 1, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "noc@hsp.net.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139963, "h": "STATIONHOTSPOT-AS-ID", "n": "PT.MURNI MAKMUR ABADI", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 11328.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.468, "det": null, "oid": "@aut-139963-APNIC", "org": "PT.MURNI MAKMUR ABADI", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://stationhotspot.net.id/"}, "pfx": 3, "reg": "2019-12-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006792581994}, {"a": 139980, "h": "IDNIC-DISKOMINFOTASIKMALAYAKOTA-AS-ID", "n": "Dinas Komunikasi Informasi Kota Tasikmalaya", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.160, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-139980-APNIC", "org": "Dinas Komunikasi Informasi Kota Tasikmalaya", "pdb": {"t": "Non-Profit", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://tasikmalayakota.go.id/"}, "pfx": 2, "reg": "2019-12-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 139994, "h": "XLNET-FTTH-ID", "n": "XLSmart AS139994", "t": "Transit & backbone", "w": 6, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 2, "web_bruteforce": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 2}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 2, "p": 0.3556, "hi": 5.69, "lo": 0.74, "ips": 3, "mean": 2.71, "above": false}, "blocklist_de": {"n": 2, "p": 0.3950, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 5.168, 0.011, 0, false], ["2026-10-12", 7.818, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 2.382, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.818, "se": 0.615, "ts": 0.400, "map": 18.373, "obs": 5, "own": 57.713, "comp": {"cins": -0.8291, "dshield": 1.6193, "crowdsec": 0.3401, "vulncheck": -0.7848, "blocklist_de": 3.959}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.110, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-139994-APNIC", "org": "PT XL Axiata Tbk", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.xlsmart.co.id"}, "pfx": 40, "reg": "2019-12-13", "rir": "apnic", "s24": 40, "sib": 3, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": "abuse@xlsmart.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0340272780452}, {"a": 139995, "h": "IDNIC-WIDEHOSTMEDIA-AS-ID", "n": "Wide Host Media", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.893, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://widehostmedia.com"}, "pfx": 1, "reg": "2019-12-13", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@widehostmedia.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140026, "h": "TIMORNET-AS-ID", "n": "PT. KUPANG INTERMEDIA", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 5.153, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 6.211, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-140026-APNIC", "org": "PT. KUPANG INTERMEDIA", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://timornet.id"}, "pfx": 5, "reg": "2019-12-13", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140038, "h": "DHAKACOLO-AS-AP", "n": "DHAKACOLO (PVT.) LIMITED.", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.946, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DL23-AP-APNIC", "org": "DHAKACOLO (PVT.) LIMITED.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://dhakacolo.com"}, "pfx": 6, "reg": "2020-01-15", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": "abuse@dhakacolo.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140042, "h": "IZEC-AS-AP", "n": "Zhipinshang (Hongkong) Electron Communication Technology", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.412, 0.011, 0, false], ["2026-10-12", 0.445, 0.012, 0, false]], "sh": false, "uc": 2857.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.775, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.445, "se": 1.365, "ts": 1.000, "map": 4.270, "obs": 1, "own": 2.893, "comp": {"cins": -0.1096, "dshield": -0.2553, "crowdsec": -1.0111, "vulncheck": -0.2766, "blocklist_de": 4.4978}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.488, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-ZECT1-AP-APNIC", "org": "Zhipinshang (Hongkong) Electron Communication Technology Limited", "pdb": null, "pfx": 18, "reg": "2020-01-17", "rir": "apnic", "s24": 19, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": "abuse@ctcsci.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00076314645106}, {"a": 140057, "h": "IPv4Superhub", "n": "IPv4 Superhub Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-ISL74-RIPE", "org": "IPv4 Superhub Limited", "pdb": null, "pfx": 3, "reg": "2020-01-22", "rir": "ripencc", "s24": 3, "sib": 4, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "abuse@ipv4superhub.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140061, "h": "CHINANET-Qinghai-AS-AP", "n": "Qinghai Telecom", "t": "Broadband & mobile", "w": 13, "cc": "CN", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2019-8318": 1, "cve:CVE-2024-6387": 3}, "n": 9}, "ev": {"cins": {"n": 3, "p": 0.2146, "hi": 4.32, "lo": 0.76, "ips": 3, "mean": 2.23, "above": false}, "dshield": {"n": 1, "p": 0.0166, "hi": 2.35, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "crowdsec": {"n": 9, "p": 0.0151, "hi": 2.61, "lo": 0.90, "ips": 9, "mean": 1.66, "above": false}, "blocklist_de": {"n": 2, "p": 0.0059, "hi": 2.08, "lo": 0.27, "ips": 2, "mean": 0.99, "above": false}}, "h2": [["2026-10-05", 0.755, 0.007, 0, false], ["2026-10-12", 0.875, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.789, "ts": null, "map": 0.109, "obs": 0, "own": 0.509, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.875, "se": 0.451, "ts": 0.600, "map": 1.501, "obs": 15, "own": 2.319, "comp": {"cins": 6.2789, "dshield": -1.1856, "crowdsec": 2.4086, "vulncheck": -0.9442, "blocklist_de": -4.7579}, "mass": 15.7, "listed": false}}, "abq": true, "bot": 0.597, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 687, "reg": "2020-01-24", "rir": "apnic", "s24": 1885, "sib": 281, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 832768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00210321622108}, {"a": 140073, "h": "DIGITALSYNAPSE-AS-AP", "n": "Digital Synapse", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.827, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DS6-AP-APNIC", "org": "Digital Synapse", "pdb": null, "pfx": 2, "reg": "2020-01-30", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@digitalsynapsebd.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140077, "h": "CNETBROADBAND-AS-AP", "n": "C Net Broadband", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 6347.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.213, "det": null, "oid": "ORG-CNB1-AP-APNIC", "org": "C Net Broadband", "pdb": null, "pfx": 4, "reg": "2020-02-02", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039409182109}, {"a": 140091, "h": "SHWE-AS-AP", "n": "SHWE MAHAR MAE KHONG", "t": "Transit & backbone", "w": 4, "cc": "MM", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "bad_crawling": 4}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 45.760, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.435, "det": null, "oid": "ORG-SMMK2-AP-APNIC", "org": "SHWE MAHAR MAE KHONG INDUSTRIAL COMPANY LIMITED", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://smktelecom.com"}, "pfx": 4, "reg": "2020-02-10", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": "infocom@smktelecom.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040093396224}, {"a": 140098, "h": "ANOWARA-AS-AP", "n": "Anowara Online System", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.207, "det": null, "oid": "ORG-AOS8-AP-APNIC", "org": "Anowara Online System", "pdb": null, "pfx": 1, "reg": "2025-02-23", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@anowaraonlinesystem.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140128, "h": "GSPACE-AS-IN", "n": "Gponspace Internet India Pvt Ltd", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 16406.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": true, "bot": 0.104, "det": null, "oid": "@aut-140128-APNIC", "org": "Gponspace Internet India Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://connect2india.com/GPONSPACE-INTERNET-INDIA-PRIVATE-LIMITED/5260200"}, "pfx": 2, "reg": "2020-02-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140139, "h": "ECONTEL-AS-IN", "n": "Juntoo Gigafiber Services", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 19.293, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.284, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-140139-APNIC", "org": "ECON TELECOMMUNICATIONS PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.econinternet.com"}, "pfx": 7, "reg": "2020-02-14", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": "info@econinternet.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140155, "h": "HOSTNET-AS-IN", "n": "The Pinnacle Group Inc", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.978, "det": null, "oid": "@aut-140155-APNIC", "org": "The Pinnacle Group Inc", "pdb": null, "pfx": 1, "reg": "2020-02-14", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140163, "h": "VCSSPL-AS", "n": "V-Connect Systems And Services Pvt. Ltd.", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.979, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-140163-APNIC", "org": "V-Connect Systems And Services Pvt. Ltd.", "pdb": null, "pfx": 3, "reg": "2020-02-14", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": "info@v-connect.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140171, "h": "REISNS-AS-IN", "n": "Reis Network solutions", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 1.689, 0.012, 0, false]], "sh": false, "uc": 4557.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.689, "se": 0.948, "ts": 0.500, "map": 7.384, "obs": 2, "own": 11.867, "comp": {"cins": -0.3049, "dshield": -0.6546, "crowdsec": 1.671, "vulncheck": -0.5299, "blocklist_de": 3.2115}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.217, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-140171-APNIC", "org": "Reis Network Solutions", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "https://reisnet.in"}, "pfx": 28, "reg": "2020-02-14", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": "abuse@reisnet.in", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006695631447}, {"a": 140173, "h": "KISPLD-AS", "n": "Kavya Internet Services Pvt. Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 24414.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": true, "bot": 0.667, "det": null, "oid": "@aut-140173-APNIC", "org": "Kavya Internet Services Pvt. Ltd.", "pdb": null, "pfx": 2, "reg": "2020-02-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140174, "h": "MITHRILTELECOM-AS", "n": "Mithril Telecommunications", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 20.061, 0.011, 1, false], ["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 35.813, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-140174-APNIC", "org": "Mithril Telecommunications Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.mithriltele.com"}, "pfx": 8, "reg": "2020-02-14", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045977412609}, {"a": 140227, "h": "HKCICL-AS-AP", "n": "Hong Kong Communications International Co.", "t": "Broadband & mobile", "w": 18, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2022-22954": 1, "cve:CVE-2022-46169": 1, "cve:CVE-2023-54391": 1}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.0673, "hi": 3.21, "lo": 0.42, "ips": 2, "mean": 1.53, "above": false}, "crowdsec": {"n": 4, "p": 0.2140, "hi": 4.17, "lo": 0.90, "ips": 4, "mean": 2.28, "above": false}, "threatfox": {"n": 9, "p": 0.9982, "hi": 14.69, "lo": 5.07, "ips": 10, "mean": 9.35, "above": true}, "vulncheck": {"n": 2, "p": 0.2841, "hi": 5.09, "lo": 0.66, "ips": 3, "mean": 2.43, "above": false}, "phishing_db": {"n": 2, "p": 0.2923, "hi": 5.16, "lo": 0.67, "ips": 2, "mean": 2.46, "above": false}, "blocklist_de": {"n": 2, "p": 0.1797, "hi": 4.25, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}}, "h2": [["2026-10-05", 1.332, 3.984, 0, false], ["2026-10-12", 1.227, 3.564, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 9, "phishing_db": 2}, "lo": 3.564, "se": 0.813, "ts": 0.818, "map": 8.201, "obs": 11, "own": 19.708, "comp": {"urlhaus": -1.4273, "threatfox": 4.8345, "phishing_db": 0.3232}, "mass": 5.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 2}, "lo": 1.227, "se": 0.536, "ts": 0.500, "map": 2.483, "obs": 8, "own": 3.859, "comp": {"cins": -1.1496, "dshield": -1.8421, "crowdsec": 2.8279, "vulncheck": 0.8512, "blocklist_de": 1.6158}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.825, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:Havoc": 1, "family:PureRAT": 5, "family:ValleyRAT": 1, "family:Cobalt Strike": 2, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-HKCI2-AP-APNIC", "org": "Hong Kong Communications International Co., Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.udc.hk"}, "pfx": 490, "reg": "2020-02-21", "rir": "apnic", "s24": 450, "sib": 1, "tor": 0, "w24": 16, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 141824, "abuse": "support@hncloud.com", "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00115054834982}, {"a": 140292, "h": "CHINATELECOM-JIANGSU-SUZHOU-5G-NETWORK", "n": "China Telecom Jiangsu Province Suzhou Network", "t": "Broadband & mobile", "w": 25, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 4, "ssh_bruteforce": 13, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 7, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1}, "n": 14}, "ev": {"cins": {"n": 2, "p": 0.0034, "hi": 1.94, "lo": 0.25, "ips": 2, "mean": 0.92, "above": false}, "shodan": {"n": 12, "p": 0.0000, "hi": 1.57, "lo": 0.62, "ips": 12, "mean": 1.05, "above": false}, "dshield": {"n": 5, "p": 0.0261, "hi": 2.72, "lo": 0.68, "ips": 5, "mean": 1.55, "above": false}, "urlhaus": {"n": 1, "p": 0.0624, "hi": 3.18, "lo": 0.24, "ips": 1, "mean": 1.34, "above": false}, "crowdsec": {"n": 13, "p": 0.0000, "hi": 1.37, "lo": 0.56, "ips": 14, "mean": 0.93, "above": false}, "blocklist_de": {"n": 10, "p": 0.0103, "hi": 2.53, "lo": 0.92, "ips": 11, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 1.891, 0.061, 0, false], ["2026-10-12", 0.703, 0.067, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.067, "se": 1.331, "ts": 1.000, "map": 0.402, "obs": 1, "own": 1.224, "comp": {"urlhaus": 2.1316, "threatfox": -0.4733, "phishing_db": -0.9436}, "mass": 3.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 5, "crowdsec": 13, "vulncheck": 0, "blocklist_de": 10}, "lo": 0.703, "se": 0.406, "ts": 0.433, "map": 1.124, "obs": 30, "own": 1.733, "comp": {"cins": 0.7708, "dshield": 0.8936, "crowdsec": -1.7992, "vulncheck": -0.981, "blocklist_de": 2.6261}, "mass": 33.1, "listed": false}}, "abq": true, "bot": 0.666, "det": {"shodan": {"malware": 1, "compromised": 11}, "blocklist_de": {"ssh": 8, "mail": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 3297, "reg": "2020-03-16", "rir": "apnic", "s24": 5314, "sib": 281, "tor": 0, "w24": 24, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1738496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00837523690276}, {"a": 140293, "h": "CHINATELECOM-JIANGSU-CHANGZHOU-5G-NETWORK", "n": "CHINATELECOM Jiangsu province Changzhou 5G network", "t": "Broadband & mobile", "w": 77, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 66, "web_exploit": 13, "bad_crawling": 19, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 52, "mail_bruteforce": 1, "cve:CVE-2025-4396": 23, "cve:CVE-2018-20062": 1, "cve:CVE-2022-26134": 3, "cve:CVE-2024-28000": 17}, "n": 71}, "ev": {"shodan": {"n": 2, "p": 0.0001, "hi": 1.37, "lo": 0.18, "ips": 2, "mean": 0.65, "above": false}, "dshield": {"n": 5, "p": 0.4907, "hi": 5.51, "lo": 1.37, "ips": 5, "mean": 3.14, "above": false}, "urlhaus": {"n": 1, "p": 0.1394, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "crowdsec": {"n": 10, "p": 0.0639, "hi": 3.10, "lo": 1.13, "ips": 71, "mean": 2.01, "above": false}, "blocklist_de": {"n": 2, "p": 0.0099, "hi": 2.24, "lo": 0.29, "ips": 3, "mean": 1.07, "above": false}}, "h2": [["2026-10-05", 3.149, 1.993, 0, false], ["2026-10-12", 0.939, 0.125, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.125, "se": 1.369, "ts": 1.000, "map": 0.854, "obs": 1, "own": 2.486, "comp": {"urlhaus": 2.747, "threatfox": -0.4307, "phishing_db": -0.8482}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.939, "se": 0.437, "ts": 0.588, "map": 1.600, "obs": 17, "own": 2.469, "comp": {"cins": -2.0341, "dshield": 4.8064, "crowdsec": 4.4399, "vulncheck": -0.9408, "blocklist_de": -4.4077}, "mass": 15.0, "listed": false}}, "abq": true, "bot": 0.613, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 1128, "reg": "2020-03-16", "rir": "apnic", "s24": 1684, "sib": 281, "tor": 0, "w24": 15, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 434176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00395312439912}, {"a": 140308, "h": "CHINATELECOM-GUANGDONG-ZHUHAI-5G-NETWORK", "n": "China Telecom Guangdong Province Zhuhai 5G Network", "t": "Broadband & mobile", "w": 5, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.2546, "hi": 4.58, "lo": 0.81, "ips": 3, "mean": 2.36, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 1.08, "lo": 0.08, "ips": 1, "mean": 0.45, "above": false}, "blocklist_de": {"n": 2, "p": 0.0270, "hi": 2.65, "lo": 0.34, "ips": 2, "mean": 1.26, "above": false}}, "h2": [["2026-10-05", 0.153, 0.008, 0, false], ["2026-10-12", 0.402, 0.009, 0, false]], "sh": false, "uc": 51.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.818, "ts": null, "map": 0.122, "obs": 0, "own": 0.591, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.402, "se": 0.562, "ts": 0.500, "map": 0.846, "obs": 6, "own": 1.314, "comp": {"cins": -1.1241, "dshield": 5.9423, "crowdsec": -4.5445, "vulncheck": -0.8471, "blocklist_de": 1.7994}, "mass": 6.1, "listed": false}}, "abq": true, "bot": 0.568, "det": {"blocklist_de": {"ftp": 1, "imap": 1, "mail": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 117, "reg": "2020-03-18", "rir": "apnic", "s24": 1282, "sib": 281, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 333568, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00267467440994}, {"a": 140309, "h": "CHINATELECOM-GUANGDONG-ZHONGSHAN-5G-NETWORK", "n": "CHINATELECOM Guangdong province Zhongshan 5G network", "t": "Broadband & mobile", "w": 3, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.0802, "hi": 3.42, "lo": 0.26, "ips": 1, "mean": 1.44, "above": false}, "crowdsec": {"n": 2, "p": 0.0077, "hi": 2.16, "lo": 0.28, "ips": 2, "mean": 1.03, "above": false}, "blocklist_de": {"n": 2, "p": 0.1005, "hi": 3.55, "lo": 0.46, "ips": 2, "mean": 1.69, "above": false}}, "h2": [["2026-10-12", 0.548, 0.010, 0, false]], "sh": false, "uc": 92.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.863, "ts": null, "map": 0.141, "obs": 0, "own": 0.732, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.548, "se": 0.598, "ts": 0.400, "map": 1.233, "obs": 5, "own": 1.918, "comp": {"cins": -0.9642, "dshield": 1.211, "crowdsec": -0.7876, "vulncheck": -0.8169, "blocklist_de": 2.9605}, "mass": 5.0, "listed": false}}, "abq": true, "bot": 0.452, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 64, "reg": "2020-03-18", "rir": "apnic", "s24": 720, "sib": 281, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 184320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055461957122}, {"a": 140319, "h": "CHINATELECOM-GUANGDONG-QINGYUAN-5G-NETWORK", "n": "CHINATELECOM Guangdong province Qingyuan 5G network", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.0009, "hi": 1.52, "lo": 0.11, "ips": 1, "mean": 0.64, "above": false}, "crowdsec": {"n": 1, "p": 0.0002, "hi": 1.30, "lo": 0.10, "ips": 1, "mean": 0.55, "above": false}}, "h2": [["2026-10-12", 0.036, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.837, "ts": null, "map": 0.131, "obs": 0, "own": 0.650, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.036, "se": 1.048, "ts": 1.000, "map": 0.190, "obs": 1, "own": 0.314, "comp": {"cins": -0.2473, "dshield": -0.5434, "crowdsec": 2.2734, "vulncheck": -0.4732, "blocklist_de": -1.279}, "mass": 1.1, "listed": false}}, "abq": true, "bot": 0.468, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 93, "reg": "2020-03-18", "rir": "apnic", "s24": 997, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 258048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051977245476}, {"a": 140389, "h": "IDNIC-DBIZ-AS-ID", "n": "Dewa Bisnis Digital", "t": "Hosting & VPS", "w": 6, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2023-50164": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.3987, "hi": 6.07, "lo": 0.79, "ips": 4, "mean": 2.89, "above": false}, "phishing_db": {"n": 2, "p": 0.4186, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 7.129, 4.861, 0, false], ["2026-10-12", 7.734, 4.937, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 4.937, "se": 1.199, "ts": 1.000, "map": 26.575, "obs": 2, "own": 9.762, "comp": {"urlhaus": -0.2394, "threatfox": -0.2405, "phishing_db": 5.3861}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.734, "se": 0.792, "ts": 0.667, "map": 25.223, "obs": 3, "own": 5.039, "comp": {"cins": -0.4408, "dshield": -0.8973, "crowdsec": 4.2541, "vulncheck": -0.6296, "blocklist_de": 2.3351}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.937, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-140389-APNIC", "org": "PT Dewa Bisnis Digital", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-100Mbps", "pol": "Open", "web": "https://dewabiz.com/"}, "pfx": 21, "reg": "2020-03-27", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": "abusen@dewabiz.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005330427872}, {"a": 140407, "h": "KITANET-AS-ID", "n": "KitaNet", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.127, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-140407-APNIC", "org": "KitaNet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://kita.net.id"}, "pfx": 9, "reg": "2020-03-27", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": "abuse@kitanet.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140411, "h": "IDNIC-PARAMADINA-AS-ID", "n": "UNIVERSITAS PARAMADINA", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.106, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-140411-APNIC", "org": "UNIVERSITAS PARAMADINA", "pdb": null, "pfx": 1, "reg": "2020-03-27", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": "abuse@paramadina.ac.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140429, "h": "URBANACCESS-AS-ID", "n": "URBANACCESS", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "proxy_or_vpn": 3, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 10.978, 0.011, 1, false], ["2026-10-12", 11.989, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.989, "se": 1.090, "ts": 1.000, "map": 69.245, "obs": 2, "own": 113.894, "comp": {"cins": -0.1839, "dshield": -0.415, "crowdsec": 7.5814, "vulncheck": -0.396, "blocklist_de": -0.9552}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.356, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://urbanaccess.net"}, "pfx": 2, "reg": "2020-03-27", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@uebanaccess.net", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140443, "h": "IDNIC-HERZA-AS-ID", "n": "Herza Cloud", "t": "Hosting & VPS", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "web_bruteforce": 3, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 3, "cve:CVE-2026-87902": 1}, "n": 3}, "ev": {"shodan": {"n": 5, "p": 0.8881, "hi": 9.69, "lo": 2.41, "ips": 5, "mean": 5.53, "above": true}, "crowdsec": {"n": 3, "p": 0.5762, "hi": 7.01, "lo": 1.24, "ips": 3, "mean": 3.62, "above": false}}, "h2": [["2026-10-05", 1.280, 0.011, 0, false], ["2026-10-12", 2.965, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.259, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.965, "se": 0.766, "ts": 1.000, "map": 9.148, "obs": 3, "own": 1.825, "comp": {"cins": -0.4552, "dshield": -0.9215, "crowdsec": 7.946, "vulncheck": -0.6381, "blocklist_de": -2.324}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.875, "det": {"shodan": {"malware": 1, "compromised": 4}}, "oid": "@aut-140443-APNIC", "org": "PT Herza Digital Indonesia", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.herza.id"}, "pfx": 47, "reg": "2020-03-27", "rir": "apnic", "s24": 40, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 14336, "abuse": "abuse@herza.id", "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0008104392107}, {"a": 140444, "h": "IDNIC-BINAWAN-AS-ID", "n": "Universitas Binawan", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.328, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-140444-APNIC", "org": "Universitas Binawan", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://binawan.ac.id"}, "pfx": 2, "reg": "2020-03-27", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@binawan.ac.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140456, "h": "IDNIC-ERANYACLOUD-AS-ID", "n": "PT Era Awan Digital", "t": "Hosting & VPS", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 12.678, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 12.678, "se": 0.829, "ts": 0.333, "map": 43.524, "obs": 3, "own": 8.905, "comp": {"cins": -0.3346, "dshield": -0.7098, "crowdsec": 1.3723, "vulncheck": 1.8203, "blocklist_de": 3.0188}, "mass": 1.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-140456-APNIC", "org": "PT Era Awan Digital", "pdb": null, "pfx": 9, "reg": "2020-03-27", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140467, "h": "KGS-AS-ID", "n": "PT. KREATIF GLOBAL SOLUSINDO", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-140467-APNIC", "org": "PT Kreatif Global Solusindo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.creative.co.id"}, "pfx": 2, "reg": "2020-03-27", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "admin@creative.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140469, "h": "WANET-AS-ID", "n": "Wahyu Adidaya Network", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 4.980, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.980, "se": 1.016, "ts": 1.000, "map": 24.735, "obs": 2, "own": 40.082, "comp": {"cins": -0.2276, "dshield": -0.5042, "crowdsec": 6.9636, "vulncheck": -0.4511, "blocklist_de": -1.1787}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.310, "det": null, "oid": "@aut-140469-APNIC", "org": "PT Wahyu Adidaya Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://winet.net.id"}, "pfx": 7, "reg": "2020-03-27", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": "abuse@wahyuadidaya.co.id", "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000543799256}, {"a": 140479, "h": "WIFIKITA-AS-ID", "n": "Wifikita", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.288, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.ignwifikita.com"}, "pfx": 2, "reg": "2020-03-27", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": "abuse@ignwifikita.com", "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140481, "h": "T2NET-AS-ID", "n": "Tonggak Teknologi Netikom", "t": "Broadband & mobile", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 4, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 4}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.8044, "hi": 8.96, "lo": 1.93, "ips": 5, "mean": 4.90, "above": true}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 29.811, 0.011, 1, false], ["2026-10-12", 31.877, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 31.877, "se": 0.626, "ts": 0.800, "map": 76.903, "obs": 5, "own": 118.560, "comp": {"cins": -0.7157, "dshield": -1.3185, "crowdsec": 7.9147, "vulncheck": -0.7515, "blocklist_de": 0.6073}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.286, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-140481-APNIC", "org": "PT Tonggak Teknologi Netikom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://T2net.id"}, "pfx": 8, "reg": "2020-03-27", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.001518710952}, {"a": 140482, "h": "IDEANET-AS-ID", "n": "IdeaNet", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.012, 0.887, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.887, "se": 1.784, "ts": 1.000, "map": 12.743, "obs": 1, "own": 50.146, "comp": {"urlhaus": 4.4321, "threatfox": -0.0933, "phishing_db": -0.1677}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.162, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-140482-APNIC", "org": "IdeaNet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://ideanet.net.id/"}, "pfx": 5, "reg": "2020-03-27", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140527, "h": "CHINANET-ANHUI-WUHU-IDC", "n": "China Telecom Anhui Province Wuhu IDC Network", "t": "Broadband & mobile", "w": 10, "cc": "CN", "cf": null, "cs": {"c": {"proxy_or_vpn": 3, "ssh_bruteforce": 7, "cve:CVE-2024-6387": 5}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1372, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "shodan": {"n": 3, "p": 0.2054, "hi": 4.25, "lo": 0.75, "ips": 3, "mean": 2.19, "above": false}, "dshield": {"n": 1, "p": 0.1234, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "crowdsec": {"n": 7, "p": 0.7343, "hi": 6.50, "lo": 1.97, "ips": 7, "mean": 3.95, "above": false}, "blocklist_de": {"n": 3, "p": 0.3885, "hi": 5.49, "lo": 0.97, "ips": 3, "mean": 2.83, "above": false}}, "h2": [["2026-10-05", 2.222, 0.010, 0, false], ["2026-10-12", 3.033, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.911, "ts": null, "map": 0.160, "obs": 0, "own": 0.908, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.033, "se": 0.468, "ts": 0.583, "map": 5.400, "obs": 12, "own": 8.317, "comp": {"cins": 1.4321, "dshield": -0.6111, "crowdsec": 2.8672, "vulncheck": -0.9205, "blocklist_de": 0.3124}, "mass": 11.5, "listed": false}}, "abq": false, "bot": 0.720, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 25, "reg": "2020-04-01", "rir": "apnic", "s24": 385, "sib": 281, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 103680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036174260356}, {"a": 140543, "h": "READYDEDIS-AS-AP", "n": "ReadyDedis, LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.509, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.509, "se": 1.406, "ts": 1.000, "map": 5.081, "obs": 1, "own": 3.647, "comp": {"cins": -0.0625, "dshield": -0.1485, "crowdsec": -0.5888, "vulncheck": 4.1459, "blocklist_de": -0.3269}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.888, "det": {"shodan": {"compromised": 1}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-RL26-AP-APNIC", "org": "ReadyDedis, LLC", "pdb": null, "pfx": 9, "reg": "2020-04-03", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140577, "h": "AHREFS-AS-AP", "n": "Ahrefs PTE Ltd", "t": "Enterprise, edu & gov", "w": 49, "cc": "SG", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 5, "p": 0.9012, "hi": 10.04, "lo": 2.50, "ips": 49, "mean": 5.73, "above": true}}, "h2": [["2026-10-05", 7.501, 0.011, 0, false], ["2026-10-12", 8.770, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 2.770, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 5}, "lo": 8.770, "se": 0.616, "ts": 1.000, "map": 20.643, "obs": 5, "own": 115.636, "comp": {"cins": -0.9817, "dshield": -1.6566, "crowdsec": -6.4791, "vulncheck": -0.8206, "blocklist_de": 14.359}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"blocklist_de": {"bots": 49}}, "oid": "ORG-APL63-AP-APNIC", "org": "Ahrefs Pte Ltd", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://ahrefs.com"}, "pfx": 12, "reg": "2020-04-16", "rir": "apnic", "s24": 44, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.02773406834002}, {"a": 140641, "h": "YOTTA", "n": "YOTTA NETWORK SERVICES", "t": "Broadband & mobile", "w": 13, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 8, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"shodan": {"n": 15, "p": 1.0000, "hi": 15.03, "lo": 6.53, "ips": 15, "mean": 10.42, "above": true}, "dshield": {"n": 1, "p": 0.1461, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 8, "p": 0.9318, "hi": 8.66, "lo": 2.82, "ips": 8, "mean": 5.40, "above": true}, "vulncheck": {"n": 2, "p": 0.3407, "hi": 5.56, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "phishing_db": {"n": 3, "p": 0.5654, "hi": 6.91, "lo": 1.22, "ips": 3, "mean": 3.56, "above": false}, "blocklist_de": {"n": 3, "p": 0.4721, "hi": 6.11, "lo": 1.08, "ips": 3, "mean": 3.15, "above": false}}, "h2": [["2026-10-05", 4.043, 1.329, 0, false], ["2026-10-12", 4.483, 1.354, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 1.354, "se": 1.012, "ts": 1.000, "map": 4.565, "obs": 3, "own": 11.577, "comp": {"urlhaus": -0.6385, "threatfox": -0.4024, "phishing_db": 4.1854}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 8, "vulncheck": 2, "blocklist_de": 3}, "lo": 4.483, "se": 0.459, "ts": 0.571, "map": 8.001, "obs": 14, "own": 12.314, "comp": {"cins": -1.7148, "dshield": -0.5425, "crowdsec": 5.0246, "vulncheck": 0.1034, "blocklist_de": 0.6026}, "mass": 11.1, "listed": false}}, "abq": false, "bot": 0.799, "det": {"shodan": {"compromised": 15}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"sip": 1, "ssh": 2}}, "oid": "@aut-140641-APNIC", "org": "YOTTA NETWORK SERVICES PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.yotta.com"}, "pfx": 184, "reg": "2020-05-13", "rir": "apnic", "s24": 251, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 72960, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00150577200347}, {"a": 140659, "h": "VONET-AS-AP", "n": "Vonet Technology", "t": "Broadband & mobile", "w": 0, "cc": "KH", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 13541.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 2.240, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.309, "det": null, "oid": "ORG-VTCL2-AP-APNIC", "org": "Vonet technology Co., Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.vonettech.net.kh/"}, "pfx": 3, "reg": "2020-05-18", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015023762828}, {"a": 140687, "h": "ISEVEN-AS-AP", "n": "I Seven", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6300, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 0.510, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.955, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-IS12-AP-APNIC", "org": "I Seven", "pdb": null, "pfx": 12, "reg": "2022-02-26", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140716, "h": "UNICOM-JSWX-IDC", "n": "UNICOM JiangSu WuXi IDC network", "t": "Other", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1046, "hi": 3.71, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.549, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.989, "ts": null, "map": 0.181, "obs": 0, "own": 0.509, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.770, "ts": null, "map": 0.143, "obs": 0, "own": 0.152, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.622, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 66, "reg": "2020-06-11", "rir": "apnic", "s24": 130, "sib": 25, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000046028112}, {"a": 140726, "h": "UNICOM-HEFEI-MAN", "n": "China Unicom AnHui Province Network", "t": "Broadband & mobile", "w": 2, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2, "home_connection": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0098, "hi": 2.13, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "crowdsec": {"n": 2, "p": 0.0193, "hi": 2.50, "lo": 0.32, "ips": 2, "mean": 1.19, "above": false}, "blocklist_de": {"n": 1, "p": 0.0462, "hi": 2.94, "lo": 0.22, "ips": 1, "mean": 1.24, "above": false}}, "h2": [["2026-10-05", 0.153, 0.009, 0, false], ["2026-10-12", 0.314, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.881, "ts": null, "map": 0.149, "obs": 0, "own": 0.794, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.314, "se": 0.722, "ts": 0.667, "map": 0.884, "obs": 3, "own": 1.389, "comp": {"cins": -0.6056, "dshield": -1.1598, "crowdsec": 2.4551, "vulncheck": -0.7114, "blocklist_de": 1.2923}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.440, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CU1-AP-APNIC", "org": "China Unicom", "pdb": null, "pfx": 127, "reg": "2020-06-15", "rir": "apnic", "s24": 572, "sib": 25, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 150016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00379421234244}, {"a": 140766, "h": "FPTCLOUD-AS-VN", "n": "FPT Smart Cloud Company Limited", "t": "Hosting & VPS", "w": 7, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 8, "p": 0.9860, "hi": 11.67, "lo": 3.80, "ips": 8, "mean": 7.27, "above": true}, "crowdsec": {"n": 1, "p": 0.1004, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "vulncheck": {"n": 3, "p": 0.6082, "hi": 7.33, "lo": 1.29, "ips": 3, "mean": 3.78, "above": false}, "phishing_db": {"n": 1, "p": 0.1761, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 3, "p": 0.5678, "hi": 6.93, "lo": 1.22, "ips": 3, "mean": 3.57, "above": false}}, "h2": [["2026-10-05", 0.488, 0.278, 0, false], ["2026-10-12", 3.565, 0.290, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.290, "se": 1.456, "ts": 1.000, "map": 2.425, "obs": 1, "own": 1.091, "comp": {"urlhaus": -0.1768, "threatfox": -0.1959, "phishing_db": 2.8846}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 3}, "lo": 3.565, "se": 0.575, "ts": 0.429, "map": 7.724, "obs": 7, "own": 1.539, "comp": {"cins": -0.9383, "dshield": -1.6053, "crowdsec": -3.4302, "vulncheck": 2.3605, "blocklist_de": 7.0513}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.685, "det": {"shodan": {"c2": 1, "compromised": 7}, "vulncheck": {"attack_tooling": 3}, "blocklist_de": {"ssh": 3}}, "oid": "@aut-140766-APNIC", "org": "FPT Smart Cloud Company Limited", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Selective", "web": "https://fptsmartcloud.com"}, "pfx": 152, "reg": "2020-06-17", "rir": "apnic", "s24": 111, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 58880, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00134877845038}, {"a": 140787, "h": "LAMA-AS-VN", "n": "LAM A ARCHITECTURE CONSTRUCTION COMPANY LIMITED", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.502, "det": null, "oid": "@aut-140787-APNIC", "org": "LAM A ARCHITECTURE CONSTRUCTION COMPANY LIMITED", "pdb": null, "pfx": 2, "reg": "2020-06-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000947301782}, {"a": 140791, "h": "BKH-AS-VN", "n": "BKHOST TECHNOLOGY VIETNAM JOINT STOCK COMPANY", "t": "Hosting & VPS", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 1.024, 1, false], ["2026-10-12", 12.714, 1.068, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.068, "se": 1.917, "ts": 1.000, "map": 16.822, "obs": 1, "own": 13.738, "comp": {"urlhaus": 4.5442, "threatfox": -0.0344, "phishing_db": -0.0609}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 15.611, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.789, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-140791-APNIC", "org": "BKHOST TECHNOLOGY VIETNAM JOINT STOCK COMPANY", "pdb": null, "pfx": 1, "reg": "2020-06-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140810, "h": "MEGACORE-AS-VN", "n": "Megacore Technology Company", "t": "Other", "w": 9, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 22.79, "lo": 10.16, "ips": 16, "mean": 15.94, "above": true}, "urlhaus": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 4, "p": 0.7722, "hi": 8.46, "lo": 1.82, "ips": 6, "mean": 4.62, "above": false}, "vulncheck": {"n": 1, "p": 0.1920, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 3, "p": 0.6249, "hi": 7.50, "lo": 1.32, "ips": 3, "mean": 3.87, "above": false}}, "h2": [["2026-10-05", 18.084, 8.825, 1, false], ["2026-10-12", 18.075, 0.650, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.650, "se": 1.651, "ts": 1.000, "map": 7.867, "obs": 1, "own": 10.360, "comp": {"urlhaus": 4.2092, "threatfox": -0.1832, "phishing_db": -0.3371}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 3}, "lo": 18.075, "se": 0.531, "ts": 0.500, "map": 36.218, "obs": 8, "own": 20.409, "comp": {"cins": -1.1538, "dshield": -1.8465, "crowdsec": 2.786, "vulncheck": -0.0041, "blocklist_de": 5.2016}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.912, "det": {"shodan": {"c2": 1, "compromised": 15}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "@aut-140810-APNIC", "org": "Megacore Technology Company Limited", "pdb": null, "pfx": 15, "reg": "2020-06-17", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7936, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00078033486062}, {"a": 140814, "h": "TECHCITYGROUP-AS-VN", "n": "TECHCITYGROUP", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 2, "reg": "2020-06-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037342025084}, {"a": 140815, "h": "HTTVSERVER-VN", "n": "HTTVSERVER TECHNOLOGY COMPANY LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1400, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.025, "ts": null, "map": 0.187, "obs": 0, "own": 0.227, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.847, "ts": null, "map": 0.172, "obs": 0, "own": 0.074, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.665, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-140815-APNIC", "org": "HTTVSERVER TECHNOLOGY COMPANY LIMITED", "pdb": null, "pfx": 36, "reg": "2020-06-17", "rir": "apnic", "s24": 72, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027433221872}, {"a": 140825, "h": "HOSTINGVIET-AS-VN", "n": "Thien Quang Digital technology joint stock company", "t": "Hosting & VPS", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"first_seen_30d": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6271, "hi": 7.53, "lo": 1.33, "ips": 3, "mean": 3.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 6.250, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 6.250, "se": 0.809, "ts": 0.333, "map": 20.560, "obs": 3, "own": 4.199, "comp": {"cins": -0.366, "dshield": -0.7669, "crowdsec": 1.064, "vulncheck": 1.6702, "blocklist_de": 2.8157}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.842, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"mail": 1}}, "oid": "@aut-140825-APNIC", "org": "Thien Quang Digital technology joint stock company", "pdb": null, "pfx": 12, "reg": "2020-06-17", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016256920904}, {"a": 140829, "h": "AS140829", "n": "VNNIC-4byte-ASBLOCK-AP", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.927, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 3, "reg": "2020-06-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140843, "h": "DHAMRAINETWORK-AS-AP", "n": "Dhamrai Network", "t": "Other", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.213, "det": null, "oid": "ORG-DN9-AP-APNIC", "org": "Dhamrai Network", "pdb": null, "pfx": 2, "reg": "2020-06-19", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044466361817}, {"a": 140869, "h": "TGL-AS-AP", "n": "Turing Group Limited", "t": "Other", "w": 9, "cc": "NZ", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1872, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 3, "p": 0.5547, "hi": 6.81, "lo": 1.20, "ips": 3, "mean": 3.51, "above": false}, "dshield": {"n": 1, "p": 0.1840, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "urlhaus": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3175, "hi": 5.37, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "threatfox": {"n": 4, "p": 0.8102, "hi": 9.06, "lo": 1.95, "ips": 5, "mean": 4.95, "above": true}, "vulncheck": {"n": 1, "p": 0.1844, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.3780, "hi": 5.89, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}}, "h2": [["2026-10-05", 0.009, 10.247, 1, false], ["2026-10-12", 7.551, 10.331, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 4, "phishing_db": 0}, "lo": 10.331, "se": 0.900, "ts": 0.800, "map": 29.533, "obs": 5, "own": 27.608, "comp": {"urlhaus": 2.3081, "threatfox": 3.6232, "phishing_db": -0.9196}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 7.551, "se": 0.555, "ts": 0.286, "map": 15.937, "obs": 7, "own": 9.020, "comp": {"cins": 2.876, "dshield": 0.8712, "crowdsec": -1.7236, "vulncheck": 0.0661, "blocklist_de": 2.0726}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.674, "det": {"shodan": {"c2": 2, "compromised": 1}, "threatfox": {"family:PureRAT": 3, "family:AdaptixC2": 1, "family:ValleyRAT": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-AA238-AP-APNIC", "org": "Turing Group Limited", "pdb": null, "pfx": 62, "reg": "2022-10-18", "rir": "apnic", "s24": 65, "sib": 0, "tor": 0, "w24": 6, "drop": 2, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 16640, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": null}, {"a": 140900, "h": "GETLINKS2-AS-AP", "n": "Getlinks", "t": "Broadband & mobile", "w": 25, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 9, "web_exploit": 24, "proxy_or_vpn": 3, "ssh_bruteforce": 8, "web_bruteforce": 8, "home_connection": 22, "router_or_botnet": 16, "cve:CVE-2019-8318": 12, "cve:CVE-2018-10562": 12, "cve:CVE-2024-12847": 16}, "n": 24}, "ev": {"cins": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 24, "mean": 2.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 11.421, 0.011, 1, false], ["2026-10-12", 18.404, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 18.404, "se": 0.623, "ts": 0.400, "map": 43.791, "obs": 5, "own": 67.663, "comp": {"cins": 3.5029, "dshield": 1.7207, "crowdsec": 0.6206, "vulncheck": -0.7762, "blocklist_de": 0.1051}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.135, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-GA63-AP-APNIC", "org": "Getlinks (SMC-Private) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://getlinks.net.pk/"}, "pfx": 16, "reg": "2020-07-09", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00194851207276}, {"a": 140920, "h": "HICLOUDS-AS-AP", "n": "HICLOUDS (SINGAPORE) PTE.LTD.", "t": "Hosting & VPS", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.321, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HP3-AP-APNIC", "org": "HICLOUDS (SINGAPORE) PTE.LTD.", "pdb": null, "pfx": 2, "reg": "2020-07-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140941, "h": "FULLTIMEHOSTING-AS-AP", "n": "Full Time Hosting", "t": "Hosting & VPS", "w": 0, "cc": "PK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.940, "det": null, "oid": "ORG-FTH1-AP-APNIC", "org": "Full Time Hosting", "pdb": {"t": "Network Services", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://fulltimehosting.net"}, "pfx": 1, "reg": "2020-07-22", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140947, "h": "SNTHOSTINGS-AS-AP", "n": "SnTHostings", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2019-11510": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.979, 0.923, 0, false], ["2026-10-12", 1.097, 0.953, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.953, "se": 1.821, "ts": 1.000, "map": 14.495, "obs": 1, "own": 9.249, "comp": {"urlhaus": -0.02, "threatfox": -0.0299, "phishing_db": 4.3499}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SA171-AP-APNIC", "org": "SnTHostings", "pdb": null, "pfx": 1, "reg": "2020-07-23", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 140952, "h": "STL-AS-AP", "n": "Strong Technology, LLC", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2023-23752": 1, "cve:CVE-2025-55182": 2, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"dshield": {"n": 3, "p": 0.6425, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}, "crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-12", 19.390, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 19.390, "se": 0.620, "ts": 0.600, "map": 46.280, "obs": 5, "own": 26.108, "comp": {"cins": -0.7024, "dshield": 8.7117, "crowdsec": 1.4977, "vulncheck": -0.7471, "blocklist_de": -3.5316}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.252, "det": null, "oid": "ORG-STL12-AP-APNIC", "org": "Strong Technology, LLC", "pdb": null, "pfx": 15, "reg": "2020-07-24", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00074356790155}, {"a": 141004, "h": "QTIME-AS-AP", "n": "QTIME BUSINESSES", "t": "Other", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.7977, "hi": 8.85, "lo": 1.91, "ips": 4, "mean": 4.83, "above": true}, "crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 2.680, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.680, "se": 0.975, "ts": 1.000, "map": 12.353, "obs": 2, "own": 7.278, "comp": {"cins": -0.2579, "dshield": -0.5644, "crowdsec": 6.5478, "vulncheck": -0.4845, "blocklist_de": -1.3334}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.762, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-QBPL1-AP-APNIC", "org": "QTIME BUSINESSES PRIVATE LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://qtime.net.in/"}, "pfx": 12, "reg": "2020-08-14", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 4096, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 141031, "h": "CONNECT-AS-AP", "n": "Connect Communications pvt ltd", "t": "Transit & backbone", "w": 8, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.3767, "hi": 5.87, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "blocklist_de": {"n": 3, "p": 0.6278, "hi": 7.54, "lo": 1.33, "ips": 4, "mean": 3.89, "above": false}}, "h2": [["2026-10-05", 10.255, 0.011, 1, false], ["2026-10-12", 15.445, 0.012, 1, false]], "sh": false, "uc": 1186.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 2.572, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 15.445, "se": 0.576, "ts": 0.500, "map": 34.034, "obs": 6, "own": 106.492, "comp": {"cins": -0.9907, "dshield": 1.1349, "crowdsec": -0.9975, "vulncheck": -0.8224, "blocklist_de": 6.5968}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-CC1-AP-APNIC", "org": "Connect Communication", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Restrictive", "web": "http://www.connect.net.pk"}, "pfx": 27, "reg": "2020-08-25", "rir": "apnic", "s24": 27, "sib": 3, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0033589018837}, {"a": 141039, "h": "PACKETHUBSA-AS-AP", "n": "PacketHub AS141039", "t": "Other", "w": 5, "cc": "PA", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"dshield": {"n": 4, "p": 0.8081, "hi": 9.03, "lo": 1.94, "ips": 4, "mean": 4.93, "above": true}, "crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-12", 10.384, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 0.734, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.384, "se": 0.615, "ts": 0.800, "map": 24.308, "obs": 5, "own": 13.730, "comp": {"cins": -0.732, "dshield": 11.7682, "crowdsec": -2.021, "vulncheck": -0.7568, "blocklist_de": -3.6739}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.178, "det": null, "oid": "ORG-PS10-AP-APNIC", "org": "PacketHub S.A.", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.packethub.net/"}, "pfx": 26, "reg": "2020-08-27", "rir": "apnic", "s24": 26, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.02038634810392}, {"a": 141071, "h": "JEMBATANDATA-AS-ID", "n": "Jembatan Data Pangrango", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2022-39290": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 4, "mean": 3.92, "above": false}}, "h2": [["2026-10-12", 11.614, 0.012, 1, false]], "sh": false, "uc": 14990.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.614, "se": 0.803, "ts": 1.000, "map": 38.729, "obs": 3, "own": 60.637, "comp": {"cins": -0.3915, "dshield": -0.8122, "crowdsec": 8.8588, "vulncheck": -0.5978, "blocklist_de": -2.007}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.324, "det": null, "oid": "@aut-141071-APNIC", "org": "PT Jembatan Data Pangrango", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://sukabuminetwork.net/"}, "pfx": 8, "reg": "2020-09-01", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002431516846}, {"a": 141074, "h": "CORENET-AS-ID", "n": "Corenet", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.149, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Selective", "web": "http://core.net.id/"}, "pfx": 4, "reg": "2020-09-01", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141077, "h": "RSTNET-AS-ID", "n": "Smart Teknologi Utama", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6383, "hi": 7.65, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 16.063, 0.011, 1, false], ["2026-10-12", 17.361, 0.013, 1, false]], "sh": false, "uc": 6406.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 17.361, "se": 0.815, "ts": 1.000, "map": 58.864, "obs": 3, "own": 92.192, "comp": {"cins": -0.3736, "dshield": -0.7804, "crowdsec": 9.125, "vulncheck": -0.5851, "blocklist_de": -1.917}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.405, "det": null, "oid": "@aut-141077-APNIC", "org": "RSTNET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.rst.net.id"}, "pfx": 5, "reg": "2020-09-01", "rir": "apnic", "s24": 5, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0023640114674}, {"a": 141085, "h": "IDNIC-DISKOMINFOSUBANG-AS-ID", "n": "Dinas Komunikasi Dan Informatika Kabupaten Subang", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.176, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-141085-APNIC", "org": "Dinas Komunikasi Dan Informatika Kabupaten Subang", "pdb": null, "pfx": 1, "reg": "2020-09-01", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141086, "h": "IDNIC-KOMNASHAM-AS-ID", "n": "Komisi Nasional Hak Asasi Manusia RI", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.092, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141086-APNIC", "org": "Komisi Nasional Hak Asasi Manusia RI", "pdb": null, "pfx": 1, "reg": "2020-09-01", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141107, "h": "IDNIC-LINKGO-AS-ID", "n": "Linkgo Metro Teknologi", "t": "Hosting & VPS", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 3, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 1.501, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.537, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141107-APNIC", "org": "PT Linkgo Metro Teknologi", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://linkgo.co.id/"}, "pfx": 10, "reg": "2020-09-01", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141114, "h": "EASTMEDIA-AS-ID", "n": "Super Media Indonesia", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "router_or_botnet": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2022-35914": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 8.372, 0.011, 0, false], ["2026-10-12", 28.273, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 28.273, "se": 0.833, "ts": 0.667, "map": 99.320, "obs": 3, "own": 155.887, "comp": {"cins": -0.3778, "dshield": -0.7879, "crowdsec": 5.0062, "vulncheck": -0.5882, "blocklist_de": 2.7397}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-141114-APNIC", "org": "PT Super Media Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.smi.net.id/"}, "pfx": 4, "reg": "2020-09-01", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013001027974}, {"a": 141120, "h": "IDNIC-WARNAHOST-AS-ID", "n": "Warna Data Multimedia", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.876, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-141120-APNIC", "org": "PT Warna Data Multimedia", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.warnahost.com"}, "pfx": 4, "reg": "2020-09-01", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141124, "h": "IDNIC-MAKASSARKOTA-AS-ID", "n": "Dinas Komunikasi dan Informatika Kota Makassar", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.679, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141124-APNIC", "org": "Dinas Komunikasi dan Informatika Kota Makassar", "pdb": null, "pfx": 2, "reg": "2020-09-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141126, "h": "IDNIC-CUBIESPOT-AS-ID", "n": "Cubiespot Pilar Data Nusantara", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6343, "hi": 7.61, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 1.539, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.289, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-141126-APNIC", "org": "PT Cubiespot Pilar Data Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.cubiespot.net.id"}, "pfx": 9, "reg": "2020-09-01", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005592510088}, {"a": 141127, "h": "IDNIC-CDNNET-AS-ID", "n": "Anugerah Cimanuk Raya", "t": "Hosting & VPS", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.4215, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 4, "p": 0.8072, "hi": 9.01, "lo": 1.94, "ips": 4, "mean": 4.92, "above": true}}, "h2": [["2026-10-05", 71.758, 0.011, 1, false], ["2026-10-12", 60.971, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 60.971, "se": 0.585, "ts": 0.667, "map": 134.754, "obs": 6, "own": 26.431, "comp": {"cins": 7.4752, "dshield": -1.5534, "crowdsec": 5.6268, "vulncheck": -0.8015, "blocklist_de": -4.4499}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.192, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-141127-APNIC", "org": "PT Anugerah Cimanuk Raya", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://cdnnet.id"}, "pfx": 6, "reg": "2020-09-01", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0023471511294}, {"a": 141128, "h": "IDNIC-SARVASOLUTION-AS-ID", "n": "PT Sarva Solution Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-141128-APNIC", "org": "PT Sarva Solution Indonesia", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://sarva.net.id"}, "pfx": 2, "reg": "2020-09-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141137, "h": "MEDIACEPAT-AS-ID", "n": "Media Cepat Indonesia", "t": "Transit & backbone", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 3.197, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 34.483, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.164, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141137-APNIC", "org": "PT Media Cepat Indonesia", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "5-10Tbps", "pol": "Open", "web": "http://rapid.net.id"}, "pfx": 6, "reg": "2020-09-01", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008299554736}, {"a": 141159, "h": "INCOMPARABLEHKNET-AS-AP", "n": "Incomparable(HK)Network Co., Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.865, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ICL14-AP-APNIC", "org": "Incomparable(HK)Network Co., Limited", "pdb": null, "pfx": 9, "reg": "2020-09-08", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141192, "h": "DHRUBOSOFTLIMITED-AS-AP", "n": "Dhrubosoft Limited", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.895, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DL36-AP-APNIC", "org": "Dhrubosoft Limited", "pdb": null, "pfx": 2, "reg": "2023-04-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141243, "h": "WALSEPAT-AS-IN", "n": "Walsepatil Enterprises", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.513, 0.012, 0, false]], "sh": false, "uc": 2644.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 3.557, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.141, "det": null, "oid": "@aut-141243-APNIC", "org": "Walsepatil Enterprises", "pdb": null, "pfx": 13, "reg": "2020-10-09", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141253, "h": "MUFT-AS-IN", "n": "Hyosec Solutions Private Limited", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.169, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.169, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-141253-APNIC", "org": "Hyosec Solutions Private Limited", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://hybridisp.com"}, "pfx": 15, "reg": "2020-10-09", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014673523704}, {"a": 141275, "h": "MAXDIGI-AS-IN", "n": "Maxnet Digital", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "home_connection": 3, "router_or_botnet": 3, "cve:CVE-2019-8318": 3, "cve:CVE-2018-10562": 3, "cve:CVE-2024-12847": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 5.886, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.886, "se": 1.031, "ts": 0.500, "map": 30.211, "obs": 2, "own": 49.175, "comp": {"cins": -0.2377, "dshield": -0.5244, "crowdsec": 2.3761, "vulncheck": -0.4627, "blocklist_de": 3.6506}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.200, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-141275-APNIC", "org": "Maxnet Digital Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.maxnetdigital.in"}, "pfx": 3, "reg": "2020-10-09", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00087439037148}, {"a": 141280, "h": "KCTIPL-AS-IN", "n": "KHUSHI CABLE AND TELEINFRA PRIVATE LIMITED", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.417, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-141280-APNIC", "org": "KHUSHI CABLE AND TELEINFRA PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.netpool.in"}, "pfx": 7, "reg": "2020-10-09", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141314, "h": "WI5INTERNET-AS", "n": "Wi5 Internet Services Private Limited", "t": "Broadband & mobile", "w": 4, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 4, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 25.453, 0.013, 1, false]], "sh": false, "uc": 7226.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 25.453, "se": 0.831, "ts": 1.000, "map": 89.676, "obs": 3, "own": 140.758, "comp": {"cins": -0.4471, "dshield": -0.9079, "crowdsec": -3.5744, "vulncheck": -0.6334, "blocklist_de": 11.4527}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.211, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-141314-APNIC", "org": "Wi5 Internet Services Private Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://rdap.apnic.net/autnum/141314"}, "pfx": 5, "reg": "2020-10-09", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141322, "h": "WYRIS-AS-IN", "n": "Wyris Network", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 2, "p": 0.4167, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 12.018, 0.012, 1, false]], "sh": false, "uc": 2560.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 12.018, "se": 0.806, "ts": 0.667, "map": 40.338, "obs": 3, "own": 63.274, "comp": {"cins": -0.452, "dshield": -0.9161, "crowdsec": 0.2594, "vulncheck": -0.6363, "blocklist_de": 6.8358}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.155, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "@aut-141322-APNIC", "org": "Wyris Network Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.wyrisnetworks.com"}, "pfx": 9, "reg": "2020-10-09", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041260922847}, {"a": 141333, "h": "ROCKETGP-AS-IN", "n": "Rocket Media Group", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "@aut-141333-APNIC", "org": "Rocket Media Group", "pdb": null, "pfx": 2, "reg": "2020-10-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141342, "h": "FIBERISHPVTLTD-AS-AP", "n": "FIBERISH", "t": "Broadband & mobile", "w": 30, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 17, "web_bruteforce": 9, "router_or_botnet": 5, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 17}, "n": 17}, "ev": {"dshield": {"n": 5, "p": 0.9074, "hi": 10.23, "lo": 2.54, "ips": 7, "mean": 5.84, "above": true}, "crowdsec": {"n": 3, "p": 0.5552, "hi": 6.81, "lo": 1.20, "ips": 17, "mean": 3.51, "above": false}, "vulncheck": {"n": 2, "p": 0.4051, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}, "blocklist_de": {"n": 3, "p": 0.6098, "hi": 7.34, "lo": 1.29, "ips": 4, "mean": 3.79, "above": false}}, "h2": [["2026-10-05", 4.858, 0.011, 0, false], ["2026-10-12", 18.855, 0.012, 1, false]], "sh": false, "uc": 3996.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 3}, "lo": 18.855, "se": 0.465, "ts": 0.385, "map": 33.988, "obs": 13, "own": 52.145, "comp": {"cins": -1.5818, "dshield": 7.5599, "crowdsec": -2.9632, "vulncheck": 0.2394, "blocklist_de": 1.6653}, "mass": 9.8, "listed": false}}, "abq": false, "bot": 0.146, "det": {"vulncheck": {"other_infrastructure": 2}, "blocklist_de": {"bots": 4}}, "oid": "ORG-FL14-AP-APNIC", "org": "FIBERISH (PVT) LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.fiberish.net.pk"}, "pfx": 52, "reg": "2020-10-10", "rir": "apnic", "s24": 52, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00693586411947}, {"a": 141356, "h": "UAL-AS-AP", "n": "Universe Action", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.938, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-UAL1-AP-APNIC", "org": "Universe Action Limited", "pdb": null, "pfx": 2, "reg": "2020-10-19", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141421, "h": "MUXBROADBANDP-AS-AP", "n": "MUX BROADBAND", "t": "Broadband & mobile", "w": 4, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.824, 0.011, 0, false], ["2026-10-12", 23.448, 0.013, 1, false]], "sh": false, "uc": 4752.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 23.448, "se": 0.715, "ts": 0.500, "map": 65.346, "obs": 4, "own": 102.691, "comp": {"cins": -0.4842, "dshield": -0.9695, "crowdsec": 3.7582, "vulncheck": 1.2104, "blocklist_de": 2.0585}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.102, "det": {"vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-MBL11-AP-APNIC", "org": "MUX BROADBAND (PRIVATE) LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://muxbroadband.com/"}, "pfx": 6, "reg": "2023-02-08", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00224770052177}, {"a": 141452, "h": "JHONGKARIT1-AS-AP", "n": "Jhongkar IT", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 12500, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.183, "det": null, "oid": "ORG-JE1-AP-APNIC", "org": "Jhongkar IT", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "https://jhongkar.net/"}, "pfx": 2, "reg": "2020-12-04", "rir": "apnic", "s24": 2, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035719090255}, {"a": 141463, "h": "TOTALITSOLUTIONS-AS-AP", "n": "Total IT Solutions", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 28.487, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.154, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-IT14-AP-APNIC", "org": "Total IT Solutions", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://tbn.com.bd"}, "pfx": 3, "reg": "2021-01-12", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141474, "h": "TrustInnovationLimited-AS-AP", "n": "Trust Innovation Limited", "t": "Other", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 1, "router_or_botnet": 4, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 3, "p": 0.6365, "hi": 7.63, "lo": 1.34, "ips": 4, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 13.931, 0.011, 1, false], ["2026-10-12", 14.800, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 14.800, "se": 0.810, "ts": 1.000, "map": 50.049, "obs": 3, "own": 28.680, "comp": {"cins": -0.3805, "dshield": -0.7927, "crowdsec": 9.0218, "vulncheck": -0.5901, "blocklist_de": -1.9518}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.146, "det": null, "oid": "ORG-SP13-AP-APNIC", "org": "Trust Innovation Limited", "pdb": null, "pfx": 6, "reg": "2020-12-07", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035968813185}, {"a": 141480, "h": "HAASHMED-AS", "n": "Haash Media", "t": "Other", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 14013.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 14.129, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.326, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-141480-APNIC", "org": "Haash Media", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.haashnet.com"}, "pfx": 8, "reg": "2020-12-17", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141492, "h": "SUNBEAM-AS-IN", "n": "Amk Sunbeam Communication", "t": "Other", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 2, "proxy_or_vpn": 1, "web_bruteforce": 5}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.319, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-141492-APNIC", "org": "Amk Sunbeam Communication Private Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.internet.amksunbeam.com/"}, "pfx": 3, "reg": "2020-12-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141514, "h": "SANCFILT-AS-IN", "n": "Sancfil Technologies Internet Services", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "mail_bruteforce": 3, "cve:CVE-2026-8181": 1}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 4, "mean": 2.74, "above": false}, "vulncheck": {"n": 1, "p": 0.1908, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 6.098, 0.011, 0, false], ["2026-10-12", 2.624, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.624, "se": 0.783, "ts": 0.667, "map": 8.288, "obs": 3, "own": 13.220, "comp": {"cins": -0.3783, "dshield": -0.7887, "crowdsec": 5.0006, "vulncheck": 1.6154, "blocklist_de": -1.9405}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.128, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-141514-APNIC", "org": "Sancfil Technologies Internet Services Pvt.Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.trunet.co.in/"}, "pfx": 50, "reg": "2020-12-17", "rir": "apnic", "s24": 36, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00204587499759}, {"a": 141516, "h": "OMIBS-AS-IN", "n": "Om Internet Broadband Service", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 26562.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 122.487, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.216, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-141516-APNIC", "org": "Om Internet Broadband Service", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": null}, "pfx": 2, "reg": "2020-12-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141526, "h": "JBNOPL-AS-IN", "n": "Jbn Online Private Limited", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 14648.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-141526-APNIC", "org": "Jbn Online Private Limited", "pdb": null, "pfx": 4, "reg": "2020-12-17", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141538, "h": "AIRONETB-AS", "n": "Aironet Broadband Private Limited", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 15429.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.180, "det": null, "oid": "@aut-141538-APNIC", "org": "Aironet Broadband Private Limited", "pdb": null, "pfx": 3, "reg": "2020-12-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141551, "h": "CREATNET-AS", "n": "Creative Networks", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 26757.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.131, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-141551-APNIC", "org": "Creative Networks", "pdb": null, "pfx": 2, "reg": "2020-12-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141595, "h": "PRIME-AS-ID", "n": "Akbar Prima Media", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 4, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 72.210, 0.011, 1, false], ["2026-10-12", 80.853, 0.013, 1, false]], "sh": false, "uc": 16992.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 80.853, "se": 0.719, "ts": 0.500, "map": 229.257, "obs": 4, "own": 355.449, "comp": {"cins": 4.0266, "dshield": -1.0842, "crowdsec": 2.9725, "vulncheck": -0.69, "blocklist_de": 1.6036}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.380, "det": {"blocklist_de": {"apache": 1}}, "oid": "@aut-141595-APNIC", "org": "PT Akbar Prima Media", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://akbarprimamedia.id"}, "pfx": 2, "reg": "2020-12-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141607, "h": "IDNIC-GAYATRI-AS-ID", "n": "Gayatri Lintas Nusantara", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 3, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6312, "hi": 7.57, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 9.852, 0.011, 0, false], ["2026-10-12", 19.571, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 19.571, "se": 0.693, "ts": 0.750, "map": 53.295, "obs": 4, "own": 82.619, "comp": {"cins": -0.5784, "dshield": -1.1186, "crowdsec": 6.3033, "vulncheck": -0.6999, "blocklist_de": 1.4631}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.196, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-141607-APNIC", "org": "PT Gayatri Lintas Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.gayatri.net.id"}, "pfx": 9, "reg": "2020-12-18", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022678861986}, {"a": 141623, "h": "IDNIC-RNA-AS-ID", "n": "PT Registrasi Neva Angkasa", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.923, 0, false], ["2026-10-12", 0.013, 0.953, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.953, "se": 1.821, "ts": 1.000, "map": 14.495, "obs": 1, "own": 24.135, "comp": {"urlhaus": -0.02, "threatfox": -0.0299, "phishing_db": 4.3499}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.383, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-141623-APNIC", "org": "PT Registrasi Neva Angkasa", "pdb": null, "pfx": 2, "reg": "2020-12-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141639, "h": "IDNIC-L1V-AS-ID", "n": "Lintas Satu Visi", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.138, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141639-APNIC", "org": "PT Lintas Satu Visi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://liv.co.id"}, "pfx": 2, "reg": "2020-12-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141642, "h": "IDNIC-RINGNET-AS-ID", "n": "Ring Media Nusantara", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 4.588, 0.011, 0, false], ["2026-10-12", 4.980, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.980, "se": 1.016, "ts": 1.000, "map": 24.735, "obs": 2, "own": 40.082, "comp": {"cins": -0.2276, "dshield": -0.5042, "crowdsec": 6.9636, "vulncheck": -0.4511, "blocklist_de": -1.1787}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.212, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-141642-APNIC", "org": "PT Ring Media Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://ring.net.id/"}, "pfx": 7, "reg": "2020-12-18", "rir": "apnic", "s24": 7, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022982988336}, {"a": 141665, "h": "IDNIC-CAD-AS-ID", "n": "PT Cahaya Artha Daya", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.123, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141665-APNIC", "org": "PT Cahaya Artha Daya", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.arthadaya.net.id"}, "pfx": 2, "reg": "2020-12-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141671, "h": "IDNIC-ZEUSS-AS-ID", "n": "ZEUSS", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.114, "det": {"shodan": {"compromised": 3}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.zeuss.id"}, "pfx": 10, "reg": "2020-12-18", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141673, "h": "IDNIC-MAMURA-AS-ID", "n": "Mamura Inter Media", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 3.310, 0.011, 0, false], ["2026-10-12", 0.555, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.555, "se": 1.412, "ts": 1.000, "map": 5.787, "obs": 1, "own": 10.984, "comp": {"cins": -0.0865, "dshield": -0.2035, "crowdsec": 4.1217, "vulncheck": -0.2306, "blocklist_de": -0.4518}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-141673-APNIC", "org": "PT Mamura Inter Media", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "100-200Gbps", "pol": "Selective", "web": "https://mamura.net.id"}, "pfx": 7, "reg": "2020-12-18", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011776412538}, {"a": 141679, "h": "CHINATELECOM-IDC-BTHBD-AP", "n": "China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch", "t": "Broadband & mobile", "w": 78, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 17, "web_exploit": 21, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 7, "ssh_bruteforce": 39, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 18, "cve:CVE-2018-20062": 2, "cve:CVE-2021-41773": 1}, "n": 57}, "ev": {"cins": {"n": 4, "p": 0.7121, "hi": 7.69, "lo": 1.66, "ips": 4, "mean": 4.20, "above": false}, "shodan": {"n": 180, "p": 1.0000, "hi": 103.85, "lo": 81.30, "ips": 180, "mean": 92.28, "above": true}, "dshield": {"n": 1, "p": 0.1136, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "urlhaus": {"n": 1, "p": 0.1813, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 41, "p": 1.0000, "hi": 24.22, "lo": 14.54, "ips": 57, "mean": 19.13, "above": true}, "threatfox": {"n": 16, "p": 1.0000, "hi": 22.73, "lo": 10.13, "ips": 16, "mean": 15.90, "above": true}, "vulncheck": {"n": 1, "p": 0.1155, "hi": 3.84, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}, "blocklist_de": {"n": 17, "p": 1.0000, "hi": 17.20, "lo": 7.85, "ips": 19, "mean": 12.14, "above": true}}, "h2": [["2026-10-05", 15.143, 7.069, 1, false], ["2026-10-12", 15.996, 6.438, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 1, "threatfox": 16, "phishing_db": 0}, "lo": 6.438, "se": 0.781, "ts": 0.941, "map": 14.092, "obs": 17, "own": 32.856, "comp": {"urlhaus": 0.0807, "threatfox": 5.3063, "phishing_db": -1.1152}, "mass": 8.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 1, "crowdsec": 41, "vulncheck": 1, "blocklist_de": 17}, "lo": 15.996, "se": 0.370, "ts": 0.641, "map": 24.649, "obs": 64, "own": 37.678, "comp": {"cins": 1.256, "dshield": -2.819, "crowdsec": 5.5373, "vulncheck": -0.8967, "blocklist_de": 1.5209}, "mass": 61.0, "listed": true}}, "abq": false, "bot": 0.903, "det": {"shodan": {"c2": 7, "malware": 4, "compromised": 169}, "threatfox": {"family:Chaos": 1, "family:VShell": 1, "family:Cobalt Strike": 12, "family:Unknown malware": 2}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 2, "ssh": 15, "apache": 2, "bruteforcelogin": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 73, "reg": "2021-01-20", "rir": "apnic", "s24": 450, "sib": 281, "tor": 0, "w24": 55, "drop": 0, "hist": [["2026-10-05", 0.9972], ["2026-10-12", 0.9977]], "ipv4": 123392, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00047328406164}, {"a": 141701, "h": "JAAN-AS-AP", "n": "Jaan Computer", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 11328.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.191, "det": null, "oid": "ORG-JC7-AP-APNIC", "org": "Jaan Computer", "pdb": null, "pfx": 2, "reg": "2021-01-28", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141718, "h": "HHXYTC-AS-AP", "n": "haoxiangyun", "t": "Other", "w": 12, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "vulncheck": {"n": 6, "p": 0.9640, "hi": 11.65, "lo": 3.23, "ips": 11, "mean": 6.89, "above": true}}, "h2": [["2026-10-05", 12.008, 0.011, 1, false], ["2026-10-12", 6.915, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 6, "blocklist_de": 0}, "lo": 6.915, "se": 0.586, "ts": 0.857, "map": 14.984, "obs": 7, "own": 8.708, "comp": {"cins": -0.5624, "dshield": -1.094, "crowdsec": -0.6975, "vulncheck": 9.307, "blocklist_de": -2.8524}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.946, "det": {"vulncheck": {"botnet_node": 11}}, "oid": "ORG-HA59-AP-APNIC", "org": "haoxiangyun", "pdb": null, "pfx": 31, "reg": "2021-02-05", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 7936, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0017414424477}, {"a": 141726, "h": "STAR5-AS-AP", "n": "Star Online", "t": "Other", "w": 1, "cc": "BD", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": 12109.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 14.019, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.238, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SO15-AP-APNIC", "org": "Star Online", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://staronlinelalpur.net"}, "pfx": 3, "reg": "2021-02-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026063524129}, {"a": 141738, "h": "NOORHOSTCOMBD-AS-AP", "n": "noorhost.com.bd", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 0.118, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-NA104-AP-APNIC", "org": "noorhost.com.bd", "pdb": null, "pfx": 20, "reg": "2021-02-18", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141739, "h": "CT-CHONGQING-MAN2-AP", "n": "China Telecom Chongqing IDC Network", "t": "Broadband & mobile", "w": 7, "cc": "CN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1234, "hi": 3.93, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "dshield": {"n": 1, "p": 0.1077, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "crowdsec": {"n": 3, "p": 0.0859, "hi": 3.36, "lo": 0.59, "ips": 3, "mean": 1.73, "above": false}, "blocklist_de": {"n": 4, "p": 0.5167, "hi": 5.99, "lo": 1.29, "ips": 4, "mean": 3.27, "above": false}}, "h2": [["2026-10-05", 0.941, 0.009, 0, false], ["2026-10-12", 1.877, 0.010, 0, false]], "sh": false, "uc": 259.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.892, "ts": null, "map": 0.153, "obs": 0, "own": 0.836, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.877, "se": 0.503, "ts": 0.444, "map": 3.545, "obs": 9, "own": 5.471, "comp": {"cins": 1.8296, "dshield": -0.2555, "crowdsec": -2.8722, "vulncheck": -0.9041, "blocklist_de": 4.8615}, "mass": 9.7, "listed": false}}, "abq": false, "bot": 0.513, "det": {"blocklist_de": {"ssh": 2, "imap": 1, "mail": 2}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 37, "reg": "2021-02-23", "rir": "apnic", "s24": 492, "sib": 281, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 125952, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013466099517}, {"a": 141740, "h": null, "n": "AS141740", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.246, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 3, "reg": null, "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141745, "h": "MOGHBAZARDOTNET-AS-AP", "n": "Moghbazar Dot Net", "t": "Other", "w": 8, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "ssh_bruteforce": 7, "web_bruteforce": 4, "cve:CVE-2026-8181": 1}, "n": 7}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 9.616, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 9.616, "se": 1.088, "ts": 0.500, "map": 53.635, "obs": 2, "own": 33.342, "comp": {"cins": -0.1438, "dshield": -0.3301, "crowdsec": 3.4321, "vulncheck": 3.1662, "blocklist_de": -0.7487}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.176, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-MDN1-AP-APNIC", "org": "Moghbazar Dot Net", "pdb": null, "pfx": 3, "reg": "2021-02-25", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141750, "h": "HCJBTC-AS-AP", "n": "PC Cloud", "t": "Hosting & VPS", "w": 4, "cc": "HK", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.666, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.666, "se": 1.469, "ts": 1.000, "map": 7.430, "obs": 1, "own": 1.935, "comp": {"cins": -0.0509, "dshield": -0.1216, "crowdsec": -0.4821, "vulncheck": 4.3202, "blocklist_de": -0.2664}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.991, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-PC22-AP-APNIC", "org": "PC Cloud", "pdb": null, "pfx": 5, "reg": "2021-02-25", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141816, "h": "VISL-AS", "n": "Velankani Information Systems", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141816-APNIC", "org": "Velankani Information Systems Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.prysmnet.com"}, "pfx": 4, "reg": "2021-03-05", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141870, "h": "GVREDDY-AS-IN", "n": "GV REDDY BROADBAND SERVICES", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 215.609, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-141870-APNIC", "org": "GV REDDY BROADBAND SERVICES", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://gvreddy.net/"}, "pfx": 1, "reg": "2021-03-05", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141873, "h": "MEERAIT-AS-IN", "n": "Meera It Solutions Pvt Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5566.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.173, "det": null, "oid": "@aut-141873-APNIC", "org": "Meera It Solutions Pvt Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://mywnz.com"}, "pfx": 4, "reg": "2021-03-05", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141883, "h": "IENS-AS-AP", "n": "IENS TECHNOLOGY PTE. LTD", "t": "Other", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.686, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.301, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.934, "det": null, "oid": "ORG-BP8-AP-APNIC", "org": "IENS TECHNOLOGY PTE. LTD", "pdb": null, "pfx": 23, "reg": "2021-03-05", "rir": "apnic", "s24": 37, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141887, "h": "IDNIC-SIPRIMA-AS-ID", "n": "PT Terra Sigma Solusi", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.138, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141887-APNIC", "org": "PT Terra Sigma Solusi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.terra.net.id"}, "pfx": 4, "reg": "2021-03-08", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141892, "h": "IDNIC-SENGKED-AS-ID", "n": "CV Andhika Pratama Sanggoro", "t": "Other", "w": 15, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 14, "data_centre": 1, "web_exploit": 13, "bad_crawling": 11, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 12, "mail_bruteforce": 1, "router_or_botnet": 8, "cve:CVE-2017-9841": 6, "cve:CVE-2018-20062": 2, "cve:CVE-2022-35914": 1, "cve:CVE-2026-53787": 2, "cve:CVE-2026-63030": 2}, "n": 14}, "ev": {"crowdsec": {"n": 6, "p": 0.9623, "hi": 11.54, "lo": 3.20, "ips": 14, "mean": 6.82, "above": true}, "blocklist_de": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 30.854, 0.011, 1, false], ["2026-10-12", 54.279, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 2}, "lo": 54.279, "se": 0.522, "ts": 0.750, "map": 109.019, "obs": 8, "own": 61.128, "comp": {"cins": -1.1287, "dshield": -1.8201, "crowdsec": 8.1161, "vulncheck": -0.8478, "blocklist_de": 1.7658}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.769, "det": {"blocklist_de": {"ssh": 1, "apache": 1}}, "oid": "@aut-141892-APNIC", "org": "CV Andhika Pratama Sanggoro", "pdb": null, "pfx": 12, "reg": "2021-03-08", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0006926824432}, {"a": 141898, "h": "MILENETWORK-AS-ID", "n": "Milenial Inti Telekomunikasi", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2026-8181": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 5.299, 0.011, 0, false], ["2026-10-12", 2.271, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.271, "se": 0.964, "ts": 1.000, "map": 10.224, "obs": 2, "own": 16.438, "comp": {"cins": -0.2663, "dshield": -0.5807, "crowdsec": 6.4347, "vulncheck": -0.4932, "blocklist_de": -1.376}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.238, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141898-APNIC", "org": "PT Milenial Inti Telekomunikasi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.milenetwork.co.id"}, "pfx": 20, "reg": "2021-03-08", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007450988864}, {"a": 141899, "h": "IDNIC-MALFINET-AS-ID", "n": "PT Malfi Karya Berkah", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.991, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141899-APNIC", "org": "PT Malfi Karya Berkah", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://malfikaryaberkah.id/"}, "pfx": 2, "reg": "2021-03-08", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141918, "h": "IDNIC-DESKTOPIP-AS-ID", "n": "PT DesktopIP Teknologi Indonesia", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.947, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-141918-APNIC", "org": "PT DesktopIP Teknologi Indonesia", "pdb": null, "pfx": 3, "reg": "2021-03-08", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 141955, "h": "IDNIC-TIMORLINTAS-AS-ID", "n": "Timor Lintas Nusantara", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8333.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.286, "det": null, "oid": "@aut-141955-APNIC", "org": "PT Timor Lintas Nusantara", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://timorlintas.net.id"}, "pfx": 2, "reg": "2021-03-08", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013321374396}, {"a": 141968, "h": "IDNIC-IKADA-AS-ID", "n": "Industri Kreatif Digital", "t": "Transit & backbone", "w": 8, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 7, "home_connection": 3, "cve:CVE-2022-46604": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"shodan": {"n": 8, "p": 0.9940, "hi": 13.43, "lo": 4.37, "ips": 8, "mean": 8.37, "above": true}, "crowdsec": {"n": 4, "p": 0.7664, "hi": 8.37, "lo": 1.80, "ips": 8, "mean": 4.57, "above": false}}, "h2": [["2026-10-05", 10.076, 0.011, 1, false], ["2026-10-12", 5.462, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 2.447, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.462, "se": 0.673, "ts": 1.000, "map": 14.294, "obs": 4, "own": 45.064, "comp": {"cins": -0.5999, "dshield": -1.1513, "crowdsec": 9.5494, "vulncheck": -0.709, "blocklist_de": -3.0356}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.837, "det": {"shodan": {"compromised": 8}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-141968-APNIC", "org": "PT Industri Kreatif Digital", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://dihostingin.com"}, "pfx": 35, "reg": "2021-03-08", "rir": "apnic", "s24": 35, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 8960, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0011040106638}, {"a": 141983, "h": "IDNIC-RAJEGNET-AS-ID", "n": "Rajeg Media Telekomunikasi", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 5.536, 0.013, 0, false]], "sh": false, "uc": 6250, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 45.634, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.215, "det": null, "oid": "@aut-141983-APNIC", "org": "PT Rajeg Media Telekomunikasi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.rajegnet.com"}, "pfx": 6, "reg": "2021-03-08", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001431741487}, {"a": 141995, "h": "CAPL-AS-AP", "n": "Contabo Asia", "t": "Hosting & VPS", "w": 115, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 33, "data_centre": 45, "web_exploit": 40, "bad_crawling": 15, "proxy_or_vpn": 13, "first_seen_30d": 19, "ssh_bruteforce": 26, "web_bruteforce": 48, "home_connection": 4, "mail_bruteforce": 1, "cve:CVE-2017-9841": 9, "cve:CVE-2019-9082": 5, "cve:CVE-2018-20062": 6, "cve:CVE-2024-28000": 6, "cve:CVE-2026-63030": 8}, "n": 61}, "ev": {"cins": {"n": 2, "p": 0.3535, "hi": 5.67, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}, "shodan": {"n": 122, "p": 1.0000, "hi": 91.16, "lo": 67.72, "ips": 122, "mean": 79.08, "above": true}, "dshield": {"n": 1, "p": 0.1445, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "urlhaus": {"n": 1, "p": 0.1886, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 39, "p": 1.0000, "hi": 30.12, "lo": 17.86, "ips": 61, "mean": 23.65, "above": true}, "threatfox": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 27, "p": 1.0000, "hi": 32.77, "lo": 17.51, "ips": 41, "mean": 24.64, "above": true}, "phishing_db": {"n": 4, "p": 0.7477, "hi": 8.12, "lo": 1.75, "ips": 5, "mean": 4.44, "above": false}, "blocklist_de": {"n": 3, "p": 0.4662, "hi": 6.06, "lo": 1.07, "ips": 3, "mean": 3.13, "above": false}}, "h2": [["2026-10-05", 20.941, 5.655, 1, false], ["2026-10-12", 18.195, 4.218, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 4}, "lo": 4.218, "se": 0.884, "ts": 0.667, "map": 11.372, "obs": 6, "own": 4.199, "comp": {"urlhaus": 1.5526, "threatfox": 0.2174, "phishing_db": 2.2873}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 39, "vulncheck": 27, "blocklist_de": 3}, "lo": 18.195, "se": 0.372, "ts": 0.542, "map": 27.712, "obs": 72, "own": 5.400, "comp": {"cins": 0.151, "dshield": -2.4575, "crowdsec": 13.3637, "vulncheck": 3.1452, "blocklist_de": -9.487}, "mass": 39.6, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"c2": 5, "compromised": 115, "doublepulsar": 2}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 4, "botnet_node": 31, "attack_tooling": 5, "other_infrastructure": 1}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-CAPL15-AP-APNIC", "org": "Contabo Asia Private Limited", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.contabo.com"}, "pfx": 87, "reg": "2021-03-11", "rir": "apnic", "s24": 260, "sib": 0, "tor": 4, "w24": 68, "drop": 0, "hist": [["2026-10-05", 0.9967], ["2026-10-12", 0.8435]], "ipv4": 71680, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": ["crowdsec"], "traffic": 0.02312071234982}, {"a": 142002, "h": "SCLOUDPTELTD-AS", "n": "Scloud Pte Ltd", "t": "Hosting & VPS", "w": 42, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "bad_crawling": 3, "first_seen_30d": 1, "ssh_bruteforce": 20, "web_bruteforce": 3, "mail_bruteforce": 3}, "n": 24}, "ev": {"cins": {"n": 8, "p": 0.9953, "hi": 13.95, "lo": 4.54, "ips": 11, "mean": 8.70, "above": true}, "shodan": {"n": 3, "p": 0.5298, "hi": 6.59, "lo": 1.16, "ips": 3, "mean": 3.40, "above": false}, "crowdsec": {"n": 18, "p": 1.0000, "hi": 21.87, "lo": 10.19, "ips": 24, "mean": 15.57, "above": true}, "threatfox": {"n": 4, "p": 0.8088, "hi": 9.04, "lo": 1.95, "ips": 4, "mean": 4.94, "above": true}, "blocklist_de": {"n": 9, "p": 0.9980, "hi": 14.42, "lo": 4.98, "ips": 12, "mean": 9.18, "above": true}}, "h2": [["2026-10-05", 47.022, 6.302, 1, false], ["2026-10-12", 52.024, 4.527, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 4.527, "se": 0.930, "ts": 1.000, "map": 13.518, "obs": 4, "own": 4.976, "comp": {"urlhaus": -0.6278, "threatfox": 5.6382, "phishing_db": -0.7801}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 0, "crowdsec": 18, "vulncheck": 0, "blocklist_de": 9}, "lo": 52.024, "se": 0.386, "ts": 0.514, "map": 82.546, "obs": 35, "own": 16.039, "comp": {"cins": 10.3704, "dshield": -3.1075, "crowdsec": 0.2689, "vulncheck": -0.9854, "blocklist_de": -0.7394}, "mass": 37.6, "listed": false}}, "abq": false, "bot": 0.853, "det": {"shodan": {"c2": 2, "compromised": 1}, "threatfox": {"family:Havoc": 1, "family:Cobalt Strike": 3}, "blocklist_de": {"ssh": 12}}, "oid": "ORG-SPL64-AP-APNIC", "org": "Scloud Pte Ltd", "pdb": null, "pfx": 83, "reg": "2021-03-16", "rir": "apnic", "s24": 83, "sib": 0, "tor": 0, "w24": 26, "drop": 0, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.8803]], "ipv4": 21248, "abuse": null, "score": 0.8803, "groups": ["sensors", "abusech"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.00067899909967}, {"a": 142019, "h": "GRIL-AS-AP", "n": "GZ REMITTANCE (CHINA) INDUSTRY LIMITED", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.312, 0.011, 0, false], ["2026-10-12", 0.301, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.740, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.301, "se": 1.307, "ts": 1.000, "map": 2.504, "obs": 1, "own": 1.708, "comp": {"cins": -0.085, "dshield": -0.2003, "crowdsec": -0.7934, "vulncheck": 3.8346, "blocklist_de": -0.4444}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.842, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-GRIL1-AP-APNIC", "org": "GZ REMITTANCE (CHINA) INDUSTRY LIMITED", "pdb": null, "pfx": 19, "reg": "2021-03-25", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000230323743}, {"a": 142036, "h": "HOSTEONS-AS-AP", "n": "Hosteons Pte. Ltd.", "t": "Hosting & VPS", "w": 2, "cc": "SG", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "phishing_db": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.329, 0.481, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.481, "se": 1.552, "ts": 1.000, "map": 5.001, "obs": 1, "own": 2.290, "comp": {"urlhaus": -0.1043, "threatfox": -0.1312, "phishing_db": 3.4712}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.329, "se": 1.306, "ts": 1.000, "map": 2.829, "obs": 1, "own": 0.646, "comp": {"cins": -0.1182, "dshield": -0.2744, "crowdsec": 3.7352, "vulncheck": -0.2925, "blocklist_de": -0.6166}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.861, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HPL9-AP-APNIC", "org": "Hosteons Pte. Ltd.", "pdb": null, "pfx": 31, "reg": "2023-08-04", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142063, "h": "GPL-AS-AP", "n": "Grand Tel", "t": "Broadband & mobile", "w": 4, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 122.487, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.123, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-GA70-AP-APNIC", "org": "Grand Tel Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://grandtel.com.pk"}, "pfx": 2, "reg": "2021-04-20", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00067862274161}, {"a": 142122, "h": "NETZONECOMPUTERS-AS-AP", "n": "Netzone Computers", "t": "Other", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 9.616, 0.013, 0, false]], "sh": false, "uc": 11132.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 9.616, "se": 1.088, "ts": 0.500, "map": 53.635, "obs": 2, "own": 33.342, "comp": {"cins": -0.1438, "dshield": -0.3301, "crowdsec": 3.4321, "vulncheck": 3.1662, "blocklist_de": -0.7487}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.229, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-NC21-AP-APNIC", "org": "Netzone Computers", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://netzone.com.bd/"}, "pfx": 2, "reg": "2021-04-25", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005860939092}, {"a": 142162, "h": "KIN-AS-AP", "n": "King IT Net", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 20312.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.408, "det": null, "oid": "ORG-KIN2-AP-APNIC", "org": "King IT Net", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.kingitnetbd.com"}, "pfx": 1, "reg": "2021-05-11", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142271, "h": "DOUBLESQUARE-AS-AP", "n": "EWS DS Networks Inc", "t": "Broadband & mobile", "w": 3, "cc": "PH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 3, "router_or_botnet": 1}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 16.911, 0.011, 1, false], ["2026-10-12", 24.572, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 24.572, "se": 0.696, "ts": 0.500, "map": 67.301, "obs": 4, "own": 104.291, "comp": {"cins": -0.5694, "dshield": 2.5172, "crowdsec": 2.8314, "vulncheck": -0.696, "blocklist_de": 1.5197}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.163, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-DNI3-AP-APNIC", "org": "DoubleSquare Networks Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.dsnetworks.net/"}, "pfx": 6, "reg": "2021-05-14", "rir": "apnic", "s24": 7, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00160608549174}, {"a": 142275, "h": "INCUBATECSRL-AS-AP", "n": "INCUBATEC Srl", "t": "Other", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.578, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-IS10-AP-APNIC", "org": "INCUBATEC Srl", "pdb": null, "pfx": 2, "reg": "2021-05-18", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142299, "h": "CLOUDFORESTCOLTD-AS-AP", "n": "CLOUDFOREST CO.,LTD.", "t": "Hosting & VPS", "w": 4, "cc": "TH", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.3924, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "threatfox": {"n": 2, "p": 0.4209, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 4.367, 23.445, 1, false], ["2026-10-12", 2.105, 3.397, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 3.397, "se": 1.182, "ts": 1.000, "map": 17.337, "obs": 2, "own": 6.516, "comp": {"urlhaus": -0.245, "threatfox": 5.1806, "phishing_db": -0.4565}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.105, "se": 0.960, "ts": 1.000, "map": 9.429, "obs": 2, "own": 1.931, "comp": {"cins": -0.27, "dshield": -0.5878, "crowdsec": 6.3863, "vulncheck": -0.4968, "blocklist_de": -1.3943}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:AsyncRAT": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CC27-AP-APNIC", "org": "CLOUDFOREST CO.,LTD", "pdb": {"t": "Content", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://cloudforest.co.th"}, "pfx": 23, "reg": "2021-05-29", "rir": "apnic", "s24": 22, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026300454756}, {"a": 142317, "h": "IDNIC-COVERNET-AS-ID", "n": "Cover Network Indonesia (Covernet)", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.150, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-142317-APNIC", "org": "PT Cover Network Indonesia", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.covernet.id"}, "pfx": 3, "reg": "2021-06-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142319, "h": "IDNIC-VIBERLINK-AS-ID", "n": "Telemedia Komunikasi Pratama", "t": "Transit & backbone", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 1, "web_bruteforce": 3, "home_connection": 2, "router_or_botnet": 2, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5779, "hi": 7.03, "lo": 1.24, "ips": 3, "mean": 3.62, "above": false}}, "h2": [["2026-10-05", 2.855, 0.011, 0, false], ["2026-10-12", 3.042, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 2.394, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.042, "se": 0.766, "ts": 1.000, "map": 9.359, "obs": 3, "own": 29.766, "comp": {"cins": -0.4542, "dshield": -0.9197, "crowdsec": 7.9603, "vulncheck": -0.6375, "blocklist_de": -2.3189}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.116, "det": null, "oid": "@aut-142319-APNIC", "org": "PT Telemedia Komunikasi Pratama", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://viberlink.net"}, "pfx": 40, "reg": "2021-06-01", "rir": "apnic", "s24": 39, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0066451287342}, {"a": 142347, "h": "IDNIC-JAGONET-AS-ID", "n": "JAGONET", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 15.817, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 15.817, "se": 0.813, "ts": 0.333, "map": 53.881, "obs": 3, "own": 84.487, "comp": {"cins": -0.407, "dshield": 3.1702, "crowdsec": 0.6736, "vulncheck": -0.6083, "blocklist_de": 2.552}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.270, "det": {"blocklist_de": {"sip": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.jago.net.id"}, "pfx": 7, "reg": "2021-06-01", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009167968854}, {"a": 142362, "h": "IDNIC-SUKMA-AS-ID", "n": "PT Sukma Sejati Media", "t": "Other", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 4, "ssh_bruteforce": 4, "router_or_botnet": 4}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.146, "det": {"blocklist_de": {"ssh": 4}}, "oid": "@aut-142362-APNIC", "org": "PT Sukma Sejati Media", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://sukmamedia.com"}, "pfx": 5, "reg": "2021-06-01", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142366, "h": "IDNIC-RELABS-AS-ID", "n": "Relabs Net Daya Cipta", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.214, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-142366-APNIC", "org": "PT Relabs Net Daya Cipta", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://relabs.id/"}, "pfx": 4, "reg": "2021-06-01", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142373, "h": "IDNIC-MULTINET-AS-ID", "n": "Multi Network Indonesia", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-142373-APNIC", "org": "PT Multi Network Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.mni.net.id/"}, "pfx": 3, "reg": "2021-06-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000780911098}, {"a": 142386, "h": "AZNET-ID", "n": "PT JARINGAN LINTAS ARTHA", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "bad_crawling": 2, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 3, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 19.293, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.310, "det": null, "oid": "@aut-142386-APNIC", "org": "PT JARINGAN LINTAS ARTHA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://jlanet.id"}, "pfx": 5, "reg": "2021-06-01", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0032773295742}, {"a": 142393, "h": "IDNIC-MEDIASOLUSISUKSES-AS-ID", "n": "Media Solusi Sukses", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": {"rb": "lo", "wb": null, "rep": 1.84, "waf": null}, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4038, "hi": 6.12, "lo": 0.79, "ips": 3, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 3.310, 0.011, 0, false], ["2026-10-12", 3.548, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.548, "se": 0.993, "ts": 1.000, "map": 16.944, "obs": 2, "own": 27.352, "comp": {"cins": -0.244, "dshield": -0.537, "crowdsec": 6.7369, "vulncheck": -0.4697, "blocklist_de": -1.2626}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.528, "det": null, "oid": "@aut-142393-APNIC", "org": "PT Media Solusi Sukses", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://mediasolusisukses.co.id"}, "pfx": 8, "reg": "2021-06-01", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022774901886}, {"a": 142403, "h": "YISUCLOUDLTD-HK", "n": "YISU CLOUD LTD", "t": "Hosting & VPS", "w": 33, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 21, "web_bruteforce": 5, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 2, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2021-41773": 1}, "n": 22}, "ev": {"shodan": {"n": 8, "p": 0.9910, "hi": 12.56, "lo": 4.08, "ips": 8, "mean": 7.83, "above": true}, "crowdsec": {"n": 19, "p": 1.0000, "hi": 23.51, "lo": 11.18, "ips": 22, "mean": 16.86, "above": true}, "threatfox": {"n": 4, "p": 0.8098, "hi": 9.06, "lo": 1.95, "ips": 4, "mean": 4.95, "above": true}, "vulncheck": {"n": 2, "p": 0.3990, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "phishing_db": {"n": 4, "p": 0.7977, "hi": 8.85, "lo": 1.90, "ips": 5, "mean": 4.83, "above": true}, "blocklist_de": {"n": 8, "p": 0.9940, "hi": 13.43, "lo": 4.37, "ips": 9, "mean": 8.37, "above": true}}, "h2": [["2026-10-05", 42.211, 13.995, 1, false], ["2026-10-12", 38.962, 13.886, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 4}, "lo": 13.886, "se": 0.798, "ts": 0.500, "map": 32.631, "obs": 8, "own": 11.329, "comp": {"urlhaus": -1.0632, "threatfox": 3.0803, "phishing_db": 3.0944}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 19, "vulncheck": 2, "blocklist_de": 8}, "lo": 38.962, "se": 0.397, "ts": 0.655, "map": 62.326, "obs": 29, "own": 12.125, "comp": {"cins": -2.5697, "dshield": -2.8871, "crowdsec": 7.7614, "vulncheck": -0.4724, "blocklist_de": 3.6938}, "mass": 24.0, "listed": false}}, "abq": false, "bot": 0.891, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 6}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 3}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 9}}, "oid": "ORG-YCL1-AP-APNIC", "org": "YISU CLOUD LIMITED", "pdb": null, "pfx": 70, "reg": "2021-06-02", "rir": "apnic", "s24": 70, "sib": 2, "tor": 0, "w24": 27, "drop": 1, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 17920, "abuse": null, "score": 1.0000, "groups": ["sensors", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0007697982998}, {"a": 142404, "h": "CHINANET-AS-AP", "n": "China Telecom AS142404", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.304, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.765, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.chinatelecomglobal.com/"}, "pfx": 3, "reg": "2021-06-03", "rir": "apnic", "s24": 32, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003114568912}, {"a": 142430, "h": "DIGIVPS-AS-AP", "n": "DIGI VPS", "t": "Broadband & mobile", "w": 6, "cc": "IN", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.68}, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 5, "ssh_bruteforce": 5, "web_bruteforce": 5, "home_connection": 4, "cve:CVE-2017-9841": 3, "cve:CVE-2021-3129": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2019-11510": 3, "cve:CVE-2021-26086": 2}, "n": 5}, "ev": {"urlhaus": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 5, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 35.879, 1.024, 1, false], ["2026-10-12", 11.989, 1.068, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.068, "se": 1.917, "ts": 1.000, "map": 16.822, "obs": 1, "own": 88.926, "comp": {"urlhaus": 4.5442, "threatfox": -0.0344, "phishing_db": -0.0609}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.989, "se": 1.090, "ts": 1.000, "map": 69.245, "obs": 2, "own": 113.894, "comp": {"cins": -0.1839, "dshield": -0.415, "crowdsec": 7.5814, "vulncheck": -0.396, "blocklist_de": -0.9552}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.997, "det": null, "oid": "ORG-DA68-AP-APNIC", "org": "DIGI VPS", "pdb": null, "pfx": 1, "reg": "2021-06-11", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00479562922322}, {"a": 142439, "h": "ALPHAFNET-AS-IN", "n": "ALPHA FIBERNET", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 30273.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 122.487, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.188, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-142439-APNIC", "org": "ALPHA FIBER NET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.alphafibernet.in"}, "pfx": 3, "reg": "2021-06-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142470, "h": "SREEDEVI-AS-IN", "n": "SREEDEVI COMMUNICATIONS", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 4.815, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": 2901.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 15.216, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.129, "det": null, "oid": "@aut-142470-APNIC", "org": "SREEDEVI COMMUNICATIONS PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://sdvcomm.in"}, "pfx": 8, "reg": "2021-06-18", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142488, "h": "NEXTIABB-AS", "n": "NEXTIABB", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4023.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.208, "det": null, "oid": "@aut-142488-APNIC", "org": "Nextia Broadband Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.nextiabroadband.in"}, "pfx": 10, "reg": "2021-06-18", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006143701794}, {"a": 142519, "h": "SMTPM-AS-IN", "n": "Smtpmailers Pvt Ltd", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-142519-APNIC", "org": "Smtpmailers Pvt Ltd", "pdb": null, "pfx": 1, "reg": "2021-06-18", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142577, "h": "MAHERINTERNATIONAL-AS-AP", "n": "Maher International", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 6.735, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.735, "se": 1.041, "ts": 0.500, "map": 35.126, "obs": 2, "own": 57.288, "comp": {"cins": -0.2307, "dshield": -0.5105, "crowdsec": 2.4519, "vulncheck": -0.4547, "blocklist_de": 3.6966}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-MI22-AP-APNIC", "org": "Maher International", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.optihub.com.bd"}, "pfx": 5, "reg": "2021-07-14", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00213599637049}, {"a": 142594, "h": "SPEEDYPAGELTD-AS-AP", "n": "SpeedyPage Ltd", "t": "Broadband & mobile", "w": 3, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3896, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "threatfox": {"n": 3, "p": 0.6448, "hi": 7.73, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 0.011, 12.842, 1, false], ["2026-10-12", 0.011, 7.630, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 7.630, "se": 1.004, "ts": 1.000, "map": 27.353, "obs": 3, "own": 63.562, "comp": {"urlhaus": -0.3997, "threatfox": 5.9544, "phishing_db": -0.6197}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 1.013, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.743, "det": {"shodan": {"c2": 2}, "threatfox": {"family:AdaptixC2": 3}}, "oid": "ORG-SA180-AP-APNIC", "org": "SpeedyPage Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://speedypage.com"}, "pfx": 24, "reg": "2021-07-27", "rir": "apnic", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00211327409407}, {"a": 142622, "h": "DIL-AS-AP", "n": "Dream Information Laboratory", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.740, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.212, "obs": 0, "own": 0.364, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.729, "det": null, "oid": "ORG-DIL7-AP-APNIC", "org": "Dream Information Laboratory LLC", "pdb": null, "pfx": 25, "reg": "2022-08-22", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142627, "h": "MULTILINK-AS-AP", "n": "Multilink International", "t": "Other", "w": 24, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 16, "web_bruteforce": 7, "router_or_botnet": 1}, "n": 16}, "ev": {"dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 16, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 12, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 39.498, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 39.498, "se": 0.845, "ts": 0.333, "map": 142.555, "obs": 3, "own": 81.921, "comp": {"cins": -0.3628, "dshield": 3.3621, "crowdsec": 1.095, "vulncheck": -0.5772, "blocklist_de": 2.8363}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.257, "det": {"blocklist_de": {"ssh": 12}}, "oid": "ORG-MI23-AP-APNIC", "org": "Multilink International", "pdb": null, "pfx": 2, "reg": "2021-08-06", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 142647, "h": "NAN-AS-AP", "n": "Nasstec Airnet", "t": "Broadband & mobile", "w": 32, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 32, "bad_crawling": 3, "proxy_or_vpn": 3, "first_seen_30d": 2, "ssh_bruteforce": 5, "web_bruteforce": 15, "home_connection": 6, "mail_bruteforce": 4, "router_or_botnet": 27, "cve:CVE-2019-8318": 19, "cve:CVE-2025-4396": 1, "cve:CVE-2018-10562": 19, "cve:CVE-2024-12847": 30, "cve:CVE-2024-28000": 1}, "n": 32}, "ev": {"cins": {"n": 3, "p": 0.6430, "hi": 7.70, "lo": 1.36, "ips": 4, "mean": 3.97, "above": false}, "dshield": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 5, "p": 0.9035, "hi": 10.11, "lo": 2.51, "ips": 32, "mean": 5.77, "above": true}}, "h2": [["2026-10-05", 28.956, 0.011, 1, false], ["2026-10-12", 47.865, 0.012, 1, false]], "sh": false, "uc": 4244.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 47.865, "se": 0.506, "ts": 0.556, "map": 91.461, "obs": 9, "own": 140.300, "comp": {"cins": 9.6849, "dshield": 0.2547, "crowdsec": 3.3022, "vulncheck": -0.8778, "blocklist_de": -6.4544}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.125, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NAN1-AP-APNIC", "org": "Nasstec Airnet Networks Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "http://www.nasstecairnet.net.pk"}, "pfx": 15, "reg": "2021-08-16", "rir": "apnic", "s24": 15, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00263406867218}, {"a": 146817, "h": "FXNET", "n": "Hubei Feixun Network Co., Ltd", "t": "Other", "w": 9, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 4, "p": 0.7770, "hi": 8.53, "lo": 1.84, "ips": 4, "mean": 4.66, "above": false}, "shodan": {"n": 12, "p": 0.9996, "hi": 14.17, "lo": 5.61, "ips": 12, "mean": 9.48, "above": true}, "urlhaus": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.1866, "hi": 4.30, "lo": 0.56, "ips": 2, "mean": 2.05, "above": false}, "threatfox": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 2, "p": 0.3100, "hi": 5.31, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}}, "h2": [["2026-10-05", 3.222, 2.350, 0, false], ["2026-10-12", 4.845, 1.311, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 1.311, "se": 1.179, "ts": 0.500, "map": 6.299, "obs": 2, "own": 6.608, "comp": {"urlhaus": 3.1033, "threatfox": 1.1367, "phishing_db": -0.7734}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.845, "se": 0.521, "ts": 0.500, "map": 9.572, "obs": 8, "own": 5.396, "comp": {"cins": 12.2878, "dshield": -2.1934, "crowdsec": -4.5484, "vulncheck": -0.8994, "blocklist_de": -0.9941}, "mass": 9.2, "listed": false}}, "abq": false, "bot": 0.824, "det": {"shodan": {"compromised": 12}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 1, "imap": 1, "mail": 1}}, "oid": "@aut-146817-APNIC", "org": "Hubei Feixun Network Co., Ltd", "pdb": null, "pfx": 51, "reg": "2021-06-27", "rir": "apnic", "s24": 174, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 45568, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00054261390534}, {"a": 146887, "h": "AS146887", "n": "NOOB TECHNOLOGIES", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://noobtech.in"}, "pfx": 1, "reg": "2021-08-12", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 146904, "h": "MGPL-AS-IN", "n": "MICRONET GIGAFIBER PVT LTD", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 3.259, 0.011, 0, false], ["2026-10-12", 3.544, 0.012, 0, false]], "sh": false, "uc": 4101.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.544, "se": 0.994, "ts": 0.500, "map": 16.944, "obs": 2, "own": 27.406, "comp": {"cins": -0.2649, "dshield": -0.578, "crowdsec": 2.0858, "vulncheck": -0.4917, "blocklist_de": 3.4724}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.209, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-146904-APNIC", "org": "MICRONET GIGAFIBER PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Selective", "web": "http://www.micronet.in/"}, "pfx": 10, "reg": "2021-08-12", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 146917, "h": "JDALLDAY-AS-IN", "n": "JD ALLDAY NETSOL PRIVATE LIMITED", "t": "Other", "w": 4, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.001, 0.011, 0, false], ["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": 12304.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 14.019, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.225, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-146917-APNIC", "org": "JD ALLDAY NETSOL PRIVATE LIMITED", "pdb": null, "pfx": 2, "reg": "2021-08-12", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 146943, "h": "TIER4CLOU-AS", "n": "Tier 4 Cloud Services", "t": "Hosting & VPS", "w": 15, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2024-28000": 3, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"cins": {"n": 3, "p": 0.6211, "hi": 7.46, "lo": 1.32, "ips": 3, "mean": 3.85, "above": false}, "shodan": {"n": 27, "p": 1.0000, "hi": 31.12, "lo": 16.63, "ips": 27, "mean": 23.40, "above": true}, "crowdsec": {"n": 6, "p": 0.9152, "hi": 9.52, "lo": 2.64, "ips": 6, "mean": 5.62, "above": true}, "vulncheck": {"n": 4, "p": 0.7904, "hi": 8.73, "lo": 1.88, "ips": 6, "mean": 4.77, "above": false}, "phishing_db": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1591, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 8.340, 0.302, 0, false], ["2026-10-12", 11.371, 0.316, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.316, "se": 1.468, "ts": 1.000, "map": 2.712, "obs": 1, "own": 1.220, "comp": {"urlhaus": -0.1646, "threatfox": -0.1861, "phishing_db": 2.9747}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 6, "vulncheck": 4, "blocklist_de": 1}, "lo": 11.371, "se": 0.470, "ts": 0.429, "map": 20.566, "obs": 14, "own": 4.036, "comp": {"cins": 8.2469, "dshield": -2.3004, "crowdsec": 2.0944, "vulncheck": 1.2423, "blocklist_de": -4.8659}, "mass": 10.5, "listed": false}}, "abq": false, "bot": 0.753, "det": {"shodan": {"compromised": 27}, "vulncheck": {"c2_server": 2, "botnet_node": 4}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-146943-APNIC", "org": "Tier 4 Cloud Services", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://tier4.cloud"}, "pfx": 89, "reg": "2021-08-12", "rir": "apnic", "s24": 92, "sib": 0, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23552, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00089791706982}, {"a": 146944, "h": "UNET-AS", "n": "Innolens Media and Broadcasting Limited - Chennai", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.164, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.innolensmedia.com"}, "pfx": 4, "reg": "2021-08-12", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 146966, "h": "CHINANET-YANGZHOUNORTH-IDC", "n": "China Telecom", "t": "Broadband & mobile", "w": 101, "cc": "CN", "cf": null, "cs": {"c": {"http_flood": 55, "web_exploit": 5, "bad_crawling": 10, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 55, "mail_bruteforce": 1, "cve:CVE-2024-6387": 3, "cve:CVE-2025-4396": 39, "cve:CVE-2022-26134": 5, "cve:CVE-2023-22515": 1, "cve:CVE-2024-28000": 20}, "n": 100}, "ev": {"shodan": {"n": 10, "p": 0.9974, "hi": 12.89, "lo": 4.69, "ips": 10, "mean": 8.36, "above": true}, "dshield": {"n": 1, "p": 0.1661, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "crowdsec": {"n": 12, "p": 0.9996, "hi": 13.95, "lo": 5.52, "ips": 100, "mean": 9.33, "above": true}, "blocklist_de": {"n": 1, "p": 0.1385, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-05", 8.238, 0.010, 0, false], ["2026-10-12", 7.659, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.980, "ts": null, "map": 0.179, "obs": 0, "own": 1.217, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.659, "se": 0.449, "ts": 0.857, "map": 13.428, "obs": 14, "own": 20.610, "comp": {"cins": -1.7037, "dshield": -0.5216, "crowdsec": 12.2829, "vulncheck": -0.9165, "blocklist_de": -5.15}, "mass": 11.0, "listed": false}}, "abq": false, "bot": 0.864, "det": {"shodan": {"malware": 1, "compromised": 9}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 107, "reg": "2021-08-25", "rir": "apnic", "s24": 148, "sib": 281, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 38912, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.0030809108551}, {"a": 147034, "h": "BAREBOXCOMBD-AS-AP", "n": "barebox.com.bd", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.189, "obs": 0, "own": 0.264, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-BA79-AP-APNIC", "org": "barebox.com.bd", "pdb": null, "pfx": 36, "reg": "2021-09-15", "rir": "apnic", "s24": 48, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147038, "h": "CHINANET-QINGYANG-IDC", "n": "China Telecom", "t": "Broadband & mobile", "w": 0, "cc": "CN", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.9816, "hi": 12.11, "lo": 3.67, "ips": 7, "mean": 7.37, "above": true}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.791, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.879, "det": {"shodan": {"compromised": 7}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 25, "reg": "2021-09-16", "rir": "apnic", "s24": 40, "sib": 281, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 10496, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0000400828142}, {"a": 147049, "h": "PACKETHUBSA-AS-AP", "n": "PacketHub AS147049", "t": "Other", "w": 11, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 6, "bad_crawling": 4, "proxy_or_vpn": 6, "web_bruteforce": 5, "cve:CVE-2025-4396": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 5, "cve:CVE-2026-75650": 1}, "n": 6}, "ev": {"dshield": {"n": 5, "p": 0.9056, "hi": 10.17, "lo": 2.53, "ips": 5, "mean": 5.81, "above": true}, "crowdsec": {"n": 2, "p": 0.3219, "hi": 5.41, "lo": 0.70, "ips": 6, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 0.884, 0.011, 0, false], ["2026-10-12", 7.396, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.613, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.396, "se": 0.540, "ts": 0.714, "map": 15.254, "obs": 7, "own": 8.594, "comp": {"cins": -1.0131, "dshield": 12.1289, "crowdsec": -1.1718, "vulncheck": -0.8269, "blocklist_de": -4.9985}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.510, "det": null, "oid": "ORG-PS10-AP-APNIC", "org": "PacketHub S.A.", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.packethub.net/"}, "pfx": 62, "reg": "2021-09-21", "rir": "apnic", "s24": 62, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.03429687303646}, {"a": 147124, "h": "IDNIC-HOSTINGAN-AS-ID", "n": "Hostingan Awan Indonesia", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.997, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-147124-APNIC", "org": "PT Hostingan Awan Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.hostingan.id/"}, "pfx": 2, "reg": "2021-09-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147152, "h": "IDNIC-ISOAE-AS-ID", "n": "PT Asli Isoae Solusine", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.514, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-147152-APNIC", "org": "PT Asli Isoae Solusine", "pdb": {"t": "Enterprise", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://isoae.id/"}, "pfx": 3, "reg": "2021-09-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147154, "h": "PASSNET-AS-ID", "n": "PT Pass Internet Indonesia", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.151, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-147154-APNIC", "org": "PT Pass Internet Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.pass.net.id"}, "pfx": 2, "reg": "2021-09-17", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147181, "h": "FLAREZENLTD-AS-AP", "n": "Flarezen", "t": "Enterprise, edu & gov", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6343, "hi": 7.61, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 9.852, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 3.617, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 46.156, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.835, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-MA119-AP-APNIC", "org": "Flarezen Ltd.", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://flarezen.com"}, "pfx": 10, "reg": "2021-10-05", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147185, "h": "IDSPL-AS-AP", "n": "INFYNIX DATA SERVICES", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3493, "hi": 5.64, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 4.635, 0.011, 0, false], ["2026-10-12", 1.235, 0.012, 0, false]], "sh": false, "uc": 1260.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.254, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.235, "se": 0.930, "ts": 1.000, "map": 5.214, "obs": 2, "own": 1.064, "comp": {"cins": -0.2967, "dshield": -0.639, "crowdsec": 6.0328, "vulncheck": -0.5224, "blocklist_de": -1.5298}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.138, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-IDSP2-AP-APNIC", "org": "INFYNIX DATA SERVICES PRIVATE LIMITED", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.infynix.in"}, "pfx": 44, "reg": "2021-10-06", "rir": "apnic", "s24": 44, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00065272650276}, {"a": 147221, "h": "INSPITELE-AS-IN", "n": "INSPITELE SOLUTIONS PRIVATE LIMITED", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 6.211, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.138, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-147221-APNIC", "org": "INSPITELE SOLUTIONS PRIVATE LIMITED", "pdb": null, "pfx": 6, "reg": "2021-10-08", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046490316933}, {"a": 147233, "h": "AAACT-AS-IN", "n": "Ekam Convergence Pvt. Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.932, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://ektv.in"}, "pfx": 1, "reg": "2021-10-08", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147236, "h": "SSICON-AS-IN", "n": "SSICON SYSTEMS PRIVATE LIMITED", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5761.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-147236-APNIC", "org": "SSICON SYSTEMS PRIVATE LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.ssiconsystems.com"}, "pfx": 4, "reg": "2021-10-08", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147237, "h": "CLOUDMINI-AS-IN", "n": "CLOUDMINISTER TECHNOLOGIES PRIVATE LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.769, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-147237-APNIC", "org": "CLOUDMINISTER TECHNOLOGIES PRIVATE LIMITED", "pdb": null, "pfx": 5, "reg": "2021-10-08", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147277, "h": "CFIBER-AS-IN", "n": "C FIBER COMMUNICATIONS", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 19.293, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.140, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-147277-APNIC", "org": "C FIBER COMMUNICATIONS PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.cfnet.in"}, "pfx": 4, "reg": "2021-10-08", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147287, "h": "DATAPARA1-AS-IN", "n": "DATAPARADISE", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.280, "det": null, "oid": "@aut-147287-APNIC", "org": "DATAPARADISE", "pdb": null, "pfx": 3, "reg": "2021-10-08", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 147302, "h": "FBPL-AS-AP", "n": "FALCON BROADBAND (PRIVATE) LIMITED", "t": "Broadband & mobile", "w": 7, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 2, "router_or_botnet": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 3, "mean": 2.90, "above": false}, "blocklist_de": {"n": 3, "p": 0.6379, "hi": 7.65, "lo": 1.35, "ips": 4, "mean": 3.95, "above": false}}, "h2": [["2026-10-12", 23.423, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 23.423, "se": 0.625, "ts": 0.600, "map": 55.892, "obs": 5, "own": 86.225, "comp": {"cins": -0.8215, "dshield": -1.4601, "crowdsec": 0.4072, "vulncheck": -0.7828, "blocklist_de": 8.0743}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.139, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-FBL5-AP-APNIC", "org": "FALCON BROADBAND (PRIVATE) LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.falconbroadband.net.pk"}, "pfx": 13, "reg": "2024-09-02", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00237657486297}, {"a": 147303, "h": "COLOCONE1-AS-AP", "n": "ColoCone", "t": "Hosting & VPS", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 2.459, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.929, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CA100-AP-APNIC", "org": "ColoCone", "pdb": null, "pfx": 5, "reg": "2021-10-13", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 148993, "h": "DIANAHOSTLTD-AS-AP", "n": "Diana Host Ltd", "t": "Hosting & VPS", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-DHL2-AP-APNIC", "org": "Diana Host Ltd", "pdb": null, "pfx": 2, "reg": "2021-11-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149014, "h": "BOJINGCOLIMITED-AS-AP", "n": "bo jing", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1923, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.010, 0.457, 0, false], ["2026-10-12", 0.011, 0.476, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.476, "se": 1.549, "ts": 1.000, "map": 4.917, "obs": 1, "own": 5.870, "comp": {"urlhaus": -0.1058, "threatfox": -0.1327, "phishing_db": 3.4575}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.339, "det": null, "oid": "ORG-BJ1-AP-APNIC", "org": "bo jing", "pdb": null, "pfx": 32, "reg": "2021-11-12", "rir": "apnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149020, "h": "WEBHORIZON-AS-AP", "n": "WebHorizon Internet Services", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "vulncheck": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.011, 6.421, 0, false], ["2026-10-12", 0.410, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.410, "se": 1.361, "ts": 1.000, "map": 3.766, "obs": 1, "own": 7.206, "comp": {"cins": -0.0719, "dshield": -0.1702, "crowdsec": -0.6744, "vulncheck": 4.012, "blocklist_de": -0.3758}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.817, "det": {"shodan": {"compromised": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "ORG-WIS5-AP-APNIC", "org": "WebHorizon Internet Services", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://webhorizon.net"}, "pfx": 14, "reg": "2021-11-18", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030353543288}, {"a": 149060, "h": "SQUARENET-AS-AP", "n": "SQUARE NET", "t": "Other", "w": 12, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 6, "proxy_or_vpn": 11, "first_seen_30d": 10, "web_bruteforce": 11}, "n": 11}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 11, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.343, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SN33-AP-APNIC", "org": "SQUARE NET", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://squarenetbd.com"}, "pfx": 3, "reg": "2021-12-02", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149068, "h": "INETSOFT-AS-VN", "n": "iNET software one member company limited", "t": "Other", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.8109, "hi": 9.08, "lo": 1.95, "ips": 4, "mean": 4.96, "above": true}, "crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.968, "det": {"shodan": {"compromised": 4}}, "oid": "@aut-149068-APNIC", "org": "iNET software one member company limited", "pdb": null, "pfx": 1, "reg": "2021-12-03", "rir": "apnic", "s24": 4, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00009550077432}, {"a": 149078, "h": "VPSMMO-AS-VN", "n": "VPSMMO TECHNOLOGY COMPANY LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.531, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149078-APNIC", "org": "VPSMMO TECHNOLOGY COMPANY LIMITED", "pdb": null, "pfx": 9, "reg": "2021-12-03", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009023946288}, {"a": 149087, "h": "HANU-AS-VN", "n": "Hanoi University", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.989, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149087-APNIC", "org": "Hanoi University", "pdb": null, "pfx": 1, "reg": "2021-12-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149089, "h": "CLOUDFLY-VN", "n": "CLOUDFLY CORPORATION", "t": "Hosting & VPS", "w": 2, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.923, 0.011, 1, false], ["2026-10-12", 3.570, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.570, "se": 1.013, "ts": 0.500, "map": 17.224, "obs": 2, "own": 3.668, "comp": {"cins": -0.183, "dshield": -0.4131, "crowdsec": 2.9803, "vulncheck": 2.8065, "blocklist_de": -0.9506}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.883, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-149089-APNIC", "org": "CLOUDFLY CORPORATION", "pdb": null, "pfx": 2, "reg": "2021-12-03", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026310543042}, {"a": 149098, "h": "HATANGSO-VN", "n": "VIETNAM DIGITAL INFRASTRUCTURE JOINT STOCK COMPANY", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.926, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149098-APNIC", "org": "VIETNAM DIGITAL INFRASTRUCTURE JOINT STOCK COMPANY", "pdb": null, "pfx": 2, "reg": "2021-12-03", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149107, "h": "TRUMVPS-VN", "n": "TRUMVPS COMPANY LIMITED", "t": "Hosting & VPS", "w": 6, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 6, "ssh_bruteforce": 1, "web_bruteforce": 6, "cve:CVE-2024-28000": 4}, "n": 6}, "ev": {"shodan": {"n": 2, "p": 0.3992, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 6, "mean": 2.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 16.561, 0.011, 1, false], ["2026-10-12", 6.606, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.606, "se": 0.788, "ts": 0.667, "map": 21.200, "obs": 3, "own": 4.235, "comp": {"cins": -0.449, "dshield": -0.9111, "crowdsec": 4.1594, "vulncheck": -0.6345, "blocklist_de": 2.2828}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.697, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-149107-APNIC", "org": "TRUMVPS COMPANY LIMITED", "pdb": null, "pfx": 9, "reg": "2021-12-03", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004866713082}, {"a": 149113, "h": "ODB-VN", "n": "ODB VIET NAM COMPANY LIMITED", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.785, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149113-APNIC", "org": "ODB VIET NAM COMPANY LIMITED", "pdb": null, "pfx": 4, "reg": "2021-12-03", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149125, "h": "DV4S-VN", "n": "4S TECHNOLOGY TRADING SERVICES COMPANY LIMITED", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.943, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-149125-APNIC", "org": "4S TECHNOLOGY TRADING SERVICES COMPANY LIMITED", "pdb": null, "pfx": 1, "reg": "2021-12-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149137, "h": "TANTHANHAN-VN", "n": "TAN THANH AN INTERNATIONAL TRADE DEVELOPMENT COMPANY LIMITED", "t": "Other", "w": 3, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4056, "hi": 6.13, "lo": 0.80, "ips": 3, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 3.545, 0.011, 0, false], ["2026-10-12", 3.827, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.827, "se": 0.998, "ts": 1.000, "map": 18.356, "obs": 2, "own": 10.851, "comp": {"cins": -0.2405, "dshield": -0.5301, "crowdsec": 6.7848, "vulncheck": -0.4658, "blocklist_de": -1.2448}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.452, "det": null, "oid": "@aut-149137-APNIC", "org": "TAN THANH AN INTERNATIONAL TRADE DEVELOPMENT COMPANY LIMITED", "pdb": null, "pfx": 5, "reg": "2021-12-03", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008479214548}, {"a": 149143, "h": "MONA-MEDIA-VN", "n": "MONA MEDIA COMPANY", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.896, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149143-APNIC", "org": "MONA MEDIA COMPANY", "pdb": null, "pfx": 1, "reg": "2021-12-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149147, "h": "GOFIBER-SOFTWARE-VN", "n": "GOFIBER SOFTWARE TECHNOLOGY COMPANY LIMITED", "t": "Broadband & mobile", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.721, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149147-APNIC", "org": "GOFIBER SOFTWARE TECHNOLOGY COMPANY LIMITED", "pdb": null, "pfx": 10, "reg": "2021-12-03", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017281282298}, {"a": 149148, "h": "PHUHAIPC-VN", "n": "Phu Hai Computer Co., Ltd", "t": "Other", "w": 2, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "threatfox": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.911, 0, false], ["2026-10-12", 1.134, 0.938, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.938, "se": 1.811, "ts": 1.000, "map": 14.132, "obs": 1, "own": 23.079, "comp": {"urlhaus": -0.0195, "threatfox": 4.3458, "phishing_db": -0.0516}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 14.019, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.845, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-149148-APNIC", "org": "Phu Hai Computer Co., Ltd", "pdb": null, "pfx": 1, "reg": "2021-12-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000165412443}, {"a": 149173, "h": "HBISC-AS-AP", "n": "Hindukush Bridge ICT Services Company", "t": "Broadband & mobile", "w": 0, "cc": "AF", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 12812.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.162, "det": null, "oid": "ORG-HBIS1-AP-APNIC", "org": "Hindukush Bridge ICT Services Company", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://hindukush-bridge.com/#slider"}, "pfx": 5, "reg": "2021-12-08", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051039551691}, {"a": 149178, "h": "CT-HEFEI-NANGANG-IDC", "n": "China Telecom", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1874, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.207, 0.011, 0, false], ["2026-10-12", 0.233, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.233, "se": 1.253, "ts": 1.000, "map": 1.809, "obs": 1, "own": 3.182, "comp": {"cins": 4.8977, "dshield": -0.3536, "crowdsec": -1.3989, "vulncheck": -0.3536, "blocklist_de": -0.8053}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.617, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 2, "reg": "2021-12-09", "rir": "apnic", "s24": 64, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007159289254}, {"a": 149181, "h": "BHAGWAT-AS-IN", "n": "BHAGWAT SOFTWARE", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-149181-APNIC", "org": "BHAGWAT SOFTWARE", "pdb": null, "pfx": 3, "reg": "2021-12-09", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149183, "h": "LEMON-AS-IN", "n": "LEMONGRASS NETWORKS", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 27343.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.177, "det": null, "oid": "@aut-149183-APNIC", "org": "LEMONGRASS NETWORKS", "pdb": null, "pfx": 2, "reg": "2021-12-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149194, "h": "XTELIFY-AS-IN", "n": "Xtelify Limited", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1938, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.316, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.316, "se": 1.315, "ts": 1.000, "map": 2.658, "obs": 1, "own": 1.819, "comp": {"cins": -0.0831, "dshield": -0.1958, "crowdsec": -0.7758, "vulncheck": 3.8601, "blocklist_de": -0.4343}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"malware": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-XL15-AP-APNIC", "org": "Xtelify Limited", "pdb": null, "pfx": 11, "reg": "2021-12-09", "rir": "apnic", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149196, "h": "ZAIFCOMP-AS-IN", "n": "Zaif Computers", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-149196-APNIC", "org": "Zaif Computers", "pdb": null, "pfx": 2, "reg": "2021-12-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149197, "h": "GIRDHARI-AS-IN", "n": "Girdhari Computers", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-149197-APNIC", "org": "Girdhari Computers", "pdb": null, "pfx": 2, "reg": "2021-12-09", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149208, "h": "RAKESSEN-AS-IN", "n": "RAKESH TELESOFT", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.945, "det": null, "oid": "@aut-149208-APNIC", "org": "RAKESH TELESOFT", "pdb": null, "pfx": 9, "reg": "2021-12-09", "rir": "apnic", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149240, "h": "MNPL-AS-IN", "n": "Megatel Networks Private Limited", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 2.516, 0.011, 0, false], ["2026-10-12", 0.484, 0.012, 0, false]], "sh": false, "uc": 4572.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.484, "se": 1.383, "ts": 1.000, "map": 4.801, "obs": 1, "own": 8.979, "comp": {"cins": -0.1039, "dshield": -0.2427, "crowdsec": -0.961, "vulncheck": -0.2657, "blocklist_de": 4.5357}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.226, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-149240-APNIC", "org": "Megatel Networks Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "50-100Gbps", "pol": "Open", "web": "http://megatelnetworks.in"}, "pfx": 16, "reg": "2021-12-09", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00062039123016}, {"a": 149242, "h": "ANANYAA-AS-IN", "n": "ANANYA COMPUTERS", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-149242-APNIC", "org": "ANANYA COMPUTERS", "pdb": null, "pfx": 2, "reg": "2021-12-09", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149280, "h": "DLCPL-AS-AP", "n": "Duos links", "t": "Other", "w": 2, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 10351.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.141, "det": {"blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-DL34-AP-APNIC", "org": "Duos links", "pdb": null, "pfx": 2, "reg": "2021-12-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058154219706}, {"a": 149346, "h": "IDNIC-DISKOMINFOPKP-AS-ID", "n": "Dinas Komunikasi dan Informatika Kota Pangkalpinang", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.262, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149346-APNIC", "org": "Dinas Komunikasi dan Informatika Kota Pangkalpinang", "pdb": null, "pfx": 1, "reg": "2021-12-29", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149359, "h": "IDNIC-PDM-AS-ID", "n": "Persada Data Multimedia", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "web_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 4.308, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-149359-APNIC", "org": "PT Persada Data Multimedia", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://pdm.net.id"}, "pfx": 10, "reg": "2021-12-29", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0026170445906}, {"a": 149360, "h": "IDNIC-INTELMEDIA-AS-ID", "n": "Indo Telemedia Solusi", "t": "Broadband & mobile", "w": 5, "cc": "ID", "cf": {"rb": "lo", "wb": null, "rep": 2.27, "waf": null}, "cs": {"c": {"http_flood": 4, "web_exploit": 1, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 1, "router_or_botnet": 5}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.7989, "hi": 8.87, "lo": 1.91, "ips": 5, "mean": 4.85, "above": true}, "blocklist_de": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 20.411, 0.011, 1, false], ["2026-10-12", 30.934, 0.012, 1, false]], "sh": false, "uc": 5143.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 30.934, "se": 0.579, "ts": 0.667, "map": 68.348, "obs": 6, "own": 105.143, "comp": {"cins": -0.9058, "dshield": -1.5661, "crowdsec": 5.5042, "vulncheck": -0.8039, "blocklist_de": 3.3899}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.279, "det": {"blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-149360-APNIC", "org": "PT Indo Telemedia Solusi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "500-1000Gbps", "pol": "Open", "web": "https://indotel.net.id/"}, "pfx": 12, "reg": "2021-12-29", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0079712263312}, {"a": 149364, "h": "IDNIC-AWANBIT-AS-ID", "n": "PT. AwanBit Data Indonesia", "t": "Transit & backbone", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"data_centre": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": 60156.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 3.643, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 113.579, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.185, "det": null, "oid": "@aut-149364-APNIC", "org": "PT. AwanBit Data Indonesia", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://cloudbit.net.id/"}, "pfx": 1, "reg": "2021-12-29", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149374, "h": "IDNIC-AMDNET-AS-ID", "n": "Alam Media Data", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10937.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.410, "det": null, "oid": "@aut-149374-APNIC", "org": "PT Alam Media Data", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.amd.net.id/"}, "pfx": 2, "reg": "2021-12-29", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007775390304}, {"a": 149391, "h": "IDNIC-DAA-AS-ID", "n": "NevaCloud", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.662, "det": {"shodan": {"compromised": 2}}, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://nevacloud.com/"}, "pfx": 2, "reg": "2021-12-29", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149419, "h": "AA2-AS-AP", "n": "A.A Networks", "t": "Broadband & mobile", "w": 2, "cc": "PK", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 4.340, 0.012, 0, false]], "sh": false, "uc": 2812.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.340, "se": 1.009, "ts": 1.000, "map": 21.348, "obs": 2, "own": 34.642, "comp": {"cins": -0.2773, "dshield": -0.602, "crowdsec": -2.3765, "vulncheck": -0.5041, "blocklist_de": 8.2146}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.135, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-ANPL14-AP-APNIC", "org": "A.A Networks PVT Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://aa-networks.net"}, "pfx": 10, "reg": "2022-01-05", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00172484451051}, {"a": 149440, "h": "EVOXTSDNBHD-AS-AP", "n": "Evoxt", "t": "Broadband & mobile", "w": 13, "cc": "MY", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 3, "web_exploit": 4, "bad_crawling": 3, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.4064, "hi": 5.62, "lo": 0.99, "ips": 3, "mean": 2.90, "above": false}, "dshield": {"n": 1, "p": 0.1600, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "crowdsec": {"n": 5, "p": 0.7166, "hi": 7.14, "lo": 1.77, "ips": 5, "mean": 4.07, "above": false}, "threatfox": {"n": 4, "p": 0.8013, "hi": 8.91, "lo": 1.92, "ips": 4, "mean": 4.87, "above": true}, "blocklist_de": {"n": 3, "p": 0.5211, "hi": 6.51, "lo": 1.15, "ips": 4, "mean": 3.36, "above": false}}, "h2": [["2026-10-05", 2.586, 3.270, 0, false], ["2026-10-12", 4.315, 2.431, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 2.431, "se": 0.943, "ts": 1.000, "map": 7.174, "obs": 4, "own": 17.696, "comp": {"urlhaus": -0.6958, "threatfox": 5.1088, "phishing_db": -0.8163}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 4.315, "se": 0.502, "ts": 0.556, "map": 8.297, "obs": 9, "own": 12.779, "comp": {"cins": -1.4034, "dshield": 0.0958, "crowdsec": 2.5856, "vulncheck": -0.8864, "blocklist_de": 3.1178}, "mass": 8.2, "listed": false}}, "abq": false, "bot": 0.736, "det": {"shodan": {"c2": 2, "compromised": 1}, "threatfox": {"family:PureRAT": 1, "family:AdaptixC2": 2, "family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 3, "bots": 1}}, "oid": "ORG-ESB5-AP-APNIC", "org": "Evoxt Sdn. Bhd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://evoxt.com"}, "pfx": 178, "reg": "2022-01-13", "rir": "apnic", "s24": 178, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 45568, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00175598492898}, {"a": 149501, "h": "PALASHBARIONLINE-AS-AP", "n": "Palashbari Online", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 12695.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.237, "det": null, "oid": "ORG-PO3-AP-APNIC", "org": "Palashbari Online", "pdb": null, "pfx": 3, "reg": "2022-02-07", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028967279129}, {"a": 149534, "h": "GAZONTEC-AS-IN", "n": "Gazon Technologies Pvt.ltd.", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.922, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-149534-APNIC", "org": "Gazon Technologies Pvt.ltd.", "pdb": null, "pfx": 1, "reg": "2022-02-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149538, "h": "POLYINFO-AS-IN", "n": "POLY INFORMATICS PRIVATE LIMITED", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 16601.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.265, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-149538-APNIC", "org": "POLY INFORMATICS PRIVATE LIMITED", "pdb": null, "pfx": 2, "reg": "2022-02-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149553, "h": "AXONIS-AS", "n": "AXOM INTERNET SERVICES PRIVATE LIMITED", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 64453.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 215.609, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.122, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "@aut-149553-APNIC", "org": "AXOM INTERNET SERVICES PRIVATE LIMITED", "pdb": null, "pfx": 1, "reg": "2022-02-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149557, "h": "GRBINFO-AS-IN", "n": "GRB INFOTECH", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-149557-APNIC", "org": "GRB INFOTECH", "pdb": null, "pfx": 2, "reg": "2022-02-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149575, "h": "SITIDATA-AS-IN", "n": "SITI VISION DATA SOLUTIONS PRIVATE LIMITED", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 27539.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.127, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-149575-APNIC", "org": "SITI VISION DATA SOLUTIONS PRIVATE LIMITED", "pdb": null, "pfx": 2, "reg": "2022-02-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149591, "h": "WIFIWALA-AS-IN", "n": "Swip Wifi Network", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 14.019, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-149591-APNIC", "org": "Swip Wifi Network Private Limited", "pdb": {"t": null, "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://wifiwalanet.in"}, "pfx": 2, "reg": "2022-02-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149621, "h": "SERVERBASKET-AS-IN", "n": "SB Secure Data centers India Private Limited", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.872, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-154784-APNIC", "org": "SB Secure Data centers India Private Limited", "pdb": null, "pfx": 8, "reg": "2022-02-24", "rir": "apnic", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149636, "h": "HASANBROADBANDNET-AS-AP", "n": "Hasan Broadband Net", "t": "Broadband & mobile", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 215.609, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.257, "det": {"blocklist_de": {"ssh": 4}}, "oid": "ORG-HBN4-AP-APNIC", "org": "Hasan Broadband Net", "pdb": null, "pfx": 1, "reg": "2022-03-04", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149670, "h": "IDNIC-SIBERTECH-AS-ID", "n": "Siber Tech Indonesia", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 5957, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.227, "det": null, "oid": "@aut-149670-APNIC", "org": "PT Siber Tech Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://siber.net.id/"}, "pfx": 5, "reg": "2022-03-30", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007566450166}, {"a": 149671, "h": "IDNIC-WONOARTO-AS-ID", "n": "Wonoarto Media Nusantara", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.134, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-149671-APNIC", "org": "PT Wonoarto Media Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://wonoarto.co.id"}, "pfx": 2, "reg": "2022-03-30", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149741, "h": "IDNIC-IAIN-LHOKSEUMAWE-AS-ID", "n": "Institut Agama Islam Negeri Lhokseumawe", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": 23046.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.136, "det": null, "oid": "@aut-149741-APNIC", "org": "Institut Agama Islam Negeri Lhokseumawe", "pdb": null, "pfx": 1, "reg": "2022-03-30", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149746, "h": "IDNIC-BLIP-AS-ID", "n": "PT BLiP Integrator Provider", "t": "Broadband & mobile", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2019-8318": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 2, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3851, "hi": 5.95, "lo": 0.77, "ips": 3, "mean": 2.83, "above": false}}, "h2": [["2026-10-12", 2.105, 0.012, 0, false]], "sh": false, "uc": 1012.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 1.876, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.105, "se": 0.960, "ts": 1.000, "map": 9.429, "obs": 2, "own": 15.150, "comp": {"cins": -0.27, "dshield": -0.5878, "crowdsec": 6.3863, "vulncheck": -0.4968, "blocklist_de": -1.3943}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.203, "det": null, "oid": "@aut-149746-APNIC", "org": "PT Blip Integrator Provider", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://blip.net.id"}, "pfx": 22, "reg": "2022-03-30", "rir": "apnic", "s24": 22, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005634981066}, {"a": 149766, "h": "YUT-AS-AP", "n": "Y.U.T Corporate (NIX/ISP)", "t": "Broadband & mobile", "w": 0, "cc": "TH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.432, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-YI5-AP-APNIC", "org": "Y.U.T Corporate Company Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://ycorp.co.th"}, "pfx": 11, "reg": "2022-04-04", "rir": "apnic", "s24": 16, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022166107242}, {"a": 149873, "h": "MOBILECARE-AS-AP", "n": "MOBILECARE", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 18750, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.249, "det": null, "oid": "ORG-MC30-AP-APNIC", "org": "Mobile Care", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "https://mobilecarebd.net"}, "pfx": 2, "reg": "2022-06-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149907, "h": "IDNIC-LINKBIT-AS-ID", "n": "LINKBIT INOVASI TEKNOLOGI", "t": "Enterprise, edu & gov", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.210, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-149907-APNIC", "org": "PT Linkbit Inovasi Teknologi", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://linkbit.net.id"}, "pfx": 3, "reg": "2022-06-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 149978, "h": "SPNHOST-AS-AP", "n": "SPNHOST", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SA194-AP-APNIC", "org": "SPNHOST", "pdb": null, "pfx": 8, "reg": "2022-06-20", "rir": "apnic", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150001, "h": "SFNL-AS-AP", "n": "Sixty Four Networks", "t": "Broadband & mobile", "w": 6, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 5, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 6}, "ev": {"crowdsec": {"n": 2, "p": 0.4038, "hi": 6.12, "lo": 0.79, "ips": 6, "mean": 2.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.173, 0.011, 0, false], ["2026-10-12", 9.466, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.466, "se": 0.798, "ts": 0.667, "map": 31.290, "obs": 3, "own": 49.048, "comp": {"cins": -0.4308, "dshield": -0.8802, "crowdsec": 4.3718, "vulncheck": -0.6235, "blocklist_de": 2.3995}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.206, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SFNL1-AP-APNIC", "org": "Sixty Four Networks Limited.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://sixtyfournetworks.com"}, "pfx": 13, "reg": "2022-07-03", "rir": "apnic", "s24": 11, "sib": 2, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00127009082198}, {"a": 150008, "h": "PEL-AS-IN", "n": "Pioneer Elabs Ltd.", "t": "Broadband & mobile", "w": 11, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.2298, "hi": 4.65, "lo": 0.60, "ips": 2, "mean": 2.22, "above": false}, "urlhaus": {"n": 1, "p": 0.1924, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 3, "p": 0.3743, "hi": 5.39, "lo": 0.95, "ips": 3, "mean": 2.78, "above": false}, "vulncheck": {"n": 4, "p": 0.7699, "hi": 8.42, "lo": 1.81, "ips": 4, "mean": 4.60, "above": false}, "phishing_db": {"n": 1, "p": 0.1658, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.3153, "hi": 5.35, "lo": 0.69, "ips": 2, "mean": 2.55, "above": false}}, "h2": [["2026-10-05", 2.703, 1.351, 0, false], ["2026-10-12", 3.111, 1.438, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 1.438, "se": 1.174, "ts": 0.500, "map": 6.858, "obs": 2, "own": 17.620, "comp": {"urlhaus": 3.0644, "threatfox": -0.4007, "phishing_db": 0.8879}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 4, "blocklist_de": 2}, "lo": 3.111, "se": 0.533, "ts": 0.444, "map": 6.164, "obs": 9, "own": 9.599, "comp": {"cins": -1.0711, "dshield": -1.7578, "crowdsec": 1.016, "vulncheck": 2.844, "blocklist_de": 2.1813}, "mass": 5.7, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"c2": 1, "compromised": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 3}, "blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-150008-APNIC", "org": "Pioneer Elabs Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Tbps", "pol": "Open", "web": "http://pioneerelabs.com"}, "pfx": 165, "reg": "2022-07-05", "rir": "apnic", "s24": 165, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.009650406357}, {"a": 150019, "h": "VISHWAMAN-AS-IN", "n": "Vishwamani Solutions Pvt Ltd", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 51953.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 78.899, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.172, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-150019-APNIC", "org": "Vishwamani Solutions Pvt Ltd", "pdb": null, "pfx": 1, "reg": "2022-07-05", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150027, "h": "AUIGANET-AS-IN", "n": "Auriganet Digital Technologies", "t": "Broadband & mobile", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3636, "hi": 5.76, "lo": 0.75, "ips": 2, "mean": 2.74, "above": false}}, "h2": [["2026-10-12", 1.484, 0.012, 0, false]], "sh": false, "uc": 2098.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 1.721, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.484, "se": 0.940, "ts": 1.000, "map": 6.345, "obs": 2, "own": 10.169, "comp": {"cins": -0.2878, "dshield": -0.622, "crowdsec": 6.1498, "vulncheck": -0.5141, "blocklist_de": -1.4847}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.122, "det": null, "oid": "@aut-150027-APNIC", "org": "Auriganet Digital Technologies Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://auriganet.in/"}, "pfx": 35, "reg": "2022-07-05", "rir": "apnic", "s24": 35, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00316835496057}, {"a": 150044, "h": "MIEUXTECH-AS-IN", "n": "MIEUXTECH-AS-IN", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-72898": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 1.763, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.808, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"apache": 1}}, "oid": "@aut-150044-APNIC", "org": "Mieux Technologies Pvt Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.mieuxtechnologies.com"}, "pfx": 7, "reg": "2022-07-05", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150055, "h": "DIGISNAP-AS-IN", "n": "DIGITAL SNAP", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 7, "p": 0.9877, "hi": 13.06, "lo": 3.96, "ips": 7, "mean": 7.95, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.885, "det": {"shodan": {"compromised": 7}}, "oid": "@aut-150055-APNIC", "org": "DIGITAL SNAP", "pdb": null, "pfx": 2, "reg": "2022-07-05", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 768, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 150132, "h": "REDDOT-AS-AP", "n": "REDDOT DIGITAL LIMITED", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.640, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RDL5-AP-APNIC", "org": "REDDOT DIGITAL LIMITED", "pdb": null, "pfx": 2, "reg": "2022-07-20", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150142, "h": "WOLAST-AS-AP", "n": "Wolast Technologies", "t": "Enterprise, edu & gov", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "threatfox": {"n": 1, "p": 0.1981, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 2, "p": 0.4176, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 15.952, 0.572, 1, false], ["2026-10-12", 7.736, 0.579, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.579, "se": 1.603, "ts": 1.000, "map": 6.611, "obs": 1, "own": 34.245, "comp": {"urlhaus": -0.0719, "threatfox": 3.7599, "phishing_db": -0.1731}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 7.736, "se": 0.709, "ts": 0.500, "map": 21.171, "obs": 4, "own": 122.298, "comp": {"cins": -0.4246, "dshield": -0.8696, "crowdsec": 4.4444, "vulncheck": 3.468, "blocklist_de": -2.1719}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.532, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:AsyncRAT": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-WT6-AP-APNIC", "org": "Wolast Technologies", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://wolast.com"}, "pfx": 16, "reg": "2022-07-22", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025723204043}, {"a": 150172, "h": "STSB-AS-AP", "n": "Serverfreak", "t": "Hosting & VPS", "w": 0, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.948, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-STSB1-AP-APNIC", "org": "Serverfreak Technologies Sdn Bhd", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.web-hosting.net.my/"}, "pfx": 8, "reg": "2022-08-24", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006168463353}, {"a": 150180, "h": "AFRENIT-AS-AP", "n": "AFREN IT", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.546, "det": null, "oid": "ORG-AI39-AP-APNIC", "org": "AFREN IT", "pdb": null, "pfx": 6, "reg": "2022-08-26", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150193, "h": "IDNIC-OLEAN-AS-ID", "n": "Olean Permata Telematika", "t": "Hosting & VPS", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 23437.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.184, "det": null, "oid": "@aut-150193-APNIC", "org": "PT Olean Permata Telematika", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "http://olean.id"}, "pfx": 3, "reg": "2022-08-29", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150208, "h": "IDNIC-IDMNET-AS-ID", "n": "PT Internusa Duta Makmur", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.223, "det": null, "oid": "@aut-150208-APNIC", "org": "PT Internusa Duta Makmur", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://idnet.id/"}, "pfx": 8, "reg": "2022-08-29", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0019432926788}, {"a": 150229, "h": "EAZYNET-ID", "n": "PT Wijaya Lintas Komindo", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.266, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-150229-APNIC", "org": "PT Wijaya Lintas Komindo", "pdb": null, "pfx": 2, "reg": "2022-08-29", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150247, "h": "IDNIC-PLJNET-AS-ID", "n": "PT Pandawa Lima Java Network", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-150247-APNIC", "org": "PT Pandawa Lima Java Network", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.pandawalimo.id"}, "pfx": 2, "reg": "2022-08-29", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150249, "h": "IDNIC-ATHARVA-AS-ID", "n": "Atharva", "t": "Broadband & mobile", "w": 10, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 8, "bad_crawling": 7, "web_bruteforce": 8, "home_connection": 8, "cve:CVE-2017-9841": 8, "cve:CVE-2021-3129": 4, "cve:CVE-2021-41773": 1, "cve:CVE-2022-46604": 5, "cve:CVE-2026-63030": 2}, "n": 8}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 8, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.310, 0.011, 0, false], ["2026-10-12", 3.796, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.796, "se": 0.999, "ts": 0.500, "map": 18.227, "obs": 2, "own": 29.503, "comp": {"cins": -0.2615, "dshield": -0.5712, "crowdsec": 2.1224, "vulncheck": -0.4882, "blocklist_de": 3.4951}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.855, "det": {"blocklist_de": {"bots": 3}}, "oid": "@aut-150249-APNIC", "org": "PT Atharva Telematika Persada", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://www.atharva.co.id"}, "pfx": 11, "reg": "2022-08-29", "rir": "apnic", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009140223994}, {"a": 150279, "h": "IDNIC-LNS-AS-ID", "n": "Lintas Network Solusi", "t": "Broadband & mobile", "w": 4, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"cins": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}, "dshield": {"n": 2, "p": 0.4214, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 39.362, 0.011, 1, false], ["2026-10-12", 78.220, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 78.220, "se": 0.587, "ts": 0.500, "map": 173.778, "obs": 6, "own": 267.361, "comp": {"cins": 11.4229, "dshield": 4.132, "crowdsec": -3.4933, "vulncheck": -0.8134, "blocklist_de": -4.6967}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.198, "det": null, "oid": "@aut-150279-APNIC", "org": "PT Lintas Network Solusi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.lintasnetwork.net"}, "pfx": 6, "reg": "2022-08-29", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0032832627058}, {"a": 150303, "h": "SOLORDP-AS-AP", "n": "SoloRDP", "t": "Broadband & mobile", "w": 8, "cc": "IN", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.87}, "cs": {"c": {"http_flood": 7, "web_exploit": 6, "bad_crawling": 7, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 6, "home_connection": 7, "mail_bruteforce": 1, "cve:CVE-2017-9841": 4, "cve:CVE-2018-20062": 5, "cve:CVE-2019-11510": 4, "cve:CVE-2020-36836": 1, "cve:CVE-2021-26084": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 7, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 72.210, 0.011, 1, false], ["2026-10-12", 80.853, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 80.853, "se": 0.719, "ts": 0.500, "map": 229.257, "obs": 4, "own": 355.449, "comp": {"cins": 4.0266, "dshield": -1.0842, "crowdsec": 2.9725, "vulncheck": -0.69, "blocklist_de": 1.6036}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.996, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SA198-AP-APNIC", "org": "SoloRDP", "pdb": null, "pfx": 1, "reg": "2022-09-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0053777415521}, {"a": 150357, "h": "SUNDAICHI", "n": "University of Nagasaki", "t": "Other", "w": 0, "cc": "JP", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.468, "det": {"shodan": {"doublepulsar": 2}}, "oid": "@aut-150357-APNIC", "org": "University of Nagasaki", "pdb": null, "pfx": 1, "reg": "2022-10-13", "rir": "apnic", "s24": 1, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150371, "h": "PTABPL-AS-AP", "n": "Pace Telecom and Broadcasting", "t": "Broadband & mobile", "w": 3, "cc": "PK", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6292, "hi": 7.55, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}}, "h2": [["2026-10-12", 5.458, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 1.835, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.458, "se": 0.784, "ts": 1.000, "map": 17.528, "obs": 3, "own": 27.461, "comp": {"cins": -0.5344, "dshield": -1.0502, "crowdsec": -4.1294, "vulncheck": -0.6799, "blocklist_de": 10.6513}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.132, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "ORG-PTAB1-AP-APNIC", "org": "Pace Telecom and Brodcasting Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Open", "web": "https://pace-tel.com/"}, "pfx": 25, "reg": "2022-10-13", "rir": "apnic", "s24": 25, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00501140161951}, {"a": 150436, "h": "BYTEPLUS-AS-AP", "n": "Byteplus Pte. Ltd.", "t": "Hyperscale cloud", "w": 986, "cc": "SG", "cf": {"rb": "lo", "wb": "lo", "rep": 30.30, "waf": 9.76}, "cs": {"c": {"http_flood": 880, "web_exploit": 499, "bad_crawling": 382, "proxy_or_vpn": 156, "first_seen_30d": 520, "ssh_bruteforce": 69, "web_bruteforce": 37, "mail_bruteforce": 1, "cve:CVE-2017-9841": 8, "cve:CVE-2024-6387": 11, "cve:CVE-2025-4396": 9, "cve:CVE-2025-36604": 377, "cve:CVE-2026-21859": 21}, "n": 982}, "ev": {"cins": {"n": 1, "p": 0.0684, "hi": 3.26, "lo": 0.24, "ips": 1, "mean": 1.38, "above": false}, "shodan": {"n": 6, "p": 0.1372, "hi": 3.59, "lo": 1.00, "ips": 6, "mean": 2.12, "above": false}, "dshield": {"n": 2, "p": 0.1483, "hi": 3.98, "lo": 0.52, "ips": 2, "mean": 1.90, "above": false}, "crowdsec": {"n": 61, "p": 1.0000, "hi": 19.57, "lo": 12.87, "ips": 982, "mean": 16.07, "above": true}, "blocklist_de": {"n": 23, "p": 1.0000, "hi": 15.14, "lo": 7.69, "ips": 31, "mean": 11.15, "above": true}}, "h2": [["2026-10-05", 9.735, 0.008, 0, false], ["2026-10-12", 8.901, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.832, "ts": null, "map": 0.128, "obs": 0, "own": 0.181, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 61, "vulncheck": 0, "blocklist_de": 23}, "lo": 8.901, "se": 0.365, "ts": 0.701, "map": 13.511, "obs": 87, "own": 5.530, "comp": {"cins": -2.7063, "dshield": -2.6327, "crowdsec": 8.1766, "vulncheck": -1.0017, "blocklist_de": 2.1612}, "mass": 80.0, "listed": false}}, "abq": false, "bot": 0.991, "det": {"shodan": {"c2": 1, "compromised": 5}, "threatfox": {"family:VShell": 1}, "blocklist_de": {"ssh": 27, "bots": 1, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-BPL26-AP-APNIC", "org": "Byteplus Pte. Ltd.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.byteplus.com"}, "pfx": 175, "reg": "2022-11-22", "rir": "apnic", "s24": 1075, "sib": 0, "tor": 0, "w24": 63, "drop": 0, "hist": [["2026-10-05", 0.6744], ["2026-10-12", 0.6956]], "ipv4": 504320, "abuse": null, "score": 0.6956, "groups": ["sensors", "cloudflare"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.04565780325161}, {"a": 150452, "h": "LANDUPS-AS-AP", "n": "LANDUPS LIMITED", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3670, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.266, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.672, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.918, "ts": null, "map": 0.195, "obs": 0, "own": 0.286, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.835, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-AA248-AP-APNIC", "org": "LANDUPS LIMITED", "pdb": null, "pfx": 23, "reg": "2022-11-28", "rir": "apnic", "s24": 41, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020473076294}, {"a": 150462, "h": "IDNIC-AIRLINK-AS-ID", "n": "PT Air Lintas Komunikasi", "t": "Broadband & mobile", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 38.280, 0.011, 1, false], ["2026-10-12", 42.496, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 42.496, "se": 0.850, "ts": 0.333, "map": 155.062, "obs": 3, "own": 244.083, "comp": {"cins": 4.383, "dshield": -0.8128, "crowdsec": 0.8162, "vulncheck": -0.5981, "blocklist_de": 2.6491}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-150462-APNIC", "org": "PT Air Lintas Komunikasi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://airlink.co.id"}, "pfx": 3, "reg": "2022-12-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004253073616}, {"a": 150478, "h": "IDNIC-STG-AS-ID", "n": "PT Solusi Teknologi Gemilang", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "router_or_botnet": 2, "cve:CVE-2024-28000": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-150478-APNIC", "org": "PT Solusi Teknologi Gemilang", "pdb": null, "pfx": 2, "reg": "2022-12-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150493, "h": "IDNIC-PGSS-AS-ID", "n": "PT Gunung Sedayu Sentosa", "t": "Broadband & mobile", "w": 44, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 40, "data_centre": 2, "web_exploit": 41, "bad_crawling": 34, "proxy_or_vpn": 6, "first_seen_30d": 14, "web_bruteforce": 31, "home_connection": 33, "cve:CVE-2017-9841": 6, "cve:CVE-2021-43798": 4, "cve:CVE-2024-28000": 5, "cve:CVE-2026-63030": 11, "cve:CVE-2026-87902": 4}, "n": 44}, "ev": {"crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 44, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 35.879, 0.011, 1, false], ["2026-10-12", 39.389, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 39.389, "se": 0.845, "ts": 0.667, "map": 142.088, "obs": 3, "own": 223.163, "comp": {"cins": -0.3617, "dshield": -0.7592, "crowdsec": 5.2041, "vulncheck": -0.5764, "blocklist_de": 2.8434}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.948, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-150493-APNIC", "org": "PT Gunung Sedayu Sentosa", "pdb": null, "pfx": 2, "reg": "2022-12-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.001159628437}, {"a": 150553, "h": "IDNIC-SITEOONET-AS-ID", "n": "PT Nusa Jaya Prasetyo", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 11328.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.172, "det": null, "oid": "@aut-150553-APNIC", "org": "PT Nusa Jaya Prasetyo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://njp.co.id"}, "pfx": 2, "reg": "2022-12-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150593, "h": "DATAEX-AS-IN", "n": "Data Express Pvt Ltd", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 3, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.492, 0.011, 0, false], ["2026-10-12", 3.544, 0.012, 0, false]], "sh": false, "uc": 11959.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.544, "se": 0.994, "ts": 0.500, "map": 16.944, "obs": 2, "own": 27.406, "comp": {"cins": -0.2649, "dshield": -0.578, "crowdsec": 2.0858, "vulncheck": -0.4917, "blocklist_de": 3.4724}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-150593-APNIC", "org": "Dataexpress Pvt Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "100-200Gbps", "pol": "Selective", "web": "https://dataexpress.co.in/"}, "pfx": 12, "reg": "2022-12-02", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150623, "h": "HOSTPAT-AS-IN", "n": "HOSTDZIRE WEB SERVICES PRIVATE LIMITED", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "threatfox": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.011, 0.551, 0, false], ["2026-10-12", 2.731, 0.568, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.568, "se": 1.598, "ts": 1.000, "map": 6.420, "obs": 1, "own": 3.034, "comp": {"urlhaus": -0.0741, "threatfox": 3.7376, "phishing_db": -0.1778}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.731, "se": 0.977, "ts": 0.500, "map": 12.635, "obs": 2, "own": 2.598, "comp": {"cins": -0.2789, "dshield": -0.6051, "crowdsec": 1.939, "vulncheck": -0.5057, "blocklist_de": 3.3809}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.853, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-150623-APNIC", "org": "HOSTDZIRE WEB SERVICES PRIVATE LIMITED", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Open", "web": "https://hostdzire.com/"}, "pfx": 17, "reg": "2022-12-02", "rir": "apnic", "s24": 17, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150627, "h": "PISPLAGRA-AS-IN", "n": "Paltech Info Services Pvt Ltd", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 6250, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-150627-APNIC", "org": "Paltech Info Services Pvt Ltd", "pdb": null, "pfx": 4, "reg": "2022-12-02", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150639, "h": "WEBSOLL-AS-IN", "n": "WEB SOLUTION", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 3, "web_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.397, "det": null, "oid": "@aut-150639-APNIC", "org": "WEB SOLUTION", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.wsnet.in"}, "pfx": 2, "reg": "2022-12-02", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150644, "h": "INFINITE1-AS-IN", "n": "INFINITE BROADNET SOLUTIONS PRIVATE LIMITED", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-150644-APNIC", "org": "INFINITE BROADNET SOLUTIONS PRIVATE LIMITED", "pdb": null, "pfx": 3, "reg": "2022-12-02", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150692, "h": "GD2CL-AS-AP", "n": "Golden Dragon 2000", "t": "Transit & backbone", "w": 4, "cc": "MM", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 4, "web_bruteforce": 4, "cve:CVE-2024-6387": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 248.836, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.423, "det": {"blocklist_de": {"ssh": 3}}, "oid": "ORG-DN16-AP-APNIC", "org": "Dragon Net", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://goldendragon2000.com/"}, "pfx": 2, "reg": "2022-12-22", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002135775936}, {"a": 150698, "h": "COS-AS-AP", "n": "Chandpur Online Systems", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 710.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.345, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.040, "det": null, "oid": "ORG-COS4-AP-APNIC", "org": "Chandpur Online Systems", "pdb": null, "pfx": 15, "reg": "2026-06-04", "rir": "apnic", "s24": 28, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007951090483}, {"a": 150706, "h": "HKZTCL-AS-AP", "n": "Hong Kong Zhengxing Technology Co., Ltd.", "t": "Other", "w": 4, "cc": "HK", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "phishing_db": {"n": 2, "p": 0.4076, "hi": 6.15, "lo": 0.80, "ips": 3, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 0.244, 2.165, 0, false], ["2026-10-12", 0.258, 2.209, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 2.209, "se": 1.161, "ts": 1.000, "map": 10.627, "obs": 2, "own": 10.565, "comp": {"urlhaus": -0.3194, "threatfox": -0.2868, "phishing_db": 4.5957}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.258, "se": 1.266, "ts": 1.000, "map": 2.057, "obs": 1, "own": 1.326, "comp": {"cins": -0.1327, "dshield": -0.306, "crowdsec": 3.5629, "vulncheck": -0.3179, "blocklist_de": -0.6914}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.765, "det": null, "oid": "ORG-ZT3-AP-APNIC", "org": "Zhengxing Technology", "pdb": null, "pfx": 48, "reg": "2023-01-03", "rir": "apnic", "s24": 48, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150747, "h": "HIRAELECTRONICSANDN-AS-AP", "n": "Hira Electronics & Networking", "t": "Broadband & mobile", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.253, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HA80-AP-APNIC", "org": "Hire Electronic & Networking", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.hiraelectronicsandnetworking.com"}, "pfx": 2, "reg": "2023-02-06", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150750, "h": "ICIL-AS-AP", "n": "IN CABLE INTERNET", "t": "Broadband & mobile", "w": 17, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 11, "bad_crawling": 2, "proxy_or_vpn": 10, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 14, "mail_bruteforce": 3, "router_or_botnet": 14, "cve:CVE-2025-4396": 1}, "n": 15}, "ev": {"crowdsec": {"n": 12, "p": 0.9999, "hi": 15.96, "lo": 6.31, "ips": 15, "mean": 10.67, "above": true}, "blocklist_de": {"n": 2, "p": 0.3668, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 12.175, 0.011, 1, false], ["2026-10-12", 14.209, 0.012, 1, false]], "sh": false, "uc": 1726.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 1.423, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 12, "vulncheck": 0, "blocklist_de": 2}, "lo": 14.209, "se": 0.448, "ts": 0.857, "map": 24.696, "obs": 14, "own": 37.850, "comp": {"cins": -1.7235, "dshield": -2.3559, "crowdsec": 11.9609, "vulncheck": -0.9182, "blocklist_de": -2.363}, "mass": 11.2, "listed": false}}, "abq": false, "bot": 0.153, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-ICIL2-AP-APNIC", "org": "IN CABLE INTERNET (PRIVATE) LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://incableinternet.com/"}, "pfx": 82, "reg": "2023-02-06", "rir": "apnic", "s24": 82, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20992, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0077025945623}, {"a": 150774, "h": "EXABYTELTD2-AS-AP", "n": "Exabyte AS150774", "t": "Transit & backbone", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2436.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 2.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 2.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.180, "det": null, "oid": "ORG-EL33-AP-APNIC", "org": "Exabyte ltd", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.exabytebd.net"}, "pfx": 23, "reg": "2023-02-09", "rir": "apnic", "s24": 21, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00253856715618}, {"a": 150790, "h": "NU-AS-AP", "n": "Nu Internet (Private) Limited", "t": "Broadband & mobile", "w": 0, "cc": "PK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 14453.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "ORG-NIL4-AP-APNIC", "org": "Nu Internet (Private) Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": null, "pol": "Selective", "web": "http://nuinternet.com.pk"}, "pfx": 2, "reg": "2023-03-01", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037572882853}, {"a": 150814, "h": "TVAN-VN", "n": "VNIS JOINT STOCK COMPANY", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.911, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.791, "det": {"shodan": {"c2": 1}}, "oid": "@aut-150814-APNIC", "org": "VNIS JOINT STOCK COMPANY", "pdb": null, "pfx": 2, "reg": "2023-01-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150821, "h": "CTKYTHUATHD-VN", "n": "HD TECHNICAL INFRASTRUCTURE CONSTRUCTION COMPANY LIMITED", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.989, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-150821-APNIC", "org": "HD TECHNICAL INFRASTRUCTURE CONSTRUCTION COMPANY LIMITED", "pdb": null, "pfx": 1, "reg": "2023-01-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001289419887}, {"a": 150826, "h": "VR-VN", "n": "VR VIET NAM COMPANY LIMITED", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2014-2383": 1, "cve:CVE-2015-4455": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.872, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-150826-APNIC", "org": "VR VIET NAM COMPANY LIMITED", "pdb": null, "pfx": 4, "reg": "2023-01-10", "rir": "apnic", "s24": 4, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003389294314}, {"a": 150828, "h": "VMONCLOUD-VN", "n": "Vmon Cloud Company Limited", "t": "Hosting & VPS", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 4.921, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-150828-APNIC", "org": "VMON CLOUD COMPANY LIMITED", "pdb": null, "pfx": 7, "reg": "2023-01-10", "rir": "apnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029466001292}, {"a": 150861, "h": "POWERNET-VN", "n": "POWERNET COMPANY LIMITED", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-150861-APNIC", "org": "POWERNET COMPANY LIMITED", "pdb": null, "pfx": 2, "reg": "2023-01-10", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008168318872}, {"a": 150862, "h": "MAYTINHVPSTTT-VN", "n": "VPSTTT COMPUTER COMPANY LIMITED", "t": "Hosting & VPS", "w": 9, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 1, "first_seen_30d": 3, "ssh_bruteforce": 7, "web_bruteforce": 4, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 9}, "ev": {"shodan": {"n": 2, "p": 0.3683, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}, "crowdsec": {"n": 6, "p": 0.9478, "hi": 10.70, "lo": 2.97, "ips": 9, "mean": 6.33, "above": true}, "threatfox": {"n": 1, "p": 0.1964, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1807, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 9.952, 3.318, 0, false], ["2026-10-12", 11.686, 0.424, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.424, "se": 1.524, "ts": 1.000, "map": 4.114, "obs": 1, "own": 1.878, "comp": {"urlhaus": -0.1105, "threatfox": 3.4007, "phishing_db": -0.2497}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 11.686, "se": 0.543, "ts": 0.857, "map": 24.196, "obs": 7, "own": 4.746, "comp": {"cins": -1.0313, "dshield": -1.7134, "crowdsec": 9.4609, "vulncheck": -0.8304, "blocklist_de": -1.3061}, "mass": 5.4, "listed": false}}, "abq": false, "bot": 0.708, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Mirai": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-150862-APNIC", "org": "VPSTTT COMPUTER COMPANY LIMITED", "pdb": null, "pfx": 20, "reg": "2023-01-10", "rir": "apnic", "s24": 40, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00050960318584}, {"a": 150873, "h": "TCTH-VN", "n": "THUONGCLOUD COMPANY LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.909, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Unknown malware": 1}}, "oid": "@aut-150873-APNIC", "org": "THUONGCLOUD COMPANY LIMITED", "pdb": null, "pfx": 1, "reg": "2023-01-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002087252594}, {"a": 150884, "h": "NEWVINA-VN", "n": "ANZIX Joint Stock Company", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.726, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-150884-APNIC", "org": "ANZIX Joint Stock Company", "pdb": null, "pfx": 1, "reg": "2023-01-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000115589418}, {"a": 150895, "h": "EZTECH-VN", "n": "EZ TECHNOLOGY COMPANY LIMITED", "t": "Other", "w": 50, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 10, "data_centre": 1, "web_exploit": 11, "bad_crawling": 5, "proxy_or_vpn": 5, "first_seen_30d": 11, "ssh_bruteforce": 16, "web_bruteforce": 12, "home_connection": 3, "mail_bruteforce": 8, "cve:CVE-2017-9841": 4, "cve:CVE-2026-8181": 2, "cve:CVE-2017-16894": 3, "cve:CVE-2019-17050": 3, "cve:CVE-2024-28000": 2}, "n": 30}, "ev": {"cins": {"n": 3, "p": 0.6291, "hi": 7.55, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}, "shodan": {"n": 10, "p": 0.9992, "hi": 14.92, "lo": 5.43, "ips": 10, "mean": 9.68, "above": true}, "dshield": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "crowdsec": {"n": 21, "p": 1.0000, "hi": 25.84, "lo": 12.73, "ips": 30, "mean": 18.80, "above": true}, "threatfox": {"n": 8, "p": 0.9960, "hi": 14.29, "lo": 4.65, "ips": 11, "mean": 8.91, "above": true}, "vulncheck": {"n": 2, "p": 0.4010, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "phishing_db": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 14, "p": 1.0000, "hi": 20.48, "lo": 8.65, "ips": 14, "mean": 14.04, "above": true}}, "h2": [["2026-10-05", 49.081, 14.471, 1, false], ["2026-10-12", 72.109, 16.219, 1, false]], "sh": false, "uc": 1342.8, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 8, "phishing_db": 1}, "lo": 16.219, "se": 0.783, "ts": 0.889, "map": 37.559, "obs": 9, "own": 33.814, "comp": {"urlhaus": -1.0999, "threatfox": 6.3472, "phishing_db": 0.0047}, "mass": 3.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 2, "crowdsec": 21, "vulncheck": 2, "blocklist_de": 14}, "lo": 72.109, "se": 0.378, "ts": 0.500, "map": 113.133, "obs": 42, "own": 63.054, "comp": {"cins": 1.7493, "dshield": -1.7946, "crowdsec": 1.5553, "vulncheck": -0.6824, "blocklist_de": 5.2947}, "mass": 39.7, "listed": false}}, "abq": false, "bot": 0.820, "det": {"shodan": {"c2": 2, "compromised": 8}, "threatfox": {"family:Remcos": 5, "family:PureRAT": 3, "family:AsyncRAT": 1, "family:AdaptixC2": 2}, "vulncheck": {"c2_server": 1, "other_infrastructure": 1}, "blocklist_de": {"ftp": 1, "sip": 1, "ssh": 7, "bots": 1, "imap": 4, "mail": 4}}, "oid": "@aut-150895-APNIC", "org": "EZ TECHNOLOGY COMPANY LIMITED", "pdb": null, "pfx": 43, "reg": "2023-01-10", "rir": "apnic", "s24": 64, "sib": 0, "tor": 0, "w24": 30, "drop": 1, "hist": [["2026-10-05", 0.9972], ["2026-10-12", 0.9977]], "ipv4": 17920, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00117488007406}, {"a": 150900, "h": "VPSMMOCLOUD-VN", "n": "VPSMMO COMPANY LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.925, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-150900-APNIC", "org": "VPSMMO COMPANY LIMITED", "pdb": null, "pfx": 1, "reg": "2023-01-10", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003641730974}, {"a": 150919, "h": "IDNIC-TRINITY-AS-ID", "n": "TRINITY MEDIA INDONESIA", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.143, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-150919-APNIC", "org": "PT Trinity Media Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://trinitymedia.co.id"}, "pfx": 1, "reg": "2023-02-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150920, "h": "IDNIC-SOLUSI247-AS-ID", "n": "PT Dua Empat Tujuh", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.428, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-150920-APNIC", "org": "PT Dua Empat Tujuh", "pdb": null, "pfx": 1, "reg": "2023-02-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150930, "h": "IDNIC-KDB-AS-ID", "n": "PT Kolaborasi Digital Bersama", "t": "Other", "w": 4, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.118, 0.012, 0, false], ["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 16.363, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.789, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 4}}, "oid": "@aut-150930-APNIC", "org": "PT Kolaborasi Digital Bersama", "pdb": null, "pfx": 1, "reg": "2023-02-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 150935, "h": "IDNIC-PONOROGO-ID", "n": "Dinas Komunikasi Informatika dan Statistik Kab. Ponorogo", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.481, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-150935-APNIC", "org": "Dinas Komunikasi Informatika dan Statistik Kab. Ponorogo", "pdb": null, "pfx": 3, "reg": "2023-02-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151000, "h": "IDNIC-MAXCLOUD-AS-ID", "n": "PT Awan Data Indonesia", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2022-35914": 1, "cve:CVE-2023-49103": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4006, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 1.063, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.742, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-151000-APNIC", "org": "PT Awan Data Indonesia", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://maxcloud.id/"}, "pfx": 24, "reg": "2023-02-24", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151006, "h": "IDNIC-NIMNET-AS-ID", "n": "PT Nesta Indo Media", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 5.824, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 19.293, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-151006-APNIC", "org": "PT Nesta Indo Media", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://nim.net.id"}, "pfx": 5, "reg": "2023-02-24", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011372618114}, {"a": 151099, "h": "ANANTHT-AS-IN", "n": "ANANTH TELECOM SERVICES", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.109, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-151099-APNIC", "org": "ANANTH TELECOM SERVICES PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://ananthtelecomservices.com/"}, "pfx": 2, "reg": "2023-04-06", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151106, "h": "HOSTYCARE-AS-IN", "n": "HostyCare", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"first_seen_30d": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1434, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.228, 0.011, 0, false], ["2026-10-12", 0.241, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.040, "ts": null, "map": 0.189, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.241, "se": 1.255, "ts": 1.000, "map": 1.885, "obs": 1, "own": 0.421, "comp": {"cins": -0.1367, "dshield": -0.3147, "crowdsec": 3.5157, "vulncheck": -0.3246, "blocklist_de": -0.712}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.654, "det": null, "oid": null, "org": null, "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.hostycare.com/"}, "pfx": 54, "reg": "2023-04-06", "rir": "apnic", "s24": 54, "sib": 0, "tor": 0, "w24": 1, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051128756037}, {"a": 151116, "h": "SKYWORLDINFOTECH-AS-IN", "n": "Skyworld Infotech", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10156.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.295, "det": null, "oid": "@aut-151116-APNIC", "org": "Skyworld Infotech", "pdb": null, "pfx": 1, "reg": "2023-04-06", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151157, "h": "CHATSIGNL-AS-IN", "n": "CHATSIGNAL PVT LTD", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.534, 0.012, 0, false]], "sh": false, "uc": 2929.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 10.308, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.176, "det": null, "oid": "@aut-151157-APNIC", "org": "CHATSIGNAL PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.chatsignal.in"}, "pfx": 12, "reg": "2023-04-06", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151185, "h": "CT-XIANGYANG-IDC2", "n": "China Telecom Xiangyang IDC Network", "t": "Broadband & mobile", "w": 5, "cc": "CN", "cf": null, "cs": null, "ev": {"cins": {"n": 2, "p": 0.3367, "hi": 5.53, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "shodan": {"n": 8, "p": 0.9250, "hi": 8.49, "lo": 2.76, "ips": 8, "mean": 5.29, "above": true}, "dshield": {"n": 1, "p": 0.1327, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "urlhaus": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "threatfox": {"n": 2, "p": 0.3902, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}}, "h2": [["2026-10-05", 0.007, 0.813, 0, false], ["2026-10-12", 0.566, 1.483, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 1.483, "se": 1.044, "ts": 0.667, "map": 5.333, "obs": 3, "own": 13.633, "comp": {"urlhaus": 2.4559, "threatfox": 1.7417, "phishing_db": -0.8976}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.566, "se": 0.735, "ts": 0.667, "map": 1.642, "obs": 3, "own": 2.583, "comp": {"cins": 8.3314, "dshield": 2.2594, "crowdsec": -4.7497, "vulncheck": -0.7246, "blocklist_de": -3.2268}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.858, "det": {"shodan": {"c2": 1, "compromised": 7}, "threatfox": {"family:Sliver": 1, "family:Unknown malware": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 26, "reg": "2023-04-11", "rir": "apnic", "s24": 328, "sib": 281, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 101120, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00041469411074}, {"a": 151215, "h": "BDCALLINGITLTD-AS-AP", "n": "bdCalling IT Ltd", "t": "Other", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.072, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-BIL6-AP-APNIC", "org": "bdCalling IT Ltd", "pdb": null, "pfx": 2, "reg": "2023-05-07", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151300, "h": "AS151300", "n": "APNIC ASN block", "t": "Other", "w": 4, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 3}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.3856, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.84, "above": false}, "crowdsec": {"n": 3, "p": 0.5991, "hi": 7.23, "lo": 1.27, "ips": 3, "mean": 3.73, "above": false}, "threatfox": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 4.144, 0.487, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.487, "se": 1.557, "ts": 1.000, "map": 5.082, "obs": 1, "own": 6.126, "comp": {"urlhaus": -0.0927, "threatfox": 3.5601, "phishing_db": -0.2155}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.144, "se": 0.774, "ts": 1.000, "map": 13.029, "obs": 3, "own": 7.463, "comp": {"cins": -0.4393, "dshield": -0.8947, "crowdsec": 8.169, "vulncheck": -0.6287, "blocklist_de": -2.2453}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.475, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:NjRAT": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 27, "reg": "2023-05-08", "rir": "apnic", "s24": 27, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006706679486}, {"a": 151326, "h": "DCPL-AS-AP", "n": "DCConnect Communication", "t": "Broadband & mobile", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8044, "hi": 8.96, "lo": 1.93, "ips": 4, "mean": 4.90, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 1.477, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.291, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-DCPL6-AP-APNIC", "org": "DCConnect Communication Pte. Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.dcconnectglobal.com"}, "pfx": 8, "reg": "2023-05-15", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00017149588626}, {"a": 151330, "h": "PBPL-AS-AP", "n": "PLAY BROADBAND", "t": "Broadband & mobile", "w": 24, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 21, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 15, "home_connection": 19, "mail_bruteforce": 1, "router_or_botnet": 18, "cve:CVE-2019-8318": 6, "cve:CVE-2018-10562": 8, "cve:CVE-2024-12847": 19, "cve:CVE-2024-28000": 1}, "n": 21}, "ev": {"cins": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.6205, "hi": 7.46, "lo": 1.31, "ips": 21, "mean": 3.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.4125, "hi": 6.20, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 49.548, 9.670, 1, false], ["2026-10-12", 33.358, 0.012, 1, false]], "sh": false, "uc": 2682.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 33.358, "se": 0.548, "ts": 0.429, "map": 69.929, "obs": 7, "own": 107.443, "comp": {"cins": 2.8536, "dshield": 0.8436, "crowdsec": 0.7883, "vulncheck": -0.8423, "blocklist_de": 1.998}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.207, "det": {"blocklist_de": {"apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-PBPL1-AP-APNIC", "org": "PLAY BROADBAND (PRIVATE) LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://pbb.net.pk/"}, "pfx": 15, "reg": "2023-05-15", "rir": "apnic", "s24": 15, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00375928152435}, {"a": 151338, "h": "POLONETWORK-AS-AP", "n": "POLONETWORK", "t": "Broadband & mobile", "w": 2, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1731, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "crowdsec": {"n": 1, "p": 0.1672, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "vulncheck": {"n": 1, "p": 0.1924, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.390, 0.011, 0, false], ["2026-10-12", 1.353, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.353, "se": 0.956, "ts": 0.500, "map": 5.841, "obs": 2, "own": 9.660, "comp": {"cins": -0.2229, "dshield": -0.4948, "crowdsec": 2.5369, "vulncheck": 2.494, "blocklist_de": -1.1547}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.359, "det": {"shodan": {"compromised": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "ORG-PL51-AP-APNIC", "org": "POLONETWORK LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://polonet.io/"}, "pfx": 30, "reg": "2023-05-17", "rir": "apnic", "s24": 29, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00256910061072}, {"a": 151347, "h": "AERPACE-AS-AP", "n": "Aerpace", "t": "Broadband & mobile", "w": 5, "cc": "IN", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 3, "router_or_botnet": 2}, "n": 4}, "ev": {"urlhaus": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 4, "p": 0.6544, "hi": 7.10, "lo": 1.53, "ips": 4, "mean": 3.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1526, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 2.695, 0.401, 0, false], ["2026-10-12", 2.916, 0.434, 0, false]], "sh": false, "uc": 1806.2, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.434, "se": 1.539, "ts": 1.000, "map": 4.311, "obs": 1, "own": 12.862, "comp": {"urlhaus": 3.8798, "threatfox": -0.2746, "phishing_db": -0.5178}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.916, "se": 0.608, "ts": 0.800, "map": 6.726, "obs": 5, "own": 10.422, "comp": {"cins": -0.8275, "dshield": -1.4679, "crowdsec": 6.4587, "vulncheck": -0.7844, "blocklist_de": -0.0791}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.128, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-AA273-AP-APNIC", "org": "Aerpace", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://aerloop.in/"}, "pfx": 109, "reg": "2023-05-19", "rir": "apnic", "s24": 109, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00100735524243}, {"a": 151407, "h": "HNSL-AS-AP", "n": "Hytron Network Services (US) LLC - AS151407", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1747, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.729, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.209, "obs": 0, "own": 0.351, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.465, "det": {"shodan": {"malware": 1}}, "oid": "ORG-AA270-AP-APNIC", "org": "Hytron Network Services Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://hytron.io"}, "pfx": 30, "reg": "2023-06-14", "rir": "apnic", "s24": 27, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00251775797042}, {"a": 151419, "h": "LINKLESS-AS-AP", "n": "LINKLESS COMMUNICATIONS LIMITED", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.551, "det": {"shodan": {"c2": 1}}, "oid": "ORG-LCL14-AP-APNIC", "org": "LINKLESS COMMUNICATIONS LIMITED", "pdb": null, "pfx": 4, "reg": "2023-06-21", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001064960245}, {"a": 151488, "h": "AML-AS-AP", "n": "Ad-din Mother Care Limited", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"c2": 1}}, "oid": "ORG-AML4-AP-APNIC", "org": "Ad-din Mother Care Limited", "pdb": null, "pfx": 3, "reg": "2023-07-03", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151540, "h": "IDNIC-DIGITALNETCOM-AS-ID", "n": "Digital Netcom Solution", "t": "Transit & backbone", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 13671.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 72.971, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.462, "det": null, "oid": "@aut-151540-APNIC", "org": "PT Digital Netcom Solution", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://digitalnetcom.co.id"}, "pfx": 2, "reg": "2023-07-07", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000559058929}, {"a": 151592, "h": "IDNIC-AWANDATA-AS-ID", "n": "PT Awan Data Teknologi", "t": "Other", "w": 9, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 3, "web_exploit": 9, "bad_crawling": 5, "proxy_or_vpn": 5, "ssh_bruteforce": 4, "web_bruteforce": 9, "mail_bruteforce": 1, "router_or_botnet": 8, "cve:CVE-2011-3600": 2, "cve:CVE-2017-9841": 5, "cve:CVE-2021-3129": 2, "cve:CVE-2017-16894": 3, "cve:CVE-2019-17050": 3}, "n": 9}, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "crowdsec": {"n": 3, "p": 0.6365, "hi": 7.63, "lo": 1.34, "ips": 9, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 25.862, 0.011, 1, false], ["2026-10-12", 14.800, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 14.800, "se": 0.810, "ts": 1.000, "map": 50.049, "obs": 3, "own": 28.680, "comp": {"cins": -0.3805, "dshield": -0.7927, "crowdsec": 9.0218, "vulncheck": -0.5901, "blocklist_de": -1.9518}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.765, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-151592-APNIC", "org": "PT Awan Data Teknologi", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://awandata.co.id"}, "pfx": 6, "reg": "2023-07-07", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005234814816}, {"a": 151620, "h": "MD2-AS-AP", "n": "AVEVA RESOURCE", "t": "Broadband & mobile", "w": 3, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "web_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 19726.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.234, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-AR4-AP-APNIC", "org": "AVEVA RESOURCE", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.avevaresource.com"}, "pfx": 3, "reg": "2023-07-18", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00026464242319}, {"a": 151629, "h": "AALOKITLIMITED-AS-AP", "n": "Aalok IT Limited", "t": "Other", "w": 4, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2026-63030": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.200, "det": null, "oid": "ORG-AIL1-AP-APNIC", "org": "Aalok IT Limited", "pdb": null, "pfx": 4, "reg": "2023-07-25", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00088182974093}, {"a": 151636, "h": "RELIANCE-AS-AP", "n": "Reliance Broadband (Pvt) Limited", "t": "Broadband & mobile", "w": 0, "cc": "PK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 4296.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.141, "det": null, "oid": "ORG-RB6-AP-APNIC", "org": "Reliance Broadband", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://reliance-broadband.net/"}, "pfx": 7, "reg": "2023-07-28", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009932212158}, {"a": 151690, "h": "FAB1-AS-IN", "n": "FAB FIVE NETWORK PRIVATE LIMITED", "t": "Broadband & mobile", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5867, "hi": 7.11, "lo": 1.25, "ips": 3, "mean": 3.67, "above": false}, "blocklist_de": {"n": 1, "p": 0.1834, "hi": 4.58, "lo": 0.34, "ips": 3, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 5.326, 0.011, 0, false], ["2026-10-12", 5.979, 0.012, 0, false]], "sh": false, "uc": 7801, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.979, "se": 0.676, "ts": 0.750, "map": 15.713, "obs": 4, "own": 24.402, "comp": {"cins": -0.6349, "dshield": -1.2032, "crowdsec": 5.5999, "vulncheck": -0.7229, "blocklist_de": 1.1093}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.191, "det": {"blocklist_de": {"bots": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-151690-APNIC", "org": "FAB FIVE NETWORK PRIVATE LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "300-500Gbps", "pol": "Open", "web": "http://fab5network.com"}, "pfx": 34, "reg": "2023-08-25", "rir": "apnic", "s24": 34, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082672371963}, {"a": 151704, "h": "BHARATDC-AS", "n": "Bharat Datacenter", "t": "Hosting & VPS", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2012-0392": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2016-1555": 1}, "n": 1}, "ev": {"shodan": {"n": 8, "p": 0.9945, "hi": 13.62, "lo": 4.43, "ips": 8, "mean": 8.49, "above": true}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.327, 0.011, 0, false], ["2026-10-12", 0.347, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.347, "se": 1.316, "ts": 1.000, "map": 3.042, "obs": 1, "own": 0.698, "comp": {"cins": -0.115, "dshield": -0.2672, "crowdsec": 3.7746, "vulncheck": -0.2866, "blocklist_de": -0.5996}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.567, "det": {"shodan": {"compromised": 8}}, "oid": "@aut-151704-APNIC", "org": "BHARAT DATACENTER", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://bharatdatacenter.com/"}, "pfx": 28, "reg": "2023-08-25", "rir": "apnic", "s24": 28, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7168, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00070942473075}, {"a": 151712, "h": "MULTIREACHBROADBANDSERVICES-AS-IN", "n": "Multireach Broadband Services Private Limited", "t": "Broadband & mobile", "w": 3, "cc": "IN", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.535, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.535, "se": 1.403, "ts": 1.000, "map": 5.480, "obs": 1, "own": 10.342, "comp": {"cins": -0.0893, "dshield": 4.7178, "crowdsec": -0.8311, "vulncheck": -0.2364, "blocklist_de": -0.4663}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.131, "det": null, "oid": "@aut-151712-APNIC", "org": "Multireach Broadband Services Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://multireach.net"}, "pfx": 11, "reg": "2023-08-25", "rir": "apnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049590043065}, {"a": 151719, "h": "TACT-AS-IN", "n": "TACT COMMUNICATION PVT LTD", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 1.327, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-151719-APNIC", "org": "TACT COMMUNICATION PVT LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.tactcom.in"}, "pfx": 19, "reg": "2023-08-25", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151734, "h": "WEBYNEDC-AS-IN", "n": "WEBYNE DATA CENTRE", "t": "Hosting & VPS", "w": 113, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "web_bruteforce": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.8796, "hi": 9.48, "lo": 2.36, "ips": 5, "mean": 5.41, "above": true}, "crowdsec": {"n": 2, "p": 0.3385, "hi": 5.54, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}, "vulncheck": {"n": 8, "p": 0.9955, "hi": 14.06, "lo": 4.57, "ips": 111, "mean": 8.77, "above": true}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 6.814, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 0.246, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 8, "blocklist_de": 0}, "lo": 6.814, "se": 0.529, "ts": 0.800, "map": 13.400, "obs": 10, "own": 2.683, "comp": {"cins": -0.7812, "dshield": -1.4074, "crowdsec": 0.766, "vulncheck": 9.3202, "blocklist_de": -3.9088}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.883, "det": {"shodan": {"compromised": 5}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 108, "botnet_node": 3}}, "oid": "@aut-151734-APNIC", "org": "WEBYNE DATA CENTRE PRIVATE LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.webyne.com"}, "pfx": 51, "reg": "2023-08-25", "rir": "apnic", "s24": 51, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 13056, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": null}, {"a": 151749, "h": "VTLPVT-AS-IN", "n": "Virtel Communications Private Limited", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": 26367.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 38.309, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.815, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-151749-APNIC", "org": "Virtel Communications Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://virtel.in/"}, "pfx": 2, "reg": "2023-08-25", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151823, "h": "CT-Centralsouth-China-IIP", "n": "China Telecom", "t": "Broadband & mobile", "w": 1, "cc": "CN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.8125, "hi": 8.26, "lo": 2.05, "ips": 5, "mean": 4.71, "above": true}, "crowdsec": {"n": 1, "p": 0.0901, "hi": 3.54, "lo": 0.27, "ips": 1, "mean": 1.49, "above": false}}, "h2": [["2026-10-05", 0.538, 0.010, 0, false], ["2026-10-12", 0.143, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.990, "ts": null, "map": 0.181, "obs": 0, "own": 1.267, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.143, "se": 1.184, "ts": 1.000, "map": 0.979, "obs": 1, "own": 1.676, "comp": {"cins": -0.1672, "dshield": -0.3799, "crowdsec": 3.1612, "vulncheck": -0.3722, "blocklist_de": -0.869}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.394, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CT1-AP-APNIC", "org": "China Telecom", "pdb": null, "pfx": 15, "reg": "2023-09-25", "rir": "apnic", "s24": 128, "sib": 281, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 37632, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00017540546348}, {"a": 151845, "h": "SCALEWITHUSINDIA-AS-AP", "n": "Scalewithus India", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.934, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SI44-AP-APNIC", "org": "Scalewithus India", "pdb": null, "pfx": 4, "reg": "2023-10-05", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151858, "h": "INTERDIGI-VN", "n": "INTERDIGI JOINT STOCK COMPANY", "t": "Other", "w": 26, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 11, "bad_crawling": 2, "proxy_or_vpn": 4, "first_seen_30d": 2, "ssh_bruteforce": 15, "web_bruteforce": 11, "home_connection": 2, "mail_bruteforce": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-20062": 3, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 3}, "n": 21}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 22.00, "lo": 9.81, "ips": 16, "mean": 15.39, "above": true}, "urlhaus": {"n": 1, "p": 0.1971, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 16, "p": 1.0000, "hi": 21.50, "lo": 9.58, "ips": 21, "mean": 15.04, "above": true}, "blocklist_de": {"n": 8, "p": 0.9947, "hi": 13.71, "lo": 4.46, "ips": 10, "mean": 8.55, "above": true}}, "h2": [["2026-10-05", 35.766, 2.764, 1, false], ["2026-10-12", 49.076, 0.568, 1, false]], "sh": false, "uc": 1347.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.568, "se": 1.608, "ts": 1.000, "map": 6.412, "obs": 1, "own": 8.106, "comp": {"urlhaus": 4.1035, "threatfox": -0.2168, "phishing_db": -0.4024}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 16, "vulncheck": 0, "blocklist_de": 8}, "lo": 49.076, "se": 0.405, "ts": 0.667, "map": 79.100, "obs": 24, "own": 44.159, "comp": {"cins": -2.4394, "dshield": -2.8179, "crowdsec": 6.6166, "vulncheck": -0.9627, "blocklist_de": 5.3678}, "mass": 21.3, "listed": false}}, "abq": false, "bot": 0.844, "det": {"shodan": {"compromised": 16}, "blocklist_de": {"ftp": 4, "ssh": 5, "imap": 1, "mail": 1}}, "oid": "@aut-151858-APNIC", "org": "INTERDIGI JOINT STOCK COMPANY", "pdb": null, "pfx": 27, "reg": "2023-10-09", "rir": "apnic", "s24": 49, "sib": 0, "tor": 0, "w24": 18, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 12544, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0005841251451}, {"a": 151863, "h": "PSG-VN", "n": "PSG JOINT STOCK COMPANY", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.672, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-151863-APNIC", "org": "PSG JOINT STOCK COMPANY", "pdb": null, "pfx": 3, "reg": "2023-10-09", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001092120708}, {"a": 151898, "h": "MEGAHOSTBIZ-VN", "n": "MEGAHOST TECHNOLOGY COMPANY LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.942, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-151898-APNIC", "org": "MEGAHOST TECHNOLOGY COMPANY LIMITED", "pdb": null, "pfx": 4, "reg": "2023-10-09", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004986288342}, {"a": 151911, "h": "VERICHAINS-VN", "n": "Verichains Joint Stock Company", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.937, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-151911-APNIC", "org": "VERICHAINS LIMITED", "pdb": null, "pfx": 3, "reg": "2023-10-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 151917, "h": "JUPITERMEDIA-VN", "n": "Jupiter Media Joint Stock Company", "t": "Other", "w": 3, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 38.280, 0.011, 1, false], ["2026-10-12", 42.496, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 42.496, "se": 0.850, "ts": 0.333, "map": 155.062, "obs": 3, "own": 89.318, "comp": {"cins": 4.383, "dshield": -0.8128, "crowdsec": 0.8162, "vulncheck": -0.5981, "blocklist_de": 2.6491}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.764, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-151917-APNIC", "org": "Jupiter Media Joint Stock Company", "pdb": null, "pfx": 1, "reg": "2023-10-09", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000696193736}, {"a": 152026, "h": "IDNIC-ANTEN-AS-ID", "n": "PT Anten Sarana Teknologi", "t": "Transit & backbone", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 3.643, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 6.015, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.298, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-152026-APNIC", "org": "PT Anten Sarana Teknologi", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "http://anten.net.id"}, "pfx": 1, "reg": "2023-10-20", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000440609719}, {"a": 152032, "h": "IDNIC-DINETKAN-AS-ID", "n": "DINETKAN", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 550.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.713, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.461, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://dinetkan.com"}, "pfx": 12, "reg": "2023-10-20", "rir": "apnic", "s24": 49, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011904038894}, {"a": 152129, "h": "EXCLOUD-AS-AP", "n": "Excloud", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.9135, "hi": 10.42, "lo": 2.59, "ips": 5, "mean": 5.95, "above": true}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.950, "det": {"shodan": {"compromised": 5}}, "oid": "ORG-ATPL16-AP-APNIC", "org": "EXCLOUD INDIA PRIVATE LIMITED", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://excloud.dev"}, "pfx": 2, "reg": "2023-11-27", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 152149, "h": "AHAMEDIT-AS-AP", "n": "Ahamed IT", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.200, "det": null, "oid": "ORG-AI41-AP-APNIC", "org": "Ahamed IT", "pdb": null, "pfx": 1, "reg": "2023-11-29", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152179, "h": "GCNL-AS-AP", "n": "HongKong Global Network", "t": "Broadband & mobile", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.303, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.899, "ts": null, "map": 0.155, "obs": 0, "own": 0.862, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.607, "ts": null, "map": 0.084, "obs": 0, "own": 0.193, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.699, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GCNL1-AP-APNIC", "org": "GLOBAL COMMUNICATION NETWORK LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.hkglobalnetwork.com/"}, "pfx": 346, "reg": "2023-12-15", "rir": "apnic", "s24": 449, "sib": 2, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 120064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00188341967968}, {"a": 152194, "h": "CTGSERVERLIMITED-AS-AP", "n": "CTG Server Limited", "t": "Hosting & VPS", "w": 110, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 9, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "web_bruteforce": 6, "cve:CVE-2017-9841": 2, "cve:CVE-2024-4577": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-63030": 1}, "n": 10}, "ev": {"shodan": {"n": 29, "p": 1.0000, "hi": 15.36, "lo": 8.39, "ips": 29, "mean": 11.65, "above": true}, "urlhaus": {"n": 3, "p": 0.6015, "hi": 7.26, "lo": 1.28, "ips": 7, "mean": 3.74, "above": false}, "crowdsec": {"n": 8, "p": 0.4720, "hi": 4.88, "lo": 1.59, "ips": 10, "mean": 3.04, "above": false}, "threatfox": {"n": 20, "p": 1.0000, "hi": 26.11, "lo": 12.64, "ips": 37, "mean": 18.87, "above": true}, "phishing_db": {"n": 28, "p": 1.0000, "hi": 28.22, "lo": 15.25, "ips": 56, "mean": 21.32, "above": true}, "blocklist_de": {"n": 1, "p": 0.0297, "hi": 2.65, "lo": 0.20, "ips": 1, "mean": 1.12, "above": false}}, "h2": [["2026-10-05", 1.989, 14.584, 1, false], ["2026-10-12", 1.005, 13.245, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 20, "phishing_db": 28}, "lo": 13.245, "se": 0.720, "ts": 0.549, "map": 26.502, "obs": 51, "own": 9.204, "comp": {"urlhaus": 0.0424, "threatfox": 1.932, "phishing_db": 2.929}, "mass": 25.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.005, "se": 0.501, "ts": 0.889, "map": 1.922, "obs": 9, "own": 0.379, "comp": {"cins": -1.3634, "dshield": -2.053, "crowdsec": 9.5875, "vulncheck": -0.8815, "blocklist_de": -3.2427}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.874, "det": {"shodan": {"c2": 5, "compromised": 24}, "threatfox": {"family:DCRat": 1, "family:PureRAT": 23, "family:AdaptixC2": 5, "family:ValleyRAT": 1, "family:Cobalt Strike": 7}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-CSL17-AP-APNIC", "org": "CTG Server Limited", "pdb": null, "pfx": 644, "reg": "2023-12-22", "rir": "apnic", "s24": 737, "sib": 0, "tor": 0, "w24": 53, "drop": 31, "hist": [["2026-10-05", 0.9970], ["2026-10-12", 0.9980]], "ipv4": 290048, "abuse": null, "score": 0.9980, "groups": ["abusech", "phishing", "shodan"], "sensors": [], "traffic": 0.00676590884347}, {"a": 152205, "h": "IMOBI-AS-KR", "n": "imobi inc,", "t": "Other", "w": 0, "cc": "KR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1205, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.004, "ts": null, "map": 0.184, "obs": 0, "own": 0.543, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.802, "ts": null, "map": 0.155, "obs": 0, "own": 0.175, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.533, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-152205-APNIC", "org": "imobi inc,", "pdb": null, "pfx": 4, "reg": "2023-12-29", "rir": "apnic", "s24": 102, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26112, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152301, "h": "DPDCCL-AS-AP", "n": "DAUN PENH DATA CENTER CO., LTD., DAUN PENH DATA CENTER CO., LTD.", "t": "Hosting & VPS", "w": 0, "cc": "KH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.855, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DPDC2-AP-APNIC", "org": "DAUN PENH DATA CENTER CO., LTD.", "pdb": null, "pfx": 6, "reg": "2024-01-03", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012445393778}, {"a": 152304, "h": "MOUMITAONLINE-AS-AP", "n": "Md Mostafizur Rahman", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 22070.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.200, "det": null, "oid": "ORG-MO17-AP-APNIC", "org": "Moumita Online", "pdb": null, "pfx": 2, "reg": "2024-01-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152327, "h": "RASUWEBHOST-AS-AP", "n": "Rasu Web Host", "t": "Hosting & VPS", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-RWH2-AP-APNIC", "org": "Rasu Web Host", "pdb": null, "pfx": 1, "reg": "2024-01-11", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152373, "h": "IDNIC-AMAN-AS-ID", "n": "Anugerah Media Data Nusantara, PT", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.295, "det": null, "oid": "@aut-152373-APNIC", "org": "PT Anugerah Media Data Nusantara", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://amanisp.net.id"}, "pfx": 5, "reg": "2024-01-24", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000929132677}, {"a": 152377, "h": "IDNIC-TRITAMA-AS-ID", "n": "Trimitra Aditama Koneksindo", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": 10807.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 27.413, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.295, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-152377-APNIC", "org": "PT Trimitra Aditama Koneksindo", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://tritama.net"}, "pfx": 3, "reg": "2024-01-24", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000496953127}, {"a": 152390, "h": "IDNIC-INTERCLOUD-AS-ID", "n": "PT Intercloud Digital Inovasi", "t": "Hosting & VPS", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 2, "web_exploit": 5, "bad_crawling": 2, "web_bruteforce": 3, "home_connection": 3, "router_or_botnet": 2, "cve:CVE-2012-0392": 1, "cve:CVE-2017-9805": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2024-28000": 1, "cve:CVE-2024-57046": 1}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.957, "det": null, "oid": "@aut-152390-APNIC", "org": "PT Intercloud Digital Inovasi", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://intercloud-digital.com"}, "pfx": 1, "reg": "2024-01-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152401, "h": "IDNIC-AMD-AS-ID", "n": "PT Airlink Media Data", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 18359.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.256, "det": null, "oid": "@aut-152401-APNIC", "org": "PT Airlink Media Data", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "http://airlink.id"}, "pfx": 2, "reg": "2024-01-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152412, "h": "IDNIC-QELOPAK-AS-ID", "n": "PT Qelopak Teknologi Indonesia", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.131, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-152412-APNIC", "org": "PT Qelopak Teknologi Indonesia", "pdb": null, "pfx": 2, "reg": "2024-01-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152432, "h": "IDNIC-WEEGOO-AS-ID", "n": "Sinergi Innovate Pratama", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.180, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-152432-APNIC", "org": "PT Sinergi Innovate Pratama", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://skylink-sip.com/"}, "pfx": 2, "reg": "2024-01-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152435, "h": "IDNIC-KONNEK-AS-ID", "n": "KONNEK JAYA BERSAMA", "t": "Broadband & mobile", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.156, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-152435-APNIC", "org": "PT Konnek Jaya Bersama", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://konnek.id"}, "pfx": 3, "reg": "2024-01-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152436, "h": "IDNIC-ERATELINDO-AS-ID", "n": "Erajaya Telco Indonesia", "t": "Broadband & mobile", "w": 5, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 3, "router_or_botnet": 5}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 5, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": 28645.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 27.413, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.248, "det": null, "oid": "@aut-152436-APNIC", "org": "PT Erajaya Telco Indonesia", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.eratelindo.id"}, "pfx": 4, "reg": "2024-01-24", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0015883718928}, {"a": 152474, "h": "WEBCONNECTION-AS-AP", "n": "Web Connection", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 26562.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.211, "det": null, "oid": "ORG-WC17-AP-APNIC", "org": "Web Connection", "pdb": {"t": null, "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.webconnectionbd.com"}, "pfx": 1, "reg": "2024-02-11", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152475, "h": "IENS-AS-AP", "n": "IENS TECHNOLOGY PTE. LTD", "t": "Other", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.513, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.395, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BP8-AP-APNIC", "org": "IENS TECHNOLOGY PTE. LTD", "pdb": null, "pfx": 11, "reg": "2024-02-13", "rir": "apnic", "s24": 11, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023447135092}, {"a": 152485, "h": "HOSTER-AS-IN", "n": "Hosterdaddy Private Limited", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.999, 0, false], ["2026-10-12", 0.013, 1.030, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 1.030, "se": 1.880, "ts": 1.000, "map": 16.185, "obs": 1, "own": 11.843, "comp": {"urlhaus": -0.0112, "threatfox": 4.4516, "phishing_db": -0.0301}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.536, "det": {"threatfox": {"family:AsyncRAT": 2}}, "oid": "@aut-152485-APNIC", "org": "Hosterdaddy Private Limited", "pdb": null, "pfx": 1, "reg": "2024-02-16", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152516, "h": "WINDNET-AS-IN", "n": "Windnet Pvt Ltd", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 26367.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.216, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-152516-APNIC", "org": "Windnet Pvt Ltd", "pdb": null, "pfx": 2, "reg": "2024-02-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152528, "h": "MCMNPL-AS-IN", "n": "Mcm Network Private Limited", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 9960.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.152, "det": null, "oid": "@aut-152528-APNIC", "org": "Mcm Network Private Limited", "pdb": null, "pfx": 2, "reg": "2024-02-16", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152565, "h": "JOYSVC-AS-IN", "n": "Joy Services", "t": "Hosting & VPS", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2011-3600": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 5.928, 0.747, 0, false], ["2026-10-12", 8.309, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 8.309, "se": 0.794, "ts": 0.667, "map": 26.951, "obs": 3, "own": 5.384, "comp": {"cins": -0.4377, "dshield": -0.892, "crowdsec": 4.2903, "vulncheck": -0.6278, "blocklist_de": 2.3549}, "mass": 2.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-152565-APNIC", "org": "JOY SERVICES", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.joy.services/"}, "pfx": 11, "reg": "2024-02-16", "rir": "apnic", "s24": 13, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152586, "h": "KUROIT-AS-AP", "n": "Kuroit (India)", "t": "Enterprise, edu & gov", "w": 8, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 2, "ssh_bruteforce": 3, "home_connection": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}, "crowdsec": {"n": 4, "p": 0.7722, "hi": 8.46, "lo": 1.82, "ips": 5, "mean": 4.62, "above": false}, "threatfox": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 2, "p": 0.4012, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 6.147, 0.449, 0, false], ["2026-10-12", 16.983, 0.464, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.464, "se": 1.545, "ts": 1.000, "map": 4.724, "obs": 1, "own": 23.710, "comp": {"urlhaus": -0.0987, "threatfox": 3.5048, "phishing_db": -0.2273}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 16.983, "se": 0.546, "ts": 0.571, "map": 35.109, "obs": 7, "own": 196.264, "comp": {"cins": 2.7867, "dshield": -1.8186, "crowdsec": 3.0557, "vulncheck": -0.8476, "blocklist_de": 1.7759}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.650, "det": {"threatfox": {"family:DCRat": 1}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": null, "org": null, "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.kuroit.com"}, "pfx": 31, "reg": "2024-02-23", "rir": "apnic", "s24": 31, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000014101425}, {"a": 152600, "h": "RESETDATA-AP-SOUTHEAST-2", "n": "ResetData Pty Ltd", "t": "Other", "w": 4, "cc": "AU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 16.363, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.894, "det": {"vulncheck": {"c2_server": 4}}, "oid": "ORG-RPL26-AP-APNIC", "org": "ResetData Pty Ltd", "pdb": null, "pfx": 1, "reg": "2024-03-01", "rir": "apnic", "s24": 1, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152605, "h": "ZCOMNETWORKS-AS-AP", "n": "Z COM NETWORKS", "t": "Broadband & mobile", "w": 5, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 3, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2024-12847": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7793, "hi": 8.56, "lo": 1.84, "ips": 4, "mean": 4.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 18.488, 0.011, 1, false], ["2026-10-12", 10.944, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 1.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 10.944, "se": 0.617, "ts": 0.800, "map": 25.641, "obs": 5, "own": 39.615, "comp": {"cins": -0.7653, "dshield": -1.3862, "crowdsec": 7.2547, "vulncheck": -0.7669, "blocklist_de": 0.3016}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.153, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-ZCNL1-AP-APNIC", "org": "Z COM NETWORKS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://zcomnetworks.com.pk"}, "pfx": 28, "reg": "2024-03-01", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00822665958741}, {"a": 152615, "h": "CHUMMYMAIN-AS-TW", "n": "Chummy Technology", "t": "Hosting & VPS", "w": 4, "cc": "TW", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 3.631, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.703, "det": {"vulncheck": {"c2_server": 4}}, "oid": "@aut-152615-APNIC", "org": "Chummy Technology Ltd.", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://chummy.tw"}, "pfx": 1, "reg": "2024-03-04", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152644, "h": "QINIU-AS-AP", "n": "QINIU (CHINA) limited, QINIU (CHINA) limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.866, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-QL7-AP-APNIC", "org": "QINIU (CHINA) limited", "pdb": null, "pfx": 6, "reg": "2024-03-13", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007756269128}, {"a": 152698, "h": "ZORN-AS-AP", "n": "Zorn Technologies", "t": "Enterprise, edu & gov", "w": 3, "cc": "BD", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.011, 13.363, 1, false], ["2026-10-12", 0.012, 0.706, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.706, "se": 1.670, "ts": 1.000, "map": 9.006, "obs": 1, "own": 49.492, "comp": {"urlhaus": -0.0493, "threatfox": 3.9968, "phishing_db": -0.1234}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 5.847, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.459, "det": {"threatfox": {"family:DanaBot": 3}}, "oid": "ORG-ZT5-AP-APNIC", "org": "Zorn Technologies", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://zorntech.com"}, "pfx": 8, "reg": "2024-04-15", "rir": "apnic", "s24": 8, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000517018334}, {"a": 152708, "h": "JADOOTECHNOLOGY-AS-AP", "n": "Jadoo Technology", "t": "Other", "w": 0, "cc": "BD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.276, "det": null, "oid": "ORG-JT8-AP-APNIC", "org": "Jadoo Technology", "pdb": null, "pfx": 1, "reg": "2024-04-23", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152726, "h": "DREAMENGINEERING-AS-AP", "n": "Dream Engineering", "t": "Enterprise, edu & gov", "w": 45, "cc": "BD", "cf": null, "cs": null, "ev": {"threatfox": {"n": 7, "p": 0.9870, "hi": 12.94, "lo": 3.92, "ips": 45, "mean": 7.87, "above": true}}, "h2": [["2026-10-05", 0.010, 16.077, 1, false], ["2026-10-12", 0.009, 7.630, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 0}, "lo": 7.630, "se": 0.830, "ts": 1.000, "map": 18.854, "obs": 7, "own": 73.634, "comp": {"urlhaus": -0.9704, "threatfox": 6.4621, "phishing_db": -0.9289}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.797, "ts": null, "map": 0.153, "obs": 0, "own": 1.700, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:DanaBot": 45}}, "oid": "ORG-DE6-AP-APNIC", "org": "Dream Engineering", "pdb": {"t": "Enterprise", "sc": null, "tr": "100-1000Mbps", "pol": "Selective", "web": "https://dreamengineering.com.bd/"}, "pfx": 106, "reg": "2024-04-30", "rir": "apnic", "s24": 106, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 27136, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": null}, {"a": 152746, "h": "IDNIC-UNISAYOGYA-AS-ID", "n": "Universitas Aisyiyah Yogyakarta", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.990, "det": {"shodan": {"compromised": 1, "doublepulsar": 2}}, "oid": "@aut-152746-APNIC", "org": "Universitas Aisyiyah Yogyakarta", "pdb": null, "pfx": 1, "reg": "2024-05-08", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152833, "h": "IDNIC-TCN-AS-ID", "n": "PT Tuxsindo Cyber Networks", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.001, 0.011, 0, false], ["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": 32226.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 4.883, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.222, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-152833-APNIC", "org": "PT Tuxsindo Cyber Networks", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://tuxsnet.id"}, "pfx": 2, "reg": "2024-05-08", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152900, "h": "ONIDEL-AS-AP", "n": "Onidel Pty Ltd", "t": "Transit & backbone", "w": 1, "cc": "AU", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6200, "hi": 7.45, "lo": 1.31, "ips": 3, "mean": 3.84, "above": false}, "phishing_db": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 1.668, 0.547, 0, false], ["2026-10-12", 0.011, 0.567, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.567, "se": 1.596, "ts": 1.000, "map": 6.410, "obs": 1, "own": 27.696, "comp": {"urlhaus": -0.0825, "threatfox": -0.1082, "phishing_db": 3.6748}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 2.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-HCH1-AP-APNIC", "org": "Onidel Pty Ltd", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://onidel.com"}, "pfx": 19, "reg": "2024-06-05", "rir": "apnic", "s24": 19, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045596420773}, {"a": 152918, "h": "LNL-AS-AP", "n": "Liberally Network (BYOIP Service, Asia-Pacific)", "t": "Broadband & mobile", "w": 6, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7506, "hi": 8.16, "lo": 1.76, "ips": 4, "mean": 4.46, "above": false}, "phishing_db": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 6, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.010, 0.367, 0, false], ["2026-10-12", 0.010, 0.384, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.384, "se": 1.503, "ts": 1.000, "map": 3.581, "obs": 1, "own": 10.455, "comp": {"urlhaus": -0.1359, "threatfox": -0.1615, "phishing_db": 3.1993}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.182, "obs": 0, "own": 0.658, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.645, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-LNL5-AP-APNIC", "org": "Liberally Network LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "https://cdn.liberally.network/as/152918"}, "pfx": 39, "reg": "2024-06-13", "rir": "apnic", "s24": 57, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023075773494}, {"a": 152979, "h": "VIETSERVICE-VN", "n": "Vietservice Technology Company Limited", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.544, 0.011, 1, false], ["2026-10-12", 12.851, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.851, "se": 1.099, "ts": 0.500, "map": 75.101, "obs": 2, "own": 45.454, "comp": {"cins": 4.8022, "dshield": -0.4457, "crowdsec": 2.8032, "vulncheck": -0.4158, "blocklist_de": -1.0314}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-152979-APNIC", "org": "Vietservice Technology Company Limited", "pdb": null, "pfx": 3, "reg": "2024-06-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 152992, "h": "DATAONLINE-VN", "n": "ONLINE DATA", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.761, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-152992-APNIC", "org": "ONLINE DATA COMPANY LIMITED", "pdb": null, "pfx": 2, "reg": "2024-06-24", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000154783531}, {"a": 153003, "h": "LACHANSO-VN", "n": "Digital Shield Technology Company Limited", "t": "Other", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2019-7254": 1, "cve:CVE-2021-33044": 1, "cve:CVE-2021-33690": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.681, "det": null, "oid": "@aut-153003-APNIC", "org": "Digital Shield Technology Company Limited", "pdb": null, "pfx": 2, "reg": "2024-06-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001978306246}, {"a": 153013, "h": "GTSC-DC1-VN", "n": "GTSC VIETNAM TECHNOLOGY SERVICES AND COMMERCIAL JOINT STOCK COMPANY", "t": "Other", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.752, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-153013-APNIC", "org": "GTSC VIETNAM TECHNOLOGY SERVICES AND COMMERCIAL JOINT STOCK COMPANY", "pdb": null, "pfx": 2, "reg": "2024-06-24", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153038, "h": "BUSINESSZONELIMITED-AS-BD", "n": "Business Zone", "t": "Broadband & mobile", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.426, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.426, "se": 1.354, "ts": 1.000, "map": 3.997, "obs": 1, "own": 7.336, "comp": {"cins": -0.1028, "dshield": -0.2401, "crowdsec": 3.922, "vulncheck": -0.2635, "blocklist_de": -0.5364}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-BZL3-AP-APNIC", "org": "Business Zone Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://businesszoneltd.com"}, "pfx": 20, "reg": "2024-06-25", "rir": "apnic", "s24": 19, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00348121894934}, {"a": 153115, "h": "IDNIC-NUANSATEKNOLOGI-AS-ID", "n": "Nuansa Teknologi Informasi", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.220, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-153115-APNIC", "org": "PT Nuansa Teknologi Informasi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.nuansateknologi.id"}, "pfx": 3, "reg": "2024-07-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153131, "h": "IDNIC-MAJUIN-AS-ID", "n": "MAINTEK", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10156.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.452, "det": null, "oid": "@aut-153131-APNIC", "org": "PT Maintek Juara Intisolusi", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Open", "web": "https://maintek.net.id"}, "pfx": 2, "reg": "2024-07-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153135, "h": "IDNIC-NPN-AS-ID", "n": "PT Netindo Persada Nusantara", "t": "Other", "w": 2, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 35.879, 0.011, 1, false], ["2026-10-12", 11.989, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.989, "se": 1.090, "ts": 1.000, "map": 69.245, "obs": 2, "own": 41.678, "comp": {"cins": -0.1839, "dshield": -0.415, "crowdsec": 7.5814, "vulncheck": -0.396, "blocklist_de": -0.9552}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-153135-APNIC", "org": "PT Netindo Persada Nusantara", "pdb": null, "pfx": 2, "reg": "2024-07-05", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0006874962886}, {"a": 153243, "h": "RIVFLOW-AS-IN", "n": "RIVFLOW INTERNET SERVICES PRIVATE LIMITED", "t": "Broadband & mobile", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 10546.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.078, "det": null, "oid": "@aut-153243-APNIC", "org": "RIVFLOW INTERNET SERVICES PRIVATE LIMITED", "pdb": null, "pfx": 1, "reg": "2024-08-20", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153252, "h": "RGCOMP-AS-IN", "n": "Rg Communications Private Limited", "t": "Other", "w": 10, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 3, "web_bruteforce": 8, "mail_bruteforce": 6, "router_or_botnet": 6, "cve:CVE-2024-6387": 1}, "n": 8}, "ev": {"urlhaus": {"n": 2, "p": 0.4190, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "crowdsec": {"n": 8, "p": 0.9895, "hi": 12.25, "lo": 3.99, "ips": 8, "mean": 7.64, "above": true}}, "h2": [["2026-10-05", 9.627, 0.478, 0, false], ["2026-10-12", 8.200, 4.230, 0, false]], "sh": false, "uc": 8465.5, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 4.230, "se": 1.194, "ts": 1.000, "map": 23.199, "obs": 2, "own": 21.696, "comp": {"urlhaus": 6.0783, "threatfox": -0.4398, "phishing_db": -0.8683}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.200, "se": 0.518, "ts": 1.000, "map": 16.022, "obs": 8, "own": 9.018, "comp": {"cins": -1.1157, "dshield": -1.8062, "crowdsec": 13.4062, "vulncheck": -0.8457, "blocklist_de": -5.471}, "mass": 5.9, "listed": false}}, "abq": false, "bot": 0.200, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": null, "org": null, "pdb": {"t": null, "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.rgcommunications.in"}, "pfx": 67, "reg": "2024-08-20", "rir": "apnic", "s24": 67, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0019250637291}, {"a": 153283, "h": "SOFTCROP-AS-IN", "n": "Softcrop It", "t": "Other", "w": 2, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": 40755.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 32.074, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.112, "det": {"blocklist_de": {"imap": 1, "mail": 2}}, "oid": "@aut-153283-APNIC", "org": "Softcrop It", "pdb": null, "pfx": 3, "reg": "2024-08-20", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153291, "h": "MASLINK-AS-IN", "n": "Maslink Infocom India", "t": "Broadband & mobile", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 21484.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.134, "det": null, "oid": "@aut-153291-APNIC", "org": "Maslink Infocom India Private Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://maslinkinfocom.com"}, "pfx": 2, "reg": "2024-08-20", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153328, "h": "IPL-AS-AP", "n": "Imegh Private Limited", "t": "Other", "w": 3, "cc": "IN", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.861, "det": null, "oid": "ORG-IPL52-AP-APNIC", "org": "Imegh Private Limited", "pdb": null, "pfx": 2, "reg": "2024-09-12", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153359, "h": "ISADP-AS-AP", "n": "Imtech Solution and Data Providers", "t": "Broadband & mobile", "w": 9, "cc": "PH", "cf": null, "cs": {"c": {"http_flood": 9, "web_exploit": 8, "proxy_or_vpn": 5, "ssh_bruteforce": 3, "web_bruteforce": 8, "mail_bruteforce": 1, "router_or_botnet": 8, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 9}, "ev": {"crowdsec": {"n": 2, "p": 0.4143, "hi": 6.21, "lo": 0.81, "ips": 9, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 5.824, 0.011, 0, false], ["2026-10-12", 6.346, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.346, "se": 1.035, "ts": 1.000, "map": 32.708, "obs": 2, "own": 53.179, "comp": {"cins": -0.2156, "dshield": -0.48, "crowdsec": 7.1311, "vulncheck": -0.4369, "blocklist_de": -1.1174}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.266, "det": null, "oid": "ORG-IS18-AP-APNIC", "org": "Imtech Solution and Data Providers", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://imtechsolutions.net/"}, "pfx": 5, "reg": "2024-10-08", "rir": "apnic", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00148696027524}, {"a": 153379, "h": "NS-AS-AP", "n": "NS INTERNET", "t": "Other", "w": 12, "cc": "BD", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 12, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.211, 0.012, 0, false], ["2026-10-12", 1.385, 0.013, 0, false]], "sh": false, "uc": 355078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.385, "se": 1.717, "ts": 1.000, "map": 22.773, "obs": 1, "own": 21.732, "comp": {"cins": -0.0313, "dshield": -0.0755, "crowdsec": -0.2996, "vulncheck": -0.0965, "blocklist_de": 5.0223}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.290, "det": {"blocklist_de": {"imap": 11, "mail": 12}}, "oid": "ORG-NI17-AP-APNIC", "org": "NS INTERNET", "pdb": null, "pfx": 1, "reg": "2024-10-24", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153447, "h": "CLOUD360-VN", "n": "360 Technology and Services Company Limited", "t": "Hosting & VPS", "w": 1, "cc": "VN", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 2.163, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.712, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-153447-APNIC", "org": "360 Technology and Services Company Limited", "pdb": null, "pfx": 6, "reg": "2024-11-11", "rir": "apnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000211913933}, {"a": 153533, "h": "SHAHRAM-AS-AP", "n": "SHAHRAM TELECOM PRIVATE LIMITED", "t": "Broadband & mobile", "w": 3, "cc": "PK", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 38.309, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"imap": 1, "mail": 1, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-STPL37-AP-APNIC", "org": "SHAHRAM TELECOM PRIVATE LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://shahramteleco.pk"}, "pfx": 2, "reg": "2025-01-22", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009194386949}, {"a": 153568, "h": "NEWDHAKAHARDWARE-AS-AP", "n": "NEW DHAKA HARDWARE", "t": "Other", "w": 1, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.922, "det": null, "oid": "ORG-NA174-AP-APNIC", "org": "NEW DHAKA HARDWARE", "pdb": null, "pfx": 1, "reg": "2025-01-30", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153622, "h": "MADINAIT-AS-AP", "n": "Madina IT", "t": "Other", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-42013": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 20.312, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.312, "se": 1.147, "ts": 0.500, "map": 130.482, "obs": 2, "own": 79.978, "comp": {"cins": 4.8566, "dshield": -0.3936, "crowdsec": 3.0863, "vulncheck": -0.3817, "blocklist_de": -0.9027}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MI31-AP-APNIC", "org": "Madina IT", "pdb": null, "pfx": 1, "reg": "2025-02-19", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001123760666}, {"a": 153656, "h": "HKISP-AS-AP", "n": "OWGELS INTERNATIONAL CO., LIMITED", "t": "Other", "w": 5, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "threatfox": {"n": 1, "p": 0.1981, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.011, 11.422, 1, false], ["2026-10-12", 3.022, 4.517, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 4.517, "se": 1.195, "ts": 0.500, "map": 24.106, "obs": 2, "own": 23.273, "comp": {"urlhaus": -0.2332, "threatfox": 2.535, "phishing_db": 2.5068}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.022, "se": 0.983, "ts": 0.500, "map": 14.043, "obs": 2, "own": 8.298, "comp": {"cins": -0.2739, "dshield": -0.5953, "crowdsec": 1.9918, "vulncheck": -0.5007, "blocklist_de": 3.4139}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.579, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Unknown malware": 2}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-OI12-AP-APNIC", "org": "OWGELS INTERNATIONAL CO., LIMITED", "pdb": null, "pfx": 15, "reg": "2025-03-05", "rir": "apnic", "s24": 15, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014741855232}, {"a": 153706, "h": "STACKNETWORK-AS-AP", "n": "Stack Network Sdn. Bhd.", "t": "Other", "w": 6, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "threatfox": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 6, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.011, 3.608, 0, false], ["2026-10-12", 0.011, 3.615, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 3.615, "se": 1.185, "ts": 1.000, "map": 18.608, "obs": 2, "own": 18.198, "comp": {"urlhaus": -0.2395, "threatfox": 5.2387, "phishing_db": -0.4495}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.403, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.796, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:AdaptixC2": 3, "family:Cobalt Strike": 3}}, "oid": "ORG-SN59-AP-APNIC", "org": "Stack Network Sdn. Bhd.", "pdb": null, "pfx": 29, "reg": "2025-03-18", "rir": "apnic", "s24": 20, "sib": 0, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153707, "h": "IDNIC-SEMESTA-AS-ID", "n": "PT Multisemesta Data Nusantara", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 20312.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.164, "det": null, "oid": "@aut-153707-APNIC", "org": "PT Multisemesta Data Nusantara", "pdb": null, "pfx": 1, "reg": "2025-03-18", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153753, "h": "IDNIC-METROMATIKA-ID", "n": "PT METROMATIKA TEKNOLOGI REKAYASA", "t": "Other", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": 7812.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.277, "det": null, "oid": "@aut-153753-APNIC", "org": "PT METROMATIKA TEKNOLOGI REKAYASA", "pdb": null, "pfx": 3, "reg": "2026-04-06", "rir": "apnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153761, "h": "BRNET-IN", "n": "BRNET-IN", "t": "Other", "w": 1, "cc": "IN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": 16992.2, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 44.822, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.247, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-153761-APNIC", "org": "BRNET INFOCOM PRIVATE LIMITED", "pdb": null, "pfx": 2, "reg": "2025-04-04", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153889, "h": "IDNIC-EL2NET-AS-ID", "n": "IDNIC-EL2NET-AS-ID", "t": "Broadband & mobile", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 11523.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.132, "det": null, "oid": null, "org": null, "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://mediacentralaccess.com/"}, "pfx": 1, "reg": "2025-05-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153903, "h": "IDNIC-ATMAJAYA-AS-ID", "n": "Yayasan Atma Jaya", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.162, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-153903-APNIC", "org": "Yayasan Atma Jaya", "pdb": null, "pfx": 1, "reg": "2025-05-21", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 153947, "h": "FASTZONEIT-AS-AP", "n": "FAST ZONE IT", "t": "Hosting & VPS", "w": 6, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 3, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 1}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 115.763, 0.012, 1, false], ["2026-10-12", 69.325, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 69.325, "se": 0.867, "ts": 0.333, "map": 262.148, "obs": 3, "own": 52.551, "comp": {"cins": -0.3358, "dshield": 3.4829, "crowdsec": 1.3605, "vulncheck": -0.5562, "blocklist_de": 3.0111}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.938, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-FA63-AP-APNIC", "org": "FAST ZONE IT", "pdb": null, "pfx": 1, "reg": "2025-06-04", "rir": "apnic", "s24": 1, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002852156685}, {"a": 153962, "h": "IDNIC-WISMILAK-AS-ID", "n": "PT Wismilak Inti Makmur TBK", "t": "Other", "w": 0, "cc": "ID", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-153962-APNIC", "org": "PT Wismilak Inti Makmur TBK", "pdb": null, "pfx": 1, "reg": "2025-06-09", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154107, "h": "DGNL-AS-AP", "n": "DigitalLink Global Network Limited", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 19.189, 0.011, 1, false], ["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 3.051, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-DGNL1-AP-APNIC", "org": "DigitalLink Global Network Limited", "pdb": null, "pfx": 16, "reg": "2025-07-30", "rir": "apnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154109, "h": "HOSTINGOXYGEN-AS-AP", "n": "Hosting Oxygen", "t": "Hosting & VPS", "w": 2, "cc": "BD", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 9.527, 0.011, 0, false], ["2026-10-12", 9.616, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 9.616, "se": 1.088, "ts": 0.500, "map": 53.635, "obs": 2, "own": 11.613, "comp": {"cins": -0.1438, "dshield": -0.3301, "crowdsec": 3.4321, "vulncheck": 3.1662, "blocklist_de": -0.7487}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.942, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-HO4-AP-APNIC", "org": "Hosting Oxygen", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://hostingoxygen.com"}, "pfx": 1, "reg": "2025-07-31", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154111, "h": "IRINN-HUPCLOUD-AS-IN", "n": "HOSTUP CLOUD TECHNOLOGIES PRIVATE LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.934, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-154111-APNIC", "org": "HOSTUP CLOUD TECHNOLOGIES PRIVATE LIMITED", "pdb": null, "pfx": 1, "reg": "2025-08-04", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154173, "h": "ADCPL-AS-AP", "n": "ADCPL-AS-AP", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.989, "det": {"shodan": {"compromised": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": "2025-08-26", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154177, "h": "LIGHT4-AS-AP", "n": "LIGHT NODE LIMITED", "t": "Enterprise, edu & gov", "w": 38, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 3, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2019-9194": 1, "cve:CVE-2019-18935": 1, "cve:CVE-2021-23394": 1, "cve:CVE-2024-25600": 1, "cve:CVE-2026-87902": 1}, "n": 7}, "ev": {"shodan": {"n": 9, "p": 0.9462, "hi": 8.57, "lo": 2.96, "ips": 9, "mean": 5.45, "above": true}, "dshield": {"n": 1, "p": 0.1226, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "urlhaus": {"n": 2, "p": 0.3994, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "crowdsec": {"n": 7, "p": 0.7287, "hi": 6.46, "lo": 1.95, "ips": 7, "mean": 3.93, "above": false}, "threatfox": {"n": 14, "p": 1.0000, "hi": 20.65, "lo": 8.72, "ips": 15, "mean": 14.15, "above": true}, "vulncheck": {"n": 4, "p": 0.7038, "hi": 7.60, "lo": 1.64, "ips": 4, "mean": 4.15, "above": false}, "phishing_db": {"n": 4, "p": 0.7118, "hi": 7.69, "lo": 1.65, "ips": 6, "mean": 4.20, "above": false}, "blocklist_de": {"n": 4, "p": 0.5794, "hi": 6.46, "lo": 1.39, "ips": 4, "mean": 3.53, "above": false}}, "h2": [["2026-10-05", 4.900, 15.187, 1, false], ["2026-10-12", 3.237, 9.958, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 14, "phishing_db": 4}, "lo": 9.958, "se": 0.763, "ts": 0.700, "map": 21.671, "obs": 20, "own": 83.202, "comp": {"urlhaus": 1.1762, "threatfox": 3.3625, "phishing_db": 0.1634}, "mass": 10.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 4, "blocklist_de": 4}, "lo": 3.237, "se": 0.453, "ts": 0.438, "map": 5.676, "obs": 16, "own": 31.768, "comp": {"cins": -1.8187, "dshield": -0.7335, "crowdsec": 2.1749, "vulncheck": 0.9435, "blocklist_de": 2.5635}, "mass": 12.3, "listed": false}}, "abq": false, "bot": 0.649, "det": {"shodan": {"c2": 6, "compromised": 3}, "threatfox": {"family:pupy": 1, "family:Havoc": 2, "family:VShell": 1, "family:AdaptixC2": 5, "family:Unknown malware": 5}, "vulncheck": {"c2_server": 3, "attack_tooling": 1}, "blocklist_de": {"ssh": 2, "bots": 2}}, "oid": "ORG-LNL10-AP-APNIC", "org": "LIGHT NODE LIMITED", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://lightnode.com"}, "pfx": 322, "reg": "2025-08-27", "rir": "apnic", "s24": 390, "sib": 0, "tor": 0, "w24": 34, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 102400, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.00639951226017}, {"a": 154206, "h": "CDN1COM-AS-AP", "n": "CDN1.com Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 0.734, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.211, "obs": 0, "own": 0.357, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.526, "det": null, "oid": "ORG-CL82-AP-APNIC", "org": "CDN1.com Limited", "pdb": null, "pfx": 7, "reg": "2025-09-08", "rir": "apnic", "s24": 26, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154223, "h": "DWNL-AS-AP", "n": "DIGITAL WORLDLINK NETWORK", "t": "Broadband & mobile", "w": 5, "cc": "PK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 122.487, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.125, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-DWNL1-AP-APNIC", "org": "DIGITAL WORLDLINK NETWORK (PRIVATE) LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.digitalworldlink.com"}, "pfx": 2, "reg": "2025-09-11", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00088705672935}, {"a": 154239, "h": "IRINN-NEOSOFT-AS-IN", "n": "Neosoft Technologies And Software Pvt Ltd", "t": "Hosting & VPS", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.653, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-154239-APNIC", "org": "Neosoft Technologies And Software Pvt Ltd", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://neonxt.com/"}, "pfx": 4, "reg": "2025-09-16", "rir": "apnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154321, "h": "CCSB-AS-AP", "n": "CORENET CLOUD SDN. BHD.", "t": "Hosting & VPS", "w": 6, "cc": "MY", "cf": null, "cs": {"c": {"web_exploit": 2, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 5}, "ev": {"shodan": {"n": 9, "p": 0.9946, "hi": 12.54, "lo": 4.33, "ips": 9, "mean": 7.99, "above": true}, "crowdsec": {"n": 4, "p": 0.6404, "hi": 6.97, "lo": 1.50, "ips": 5, "mean": 3.81, "above": false}, "threatfox": {"n": 1, "p": 0.1912, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.3437, "hi": 5.59, "lo": 0.73, "ips": 2, "mean": 2.66, "above": false}}, "h2": [["2026-10-05", 5.658, 1.348, 0, false], ["2026-10-12", 3.683, 0.270, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.270, "se": 1.448, "ts": 1.000, "map": 2.193, "obs": 1, "own": 0.997, "comp": {"urlhaus": -0.1704, "threatfox": 2.9338, "phishing_db": -0.3518}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.683, "se": 0.570, "ts": 0.667, "map": 7.955, "obs": 6, "own": 1.567, "comp": {"cins": -1.0072, "dshield": -1.686, "crowdsec": 4.3402, "vulncheck": -0.8257, "blocklist_de": 2.646}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.965, "det": {"shodan": {"c2": 3, "compromised": 6}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CCSB1-AP-APNIC", "org": "CORENET CLOUD SDN. BHD.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.corenetcloud.com"}, "pfx": 129, "reg": "2025-10-24", "rir": "apnic", "s24": 118, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 50944, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00263491223267}, {"a": 154376, "h": "CLOUDVALLEY-AS-AP", "n": "Cloudvalley Sdn. Bhd.", "t": "Hosting & VPS", "w": 5, "cc": "MY", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3735, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "threatfox": {"n": 1, "p": 0.1967, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4106, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 0.010, 0.426, 0, false], ["2026-10-12", 0.933, 0.440, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.440, "se": 1.533, "ts": 1.000, "map": 4.358, "obs": 1, "own": 1.995, "comp": {"urlhaus": -0.1055, "threatfox": 3.4441, "phishing_db": -0.2404}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.933, "se": 0.947, "ts": 1.000, "map": 3.881, "obs": 2, "own": 0.833, "comp": {"cins": -0.1855, "dshield": -0.4182, "crowdsec": -1.6536, "vulncheck": 5.9701, "blocklist_de": -0.9631}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:AdaptixC2": 3}, "vulncheck": {"c2_server": 2}}, "oid": "ORG-AA413-AP-APNIC", "org": "CLOUDVALLEY SDN. BHD.", "pdb": null, "pfx": 35, "reg": "2025-11-18", "rir": "apnic", "s24": 36, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046623938986}, {"a": 154383, "h": "ZWS-AS-AP", "n": "ZORNTECH WEB SOLUTIONS", "t": "Other", "w": 5, "cc": "BD", "cf": null, "cs": {"c": {"ssh_bruteforce": 5, "cve:CVE-2023-1389": 1, "cve:CVE-2024-6387": 2}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 66.527, 0.012, 1, false], ["2026-10-12", 69.325, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 69.325, "se": 0.867, "ts": 0.333, "map": 262.148, "obs": 3, "own": 150.881, "comp": {"cins": -0.3358, "dshield": 3.4829, "crowdsec": 1.3605, "vulncheck": -0.5562, "blocklist_de": 3.0111}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.803, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-ZA41-AP-APNIC", "org": "ZORNTECH WEB SOLUTIONS", "pdb": null, "pfx": 1, "reg": "2025-11-20", "rir": "apnic", "s24": 1, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 154438, "h": "SUPERSTIFY1-AS-AP", "n": "Superstify Technology Pte Ltd", "t": "Other", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.756, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SA268-AP-APNIC", "org": "Superstify Technology Pte Ltd", "pdb": null, "pfx": 10, "reg": "2025-12-15", "rir": "apnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000114260804}, {"a": 154648, "h": "TERMRATNETWORKLIMITED-AS-AP", "n": "TermRat Network", "t": "Transit & backbone", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8077, "hi": 9.02, "lo": 1.94, "ips": 4, "mean": 4.93, "above": true}, "vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.562, 0.011, 0, false], ["2026-10-12", 0.571, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 3.143, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.571, "se": 1.432, "ts": 1.000, "map": 5.994, "obs": 1, "own": 24.274, "comp": {"cins": -0.0574, "dshield": -0.1368, "crowdsec": -0.5421, "vulncheck": 4.221, "blocklist_de": -0.3003}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.513, "det": {"shodan": {"c2": 4}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-TNL7-AP-APNIC", "org": "TermRat Network Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://termrat.com/"}, "pfx": 10, "reg": "2026-05-01", "rir": "apnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 3328, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00068486725884}, {"a": 154834, "h": "M1RACEICTINC-AS-AP", "n": "M1RACEICTINC-AS-AP", "t": "Broadband & mobile", "w": 13, "cc": "PH", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 13, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 38.309, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.221, "det": {"blocklist_de": {"bots": 13}}, "oid": "ORG-II33-AP-APNIC", "org": "1RACE ICT INC.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "20-50Gbps", "pol": "Open", "web": "https://1raceict.com/"}, "pfx": 2, "reg": "2026-08-14", "rir": "apnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009050432306}, {"a": 154896, "h": "IDNIC-GRIYACLOUD-ID", "n": "CV Griya Cloud Server", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.385, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.385, "se": 1.717, "ts": 1.000, "map": 22.773, "obs": 1, "own": 7.569, "comp": {"cins": -0.0313, "dshield": -0.0755, "crowdsec": -0.2996, "vulncheck": -0.0965, "blocklist_de": 5.0223}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-154896-APNIC", "org": "CV Griya Cloud Server", "pdb": null, "pfx": 1, "reg": "2026-09-08", "rir": "apnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 196645, "h": "HOSTPRO-AS", "n": "HOSTPRO LAB LLC", "t": "Hosting & VPS", "w": 1, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 1.922, 0.011, 0, false], ["2026-10-12", 0.384, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.288, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 0.810, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.959, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LHL13-RIPE", "org": "HOSTPRO LAB LLC", "pdb": null, "pfx": 23, "reg": "2009-07-29", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027603365241}, {"a": 196705, "h": "Ardinvest", "n": "Ardinvest LTD", "t": "Other", "w": 6, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2020-17496": 1, "cve:CVE-2025-54236": 1}, "n": 1}, "ev": {"dshield": {"n": 3, "p": 0.6378, "hi": 7.65, "lo": 1.35, "ips": 4, "mean": 3.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "vulncheck": {"n": 1, "p": 0.1931, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 8.866, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.193, "obs": 0, "own": 0.734, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 8.866, "se": 0.629, "ts": 0.600, "map": 21.260, "obs": 5, "own": 12.101, "comp": {"cins": -0.6537, "dshield": 9.0848, "crowdsec": -1.4298, "vulncheck": 0.7456, "blocklist_de": -3.2964}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.466, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-AA501-RIPE", "org": "Ardinvest LTD", "pdb": null, "pfx": 17, "reg": "2009-03-13", "rir": "ripencc", "s24": 26, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035574439269}, {"a": 196709, "h": "GNC-ALFA", "n": "GNC Russia", "t": "Broadband & mobile", "w": 7, "cc": "AM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "phishing_db": {"n": 2, "p": 0.4212, "hi": 6.28, "lo": 0.82, "ips": 6, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.664, 8.208, 0, false], ["2026-10-12", 0.725, 8.305, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 8.305, "se": 1.236, "ts": 1.000, "map": 49.248, "obs": 2, "own": 115.130, "comp": {"urlhaus": -0.1931, "threatfox": -0.2084, "phishing_db": 5.9246}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 16.974, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.418, "det": null, "oid": "ORG-GC21-RIPE", "org": "GNC-Alfa CJSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.artarmenia.am"}, "pfx": 6, "reg": "2010-03-12", "rir": "ripencc", "s24": 6, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015129042182}, {"a": 196737, "h": "AIRWAVE", "n": "Airwave Internet", "t": "Other", "w": 0, "cc": "IE", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6243, "hi": 7.50, "lo": 1.32, "ips": 3, "mean": 3.87, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.175, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-AI39-RIPE", "org": "Airwave Internet", "pdb": null, "pfx": 4, "reg": "2009-09-07", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009522274086}, {"a": 196886, "h": "Orion-Telekom-Korisnici-AS", "n": "Orion Telekom Tim d.o.o.Beograd", "t": "Broadband & mobile", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8142, "hi": 9.13, "lo": 1.97, "ips": 4, "mean": 4.99, "above": true}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.302, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-PSOD1-RIPE", "org": "Orion Telekom Tim d.o.o.Beograd", "pdb": null, "pfx": 1, "reg": "2009-12-30", "rir": "ripencc", "s24": 1, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 256, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00000244650375}, {"a": 197019, "h": "WEDOS", "n": "WEDOS Internet", "t": "Hosting & VPS", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5914, "hi": 7.16, "lo": 1.26, "ips": 3, "mean": 3.69, "above": false}, "vulncheck": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.273, 0.011, 0, false], ["2026-10-12", 0.234, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.260, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.234, "se": 1.268, "ts": 1.000, "map": 1.812, "obs": 1, "own": 0.424, "comp": {"cins": -0.0958, "dshield": -0.2245, "crowdsec": -0.8893, "vulncheck": 3.6982, "blocklist_de": -0.5003}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.921, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-WIA5-RIPE", "org": "WEDOS Internet, a.s.", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.wedos.cz"}, "pfx": 4, "reg": "2010-07-22", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00048426301135}, {"a": 197131, "h": "ASCATNET", "n": "Ketnet Telecom Ltd", "t": "Broadband & mobile", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.582, 0.011, 0, false], ["2026-10-12", 0.509, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.509, "se": 1.406, "ts": 1.000, "map": 5.081, "obs": 1, "own": 9.965, "comp": {"cins": -0.0625, "dshield": -0.1485, "crowdsec": -0.5888, "vulncheck": 4.1459, "blocklist_de": -0.3269}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.250, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-ORS2-RIPE", "org": "Ketnet Telecom Ltd", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "https://ua-cat.net"}, "pfx": 4, "reg": "2010-06-18", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003847213647}, {"a": 197155, "h": "ARTNET", "n": "ARTNET", "t": "Hosting & VPS", "w": 4, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2026-8181": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3605, "hi": 5.73, "lo": 0.74, "ips": 2, "mean": 2.73, "above": false}, "crowdsec": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "vulncheck": {"n": 2, "p": 0.4072, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 1.189, 0.401, 0, false], ["2026-10-12", 1.756, 0.419, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.419, "se": 1.520, "ts": 1.000, "map": 4.039, "obs": 1, "own": 1.828, "comp": {"urlhaus": -0.1242, "threatfox": -0.1506, "phishing_db": 3.2971}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.756, "se": 0.787, "ts": 0.667, "map": 5.480, "obs": 3, "own": 1.134, "comp": {"cins": -0.3239, "dshield": -0.69, "crowdsec": 1.4797, "vulncheck": 4.2962, "blocklist_de": -1.6672}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 2}}, "oid": "ORG-ASZO16-RIPE", "org": "Artnet Sp. z o.o.", "pdb": {"t": "Content", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.artnet.pl"}, "pfx": 47, "reg": "2010-07-06", "rir": "ripencc", "s24": 46, "sib": 3, "tor": 1, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007477821741}, {"a": 197170, "h": "TECHTIES-AS", "n": "TECHTIES-AS", "t": "Other", "w": 214, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 113, "data_centre": 73, "web_exploit": 146, "bad_crawling": 97, "proxy_or_vpn": 42, "first_seen_30d": 16, "ssh_bruteforce": 109, "web_bruteforce": 97, "home_connection": 2, "mail_bruteforce": 5, "router_or_botnet": 1, "cve:CVE-2017-9841": 33, "cve:CVE-2024-6387": 28, "cve:CVE-2017-16894": 17, "cve:CVE-2019-17050": 17, "cve:CVE-2024-28000": 17}, "n": 196}, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "dshield": {"n": 6, "p": 0.9654, "hi": 11.76, "lo": 3.26, "ips": 8, "mean": 6.95, "above": true}, "crowdsec": {"n": 10, "p": 0.9996, "hi": 16.40, "lo": 5.96, "ips": 196, "mean": 10.63, "above": true}, "threatfox": {"n": 3, "p": 0.6459, "hi": 7.74, "lo": 1.36, "ips": 6, "mean": 3.99, "above": false}, "blocklist_de": {"n": 8, "p": 0.9958, "hi": 14.24, "lo": 4.63, "ips": 57, "mean": 8.88, "above": true}}, "h2": [["2026-10-05", 130.253, 30.753, 1, false], ["2026-10-12", 177.233, 12.222, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 12.222, "se": 1.007, "ts": 1.000, "map": 44.908, "obs": 3, "own": 41.180, "comp": {"urlhaus": -0.3604, "threatfox": 6.375, "phishing_db": -0.5837}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 8}, "lo": 177.233, "se": 0.401, "ts": 0.417, "map": 288.003, "obs": 24, "own": 160.287, "comp": {"cins": -2.4009, "dshield": 4.1257, "crowdsec": 0.4268, "vulncheck": -0.9609, "blocklist_de": 5.866}, "mass": 20.5, "listed": false}}, "abq": false, "bot": 0.977, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Mirai": 1, "family:PureRAT": 3, "family:Cobalt Strike": 2}, "blocklist_de": {"ftp": 1, "ssh": 31, "bots": 4, "apache": 21, "bruteforcelogin": 14}}, "oid": "ORG-TI147-RIPE", "org": "TechTies Inc.", "pdb": null, "pfx": 13, "reg": "2026-05-29", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 1, "w24": 10, "drop": 12, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.0719]], "ipv4": 3328, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.00902897606854}, {"a": 197207, "h": "MCCI-AS", "n": "Mobile Communication Company of Iran", "t": "Broadband & mobile", "w": 2, "cc": "IR", "cf": {"rb": "hi", "wb": "", "rep": 0.27, "waf": 0.70}, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.0000, "hi": 1.08, "lo": 0.14, "ips": 2, "mean": 0.51, "above": false}}, "h2": [["2026-10-05", 0.016, 0.005, 0, false], ["2026-10-12", 0.016, 0.006, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.006, "se": 1.684, "ts": null, "map": 0.060, "obs": 0, "own": 0.268, "comp": null, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.016, "se": 0.777, "ts": 1.000, "map": 0.048, "obs": 2, "own": 0.077, "comp": {"cins": -0.5306, "dshield": 6.3762, "crowdsec": -4.1064, "vulncheck": -0.6781, "blocklist_de": -2.6965}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.565, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-MCCO2-RIPE", "org": "Mobile Communication Company of Iran PLC", "pdb": null, "pfx": 796, "reg": "2012-09-17", "rir": "ripencc", "s24": 8990, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5454592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.27234}, {"a": 197218, "h": "ASLANPRO", "n": "PP Dmutrashko Evgeny Vitalievich", "t": "Other", "w": 10, "cc": "UA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 4, "p": 0.8109, "hi": 9.08, "lo": 1.95, "ips": 10, "mean": 4.96, "above": true}}, "h2": [["2026-10-05", 35.656, 0.011, 1, false], ["2026-10-12", 26.821, 0.012, 1, false]], "sh": false, "uc": 17382.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 26.821, "se": 0.699, "ts": 1.000, "map": 73.888, "obs": 4, "own": 41.852, "comp": {"cins": -0.692, "dshield": -1.2854, "crowdsec": -5.0437, "vulncheck": -0.7436, "blocklist_de": 13.4608}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.206, "det": {"blocklist_de": {"imap": 10, "mail": 10}}, "oid": "ORG-DMEV1-RIPE", "org": "PP Dmutrashko Evgeny Vitalievich", "pdb": null, "pfx": 3, "reg": "2010-08-13", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 197227, "h": "PSM_Winogrady", "n": "Winogrady", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 1.432, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.548, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PSMW3-RIPE", "org": "Poznanska Spoldzielnia Mieszkaniowa \"Winogrady\" w Poznaniu", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://wtvk.pl"}, "pfx": 20, "reg": "2010-08-18", "rir": "ripencc", "s24": 80, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082555523154}, {"a": 197261, "h": "HEPHOSTING", "n": "Omer Can Kucergun", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.573, "det": {"shodan": {"c2": 2}}, "oid": "ORG-HA1270-RIPE", "org": "Omer Can Kucergun", "pdb": null, "pfx": 1, "reg": "2026-05-26", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197283, "h": "PowerRDP-Network-AS", "n": "PowerRDP Network LTD", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.545, "det": null, "oid": "ORG-PA1777-RIPE", "org": "PowerRDP Network LTD", "pdb": null, "pfx": 6, "reg": "2026-05-26", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009065442288}, {"a": 197304, "h": "DilisGrup", "n": "Dilis Grup EOOD", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DGE1-RIPE", "org": "Dilis Grup EOOD", "pdb": null, "pfx": 8, "reg": "2010-10-08", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009962637542}, {"a": 197309, "h": "RS-Media-ru", "n": "RS-Media", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.389, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.394, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.865, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PL119-RIPE", "org": "RS-Media LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.rs-media.ru"}, "pfx": 12, "reg": "2011-01-13", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00052406016355}, {"a": 197343, "h": "TRLCo", "n": "Toloe Rayaneh Loghman Educational and Cultural Co. LTD", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 1.689, 0.012, 0, false]], "sh": false, "uc": 1281.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.689, "se": 0.948, "ts": 0.500, "map": 7.384, "obs": 2, "own": 4.342, "comp": {"cins": -0.3049, "dshield": -0.6546, "crowdsec": 1.671, "vulncheck": -0.5299, "blocklist_de": 3.2115}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.477, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-TRLE1-RIPE", "org": "Toloe Rayaneh Loghman Educational and Cultural Co. LTD", "pdb": null, "pfx": 32, "reg": "2010-10-26", "rir": "ripencc", "s24": 32, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007809847875}, {"a": 197422, "h": "TETANEUTRAL-NET-AS", "n": "Association tetaneutral.net", "t": "Enterprise, edu & gov", "w": 1, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 0.513, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 3.441, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 35.308, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.673, "det": null, "oid": "ORG-TA940-RIPE", "org": "Tetaneutral.net Association declaree", "pdb": {"t": "Non-Profit", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://tetaneutral.net/"}, "pfx": 6, "reg": "2011-02-24", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197450, "h": "SUNUCUN", "n": "SUNUCUN", "t": "Enterprise, edu & gov", "w": 4, "cc": "TR", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 2, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2024-28000": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1812, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "shodan": {"n": 2, "p": 0.2967, "hi": 5.20, "lo": 0.67, "ips": 2, "mean": 2.48, "above": false}, "crowdsec": {"n": 3, "p": 0.4757, "hi": 6.14, "lo": 1.08, "ips": 3, "mean": 3.17, "above": false}, "blocklist_de": {"n": 2, "p": 0.3558, "hi": 5.69, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 2.136, 0.011, 0, false], ["2026-10-12", 4.669, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.006, "ts": null, "map": 0.184, "obs": 0, "own": 2.288, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.669, "se": 0.572, "ts": 0.500, "map": 10.146, "obs": 6, "own": 56.963, "comp": {"cins": 2.9306, "dshield": -1.7466, "crowdsec": 1.108, "vulncheck": -0.836, "blocklist_de": 2.2546}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.702, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-SBIT4-RIPE", "org": "Sunucun Bilgi Iletisim Teknolojileri ve Ticaret Ltd. Sti.", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://sunucun.com.tr"}, "pfx": 65, "reg": "2023-07-31", "rir": "ripencc", "s24": 99, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007269571412}, {"a": 197451, "h": "VUTBR-AS", "n": "Brno University of Technology", "t": "Enterprise, edu & gov", "w": 1, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0530, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.28, "above": false}, "dshield": {"n": 1, "p": 0.1443, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.091, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.940, "ts": null, "map": 0.169, "obs": 0, "own": 1.735, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.091, "se": 1.132, "ts": 1.000, "map": 0.562, "obs": 1, "own": 3.443, "comp": {"cins": -0.1945, "dshield": 4.1594, "crowdsec": -1.7272, "vulncheck": -0.4102, "blocklist_de": -1.0093}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BUOT1-RIPE", "org": "Brno University of Technology", "pdb": {"t": "Educational/Research", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.vutbr.cz"}, "pfx": 8, "reg": "2010-12-08", "rir": "ripencc", "s24": 261, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002558998209}, {"a": 197518, "h": "RACKMARKT", "n": "Rackmarkt", "t": "Enterprise, edu & gov", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 3.217, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 3.999, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.859, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RS43-RIPE", "org": "Rackmarkt SL", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.rackmarkt.com"}, "pfx": 3, "reg": "2011-01-07", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197537, "h": "WISDOM-CLOUD", "n": "WISDOM CLOUD", "t": "Hosting & VPS", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.2280, "hi": 4.64, "lo": 0.60, "ips": 2, "mean": 2.21, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 0.182, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.737, "ts": null, "map": 0.131, "obs": 0, "own": 0.046, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.502, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-WCIT2-RIPE", "org": "WISDOM CLOUD INTERNET TECHNOLOGY PTE. LTD.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.wisdomisp.com"}, "pfx": 150, "reg": "2023-07-27", "rir": "ripencc", "s24": 167, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 52224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049908908621}, {"a": 197540, "h": "netcup-AS", "n": "netcup GmbH", "t": "Hosting & VPS", "w": 84, "cc": "DE", "cf": {"rb": "", "wb": "", "rep": 1.45, "waf": 7.96}, "cs": {"c": {"http_flood": 42, "data_centre": 46, "web_exploit": 44, "bad_crawling": 31, "proxy_or_vpn": 20, "first_seen_30d": 10, "ssh_bruteforce": 14, "web_bruteforce": 29, "home_connection": 6, "mail_bruteforce": 6, "router_or_botnet": 1, "cve:CVE-2017-9841": 9, "cve:CVE-2025-4396": 4, "cve:CVE-2018-13379": 5, "cve:CVE-2018-20062": 12, "cve:CVE-2026-60137": 4}, "n": 55}, "ev": {"cins": {"n": 2, "p": 0.2297, "hi": 4.65, "lo": 0.60, "ips": 2, "mean": 2.22, "above": false}, "shodan": {"n": 298, "p": 1.0000, "hi": 117.82, "lo": 97.39, "ips": 298, "mean": 107.40, "above": true}, "dshield": {"n": 4, "p": 0.5605, "hi": 6.31, "lo": 1.36, "ips": 4, "mean": 3.45, "above": false}, "crowdsec": {"n": 49, "p": 1.0000, "hi": 19.31, "lo": 12.10, "ips": 55, "mean": 15.53, "above": true}, "threatfox": {"n": 5, "p": 0.8725, "hi": 9.32, "lo": 2.32, "ips": 5, "mean": 5.32, "above": true}, "vulncheck": {"n": 13, "p": 0.9998, "hi": 14.37, "lo": 5.89, "ips": 13, "mean": 9.74, "above": true}, "phishing_db": {"n": 2, "p": 0.2071, "hi": 4.47, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}, "blocklist_de": {"n": 5, "p": 0.4976, "hi": 5.55, "lo": 1.38, "ips": 5, "mean": 3.17, "above": false}}, "h2": [["2026-10-05", 7.929, 1.126, 0, false], ["2026-10-12", 7.101, 1.308, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 2}, "lo": 1.308, "se": 0.885, "ts": 0.714, "map": 3.324, "obs": 7, "own": 1.313, "comp": {"urlhaus": -1.2062, "threatfox": 3.2953, "phishing_db": 0.7382}, "mass": 4.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 49, "vulncheck": 13, "blocklist_de": 5}, "lo": 7.101, "se": 0.371, "ts": 0.671, "map": 10.938, "obs": 73, "own": 2.136, "comp": {"cins": -0.57, "dshield": -1.0403, "crowdsec": 13.4939, "vulncheck": 0.5862, "blocklist_de": -8.684}, "mass": 50.4, "listed": false}}, "abq": false, "bot": 0.454, "det": {"shodan": {"c2": 13, "malware": 1, "compromised": 196, "doublepulsar": 88}, "threatfox": {"family:Unknown malware": 5}, "vulncheck": {"c2_server": 7, "botnet_node": 1, "attack_tooling": 5}, "blocklist_de": {"ssh": 3, "bots": 2}}, "oid": "ORG-NG51-RIPE", "org": "netcup GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "No", "web": "https://www.netcup.de"}, "pfx": 258, "reg": "2011-01-26", "rir": "ripencc", "s24": 835, "sib": 1, "tor": 13, "w24": 75, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.9980]], "ipv4": 257792, "abuse": null, "score": 0.9980, "groups": ["vulncheck", "abusech", "shodan"], "sensors": ["crowdsec"], "traffic": 0.05944}, {"a": 197551, "h": "AMEOS", "n": "AMEOS", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.629, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AS139-RIPE", "org": "Ameos SARL", "pdb": {"t": "Content", "sc": "Regional", "tr": "20-100Mbps", "pol": "Open", "web": "http://www.ameos.com"}, "pfx": 2, "reg": "2011-01-28", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197555, "h": "SMARTMIETEN", "n": "SMARTMIETEN TECH PRIVATE LIMITED", "t": "Other", "w": 0, "cc": "IN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false]], "sh": true, "uc": null, "v2": null, "abq": false, "bot": null, "det": null, "oid": "ORG-STPL4-RIPE", "org": "SMARTMIETEN TECH PRIVATE LIMITED", "pdb": null, "pfx": 1, "reg": "2023-07-26", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197556, "h": "Kar-Tel", "n": "Kar-Tel LLC", "t": "Other", "w": 2, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.2066, "hi": 4.47, "lo": 0.58, "ips": 2, "mean": 2.13, "above": false}}, "h2": [["2026-10-05", 0.439, 0.010, 0, false], ["2026-10-12", 0.458, 0.011, 0, false]], "sh": false, "uc": 269.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 0.485, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.458, "se": 0.883, "ts": 1.000, "map": 1.763, "obs": 2, "own": 1.029, "comp": {"cins": -0.3469, "dshield": -0.7324, "crowdsec": 5.3886, "vulncheck": -0.565, "blocklist_de": -1.7833}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.093, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-KL166-RIPE", "org": "Kar-Tel LLC", "pdb": null, "pfx": 53, "reg": "2011-02-01", "rir": "ripencc", "s24": 154, "sib": 5, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 64768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00516431015737}, {"a": 197574, "h": "EXPRESSHOST", "n": "ExpressHost Ltd", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 15.758, 0.011, 1, false], ["2026-10-12", 0.461, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.461, "se": 1.373, "ts": 1.000, "map": 4.481, "obs": 1, "own": 1.064, "comp": {"cins": 4.9971, "dshield": -0.2539, "crowdsec": -1.0056, "vulncheck": -0.2754, "blocklist_de": -0.5687}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.632, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-EA1755-RIPE", "org": "ExpressHost Ltd", "pdb": null, "pfx": 18, "reg": "2026-05-19", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00082328080165}, {"a": 197623, "h": "Kopings-Kabel-TV", "n": "Kopings Kabel-TV AB", "t": "Other", "w": 1, "cc": "SE", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.954, 0.011, 0, false], ["2026-10-12", 0.224, 0.012, 0, false]], "sh": false, "uc": 890.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 0.616, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.224, "se": 1.245, "ts": 1.000, "map": 1.722, "obs": 1, "own": 1.100, "comp": {"cins": -0.1409, "dshield": -0.3237, "crowdsec": 3.4665, "vulncheck": -0.3315, "blocklist_de": -0.7335}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.134, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-KKA1-RIPE", "org": "Kopings Kabel-TV AB", "pdb": null, "pfx": 15, "reg": "2011-06-08", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00045979243236}, {"a": 197648, "h": "CL8ASN1", "n": "CLOUDLAYER8 LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "CY", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.420, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.842, "det": null, "oid": "ORG-PDCL2-RIPE", "org": "CLOUDLAYER8 LIMITED", "pdb": null, "pfx": 16, "reg": "2011-03-11", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006967484352}, {"a": 197650, "h": "AIRMAX-AS", "n": "AirMax Srl", "t": "Other", "w": 11, "cc": "IT", "cf": null, "cs": {"c": {"mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "blocklist_de": {"n": 4, "p": 0.8065, "hi": 9.00, "lo": 1.94, "ips": 10, "mean": 4.92, "above": true}}, "h2": [["2026-10-05", 30.457, 0.011, 1, false], ["2026-10-12", 26.739, 0.012, 1, false]], "sh": false, "uc": 9497.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 26.739, "se": 0.579, "ts": 0.667, "map": 59.205, "obs": 6, "own": 33.315, "comp": {"cins": -1.0143, "dshield": -1.6942, "crowdsec": -1.1815, "vulncheck": -0.8271, "blocklist_de": 10.1918}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"imap": 10, "mail": 10}}, "oid": "ORG-AS150-RIPE", "org": "AirMax S.r.l.", "pdb": null, "pfx": 9, "reg": "2011-03-11", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 197667, "h": "FEROMEDIA-AS", "n": "FEROMEDIA", "t": "Broadband & mobile", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3952, "hi": 6.04, "lo": 0.78, "ips": 3, "mean": 2.88, "above": false}, "blocklist_de": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 11.421, 0.011, 1, false], ["2026-10-12", 12.540, 0.012, 1, false]], "sh": false, "uc": 5737.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 12.540, "se": 0.687, "ts": 0.500, "map": 33.719, "obs": 4, "own": 52.321, "comp": {"cins": -0.6402, "dshield": -1.211, "crowdsec": 2.1048, "vulncheck": -0.725, "blocklist_de": 5.3832}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.155, "det": {"blocklist_de": {"mail": 2}}, "oid": "ORG-FERO1-RIPE", "org": "Telekom System sp.z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.feromedia.net"}, "pfx": 3, "reg": "2011-03-21", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042315388596}, {"a": 197686, "h": "Kazteleport", "n": "Kazteleport", "t": "Transit & backbone", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.094, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 3.270, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.314, "det": {"shodan": {"malware": 1}}, "oid": "ORG-JKSO1-RIPE", "org": "JSC Kazteleport - subsidiary of Halyk Bank of Kazakhstan", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "https://kazteleport.kz/"}, "pfx": 9, "reg": "2011-03-25", "rir": "ripencc", "s24": 8, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003681734252}, {"a": 197695, "h": "AS-REGRU", "n": "\"Domain names registrar REG.RU\", Ltd", "t": "Broadband & mobile", "w": 17, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 3, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 5, "web_bruteforce": 3, "home_connection": 5, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9194": 1, "cve:CVE-2021-23394": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41277": 1}, "n": 8}, "ev": {"shodan": {"n": 19, "p": 1.0000, "hi": 14.12, "lo": 6.71, "ips": 19, "mean": 10.13, "above": true}, "urlhaus": {"n": 1, "p": 0.1810, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 8, "p": 0.7752, "hi": 6.53, "lo": 2.12, "ips": 8, "mean": 4.07, "above": false}, "vulncheck": {"n": 5, "p": 0.8276, "hi": 8.48, "lo": 2.11, "ips": 5, "mean": 4.84, "above": true}, "phishing_db": {"n": 2, "p": 0.2908, "hi": 5.15, "lo": 0.67, "ips": 2, "mean": 2.45, "above": false}, "blocklist_de": {"n": 3, "p": 0.3481, "hi": 5.21, "lo": 0.92, "ips": 3, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 1.817, 0.805, 0, false], ["2026-10-12", 2.530, 1.227, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 2}, "lo": 1.227, "se": 1.039, "ts": 0.667, "map": 4.372, "obs": 3, "own": 11.196, "comp": {"urlhaus": 2.2466, "threatfox": -0.4665, "phishing_db": 1.3213}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 8, "vulncheck": 5, "blocklist_de": 3}, "lo": 2.530, "se": 0.457, "ts": 0.500, "map": 4.459, "obs": 16, "own": 6.881, "comp": {"cins": -1.7278, "dshield": -2.3592, "crowdsec": 4.8712, "vulncheck": 1.6053, "blocklist_de": 0.4991}, "mass": 11.3, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"c2": 1, "compromised": 18}, "vulncheck": {"c2_server": 2, "botnet_node": 2, "attack_tooling": 1}, "blocklist_de": {"sip": 1, "ssh": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NRRL1-RIPE", "org": "\"Domain names registrar REG.RU\", Ltd", "pdb": null, "pfx": 464, "reg": "2011-03-28", "rir": "ripencc", "s24": 456, "sib": 5, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8435]], "ipv4": 126464, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.00362373850685}, {"a": 197703, "h": "FIRST-SERVER-AE", "n": "IP MARKET - FZCO", "t": "Hosting & VPS", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.536, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IMF1-RIPE", "org": "IP MARKET - FZCO", "pdb": null, "pfx": 7, "reg": "2023-07-20", "rir": "ripencc", "s24": 12, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002206176789}, {"a": 197706, "h": "Keminet", "n": "Keminet", "t": "Transit & backbone", "w": 6, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 4, "bad_crawling": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2017-9841": 3, "cve:CVE-2018-13379": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2023-49103": 1, "cve:CVE-2026-60137": 1}, "n": 6}, "ev": {"crowdsec": {"n": 3, "p": 0.5814, "hi": 7.06, "lo": 1.24, "ips": 6, "mean": 3.64, "above": false}}, "h2": [["2026-10-05", 4.967, 0.011, 0, false], ["2026-10-12", 3.171, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 2.420, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.171, "se": 0.767, "ts": 1.000, "map": 9.813, "obs": 3, "own": 31.210, "comp": {"cins": -0.452, "dshield": -0.9162, "crowdsec": 7.9902, "vulncheck": -0.6363, "blocklist_de": -2.3083}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.688, "det": null, "oid": "ORG-KL65-RIPE", "org": "Keminet SHPK", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.keminet.net"}, "pfx": 33, "reg": "2011-04-01", "rir": "ripencc", "s24": 37, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00256323925648}, {"a": 197767, "h": "Zgocloud", "n": "Zgocloud", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "threatfox": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.999, 0, false], ["2026-10-12", 0.013, 1.030, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 1.030, "se": 1.880, "ts": 1.000, "map": 16.185, "obs": 1, "own": 11.843, "comp": {"urlhaus": -0.0112, "threatfox": 4.4516, "phishing_db": -0.0301}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.822, "det": {"shodan": {"c2": 1}, "threatfox": {"family:AdaptixC2": 2}}, "oid": "ORG-ZI111-RIPE", "org": "ZgoShop, Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.zgovps.com"}, "pfx": 1, "reg": "2023-07-17", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197769, "h": "VPSDEDICATED-AS", "n": "VPS Dedicated LLC", "t": "Hosting & VPS", "w": 102, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 17, "web_exploit": 45, "bad_crawling": 16, "proxy_or_vpn": 36, "first_seen_30d": 16, "ssh_bruteforce": 51, "web_bruteforce": 16, "mail_bruteforce": 4, "cve:CVE-2017-9841": 5, "cve:CVE-2017-16894": 4, "cve:CVE-2019-17050": 4, "cve:CVE-2021-41773": 3, "cve:CVE-2021-44228": 2}, "n": 68}, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "dshield": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "urlhaus": {"n": 5, "p": 0.9159, "hi": 10.51, "lo": 2.61, "ips": 9, "mean": 6.00, "above": true}, "crowdsec": {"n": 7, "p": 0.9867, "hi": 12.87, "lo": 3.90, "ips": 68, "mean": 7.83, "above": true}, "threatfox": {"n": 6, "p": 0.9663, "hi": 11.83, "lo": 3.28, "ips": 21, "mean": 6.99, "above": true}, "blocklist_de": {"n": 7, "p": 0.9875, "hi": 13.04, "lo": 3.95, "ips": 39, "mean": 7.93, "above": true}}, "h2": [["2026-10-05", 141.672, 406.030, 1, false], ["2026-10-12", 185.440, 350.625, 1, false]], "sh": true, "uc": 18066.4, "v2": {"band": 1, "host": {"n": {"urlhaus": 5, "threatfox": 6, "phishing_db": 0}, "lo": 350.625, "se": 0.716, "ts": 0.545, "map": 798.838, "obs": 11, "own": 241.168, "comp": {"urlhaus": 7.7936, "threatfox": 1.6318, "phishing_db": -1.116}, "mass": 7.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 7}, "lo": 185.440, "se": 0.432, "ts": 0.438, "map": 319.892, "obs": 16, "own": 62.055, "comp": {"cins": -1.9771, "dshield": 0.5254, "crowdsec": 0.6349, "vulncheck": -0.9372, "blocklist_de": 8.9155}, "mass": 14.0, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"malware": 2}, "threatfox": {"family:DCRat": 4, "family:CECbot": 3, "family:Tofsee": 5, "family:PureRAT": 3, "family:AsyncRAT": 3}, "blocklist_de": {"ftp": 1, "ssh": 33, "imap": 3, "mail": 3, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-VDL11-RIPE", "org": "VPS Dedicated LLC", "pdb": null, "pfx": 6, "reg": "2026-05-06", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 7, "drop": 4, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.8803]], "ipv4": 2048, "abuse": null, "score": 0.8803, "groups": ["sensors", "abusech"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00096192086216}, {"a": 197790, "h": "AS-ACTUS", "n": "Actus", "t": "Transit & backbone", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 2.648, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 2.098, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-AS688-RIPE", "org": "Actus P.S.A", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.actus-info.pl"}, "pfx": 11, "reg": "2011-05-04", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 197846, "h": "SAOCOMP-AS", "n": "Radovan Ochvat trading as SAO Computers", "t": "Other", "w": 8, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 5, "p": 0.9108, "hi": 10.34, "lo": 2.57, "ips": 8, "mean": 5.90, "above": true}}, "h2": [["2026-10-05", 2.765, 0.011, 0, false], ["2026-10-12", 22.299, 0.012, 1, false]], "sh": false, "uc": 4809.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 5}, "lo": 22.299, "se": 0.623, "ts": 1.000, "map": 53.007, "obs": 5, "own": 29.862, "comp": {"cins": -0.9302, "dshield": -1.5957, "crowdsec": -6.2442, "vulncheck": -0.8095, "blocklist_de": 14.9436}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.171, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 8, "mail": 8}}, "oid": "ORG-ROTA2-RIPE", "org": "Radovan Ochvat trading as SAO Computers", "pdb": null, "pfx": 2, "reg": "2011-05-26", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.0000831033998}, {"a": 197860, "h": "NET-HARUKA", "n": "Haruka Network", "t": "Enterprise, edu & gov", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.463, "det": null, "oid": "ORG-HN91-RIPE", "org": "Haruka Network Limited", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://net-haruka.com/"}, "pfx": 4, "reg": "2023-07-07", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00167904263599}, {"a": 197897, "h": "PETKOM", "n": "5KOM OOD", "t": "Other", "w": 11, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 9, "p": 0.9986, "hi": 15.15, "lo": 5.23, "ips": 11, "mean": 9.65, "above": true}}, "h2": [["2026-10-05", 1.775, 0.011, 0, false], ["2026-10-12", 3.731, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.188, "obs": 0, "own": 0.596, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 9, "blocklist_de": 0}, "lo": 3.731, "se": 0.547, "ts": 1.000, "map": 7.502, "obs": 9, "own": 4.361, "comp": {"cins": -0.6256, "dshield": -1.1895, "crowdsec": -4.6713, "vulncheck": 13.0553, "blocklist_de": -3.1602}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.176, "det": {"vulncheck": {"botnet_node": 11}}, "oid": "ORG-OA407-RIPE", "org": "5KOM OOD", "pdb": null, "pfx": 69, "reg": "2011-06-15", "rir": "ripencc", "s24": 70, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 17920, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00065084539104}, {"a": 197902, "h": "HOSTNET", "n": "Hostnet", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1608, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.257, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.254, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.096, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.907, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HB6-RIPE", "org": "Hostnet B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "No", "web": "https://hostnet.nl"}, "pfx": 7, "reg": "2011-06-20", "rir": "ripencc", "s24": 44, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000141240532}, {"a": 197922, "h": "TECHCREA-SOLUTIONS", "n": "Techcrea Solutions", "t": "Transit & backbone", "w": 4, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "first_seen_30d": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "phishing_db": {"n": 3, "p": 0.6302, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 0.233, 4.592, 0, false], ["2026-10-12", 0.247, 4.644, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 4.644, "se": 1.001, "ts": 1.000, "map": 16.270, "obs": 3, "own": 54.695, "comp": {"urlhaus": -0.4973, "threatfox": -0.361, "phishing_db": 5.2738}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.247, "se": 1.259, "ts": 1.000, "map": 1.939, "obs": 1, "own": 6.917, "comp": {"cins": -0.1354, "dshield": -0.3119, "crowdsec": 3.5308, "vulncheck": -0.3225, "blocklist_de": -0.7054}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.710, "det": null, "oid": "ORG-TSS26-RIPE", "org": "Techcrea Solutions SAS", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.techcrea.fr"}, "pfx": 30, "reg": "2011-06-27", "rir": "ripencc", "s24": 52, "sib": 1, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021764924324}, {"a": 197937, "h": "HiData", "n": "Mizban Dadeh Roham Co", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.979, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MDRC1-RIPE", "org": "Mizban Dadeh Roham Co", "pdb": null, "pfx": 2, "reg": "2023-07-04", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000301310934}, {"a": 198037, "h": "SPACECORE", "n": "SPACECORE SOLUTION LTD", "t": "Transit & backbone", "w": 2, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.4111, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.396, 0.011, 0, false], ["2026-10-12", 2.939, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 2.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.939, "se": 0.983, "ts": 1.000, "map": 13.677, "obs": 2, "own": 44.891, "comp": {"cins": -0.3004, "dshield": -0.646, "crowdsec": -2.5492, "vulncheck": -0.5258, "blocklist_de": 8.0308}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.597, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-SA5057-RIPE", "org": "SPACECORE SOLUTION LTD", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Selective", "web": "https://spacecore.pro/en"}, "pfx": 16, "reg": "2023-06-23", "rir": "ripencc", "s24": 17, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00037910977}, {"a": 198068, "h": "PAGM-AS", "n": "CLOUD.DOG OU", "t": "Hosting & VPS", "w": 3, "cc": "EE", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.8420, "hi": 8.72, "lo": 2.17, "ips": 5, "mean": 4.98, "above": true}, "crowdsec": {"n": 2, "p": 0.2745, "hi": 5.02, "lo": 0.65, "ips": 2, "mean": 2.39, "above": false}, "phishing_db": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.3577, "hi": 5.71, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}}, "h2": [["2026-10-05", 0.637, 0.296, 0, false], ["2026-10-12", 2.524, 0.310, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.310, "se": 1.465, "ts": 1.000, "map": 2.645, "obs": 1, "own": 1.189, "comp": {"urlhaus": -0.1673, "threatfox": -0.1883, "phishing_db": 2.9544}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.524, "se": 0.666, "ts": 0.500, "map": 6.481, "obs": 4, "own": 1.285, "comp": {"cins": -0.7224, "dshield": -1.3279, "crowdsec": 1.3074, "vulncheck": -0.7537, "blocklist_de": 4.7591}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.773, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-PO61-RIPE", "org": "CLOUD.DOG OU", "pdb": null, "pfx": 104, "reg": "2011-09-22", "rir": "ripencc", "s24": 96, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 48896, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00089241324473}, {"a": 198071, "h": "BERCHSOLUTIONS-AS", "n": "Berch Solutions", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.364, "det": null, "oid": "ORG-BSL52-RIPE", "org": "Berch Solutions Limited", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://berch.co.uk"}, "pfx": 2, "reg": "2023-06-20", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198072, "h": "PL-FREENET", "n": "GTnet", "t": "Other", "w": 7, "cc": "PL", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 5, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 40.696, 0.011, 1, false], ["2026-10-12", 23.779, 0.013, 1, false]], "sh": false, "uc": 21093.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 23.779, "se": 0.828, "ts": 0.667, "map": 82.907, "obs": 3, "own": 47.633, "comp": {"cins": -0.4165, "dshield": -0.8557, "crowdsec": 0.5847, "vulncheck": -0.6145, "blocklist_de": 7.1134}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.275, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "ORG-GSZO51-RIPE", "org": "GTnet Sp. z o.o.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.gtnet.com.pl"}, "pfx": 1, "reg": "2011-09-23", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198093, "h": "DFRI-AS", "n": "DFRI", "t": "Hosting & VPS", "w": 20, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 20, "data_centre": 18, "web_exploit": 20, "bad_crawling": 20, "proxy_or_vpn": 20, "ssh_bruteforce": 1, "web_bruteforce": 20, "mail_bruteforce": 11, "cve:CVE-2014-8739": 4, "cve:CVE-2015-9406": 5, "cve:CVE-2017-9841": 14, "cve:CVE-2018-13379": 7, "cve:CVE-2018-20062": 9}, "n": 20}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 20, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 15.611, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.670, "det": {"blocklist_de": {"apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-DFRI1-RIPE", "org": "Foreningen for digitala fri- och rattigheter", "pdb": {"t": "Non-Profit", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://dfri.net/"}, "pfx": 2, "reg": "2011-09-28", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 20, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198133, "h": "AIR-NET-AS", "n": "AIRNET MARIUSZ KAJDAS, TOMASZ PYREK sp.j.", "t": "Other", "w": 2, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 4.579, 0.011, 0, false], ["2026-10-12", 5.141, 0.012, 0, false]], "sh": false, "uc": 7031.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.141, "se": 1.021, "ts": 1.000, "map": 25.709, "obs": 2, "own": 15.299, "comp": {"cins": -0.2678, "dshield": -0.5836, "crowdsec": -2.3041, "vulncheck": -0.4946, "blocklist_de": 8.2907}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.189, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-PAMT1-RIPE", "org": "AIRNET MARIUSZ KAJDAS, TOMASZ PYREK sp.j.", "pdb": null, "pfx": 1, "reg": "2011-10-10", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003527313309}, {"a": 198151, "h": "NCORE-AS", "n": "NCORE Sp. z o.o.", "t": "Broadband & mobile", "w": 1, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.670, 0.012, 0, false]], "sh": false, "uc": 2490.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 14.852, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-NS610-RIPE", "org": "NETON Sp. z o.o.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.ncore.pl"}, "pfx": 1, "reg": "2011-10-18", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198178, "h": "INC-PARTNERS-365", "n": "365.partners INC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.563, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IA2000-RIPE", "org": "365.partners INC", "pdb": null, "pfx": 14, "reg": "2023-06-09", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001527743983}, {"a": 198189, "h": "STEALTHVM", "n": "STEALTHVM", "t": "Other", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 11.544, 0.911, 1, false], ["2026-10-12", 28.770, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 28.770, "se": 0.834, "ts": 0.333, "map": 100.972, "obs": 3, "own": 58.067, "comp": {"cins": 4.4011, "dshield": 3.2713, "crowdsec": 0.8954, "vulncheck": -0.5923, "blocklist_de": -1.967}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.825, "det": null, "oid": "ORG-TL966-RIPE", "org": "Throttle Limited", "pdb": null, "pfx": 3, "reg": "2026-04-29", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003801728328}, {"a": 198218, "h": "HTS-MOOSBURG", "n": "Horizon Teleports GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1561, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 0.644, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.188, "obs": 0, "own": 0.258, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.360, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HTG4-RIPE", "org": "Horizon Teleports GmbH", "pdb": null, "pfx": 8, "reg": "2011-11-16", "rir": "ripencc", "s24": 50, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198263, "h": "K2MEDIA-AS", "n": "K2 Media", "t": "Broadband & mobile", "w": 3, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 6.428, 0.011, 0, false], ["2026-10-12", 7.159, 0.013, 0, false]], "sh": false, "uc": 7656.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.159, "se": 1.047, "ts": 1.000, "map": 37.924, "obs": 2, "own": 61.988, "comp": {"cins": -0.2481, "dshield": -0.5449, "crowdsec": -2.1523, "vulncheck": -0.474, "blocklist_de": 8.4486}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.154, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-KMJK1-RIPE", "org": "K2 Media Janusz Kaczmarczyk", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.k2media.pl"}, "pfx": 2, "reg": "2011-11-29", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002880922707}, {"a": 198279, "h": "ATU-AL-AS", "n": "Albanian Telecommunications Union", "t": "Broadband & mobile", "w": 2, "cc": "AL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4004, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 7.228, 0.011, 0, false], ["2026-10-12", 3.150, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.150, "se": 0.985, "ts": 1.000, "map": 14.721, "obs": 2, "own": 23.734, "comp": {"cins": -0.2502, "dshield": -0.5492, "crowdsec": 6.6527, "vulncheck": -0.4764, "blocklist_de": -1.294}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-ATUS1-RIPE", "org": "Albanian Telecommunications Union SH. P.K.", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.atu.al"}, "pfx": 12, "reg": "2011-12-01", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081464320626}, {"a": 198282, "h": "cablenet", "n": "cablenet", "t": "Broadband & mobile", "w": 2, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.539, 0.887, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.887, "se": 1.784, "ts": 1.000, "map": 12.743, "obs": 1, "own": 50.146, "comp": {"urlhaus": 4.4321, "threatfox": -0.0933, "phishing_db": -0.1677}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.539, "se": 1.418, "ts": 1.000, "map": 5.493, "obs": 1, "own": 10.853, "comp": {"cins": -0.06, "dshield": -0.143, "crowdsec": -0.5667, "vulncheck": 4.1812, "blocklist_de": -0.3143}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.130, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": "2011-12-01", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006423312005}, {"a": 198357, "h": "Padidar", "n": "Padidar Technology PJSC", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2253.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.702, "det": null, "oid": "ORG-PTC8-RIPE", "org": "Padidar Technology PJSC", "pdb": null, "pfx": 13, "reg": "2012-07-27", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002285408115}, {"a": 198364, "h": "BANATSYNC-SRL", "n": "BANATSYNC SRL", "t": "Other", "w": 214, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 8, "web_exploit": 7, "bad_crawling": 1, "first_seen_30d": 97, "ssh_bruteforce": 197, "web_bruteforce": 4, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2023-1389": 1, "cve:CVE-2024-6387": 133, "cve:CVE-2018-20062": 1}, "n": 197}, "ev": {"cins": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}, "dshield": {"n": 2, "p": 0.4210, "hi": 6.28, "lo": 0.82, "ips": 102, "mean": 2.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 197, "mean": 2.95, "above": false}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 171, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 73.912, 0.011, 1, false], ["2026-10-12", 80.154, 0.756, 1, false]], "sh": false, "uc": 13476.6, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.756, "se": 1.699, "ts": 1.000, "map": 10.084, "obs": 1, "own": 13.698, "comp": {"urlhaus": -0.0415, "threatfox": 4.084, "phishing_db": -0.1054}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 80.154, "se": 0.550, "ts": 0.286, "map": 166.707, "obs": 7, "own": 93.553, "comp": {"cins": 2.938, "dshield": 3.6395, "crowdsec": -1.5113, "vulncheck": -0.8354, "blocklist_de": 2.2791}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.285, "det": {"threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"sip": 1, "ssh": 164, "apache": 6, "bruteforcelogin": 6}}, "oid": "ORG-BS676-RIPE", "org": "BANATSYNC SRL", "pdb": null, "pfx": 6, "reg": "2026-04-29", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007616974998}, {"a": 198367, "h": "ASINKOTEL", "n": "ASINKOTEL", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 3, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 16.893, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 16.893, "se": 0.834, "ts": 0.333, "map": 58.531, "obs": 3, "own": 93.717, "comp": {"cins": -0.3023, "dshield": 3.6362, "crowdsec": 1.6976, "vulncheck": 1.9902, "blocklist_de": -1.5584}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.526, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-INKO2-RIPE", "org": "INKO-Telecom, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://playtelecom.ru"}, "pfx": 1, "reg": "2011-12-27", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198371, "h": "NINET", "n": "NINET", "t": "Other", "w": 1, "cc": "RS", "cf": null, "cs": {"c": {"data_centre": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 0.449, 0.012, 0, false]], "sh": false, "uc": 1355.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.449, "se": 1.366, "ts": 1.000, "map": 4.316, "obs": 1, "own": 2.917, "comp": {"cins": -0.0994, "dshield": -0.2325, "crowdsec": 3.9635, "vulncheck": -0.2568, "blocklist_de": -0.5188}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.180, "det": null, "oid": "ORG-NC27-RIPE", "org": "NINET Company Nis d.o.o.", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.ninet.rs"}, "pfx": 17, "reg": "2011-12-28", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013176085725}, {"a": 198483, "h": "CLOUDTEK-KZ-AS", "n": "CloudTek TOO", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.988, "det": {"shodan": {"c2": 1, "compromised": 2}}, "oid": "ORG-CT181-RIPE", "org": "CloudTek TOO", "pdb": null, "pfx": 1, "reg": "2023-05-23", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000621952562}, {"a": 198550, "h": "nodehost-as", "n": "NODE HOST", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1689, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "dshield": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1622, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "threatfox": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.518, 0.449, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.449, "se": 1.538, "ts": 1.000, "map": 4.495, "obs": 1, "own": 2.061, "comp": {"urlhaus": -0.1029, "threatfox": 3.4674, "phishing_db": -0.2353}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.518, "se": 0.941, "ts": 0.500, "map": 6.526, "obs": 2, "own": 1.333, "comp": {"cins": -0.2876, "dshield": 3.7052, "crowdsec": 1.8495, "vulncheck": -0.5139, "blocklist_de": -1.4836}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.636, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}}, "oid": "ORG-NHL36-RIPE", "org": "NODE HOST LIMITED", "pdb": null, "pfx": 33, "reg": "2026-04-22", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00058531531204}, {"a": 198584, "h": "PIO-Hosting", "n": "PIO-Hosting GmbH", "t": "Hosting & VPS", "w": 5, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 1, "mail_bruteforce": 2, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.3751, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "vulncheck": {"n": 2, "p": 0.4134, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.386, 0.011, 0, false], ["2026-10-12", 7.064, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 7.064, "se": 0.640, "ts": 0.400, "map": 17.178, "obs": 5, "own": 3.437, "comp": {"cins": -0.5798, "dshield": 2.478, "crowdsec": 2.7223, "vulncheck": 2.5541, "blocklist_de": -2.9373}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.922, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-PG281-RIPE", "org": "PIO-Hosting GmbH", "pdb": null, "pfx": 27, "reg": "2023-05-11", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198610, "h": "BEGET-AS", "n": "BeGet", "t": "Enterprise, edu & gov", "w": 19, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 4, "web_exploit": 6, "bad_crawling": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 5, "mail_bruteforce": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 9}, "ev": {"shodan": {"n": 137, "p": 1.0000, "hi": 80.23, "lo": 60.61, "ips": 137, "mean": 70.13, "above": true}, "crowdsec": {"n": 7, "p": 0.6563, "hi": 5.97, "lo": 1.81, "ips": 9, "mean": 3.63, "above": false}, "threatfox": {"n": 1, "p": 0.1701, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "vulncheck": {"n": 5, "p": 0.8282, "hi": 8.49, "lo": 2.11, "ips": 5, "mean": 4.85, "above": true}, "phishing_db": {"n": 2, "p": 0.2916, "hi": 5.15, "lo": 0.67, "ips": 2, "mean": 2.46, "above": false}, "blocklist_de": {"n": 3, "p": 0.3497, "hi": 5.22, "lo": 0.92, "ips": 5, "mean": 2.69, "above": false}}, "h2": [["2026-10-05", 1.621, 1.177, 0, false], ["2026-10-12", 2.376, 0.823, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 0.823, "se": 1.022, "ts": 0.667, "map": 2.751, "obs": 3, "own": 12.198, "comp": {"urlhaus": -0.6826, "threatfox": 0.9918, "phishing_db": 2.3288}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 5, "blocklist_de": 3}, "lo": 2.376, "se": 0.465, "ts": 0.467, "map": 4.183, "obs": 15, "own": 23.474, "comp": {"cins": -1.6538, "dshield": -2.3017, "crowdsec": 3.916, "vulncheck": 1.7768, "blocklist_de": 1.0875}, "mass": 10.5, "listed": false}}, "abq": false, "bot": 0.941, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 135}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 5}, "blocklist_de": {"ssh": 2, "apache": 3, "bruteforcelogin": 3}}, "oid": "ORG-BL131-RIPE", "org": "Beget LLC", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://beget.com"}, "pfx": 538, "reg": "2012-06-25", "rir": "ripencc", "s24": 453, "sib": 1, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8435]], "ipv4": 230656, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.00300221238625}, {"a": 198651, "h": "HOSTLINE", "n": "HOSTLINE", "t": "Hosting & VPS", "w": 4, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4141, "hi": 6.21, "lo": 0.81, "ips": 3, "mean": 2.96, "above": false}, "phishing_db": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.315, 0.492, 0, false], ["2026-10-12", 1.200, 0.513, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.513, "se": 1.567, "ts": 1.000, "map": 5.480, "obs": 1, "own": 2.529, "comp": {"urlhaus": -0.0961, "threatfox": -0.1227, "phishing_db": 3.5461}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.200, "se": 0.959, "ts": 1.000, "map": 5.114, "obs": 2, "own": 1.100, "comp": {"cins": -0.1769, "dshield": -0.4003, "crowdsec": -1.583, "vulncheck": 6.1047, "blocklist_de": -0.9189}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.837, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-HU13-RIPE", "org": "HOSTLINE, UAB", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://hostline.io/"}, "pfx": 25, "reg": "2012-04-03", "rir": "ripencc", "s24": 26, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027572778508}, {"a": 198710, "h": "UUU-TELECOM-AS", "n": "3U TELECOM GmbH", "t": "Broadband & mobile", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 1.077, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.467, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TG99-RIPE", "org": "3U TELECOM GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.3utelecom.de"}, "pfx": 13, "reg": "2012-04-18", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198785, "h": "SEDMIODJEL-AS", "n": "Sedmi Odjel d.o.o.", "t": "Transit & backbone", "w": 0, "cc": "HR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1747, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 2.572, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.968, "ts": null, "map": 0.209, "obs": 0, "own": 1.947, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.777, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SOD3-RIPE", "org": "Sedmi Odjel d.o.o.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.sedmiodjel.com"}, "pfx": 8, "reg": "2012-05-15", "rir": "ripencc", "s24": 27, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002366221585}, {"a": 198798, "h": "OFLI-AS", "n": "OFFICE LIMITED", "t": "Other", "w": 103, "cc": "GB", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 103, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.368, 0.011, 0, false], ["2026-10-12", 0.416, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.416, "se": 1.350, "ts": 1.000, "map": 3.858, "obs": 1, "own": 2.593, "comp": {"cins": -0.1145, "dshield": -0.2663, "crowdsec": -1.0543, "vulncheck": -0.2858, "blocklist_de": 4.4648}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.676, "det": {"blocklist_de": {"ssh": 103}}, "oid": "ORG-OL334-RIPE", "org": "OFFICE LIMITED", "pdb": null, "pfx": 11, "reg": "2026-04-17", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198825, "h": "VERYCLOUD-SAS", "n": "Mathys Dumonte", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.597, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VS388-RIPE", "org": "VERYCLOUD SAS", "pdb": {"t": null, "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://as198825.net"}, "pfx": 4, "reg": "2023-04-19", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001260132744}, {"a": 198831, "h": "HOLYCLOUD", "n": "Holycloud", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 72, "p": 1.0000, "hi": 84.53, "lo": 57.45, "ips": 72, "mean": 70.44, "above": true}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.941, "det": {"shodan": {"compromised": 72}}, "oid": "ORG-SG463-RIPE", "org": "GENIUSWEER SAS", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "100-200Gbps", "pol": "Selective", "web": "https://as198831.net"}, "pfx": 17, "reg": "2023-04-19", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0690]], "ipv4": 4352, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00015378593685}, {"a": 198866, "h": "CROSSNET-AS", "n": "Crossnet AB", "t": "Other", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.526, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CROS3-RIPE", "org": "Crossnet AB", "pdb": null, "pfx": 1, "reg": "2023-04-17", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198888, "h": "RNet-zg", "n": "Adam Wojewoda trading as RNet", "t": "Other", "w": 2, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.211, 0.012, 0, false], ["2026-10-12", 1.385, 0.013, 0, false]], "sh": false, "uc": 19921.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.385, "se": 1.717, "ts": 1.000, "map": 22.773, "obs": 1, "own": 21.732, "comp": {"cins": -0.0313, "dshield": -0.0755, "crowdsec": -0.2996, "vulncheck": -0.0965, "blocklist_de": 5.0223}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.146, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-RAW1-RIPE", "org": "Adam Wojewoda trading as RNet", "pdb": null, "pfx": 1, "reg": "2012-06-13", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198926, "h": "Fazed", "n": "Fazel Rezaei Kalantari", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.829, "det": null, "oid": "ORG-AA2876-RIPE", "org": "Fazel Rezaei Kalantari", "pdb": null, "pfx": 4, "reg": "2023-04-13", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198950, "h": "OAB-AF", "n": "Telenet Systems GmbH", "t": "Other", "w": 0, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.173, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-OAGU1-RIPE", "org": "Telenet Systems GmbH", "pdb": null, "pfx": 1, "reg": "2012-06-28", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005254929316}, {"a": 198953, "h": "proton66", "n": "Proton66 OOO", "t": "Other", "w": 11, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2024-6387": 2, "cve:CVE-2018-13379": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}, "threatfox": {"n": 3, "p": 0.6469, "hi": 7.75, "lo": 1.37, "ips": 4, "mean": 4.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4210, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 48.209, 73.250, 1, false], ["2026-10-12", 45.815, 71.872, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 1}, "lo": 71.872, "se": 0.903, "ts": 0.750, "map": 225.822, "obs": 4, "own": 192.430, "comp": {"urlhaus": -0.4109, "threatfox": 5.8422, "phishing_db": 1.6146}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 45.815, "se": 0.729, "ts": 0.500, "map": 131.258, "obs": 4, "own": 75.597, "comp": {"cins": -0.4861, "dshield": -0.9726, "crowdsec": -0.0449, "vulncheck": 1.2043, "blocklist_de": 6.5701}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.886, "det": {"threatfox": {"family:DCRat": 1, "family:PoshC2": 2, "family:Eye Pyramid": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ftp": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PO84-RIPE", "org": "Proton66 OOO", "pdb": null, "pfx": 3, "reg": "2023-04-06", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 3, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198967, "h": "BITel-Gesellschaft-fuer-Telekommunikation-AS", "n": "BITel", "t": "Broadband & mobile", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0692, "hi": 3.27, "lo": 0.25, "ips": 1, "mean": 1.38, "above": false}, "blocklist_de": {"n": 2, "p": 0.3129, "hi": 5.33, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}}, "h2": [["2026-10-05", 0.901, 0.010, 0, false], ["2026-10-12", 0.906, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.965, "ts": null, "map": 0.175, "obs": 0, "own": 1.141, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.906, "se": 0.742, "ts": 0.667, "map": 2.663, "obs": 3, "own": 4.178, "comp": {"cins": -0.5921, "dshield": -1.1394, "crowdsec": -0.941, "vulncheck": -0.7058, "blocklist_de": 5.7515}, "mass": 2.8, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-BGFT1-RIPE", "org": "BITel Gesellschaft fuer Telekommunikation mbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://bitel.de/"}, "pfx": 60, "reg": "2012-07-04", "rir": "ripencc", "s24": 169, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00187794380955}, {"a": 198981, "h": "NETSHIELD-BYOIP", "n": "netshield :-)", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-NL628-RIPE", "org": "NETSHIELD LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://netshield.ltd"}, "pfx": 1, "reg": "2023-04-06", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 198983, "h": "TornadoDatacenter", "n": "TornadoDatacenter", "t": "Hosting & VPS", "w": 4, "cc": "DE", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 1, "ssh_bruteforce": 1, "cve:CVE-2022-39290": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 2, "p": 0.3817, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}, "phishing_db": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 1.975, 0.528, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.528, "se": 1.574, "ts": 1.000, "map": 5.708, "obs": 1, "own": 2.644, "comp": {"urlhaus": -0.0925, "threatfox": -0.119, "phishing_db": 3.5795}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.975, "se": 0.956, "ts": 1.000, "map": 8.756, "obs": 2, "own": 1.792, "comp": {"cins": -0.2733, "dshield": -0.5942, "crowdsec": 6.3421, "vulncheck": -0.5001, "blocklist_de": -1.4111}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.823, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TDGC3-RIPE", "org": "Joseph Hofmann trading as 'Tornado Datacenter GmbH & Co. KG'", "pdb": null, "pfx": 18, "reg": "2023-04-06", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00067106234988}, {"a": 198985, "h": "AQUILENET", "n": "Aquilenet", "t": "Enterprise, edu & gov", "w": 2, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-43798": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 4.406, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 3.793, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 4.406, "se": 1.027, "ts": 0.500, "map": 21.861, "obs": 2, "own": 133.076, "comp": {"cins": -0.1746, "dshield": -0.3955, "crowdsec": 3.0763, "vulncheck": 2.8792, "blocklist_de": -0.9071}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.787, "det": {"vulncheck": {"c2_server": 1}}, "oid": "ORG-AA1915-RIPE", "org": "AQUILENET", "pdb": {"t": "Non-Profit", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.aquilenet.fr"}, "pfx": 2, "reg": "2012-07-06", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199051, "h": "SCWLAN", "n": "ELIT M d.o.o.", "t": "Other", "w": 0, "cc": "BA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 19384.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.298, "det": null, "oid": "ORG-DMB1-RIPE", "org": "D.O.O. \"Elit M\" Biljeljina", "pdb": null, "pfx": 8, "reg": "2012-07-27", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001363354278}, {"a": 199081, "h": "LANCOM", "n": "Lancom", "t": "Transit & backbone", "w": 0, "cc": "GR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1464, "hi": 4.18, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 2.156, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.864, "ts": null, "map": 0.178, "obs": 0, "own": 1.268, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LL67-RIPE", "org": "Lancom Ltd.", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.lancom.gr"}, "pfx": 67, "reg": "2012-08-07", "rir": "ripencc", "s24": 63, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 28928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.003264574806}, {"a": 199099, "h": "ERLION", "n": "ERLION BILISIM LIMITED SIRKETI", "t": "Other", "w": 40, "cc": "TR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 40, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.565, "det": {"vulncheck": {"c2_server": 40}}, "oid": "ORG-EBLS3-RIPE", "org": "ERLION BILISIM LIMITED SIRKETI", "pdb": null, "pfx": 2, "reg": "2026-04-13", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199128, "h": "PETNET-ASN", "n": "PET NET DOO Gevgelija", "t": "Other", "w": 4, "cc": "MK", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1983, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 3, "p": 0.6398, "hi": 7.67, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}}, "h2": [["2026-10-12", 2.862, 0.720, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.720, "se": 1.688, "ts": 1.000, "map": 9.221, "obs": 1, "own": 12.673, "comp": {"urlhaus": 4.2866, "threatfox": -0.1553, "phishing_db": -0.2837}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 2.862, "se": 0.804, "ts": 1.000, "map": 9.115, "obs": 3, "own": 5.491, "comp": {"cins": -0.2503, "dshield": -0.5493, "crowdsec": -2.1694, "vulncheck": 7.8667, "blocklist_de": -1.2942}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.260, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-PNDG1-RIPE", "org": "PET NET DOO Gevgelija", "pdb": null, "pfx": 11, "reg": "2012-08-20", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001295004999}, {"a": 199144, "h": "HEXCORECLOUD-AS", "n": "HexCore cloud s.r.o.", "t": "Hosting & VPS", "w": 0, "cc": "SK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.196, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.859, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HCS19-RIPE", "org": "HexCore cloud s.r.o.", "pdb": null, "pfx": 8, "reg": "2026-04-10", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036363134717}, {"a": 199152, "h": "VDC-USA", "n": "Virtual Data Center Inc", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.733, 0, false], ["2026-10-12", 0.012, 0.756, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.756, "se": 1.699, "ts": 1.000, "map": 10.084, "obs": 1, "own": 5.250, "comp": {"urlhaus": -0.0415, "threatfox": 4.084, "phishing_db": -0.1054}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.615, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Unknown malware": 1}}, "oid": "ORG-VDCI2-RIPE", "org": "Virtual Data Center Inc", "pdb": null, "pfx": 6, "reg": "2023-03-27", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009111245149}, {"a": 199218, "h": "ProtonVPN-2", "n": "Proton AG", "t": "Hosting & VPS", "w": 5, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4073, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.032, 0.011, 0, false], ["2026-10-12", 11.259, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 11.259, "se": 0.803, "ts": 0.667, "map": 37.426, "obs": 3, "own": 7.478, "comp": {"cins": -0.4224, "dshield": -0.8659, "crowdsec": 4.4698, "vulncheck": -0.6183, "blocklist_de": 2.4529}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.149, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "ORG-PTA40-RIPE", "org": "Proton AG", "pdb": null, "pfx": 9, "reg": "2023-03-22", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.012253739895}, {"a": 199226, "h": "Cablemel-AS", "n": "Cablemel", "t": "Broadband & mobile", "w": 1, "cc": "ES", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": 842.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.192, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CS130-RIPE", "org": "Cablemel S.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.cablemel.es"}, "pfx": 2, "reg": "2012-09-24", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013720215172}, {"a": 199274, "h": "MNGTNET", "n": "Serveroid, LLC", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1624, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 0.256, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.194, "obs": 0, "own": 0.098, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.946, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MNL15-RIPE", "org": "Serveroid, LLC", "pdb": null, "pfx": 4, "reg": "2013-04-02", "rir": "ripencc", "s24": 42, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199276, "h": "ermal", "n": "Tele.co.Albania Sh.p.k", "t": "Broadband & mobile", "w": 1, "cc": "AL", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": 4520.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 15.216, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.309, "det": null, "oid": "ORG-TS146-RIPE", "org": "Tele.Co.Albania SHPK", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.teleco-albania.al/"}, "pfx": 7, "reg": "2013-04-02", "rir": "ripencc", "s24": 7, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00036030650949}, {"a": 199334, "h": "rigilweb", "n": "RIGIL WEB TECHNOLOGIES LIMITED", "t": "Other", "w": 0, "cc": "NZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.483, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RWTL1-RIPE", "org": "RIGIL WEB TECHNOLOGIES LIMITED", "pdb": null, "pfx": 2, "reg": "2023-03-17", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199360, "h": "tycloud", "n": "TY CLOUD SAS", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.331, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-TCS49-RIPE", "org": "TY CLOUD SAS", "pdb": null, "pfx": 1, "reg": "2023-03-17", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199404, "h": "WHG-IN", "n": "hosting.com BOM1", "t": "Hosting & VPS", "w": 13, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 3, "web_exploit": 10, "bad_crawling": 5, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 6, "web_bruteforce": 10, "home_connection": 6, "mail_bruteforce": 3, "cve:CVE-2026-8181": 6, "cve:CVE-2024-28000": 7, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 11}, "ev": {"cins": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 5, "p": 0.9033, "hi": 10.10, "lo": 2.51, "ips": 5, "mean": 5.77, "above": true}, "crowdsec": {"n": 5, "p": 0.9000, "hi": 10.01, "lo": 2.49, "ips": 11, "mean": 5.71, "above": true}, "vulncheck": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4096, "hi": 6.17, "lo": 0.80, "ips": 3, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 24.514, 0.011, 1, false], ["2026-10-12", 33.540, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 2}, "lo": 33.540, "se": 0.512, "ts": 0.556, "map": 65.925, "obs": 9, "own": 12.910, "comp": {"cins": 2.5207, "dshield": -1.9443, "crowdsec": 4.1979, "vulncheck": -0.0936, "blocklist_de": 0.9014}, "mass": 6.9, "listed": false}}, "abq": false, "bot": 0.880, "det": {"shodan": {"compromised": 5}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "http://hosting.com"}, "pfx": 19, "reg": "2023-03-16", "rir": "ripencc", "s24": 19, "sib": 11, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 4864, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.0007537463544}, {"a": 199415, "h": "YORKHOST", "n": "YORKHOST", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.943, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-YS73-RIPE", "org": "YORKHOST SAS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://yorkhost.fr"}, "pfx": 10, "reg": "2023-03-15", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021104460013}, {"a": 199420, "h": "FLYGROUP-AS", "n": "OOO Fly Engeneering Group", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.949, "det": null, "oid": "ORG-OFEG1-RIPE", "org": "OOO Fly Engeneering Group", "pdb": null, "pfx": 3, "reg": "2013-01-25", "rir": "ripencc", "s24": 44, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199453, "h": "NEONET", "n": "Oncu Bilgi Teknolojileri Iletisim Bilisim Hizmetleri Ltd. Sti.", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.349, "det": null, "oid": "ORG-OBTI2-RIPE", "org": "Oncu Bilgi Teknolojileri Iletisim Bilisim Hizmetleri Ltd. Sti.", "pdb": null, "pfx": 1, "reg": "2026-04-02", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199457, "h": "SolidCore", "n": "SolidCore Hosting LTD", "t": "Hosting & VPS", "w": 82, "cc": "VG", "cf": null, "cs": {"c": {"http_flood": 31, "web_exploit": 14, "bad_crawling": 6, "first_seen_30d": 19, "ssh_bruteforce": 20, "web_bruteforce": 24, "mail_bruteforce": 13, "cve:CVE-2017-9841": 1, "cve:CVE-2019-8318": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2025-22457": 3}, "n": 40}, "ev": {"cins": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 33, "mean": 2.99, "above": false}, "dshield": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 7, "mean": 3.99, "above": false}, "crowdsec": {"n": 4, "p": 0.8099, "hi": 9.06, "lo": 1.95, "ips": 40, "mean": 4.95, "above": true}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 15, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 21.661, 0.011, 1, false], ["2026-10-12", 253.385, 0.827, 1, false]], "sh": true, "uc": 129687.5, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.827, "se": 1.740, "ts": 1.000, "map": 11.627, "obs": 1, "own": 6.413, "comp": {"urlhaus": -0.032, "threatfox": 4.1941, "phishing_db": -0.0826}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 3, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 253.385, "se": 0.464, "ts": 0.333, "map": 460.643, "obs": 12, "own": 89.472, "comp": {"cins": 5.0391, "dshield": 3.4512, "crowdsec": -1.3754, "vulncheck": -0.9095, "blocklist_de": 1.321}, "mass": 10.1, "listed": false}}, "abq": false, "bot": 0.995, "det": {"threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"ftp": 8, "sip": 1, "ssh": 2, "imap": 2, "mail": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SHL83-RIPE", "org": "SolidCore Hosting LTD", "pdb": null, "pfx": 4, "reg": "2026-04-02", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.000589864545}, {"a": 199524, "h": "GCORE", "n": "Gcore", "t": "Hosting & VPS", "w": 8, "cc": "LU", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.64}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "web_bruteforce": 2, "cve:CVE-2021-41773": 2, "cve:CVE-2025-30208": 2, "cve:CVE-2025-32355": 1, "cve:CVE-2025-32395": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.0165, "hi": 2.35, "lo": 0.18, "ips": 1, "mean": 0.99, "above": false}, "crowdsec": {"n": 2, "p": 0.0343, "hi": 2.78, "lo": 0.36, "ips": 3, "mean": 1.32, "above": false}, "vulncheck": {"n": 3, "p": 0.4836, "hi": 6.20, "lo": 1.09, "ips": 3, "mean": 3.20, "above": false}, "phishing_db": {"n": 2, "p": 0.2856, "hi": 5.11, "lo": 0.66, "ips": 2, "mean": 2.43, "above": false}}, "h2": [["2026-10-05", 0.683, 0.775, 0, false], ["2026-10-12", 0.454, 0.450, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.450, "se": 1.135, "ts": 1.000, "map": 1.874, "obs": 2, "own": 0.791, "comp": {"urlhaus": -0.5208, "threatfox": -0.3687, "phishing_db": 3.1436}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.454, "se": 0.632, "ts": 0.600, "map": 1.074, "obs": 5, "own": 0.218, "comp": {"cins": -0.6124, "dshield": -1.1699, "crowdsec": 2.3857, "vulncheck": 3.958, "blocklist_de": -3.0962}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.746, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"botnet_node": 1, "other_infrastructure": 2}}, "oid": "ORG-WIG6-RIPE", "org": "G-Core Labs S.A.", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Tbps", "pol": "Selective", "web": "http://gcore.com/"}, "pfx": 452, "reg": "2012-12-10", "rir": "ripencc", "s24": 477, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 124160, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02954240074781}, {"a": 199525, "h": "netflet", "n": "Net-Flet d.o.o.", "t": "Other", "w": 3, "cc": "BA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 16.363, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.201, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-ND95-RIPE", "org": "Net-Flet d.o.o.", "pdb": null, "pfx": 1, "reg": "2023-03-09", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000408261852}, {"a": 199595, "h": "GTELCOM-AS", "n": "GTELCOM LLC", "t": "Other", "w": 0, "cc": "GE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.473, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GA1098-RIPE", "org": "GTELCOM LLC", "pdb": null, "pfx": 4, "reg": "2026-03-30", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000480871601}, {"a": 199634, "h": "ESKNET", "n": "Yedinaya Setevaya Kompaniya Ltd", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 0.484, 0.012, 0, false]], "sh": false, "uc": 3784.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.484, "se": 1.383, "ts": 1.000, "map": 4.801, "obs": 1, "own": 3.286, "comp": {"cins": -0.1039, "dshield": -0.2427, "crowdsec": -0.961, "vulncheck": -0.2657, "blocklist_de": 4.5357}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.448, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-YSKL1-RIPE", "org": "Yedinaya Setevaya Kompaniya Ltd", "pdb": null, "pfx": 3, "reg": "2012-11-01", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039904251695}, {"a": 199636, "h": "FREEBOXPRO", "n": "Free Pro SAS", "t": "Other", "w": 4, "cc": "FR", "cf": null, "cs": {"c": {"data_centre": 2, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 2, "p": 0.1791, "hi": 4.24, "lo": 0.55, "ips": 2, "mean": 2.02, "above": false}, "phishing_db": {"n": 1, "p": 0.1627, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "blocklist_de": {"n": 2, "p": 0.3054, "hi": 5.27, "lo": 0.68, "ips": 2, "mean": 2.51, "above": false}}, "h2": [["2026-10-12", 2.088, 0.232, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.232, "se": 1.426, "ts": 1.000, "map": 1.792, "obs": 1, "own": 2.118, "comp": {"urlhaus": -0.2118, "threatfox": -0.2219, "phishing_db": 2.6432}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.088, "se": 0.608, "ts": 0.400, "map": 4.839, "obs": 5, "own": 2.747, "comp": {"cins": 3.1534, "dshield": -1.6292, "crowdsec": -0.7412, "vulncheck": -0.8156, "blocklist_de": 3.0031}, "mass": 4.9, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-JA30-RIPE", "org": "Free Pro SAS", "pdb": null, "pfx": 17, "reg": "2023-03-02", "rir": "ripencc", "s24": 182, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 46592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00738667154251}, {"a": 199653, "h": "ARUBAFR-AS", "n": "Aruba S.p.A.", "t": "Other", "w": 3, "cc": "IT", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6341, "hi": 7.61, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}}, "h2": [["2026-10-05", 0.010, 5.636, 0, false], ["2026-10-12", 0.010, 5.690, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 5.690, "se": 1.001, "ts": 1.000, "map": 20.121, "obs": 3, "own": 18.983, "comp": {"urlhaus": -0.4767, "threatfox": -0.3539, "phishing_db": 5.4585}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.891, "det": null, "oid": "ORG-TS9-RIPE", "org": "Aruba S.p.A.", "pdb": null, "pfx": 8, "reg": "2012-10-24", "rir": "ripencc", "s24": 40, "sib": 7, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199654, "h": "OXIDE-GROUP-LIMITED", "n": "Oxide Group Limited", "t": "Other", "w": 2, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.820, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.820, "se": 1.527, "ts": 1.000, "map": 10.128, "obs": 1, "own": 7.925, "comp": {"cins": -0.0417, "dshield": -0.1001, "crowdsec": -0.3969, "vulncheck": 4.4661, "blocklist_de": -0.2185}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.771, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-OGL12-RIPE", "org": "Oxide Group Limited", "pdb": null, "pfx": 3, "reg": "2023-03-01", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199668, "h": "Bureau1440-AS", "n": "Bureau 1440 LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-BL598-RIPE", "org": "Bureau 1440 LLC", "pdb": null, "pfx": 6, "reg": "2026-03-27", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199699, "h": "GAMGROUP-ITALIA", "n": "GAMGROUP-IT", "t": "Hosting & VPS", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.560, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-GS449-RIPE", "org": "GAMGROUP SRL", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.gam-group.net/"}, "pfx": 1, "reg": "2023-02-24", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199724, "h": "TEKNODC", "n": "TeknoDC Bilisim Teknolojileri A.S.", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1765, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.740, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.212, "obs": 0, "own": 0.364, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.824, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TBTA9-RIPE", "org": "TeknoDC Bilisim Teknolojileri A.S.", "pdb": null, "pfx": 22, "reg": "2023-02-23", "rir": "ripencc", "s24": 25, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015430720295}, {"a": 199739, "h": "Earthlink-DMCC-IQ", "n": "Earthlink Telecommunications Equipment Trading & Services DMCC", "t": "Broadband & mobile", "w": 11, "cc": "AE", "cf": {"rb": "", "wb": "hi", "rep": 2.45, "waf": 1.29}, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1523, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "dshield": {"n": 6, "p": 0.9385, "hi": 10.30, "lo": 2.86, "ips": 6, "mean": 6.09, "above": true}, "blocklist_de": {"n": 3, "p": 0.4545, "hi": 5.97, "lo": 1.05, "ips": 4, "mean": 3.08, "above": false}}, "h2": [["2026-10-05", 0.624, 0.010, 0, false], ["2026-10-12", 3.400, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.936, "ts": null, "map": 0.167, "obs": 0, "own": 1.009, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 6, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.400, "se": 0.489, "ts": 0.600, "map": 6.387, "obs": 10, "own": 9.839, "comp": {"cins": 1.7898, "dshield": 9.4823, "crowdsec": -8.745, "vulncheck": -0.9059, "blocklist_de": 1.6268}, "mass": 9.8, "listed": false}}, "abq": false, "bot": 0.187, "det": {"blocklist_de": {"bots": 2, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-ETET1-RIPE", "org": "Earthlink Telecommunications Equipment Trading & Services DMCC", "pdb": null, "pfx": 144, "reg": "2023-02-23", "rir": "ripencc", "s24": 278, "sib": 3, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 120064, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.049591}, {"a": 199741, "h": "TRANSITX-BYOIP-Customers", "n": "TransitX-BYOIP", "t": "Other", "w": 274, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 150, "data_centre": 1, "web_exploit": 134, "bad_crawling": 76, "proxy_or_vpn": 7, "ssh_bruteforce": 4, "web_bruteforce": 236, "mail_bruteforce": 5, "cve:CVE-2017-9841": 82, "cve:CVE-2021-43798": 20, "cve:CVE-2022-35914": 50, "cve:CVE-2022-46604": 50, "cve:CVE-2024-28000": 16}, "n": 264}, "ev": {"shodan": {"n": 1, "p": 0.1004, "hi": 3.66, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "dshield": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 9, "p": 0.9905, "hi": 11.49, "lo": 3.97, "ips": 264, "mean": 7.32, "above": true}, "blocklist_de": {"n": 2, "p": 0.3314, "hi": 5.48, "lo": 0.71, "ips": 20, "mean": 2.61, "above": false}}, "h2": [["2026-10-05", 4.138, 0.010, 0, false], ["2026-10-12", 7.210, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.985, "ts": null, "map": 0.180, "obs": 0, "own": 0.500, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.210, "se": 0.465, "ts": 0.750, "map": 13.038, "obs": 12, "own": 7.329, "comp": {"cins": -1.6001, "dshield": -0.3197, "crowdsec": 8.3183, "vulncheck": -0.9072, "blocklist_de": -1.5297}, "mass": 9.9, "listed": false}}, "abq": false, "bot": 0.425, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 18, "apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-TA1974-RIPE", "org": "TransitX Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://transitx.net"}, "pfx": 133, "reg": "2026-03-26", "rir": "ripencc", "s24": 138, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 35328, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00175285193905}, {"a": 199834, "h": "ipsolus", "n": "IP Solus Inc", "t": "Other", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.746, "det": null, "oid": "ORG-ISI18-RIPE", "org": "IP Solus Inc", "pdb": null, "pfx": 4, "reg": "2023-02-15", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199912, "h": "layer7-PAR1", "n": "Layer7 Networks GmbH", "t": "Other", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {"bad_crawling": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 14.416, 0.011, 1, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 6.211, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.928, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LNG5-RIPE", "org": "Layer7 Networks GmbH", "pdb": null, "pfx": 6, "reg": "2023-02-13", "rir": "ripencc", "s24": 6, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068417470342}, {"a": 199950, "h": "HJELM-ENTERPRISES-AB", "n": "HJELM ENTERPRISES", "t": "Enterprise, edu & gov", "w": 3, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 1, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2017-12149": 1, "cve:CVE-2018-11776": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 4.045, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 99.579, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.736, "det": null, "oid": "ORG-HEA56-RIPE", "org": "HJELM ENTERPRISES AB", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.hjelmenterprises.com/"}, "pfx": 3, "reg": "2023-02-09", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199959, "h": "CrownCloud", "n": "GWY IT PTY LTD", "t": "Hosting & VPS", "w": 11, "cc": "AU", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 1, "bad_crawling": 3, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 4}, "ev": {"shodan": {"n": 8, "p": 0.9873, "hi": 11.85, "lo": 3.86, "ips": 8, "mean": 7.39, "above": true}, "dshield": {"n": 1, "p": 0.1758, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 4, "p": 0.6653, "hi": 7.20, "lo": 1.55, "ips": 4, "mean": 3.93, "above": false}, "threatfox": {"n": 5, "p": 0.9113, "hi": 10.35, "lo": 2.57, "ips": 5, "mean": 5.91, "above": true}, "phishing_db": {"n": 1, "p": 0.1779, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.3539, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}}, "h2": [["2026-10-05", 2.903, 5.370, 0, false], ["2026-10-12", 5.192, 6.721, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 1}, "lo": 6.721, "se": 0.852, "ts": 0.833, "map": 17.209, "obs": 6, "own": 6.195, "comp": {"urlhaus": -0.8848, "threatfox": 5.0185, "phishing_db": 0.3379}, "mass": 2.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.192, "se": 0.541, "ts": 0.571, "map": 10.590, "obs": 7, "own": 2.082, "comp": {"cins": -1.121, "dshield": 0.7787, "crowdsec": 3.121, "vulncheck": -0.8465, "blocklist_de": 1.8214}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.634, "det": {"shodan": {"c2": 2, "compromised": 6}, "threatfox": {"family:pupy": 1, "family:PureRAT": 1, "family:Tsundere": 1, "family:AdaptixC2": 2}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-GIPL2-RIPE", "org": "GWY IT PTY LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://crowncloud.net"}, "pfx": 68, "reg": "2023-02-09", "rir": "ripencc", "s24": 102, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 26112, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.000001890251}, {"a": 199967, "h": "Think-Huge", "n": "Think-Huge", "t": "Enterprise, edu & gov", "w": 3, "cc": "HK", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.5968, "hi": 7.21, "lo": 1.27, "ips": 3, "mean": 3.72, "above": false}}, "h2": [["2026-10-05", 0.008, 1.960, 0, false], ["2026-10-12", 0.008, 1.989, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 1.989, "se": 1.007, "ts": 1.000, "map": 6.765, "obs": 3, "own": 28.265, "comp": {"urlhaus": -0.5912, "threatfox": -0.3898, "phishing_db": 4.519}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.747, "ts": null, "map": 0.135, "obs": 0, "own": 1.367, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.834, "det": null, "oid": "ORG-THL34-RIPE", "org": "Think Huge Ltd", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.thinkhuge.net"}, "pfx": 152, "reg": "2023-02-08", "rir": "ripencc", "s24": 154, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199968, "h": "IWSNET", "n": "IWS NETWORKS LLC", "t": "Other", "w": 0, "cc": "AM", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-INL21-RIPE", "org": "IWS NETWORKS LLC", "pdb": null, "pfx": 2, "reg": "2013-11-21", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 199980, "h": "IVENDO-AS", "n": "IVENDO sp. z o.o.", "t": "Other", "w": 2, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4033, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 2.009, 0.012, 0, false]], "sh": false, "uc": 865, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.009, "se": 0.959, "ts": 1.000, "map": 8.965, "obs": 2, "own": 5.282, "comp": {"cins": -0.3226, "dshield": -0.6876, "crowdsec": -2.7122, "vulncheck": -0.5452, "blocklist_de": 7.8545}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.166, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-ISZO106-RIPE", "org": "IVENDO sp. z o.o.", "pdb": null, "pfx": 11, "reg": "2013-11-15", "rir": "ripencc", "s24": 28, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200000, "h": "Ukraine-AS", "n": "Hosting Ukraine", "t": "Hosting & VPS", "w": 6, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 2, "cve:CVE-2026-4020": 1, "cve:CVE-2025-55182": 2, "cve:CVE-2026-60137": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "shodan": {"n": 16, "p": 1.0000, "hi": 18.37, "lo": 8.19, "ips": 16, "mean": 12.85, "above": true}, "crowdsec": {"n": 3, "p": 0.3947, "hi": 5.53, "lo": 0.98, "ips": 4, "mean": 2.85, "above": false}, "phishing_db": {"n": 1, "p": 0.1684, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 3.250, 0.242, 0, false], ["2026-10-12", 1.582, 0.254, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.254, "se": 1.437, "ts": 1.000, "map": 2.011, "obs": 1, "own": 0.908, "comp": {"urlhaus": -0.1981, "threatfox": -0.2121, "phishing_db": 2.7349}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.582, "se": 0.661, "ts": 0.750, "map": 4.031, "obs": 4, "own": 0.801, "comp": {"cins": 3.6941, "dshield": -1.3096, "crowdsec": 4.7171, "vulncheck": -0.7494, "blocklist_de": -3.5646}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.977, "det": {"shodan": {"compromised": 15, "doublepulsar": 1}}, "oid": "ORG-HUL6-RIPE", "org": "Hosting Ukraine LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.ukraine.com.ua"}, "pfx": 31, "reg": "2013-11-07", "rir": "ripencc", "s24": 151, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 38656, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00114779007228}, {"a": 200010, "h": "OLFE", "n": "Olfe Veri Merkezi - İzmir", "t": "Transit & backbone", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 5.100, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.581, "det": null, "oid": "ORG-OLFE2-RIPE", "org": "Olfe Veri Merkezi Anonim Sirketi", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "https://olfe.net.tr"}, "pfx": 2, "reg": "2023-02-06", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200019, "h": "AlexHost", "n": "AlexHost", "t": "Hosting & VPS", "w": 51, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 13, "web_exploit": 17, "bad_crawling": 6, "proxy_or_vpn": 6, "first_seen_30d": 3, "ssh_bruteforce": 4, "web_bruteforce": 13, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2021-43798": 2, "cve:CVE-2026-63030": 2}, "n": 19}, "ev": {"cins": {"n": 3, "p": 0.5968, "hi": 7.21, "lo": 1.27, "ips": 3, "mean": 3.72, "above": false}, "shodan": {"n": 5, "p": 0.7627, "hi": 7.62, "lo": 1.89, "ips": 5, "mean": 4.35, "above": false}, "crowdsec": {"n": 16, "p": 1.0000, "hi": 16.50, "lo": 7.35, "ips": 19, "mean": 11.54, "above": true}, "threatfox": {"n": 4, "p": 0.8013, "hi": 8.91, "lo": 1.92, "ips": 4, "mean": 4.87, "above": true}, "vulncheck": {"n": 3, "p": 0.5847, "hi": 7.09, "lo": 1.25, "ips": 3, "mean": 3.66, "above": false}, "phishing_db": {"n": 5, "p": 0.8875, "hi": 9.67, "lo": 2.40, "ips": 6, "mean": 5.52, "above": true}, "blocklist_de": {"n": 10, "p": 0.9988, "hi": 14.25, "lo": 5.18, "ips": 17, "mean": 9.24, "above": true}}, "h2": [["2026-10-05", 13.118, 9.478, 1, false], ["2026-10-12", 19.289, 6.923, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 5}, "lo": 6.923, "se": 0.806, "ts": 0.556, "map": 16.186, "obs": 9, "own": 5.798, "comp": {"urlhaus": -1.2345, "threatfox": 2.4405, "phishing_db": 3.2042}, "mass": 3.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 16, "vulncheck": 3, "blocklist_de": 10}, "lo": 19.289, "se": 0.396, "ts": 0.500, "map": 31.047, "obs": 32, "own": 6.049, "comp": {"cins": 2.9672, "dshield": -3.0108, "crowdsec": 1.4745, "vulncheck": -0.3849, "blocklist_de": 3.7832}, "mass": 30.4, "listed": false}}, "abq": false, "bot": 0.856, "det": {"shodan": {"c2": 2, "malware": 1, "compromised": 2}, "threatfox": {"family:Pink": 1, "family:AdaptixC2": 2, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1, "other_infrastructure": 1}, "blocklist_de": {"ftp": 17}}, "oid": "ORG-ALEX2-RIPE", "org": "ALEXHOST SRL", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://alexhost.com"}, "pfx": 136, "reg": "2013-10-30", "rir": "ripencc", "s24": 178, "sib": 0, "tor": 1, "w24": 36, "drop": 1, "hist": [["2026-10-05", 0.9970], ["2026-10-12", 0.9981]], "ipv4": 49152, "abuse": null, "score": 0.9981, "groups": ["sensors", "abusech", "phishing"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00579741297657}, {"a": 200051, "h": "VPSLab-Networks", "n": "RIZKI ABDUL AZIS", "t": "Hosting & VPS", "w": 9, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 2, "bad_crawling": 3, "first_seen_30d": 2}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}, "threatfox": {"n": 3, "p": 0.6468, "hi": 7.75, "lo": 1.37, "ips": 6, "mean": 4.00, "above": false}}, "h2": [["2026-10-05", 19.319, 30.512, 1, false], ["2026-10-12", 20.762, 30.070, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 30.070, "se": 1.018, "ts": 1.000, "map": 116.298, "obs": 3, "own": 39.400, "comp": {"urlhaus": -0.2939, "threatfox": 7.191, "phishing_db": -0.5148}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.762, "se": 0.821, "ts": 1.000, "map": 71.771, "obs": 3, "own": 14.330, "comp": {"cins": -0.3651, "dshield": -0.7653, "crowdsec": 9.2513, "vulncheck": -0.5789, "blocklist_de": -1.8748}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.946, "det": {"shodan": {"c2": 2}, "threatfox": {"family:DCRat": 1, "family:Remcos": 1, "family:PureRAT": 3, "family:Eye Pyramid": 1}}, "oid": "ORG-RA1245-RIPE", "org": "RIZKI ABDUL AZIS", "pdb": null, "pfx": 4, "reg": "2026-03-16", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000003824484}, {"a": 200056, "h": "INFRARINOX", "n": "INFRARINOX", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.751, "det": {"shodan": {"c2": 1}}, "oid": "ORG-IA2242-RIPE", "org": "INFRARINOX", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Restrictive", "web": "https://infrarinox.net"}, "pfx": 1, "reg": "2023-02-02", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200107, "h": "KL-EXT", "n": "Kaspersky Lab Switzerland GmbH", "t": "Hosting & VPS", "w": 5, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 4, "web_exploit": 5, "web_bruteforce": 1, "home_connection": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.3556, "hi": 5.69, "lo": 0.74, "ips": 5, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 1.256, 0.011, 0, false], ["2026-10-12", 1.330, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.259, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.330, "se": 0.934, "ts": 1.000, "map": 5.659, "obs": 2, "own": 1.155, "comp": {"cins": -0.2929, "dshield": -0.6319, "crowdsec": 6.0816, "vulncheck": -0.519, "blocklist_de": -1.5109}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.808, "det": null, "oid": "ORG-KLSG1-RIPE", "org": "Kaspersky Lab Switzerland GmbH", "pdb": null, "pfx": 41, "reg": "2013-10-08", "rir": "ripencc", "s24": 40, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003102162448}, {"a": 200132, "h": "NETONE-NL", "n": "NetOne NL", "t": "Transit & backbone", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 5.100, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.842, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-NA187-RIPE", "org": "Peter-Paul Maria Kurstjens", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://noc.netone.nl"}, "pfx": 2, "reg": "2023-01-26", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200185, "h": "XANDMAIL-ASN", "n": "Aruba Cloud DE", "t": "Hosting & VPS", "w": 10, "cc": "IT", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 4, "p": 0.8013, "hi": 8.91, "lo": 1.92, "ips": 10, "mean": 4.87, "above": true}}, "h2": [["2026-10-05", 0.010, 6.985, 0, false], ["2026-10-12", 0.010, 7.028, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 7.028, "se": 0.919, "ts": 1.000, "map": 20.989, "obs": 4, "own": 7.511, "comp": {"urlhaus": -0.6517, "threatfox": -0.4057, "phishing_db": 5.7275}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.879, "ts": null, "map": 0.183, "obs": 0, "own": 0.085, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.486, "det": null, "oid": "ORG-TS9-RIPE", "org": "Aruba S.p.A.", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.arubacloud.com/"}, "pfx": 11, "reg": "2013-09-13", "rir": "ripencc", "s24": 56, "sib": 7, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 14336, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 200223, "h": "ETHERON", "n": "ETHERON", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.564, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-EH75-RIPE", "org": "Lars Jannick Volkers trading as Etheron Hosting", "pdb": null, "pfx": 5, "reg": "2023-01-11", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200283, "h": "SENKRONET", "n": "SENKRONET", "t": "Other", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 1.099, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.099, "se": 1.615, "ts": 1.000, "map": 15.896, "obs": 1, "own": 13.183, "comp": {"cins": -0.0436, "dshield": 4.9765, "crowdsec": -0.4147, "vulncheck": -0.1299, "blocklist_de": -0.2285}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.888, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SA5574-RIPE", "org": "Mehmet Fatih Gultekin trading as Senkronet Bilgisayar Destek Hizmetleri", "pdb": null, "pfx": 2, "reg": "2026-03-06", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200303, "h": "LUMASERV", "n": "LUMASERV", "t": "Transit & backbone", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.970, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 2.888, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.552, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LG202-RIPE", "org": "LUMASERV GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://lumaserv.com"}, "pfx": 15, "reg": "2018-08-10", "rir": "ripencc", "s24": 11, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200311, "h": "PREWIFI", "n": "PRE WIFI SRL", "t": "Broadband & mobile", "w": 26, "cc": "IT", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 4, "home_connection": 8, "mail_bruteforce": 10, "router_or_botnet": 1}, "n": 10}, "ev": {"crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 10, "mean": 3.96, "above": false}, "blocklist_de": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 19, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 61.387, 0.011, 1, false], ["2026-10-12", 90.757, 0.013, 1, false]], "sh": false, "uc": 83007.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 3}, "lo": 90.757, "se": 0.586, "ts": 0.500, "map": 204.256, "obs": 6, "own": 313.500, "comp": {"cins": -0.903, "dshield": -1.5627, "crowdsec": 2.6237, "vulncheck": -0.8033, "blocklist_de": 7.3583}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.220, "det": {"blocklist_de": {"imap": 19, "mail": 19}}, "oid": "ORG-PWS11-RIPE", "org": "PRE WIFI SRL", "pdb": null, "pfx": 4, "reg": "2018-08-08", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200313, "h": "IT_WEB_LTD", "n": "ProHoster", "t": "Hosting & VPS", "w": 25, "cc": "VG", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3722, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "threatfox": {"n": 3, "p": 0.6434, "hi": 7.71, "lo": 1.36, "ips": 23, "mean": 3.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1912, "hi": 4.66, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.281, 5.654, 0, false], ["2026-10-12", 0.010, 9.090, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 1}, "lo": 9.090, "se": 0.918, "ts": 0.750, "map": 27.307, "obs": 4, "own": 9.699, "comp": {"urlhaus": -0.5766, "threatfox": 4.4671, "phishing_db": 1.0428}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.105, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Evilginx": 23}}, "oid": "ORG-IWL5-RIPE", "org": "IT WEB LTD", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://prohoster.info"}, "pfx": 33, "reg": "2018-08-08", "rir": "ripencc", "s24": 37, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000430683}, {"a": 200325, "h": "BunnyCDN", "n": "Bunny.net", "t": "Hosting & VPS", "w": 0, "cc": "SI", "cf": null, "cs": null, "ev": {"shodan": {"n": 10, "p": 0.9996, "hi": 16.40, "lo": 5.97, "ips": 10, "mean": 10.64, "above": true}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.504, "det": {"shodan": {"compromised": 10}}, "oid": "ORG-BISD2-RIPE", "org": "BUNNYWAY, informacijske storitve d.o.o.", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://bunny.net"}, "pfx": 14, "reg": "2018-08-07", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 4096, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00000219081803}, {"a": 200350, "h": "YandexCloud", "n": "Yandex Cloud", "t": "Hosting & VPS", "w": 10, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"shodan": {"n": 21, "p": 0.9999, "hi": 10.42, "lo": 5.13, "ips": 21, "mean": 7.58, "above": true}, "crowdsec": {"n": 2, "p": 0.0026, "hi": 1.87, "lo": 0.24, "ips": 2, "mean": 0.89, "above": false}, "vulncheck": {"n": 8, "p": 0.9642, "hi": 9.84, "lo": 3.20, "ips": 8, "mean": 6.14, "above": true}}, "h2": [["2026-10-05", 3.473, 0.009, 0, false], ["2026-10-12", 0.452, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.846, "ts": null, "map": 0.134, "obs": 0, "own": 0.105, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 8, "blocklist_de": 0}, "lo": 0.452, "se": 0.531, "ts": 0.800, "map": 0.891, "obs": 10, "own": 0.179, "comp": {"cins": -0.8819, "dshield": -1.5367, "crowdsec": -0.1132, "vulncheck": 8.1965, "blocklist_de": -4.386}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.911, "det": {"shodan": {"c2": 11, "compromised": 10}, "vulncheck": {"c2_server": 3, "botnet_node": 2, "attack_tooling": 3}}, "oid": "ORG-YL62-RIPE", "org": "Yandex.Cloud LLC", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://cloud.yandex.com/"}, "pfx": 53, "reg": "2018-08-02", "rir": "ripencc", "s24": 890, "sib": 2, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 238080, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.0043433242699}, {"a": 200373, "h": "Drei-K-Tech-GmbH", "n": "3xK Tech", "t": "Hosting & VPS", "w": 4044, "cc": "DE", "cf": {"rb": "", "wb": "", "rep": 1.66, "waf": 1.49}, "cs": {"c": {"http_flood": 893, "data_centre": 3546, "web_exploit": 3905, "bad_crawling": 451, "proxy_or_vpn": 2237, "web_bruteforce": 4032, "cve:CVE-2017-9841": 442, "cve:CVE-2021-41773": 352, "cve:CVE-2022-39290": 655, "cve:CVE-2026-60137": 826, "cve:CVE-2026-63030": 1706}, "n": 4035}, "ev": {"dshield": {"n": 8, "p": 0.9923, "hi": 12.90, "lo": 4.20, "ips": 9, "mean": 8.05, "above": true}, "crowdsec": {"n": 189, "p": 1.0000, "hi": 134.55, "lo": 105.95, "ips": 4035, "mean": 119.89, "above": true}, "phishing_db": {"n": 1, "p": 0.1559, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "blocklist_de": {"n": 2, "p": 0.2842, "hi": 5.09, "lo": 0.66, "ips": 2, "mean": 2.43, "above": false}}, "h2": [["2026-10-05", 67.883, 0.203, 2, false], ["2026-10-12", 71.908, 0.212, 2, false]], "sh": true, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.212, "se": 1.415, "ts": 1.000, "map": 1.592, "obs": 1, "own": 0.724, "comp": {"urlhaus": -0.2264, "threatfox": -0.2319, "phishing_db": 2.5494}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 8, "crowdsec": 189, "vulncheck": 0, "blocklist_de": 2}, "lo": 71.908, "se": 0.346, "ts": 0.950, "map": 106.913, "obs": 199, "own": 20.748, "comp": {"cins": -3.9315, "dshield": -1.6296, "crowdsec": 28.1224, "vulncheck": -1.0073, "blocklist_de": -15.4882}, "mass": 128.9, "listed": true}}, "abq": false, "bot": 0.579, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-TG236-RIPE", "org": "3xK Tech GmbH", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://3xktech.cloud"}, "pfx": 196, "reg": "2022-12-20", "rir": "ripencc", "s24": 220, "sib": 0, "tor": 0, "w24": 189, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 56320, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield"], "traffic": 0.077015}, {"a": 200391, "h": "KREZ999AS", "n": "KREZ 999 EOOD", "t": "Other", "w": 4, "cc": "BG", "cf": null, "cs": {"c": {"web_exploit": 1, "cve:CVE-2018-13379": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 66.039, 0.012, 1, false], ["2026-10-12", 70.122, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 70.122, "se": 0.868, "ts": 0.333, "map": 265.512, "obs": 3, "own": 153.033, "comp": {"cins": 4.4961, "dshield": 3.465, "crowdsec": 1.321, "vulncheck": -0.5594, "blocklist_de": -1.7474}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.994, "det": null, "oid": "ORG-KE48-RIPE", "org": "KREZ 999 EOOD", "pdb": null, "pfx": 1, "reg": "2018-07-26", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200475, "h": "BG-KARNOBATNET", "n": "ET VESELIN JELQZKOV", "t": "Other", "w": 22, "cc": "BG", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1, "home_connection": 4, "mail_bruteforce": 10}, "n": 10}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 10, "mean": 2.95, "above": false}, "blocklist_de": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 14, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 27.189, 0.011, 1, false], ["2026-10-12", 30.181, 0.013, 1, false]], "sh": false, "uc": 49739.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 30.181, "se": 0.701, "ts": 0.500, "map": 82.871, "obs": 4, "own": 47.006, "comp": {"cins": -0.5968, "dshield": -1.1465, "crowdsec": 2.5462, "vulncheck": -0.7077, "blocklist_de": 5.7157}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.205, "det": {"blocklist_de": {"imap": 13, "mail": 14}}, "oid": "ORG-EVJ2-RIPE", "org": "ET VESELIN JELQZKOV", "pdb": null, "pfx": 3, "reg": "2018-07-23", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005285017348}, {"a": 200482, "h": "nexserv", "n": "nexserv GmbH", "t": "Transit & backbone", "w": 1, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "phishing_db": {"n": 1, "p": 0.1974, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.700, 0, false], ["2026-10-12", 0.012, 0.724, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.724, "se": 1.679, "ts": 1.000, "map": 9.411, "obs": 1, "own": 43.887, "comp": {"urlhaus": -0.0515, "threatfox": -0.0719, "phishing_db": 3.9914}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 3.270, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.694, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NG255-RIPE", "org": "nexserv GmbH", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://nexserv.de"}, "pfx": 8, "reg": "2022-12-15", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200484, "h": "SENDINBLUE-ASN", "n": "Sendinblue", "t": "Other", "w": 4, "cc": "FR", "cf": null, "cs": {"c": {"data_centre": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.0182, "hi": 2.39, "lo": 0.18, "ips": 3, "mean": 1.01, "above": false}, "blocklist_de": {"n": 1, "p": 0.0788, "hi": 3.40, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}}, "h2": [["2026-10-05", 0.228, 0.010, 0, false], ["2026-10-12", 0.243, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.161, "obs": 0, "own": 0.371, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.243, "se": 0.859, "ts": 0.500, "map": 0.888, "obs": 2, "own": 0.518, "comp": {"cins": -0.412, "dshield": -0.8479, "crowdsec": 0.6267, "vulncheck": -0.6116, "blocklist_de": 2.5197}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.838, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-DTSS1-RIPE", "org": "Sendinblue SAS", "pdb": null, "pfx": 17, "reg": "2015-06-23", "rir": "ripencc", "s24": 369, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 95232, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00280393352785}, {"a": 200514, "h": "KnownSRV", "n": "KnownSRV LTD", "t": "Other", "w": 3, "cc": "GB", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.425, 0.011, 0, false], ["2026-10-12", 0.425, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.425, "se": 1.369, "ts": 1.000, "map": 3.963, "obs": 1, "own": 2.786, "comp": {"cins": -0.0702, "dshield": -0.1665, "crowdsec": -0.6597, "vulncheck": 4.0346, "blocklist_de": -0.3674}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.970, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-KL103-RIPE", "org": "KnownSRV Ltd.", "pdb": null, "pfx": 13, "reg": "2015-06-18", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200534, "h": "mserwis-as", "n": "DOMENY.TV MSERWIS Sp. z o. o.", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.672, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DMSZ1-RIPE", "org": "DOMENY.TV MSERWIS Sp. z o. o.", "pdb": null, "pfx": 2, "reg": "2018-07-20", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200590, "h": "asnls", "n": "NLS Kazakhstan", "t": "Broadband & mobile", "w": 8, "cc": "KZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1134, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "urlhaus": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2517, "hi": 4.83, "lo": 0.63, "ips": 2, "mean": 2.30, "above": false}, "threatfox": {"n": 3, "p": 0.6355, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "blocklist_de": {"n": 1, "p": 0.1507, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 4.685, 4.871, 0, false], ["2026-10-12", 1.690, 4.919, 0, false]], "sh": false, "uc": 259.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 0}, "lo": 4.919, "se": 0.959, "ts": 0.750, "map": 15.458, "obs": 4, "own": 37.177, "comp": {"urlhaus": 2.4442, "threatfox": 2.8195, "phishing_db": -0.8994}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.690, "se": 0.679, "ts": 0.500, "map": 4.422, "obs": 4, "own": 6.957, "comp": {"cins": -0.6038, "dshield": -1.1571, "crowdsec": 2.4732, "vulncheck": 0.8646, "blocklist_de": 1.3033}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.197, "det": {"shodan": {"c2": 1}, "threatfox": {"family:AdaptixC2": 1, "family:Unknown malware": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-NKL4-RIPE", "org": "NLS Kazakhstan LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://nls.kz"}, "pfx": 114, "reg": "2015-05-28", "rir": "ripencc", "s24": 114, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29952, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0054701707529}, {"a": 200593, "h": "PROSPERO-AS", "n": "PROSPERO OOO", "t": "Other", "w": 22, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "bad_crawling": 5, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 6, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2025-0282": 1, "cve:CVE-2020-15415": 1, "cve:CVE-2020-29390": 1, "cve:CVE-2025-22457": 1}, "n": 9}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 4, "mean": 3.00, "above": false}, "crowdsec": {"n": 3, "p": 0.6419, "hi": 7.69, "lo": 1.36, "ips": 9, "mean": 3.97, "above": false}, "threatfox": {"n": 3, "p": 0.6469, "hi": 7.75, "lo": 1.37, "ips": 7, "mean": 4.00, "above": false}, "phishing_db": {"n": 2, "p": 0.4222, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 24.500, 112.213, 1, false], ["2026-10-12", 74.057, 110.387, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 2}, "lo": 110.387, "se": 0.835, "ts": 0.600, "map": 305.139, "obs": 5, "own": 255.586, "comp": {"urlhaus": -0.5314, "threatfox": 4.7955, "phishing_db": 3.0828}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 74.057, "se": 0.633, "ts": 0.600, "map": 180.791, "obs": 5, "own": 101.736, "comp": {"cins": -0.6431, "dshield": 5.7063, "crowdsec": 5.4995, "vulncheck": -0.7261, "blocklist_de": -3.2455}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.980, "det": {"shodan": {"c2": 1}, "threatfox": {"family:DCRat": 1, "family:Tsundere": 1, "family:AdaptixC2": 5}}, "oid": "ORG-PO83-RIPE", "org": "PROSPERO OOO", "pdb": null, "pfx": 3, "reg": "2022-12-12", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 3, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200651, "h": "FlokiNET", "n": "FlokiNET ehf", "t": "Other", "w": 27, "cc": "IS", "cf": null, "cs": {"c": {"http_flood": 21, "data_centre": 4, "web_exploit": 23, "bad_crawling": 13, "proxy_or_vpn": 23, "ssh_bruteforce": 15, "web_bruteforce": 23, "home_connection": 1, "mail_bruteforce": 5, "cve:CVE-2017-9841": 13, "cve:CVE-2018-13379": 6, "cve:CVE-2018-20062": 14, "cve:CVE-2021-41773": 6, "cve:CVE-2021-44228": 4}, "n": 25}, "ev": {"cins": {"n": 1, "p": 0.1928, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 6, "p": 0.9543, "hi": 11.04, "lo": 3.06, "ips": 6, "mean": 6.53, "above": true}, "crowdsec": {"n": 9, "p": 0.9979, "hi": 14.40, "lo": 4.98, "ips": 25, "mean": 9.17, "above": true}, "threatfox": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4113, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 26.752, 13.568, 1, false], ["2026-10-12", 23.638, 0.449, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.449, "se": 1.538, "ts": 1.000, "map": 4.495, "obs": 1, "own": 5.377, "comp": {"urlhaus": -0.1029, "threatfox": 3.4674, "phishing_db": -0.2353}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 9, "vulncheck": 2, "blocklist_de": 0}, "lo": 23.638, "se": 0.474, "ts": 0.750, "map": 43.061, "obs": 12, "own": 24.194, "comp": {"cins": 2.2056, "dshield": -2.082, "crowdsec": 11.295, "vulncheck": 0.466, "blocklist_de": -6.7282}, "mass": 8.1, "listed": false}}, "abq": false, "bot": 0.743, "det": {"shodan": {"c2": 5, "compromised": 1}, "threatfox": {"family:Havoc": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-FE72-RIPE", "org": "FlokiNET ehf", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://flokinet.is"}, "pfx": 34, "reg": "2015-05-15", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 24, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.0690]], "ipv4": 9216, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00061751772438}, {"a": 200660, "h": "QONZER", "n": "QONZER LTD", "t": "Other", "w": 6, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 5, "first_seen_30d": 4, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2025-32355": 3}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 5, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 2.900, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.900, "se": 0.982, "ts": 0.500, "map": 13.479, "obs": 2, "own": 7.975, "comp": {"cins": 4.6259, "dshield": -0.6071, "crowdsec": 1.928, "vulncheck": -0.5067, "blocklist_de": -1.4453}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.391, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-QN18-RIPE", "org": "QONZER LTD", "pdb": null, "pfx": 16, "reg": "2026-02-24", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001255851168}, {"a": 200713, "h": "FREY-AS", "n": "Zettaplan AG", "t": "Other", "w": 1, "cc": "CH", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.513, 0.011, 0, false], ["2026-10-12", 0.555, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.555, "se": 1.412, "ts": 1.000, "map": 5.787, "obs": 1, "own": 4.020, "comp": {"cins": -0.0865, "dshield": -0.2035, "crowdsec": 4.1217, "vulncheck": -0.2306, "blocklist_de": -0.4518}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.451, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FCTA1-RIPE", "org": "Zettaplan AG", "pdb": null, "pfx": 4, "reg": "2015-04-30", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002688169608}, {"a": 200740, "h": "FIRST-SERVER-EU-AS", "n": "First Server Limited", "t": "Hosting & VPS", "w": 6, "cc": "GB", "cf": null, "cs": {"c": {"data_centre": 4, "web_exploit": 2, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 4}, "ev": {"shodan": {"n": 3, "p": 0.4944, "hi": 6.29, "lo": 1.11, "ips": 3, "mean": 3.24, "above": false}, "crowdsec": {"n": 4, "p": 0.6544, "hi": 7.10, "lo": 1.53, "ips": 4, "mean": 3.88, "above": false}, "threatfox": {"n": 1, "p": 0.1918, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1526, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 1.692, 0.272, 0, false], ["2026-10-12", 2.916, 0.280, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.280, "se": 1.453, "ts": 1.000, "map": 2.301, "obs": 1, "own": 1.046, "comp": {"urlhaus": -0.1654, "threatfox": 2.969, "phishing_db": -0.344}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.916, "se": 0.608, "ts": 0.800, "map": 6.726, "obs": 5, "own": 1.328, "comp": {"cins": -0.8275, "dshield": -1.4679, "crowdsec": 6.4587, "vulncheck": -0.7844, "blocklist_de": -0.0791}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.531, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-FSL27-RIPE", "org": "FIRST SERVER LIMITED", "pdb": null, "pfx": 59, "reg": "2018-07-18", "rir": "ripencc", "s24": 109, "sib": 4, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090620350962}, {"a": 200758, "h": "ORG-DL626-RIPE", "n": "Datagear LLP", "t": "Other", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 3, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2020-25078": 1, "cve:CVE-2023-42793": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 17.109, 0.011, 1, false], ["2026-10-12", 21.886, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 21.886, "se": 0.694, "ts": 0.750, "map": 59.373, "obs": 4, "own": 33.677, "comp": {"cins": -0.5735, "dshield": -1.1111, "crowdsec": 6.3659, "vulncheck": -0.6978, "blocklist_de": 1.494}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.619, "det": {"blocklist_de": {"ftp": 1}}, "oid": "ORG-DL626-RIPE", "org": "Datagear LLP", "pdb": null, "pfx": 8, "reg": "2026-02-20", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200823, "h": "MHost-AS", "n": "MHost", "t": "Hosting & VPS", "w": 3, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3937, "hi": 6.03, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "phishing_db": {"n": 2, "p": 0.4163, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 2.048, 3.747, 0, false], ["2026-10-12", 0.404, 3.812, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 3.812, "se": 1.184, "ts": 1.000, "map": 19.696, "obs": 2, "own": 7.312, "comp": {"urlhaus": -0.264, "threatfox": -0.2559, "phishing_db": 5.1264}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.404, "se": 1.344, "ts": 1.000, "map": 3.728, "obs": 1, "own": 0.867, "comp": {"cins": -0.1059, "dshield": -0.247, "crowdsec": 3.8844, "vulncheck": -0.2695, "blocklist_de": -0.5525}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.744, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Hermes": 1}}, "oid": "ORG-ML960-RIPE", "org": "MHost LLC", "pdb": {"t": null, "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://mhost.ee"}, "pfx": 21, "reg": "2026-02-19", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00087948823675}, {"a": 200845, "h": "AVATEL-AS", "n": "Avatel Telecom", "t": "Broadband & mobile", "w": 19, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2021-41773": 1}, "n": 5}, "ev": {"dshield": {"n": 1, "p": 0.0380, "hi": 2.80, "lo": 0.21, "ips": 1, "mean": 1.18, "above": false}, "urlhaus": {"n": 2, "p": 0.3484, "hi": 5.63, "lo": 0.73, "ips": 2, "mean": 2.68, "above": false}, "crowdsec": {"n": 5, "p": 0.0093, "hi": 2.39, "lo": 0.59, "ips": 5, "mean": 1.36, "above": false}, "vulncheck": {"n": 3, "p": 0.2626, "hi": 4.64, "lo": 0.82, "ips": 3, "mean": 2.39, "above": false}, "blocklist_de": {"n": 6, "p": 0.4318, "hi": 4.99, "lo": 1.38, "ips": 10, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.760, 0.527, 0, false], ["2026-10-12", 1.104, 0.581, 0, false]], "sh": false, "uc": 192.7, "v2": {"band": 0, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 0.581, "se": 1.124, "ts": 1.000, "map": 2.527, "obs": 2, "own": 6.419, "comp": {"urlhaus": 4.0867, "threatfox": -0.5087, "phishing_db": -1.0246}, "mass": 4.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 6}, "lo": 1.104, "se": 0.459, "ts": 0.400, "map": 1.934, "obs": 15, "own": 2.987, "comp": {"cins": -1.9424, "dshield": -0.9482, "crowdsec": -2.1013, "vulncheck": 0.3288, "blocklist_de": 6.7164}, "mass": 13.8, "listed": false}}, "abq": false, "bot": 0.159, "det": {"vulncheck": {"botnet_node": 3}, "blocklist_de": {"ssh": 1, "bots": 2, "imap": 7, "mail": 7}}, "oid": "ORG-WBS4-RIPE", "org": "AVATEL TELECOM, SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.avatel.es"}, "pfx": 470, "reg": "2015-03-30", "rir": "ripencc", "s24": 1282, "sib": 25, "tor": 0, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 362752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0239759837719}, {"a": 200851, "h": "BAMBOOZLE-AS", "n": "Bamboozle Web Services", "t": "Hosting & VPS", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.332, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BWSM1-RIPE", "org": "Bamboozle Web Services MEA FZ-LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.bamboozle.me"}, "pfx": 9, "reg": "2015-03-27", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003474037034}, {"a": 200897, "h": "jormungand", "n": "JORMUNGAND LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.818, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-JL170-RIPE", "org": "JORMUNGAND LLC", "pdb": null, "pfx": 2, "reg": "2026-02-17", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200904, "h": "FOXCLOUD", "n": "FOXCLOUD LLP", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.470, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.470, "se": 1.377, "ts": 1.000, "map": 4.607, "obs": 1, "own": 1.094, "comp": {"cins": -0.1059, "dshield": -0.2471, "crowdsec": -0.9786, "vulncheck": -0.2696, "blocklist_de": 4.5224}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.835, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-FL144-RIPE", "org": "FOXCLOUD LLP", "pdb": null, "pfx": 17, "reg": "2015-03-16", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200912, "h": "KRAUSE-AS", "n": "Joel Krause", "t": "Hosting & VPS", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2019-18935": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 10.978, 0.011, 1, false], ["2026-10-12", 11.989, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.989, "se": 1.090, "ts": 1.000, "map": 69.245, "obs": 2, "own": 14.516, "comp": {"cins": -0.1839, "dshield": -0.415, "crowdsec": 7.5814, "vulncheck": -0.396, "blocklist_de": -0.9552}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.699, "det": null, "oid": "ORG-JKTA8-RIPE", "org": "Joel Krause", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.vpslayer.net"}, "pfx": 2, "reg": "2026-02-17", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000000121791}, {"a": 200918, "h": "ORELSOFT", "n": "ORELSOFT", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.394, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.252, "det": null, "oid": "ORG-OREL2-RIPE", "org": "Pavel Zizka", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.orelsoft.cz"}, "pfx": 10, "reg": "2015-03-12", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000999967931}, {"a": 200950, "h": "CalibourNetwork", "n": "Calibour Limited", "t": "Transit & backbone", "w": 1, "cc": "GB", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 72.971, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.819, "det": null, "oid": "ORG-CLBR1-RIPE", "org": "Calibour Limited", "pdb": {"t": "NSP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://calibour.com"}, "pfx": 2, "reg": "2022-12-02", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 200999, "h": "pl-cloudferro", "n": "pl-cloudferro", "t": "Hosting & VPS", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1267, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 0.214, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.160, "obs": 0, "own": 0.065, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.912, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CSZO29-RIPE", "org": "CloudFerro S.A", "pdb": {"t": null, "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://cloudferro.com/"}, "pfx": 26, "reg": "2015-02-23", "rir": "ripencc", "s24": 92, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201011, "h": "CORE-BACKBONE", "n": "Core-Backbone GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1035, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.988, "ts": null, "map": 0.181, "obs": 0, "own": 0.506, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.768, "ts": null, "map": 0.143, "obs": 0, "own": 0.151, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.565, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IICG1-RIPE", "org": "Core-Backbone GmbH", "pdb": null, "pfx": 33, "reg": "2015-02-20", "rir": "ripencc", "s24": 132, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201021, "h": "OnurBilisim-AS", "n": "Ahmet Onur Guney trading as Onur Bilisim Ve Yazilim Hizmetleri", "t": "Other", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1584, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "blocklist_de": {"n": 1, "p": 0.1777, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.275, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 0.653, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.275, "se": 1.278, "ts": 1.000, "map": 2.243, "obs": 1, "own": 1.457, "comp": {"cins": -0.1414, "dshield": -0.3249, "crowdsec": -1.2858, "vulncheck": -0.3324, "blocklist_de": 4.2862}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.444, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AOGT3-RIPE", "org": "Ahmet Onur Guney trading as Onur Bilisim Ve Yazilim Hizmetleri", "pdb": null, "pfx": 47, "reg": "2015-02-18", "rir": "ripencc", "s24": 47, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000627416678}, {"a": 201041, "h": "OBLTELECOM-AS", "n": "Obltelecom LLC", "t": "Broadband & mobile", "w": 5, "cc": "UA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.612, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.612, "se": 1.449, "ts": 1.000, "map": 6.620, "obs": 1, "own": 13.341, "comp": {"cins": -0.0543, "dshield": -0.1297, "crowdsec": -0.5143, "vulncheck": 4.2667, "blocklist_de": -0.2846}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.189, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-OBLT1-RIPE", "org": "Obltelecom LLC", "pdb": null, "pfx": 5, "reg": "2015-02-12", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00071516220813}, {"a": 201079, "h": "garantiserver-com", "n": "AKA Bilisim Yazilim Arge Ins. Taah. San. Tic. A.S.", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4090, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.661, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ABYA1-RIPE", "org": "AKA Bilisim Yazilim Arge Ins. Taah. San. Tic. A.S.", "pdb": null, "pfx": 10, "reg": "2015-02-04", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201094, "h": "gmhost", "n": "Mulgin Alexander Sergeevich", "t": "Hosting & VPS", "w": 6, "cc": "UA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 4, "p": 0.8123, "hi": 9.10, "lo": 1.96, "ips": 6, "mean": 4.97, "above": true}}, "h2": [["2026-10-12", 7.786, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 4, "blocklist_de": 0}, "lo": 7.786, "se": 0.721, "ts": 1.000, "map": 21.319, "obs": 4, "own": 4.416, "comp": {"cins": -0.3028, "dshield": -0.6505, "crowdsec": -2.567, "vulncheck": 9.5344, "blocklist_de": -1.5608}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.665, "det": {"vulncheck": {"c2_server": 2, "botnet_node": 4}}, "oid": "ORG-AMS18-RIPE", "org": "Mulgin Alexander Sergeevich", "pdb": null, "pfx": 9, "reg": "2015-02-02", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0833]], "ipv4": 3072, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00023578813944}, {"a": 201097, "h": "kvanta-llc", "n": "KVANTA LLC", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"threatfox": {"n": 3, "p": 0.6467, "hi": 7.75, "lo": 1.37, "ips": 3, "mean": 4.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.666, 25.284, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 25.284, "se": 1.015, "ts": 1.000, "map": 97.156, "obs": 3, "own": 86.457, "comp": {"urlhaus": -0.3057, "threatfox": 7.036, "phishing_db": -0.5278}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.666, "se": 1.469, "ts": 1.000, "map": 7.430, "obs": 1, "own": 5.556, "comp": {"cins": -0.0509, "dshield": -0.1216, "crowdsec": -0.4821, "vulncheck": 4.3202, "blocklist_de": -0.2664}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.678, "det": {"threatfox": {"family:Aisuru": 1, "family:Kimwolf": 2}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-KL395-RIPE", "org": "KVANTA LLC", "pdb": null, "pfx": 5, "reg": "2026-02-13", "rir": "ripencc", "s24": 5, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201112, "h": "awhost", "n": "awhost", "t": "Hosting & VPS", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.634, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AETA5-RIPE", "org": "Andrzej Erenc trading as awHost", "pdb": {"t": null, "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "https://awHost.pl"}, "pfx": 2, "reg": "2022-11-28", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201123, "h": "ZT-UFA-AS", "n": "OOO SET", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.509, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.509, "se": 1.406, "ts": 1.000, "map": 5.081, "obs": 1, "own": 3.647, "comp": {"cins": -0.0625, "dshield": -0.1485, "crowdsec": -0.5888, "vulncheck": 4.1459, "blocklist_de": -0.3269}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.464, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-OS57-RIPE", "org": "OOO SET", "pdb": null, "pfx": 5, "reg": "2015-01-22", "rir": "ripencc", "s24": 9, "sib": 9, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201178, "h": "EURONET", "n": "Euronet Telekomunikasyon", "t": "Broadband & mobile", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1217, "hi": 3.91, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "crowdsec": {"n": 1, "p": 0.1076, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 0.694, 0.011, 0, false], ["2026-10-12", 0.167, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 1.353, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.167, "se": 1.204, "ts": 1.000, "map": 1.184, "obs": 1, "own": 2.039, "comp": {"cins": -0.1582, "dshield": -0.3609, "crowdsec": 3.264, "vulncheck": -0.3589, "blocklist_de": -0.8231}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.422, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ETVB1-RIPE", "org": "Euronet Telekomunikasyon A.S.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.euronet.net.tr"}, "pfx": 90, "reg": "2015-01-06", "rir": "ripencc", "s24": 100, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055541963995}, {"a": 201190, "h": "VOXBEE-SERVICES", "n": "VOXBEE-SERVICES", "t": "Other", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.977, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VSS37-RIPE", "org": "Voxbee Services SRL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.voxbee.ro"}, "pfx": 1, "reg": "2022-11-23", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201201, "h": "Datalogistics", "n": "Delska Lithuania 201201", "t": "Transit & backbone", "w": 0, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 2.760, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 2.345, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.934, "det": {"shodan": {"c2": 1}}, "oid": "ORG-DLCL1-RIPE", "org": "UAB Delska Lithuania", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://delska.com"}, "pfx": 11, "reg": "2014-12-23", "rir": "ripencc", "s24": 18, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.002126237927}, {"a": 201249, "h": "IPRO", "n": "IPRO Sh.p.k.", "t": "Other", "w": 0, "cc": "AL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.522, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-IS288-RIPE", "org": "IPRO Sh.p.k.", "pdb": null, "pfx": 4, "reg": "2014-12-11", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014880613097}, {"a": 201295, "h": "VOLCAN", "n": "Shabakeh Ertebatat Artak Towseeh PJSC", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6386, "hi": 7.66, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.306, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-SEAT2-RIPE", "org": "Shabakeh Ertebatat Artak Towseeh PJSC", "pdb": null, "pfx": 6, "reg": "2018-07-04", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001147880175}, {"a": 201308, "h": "CASTLEGEM", "n": "Castlegem SRL", "t": "Other", "w": 1, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2021-26086": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.702, "det": null, "oid": "ORG-CS778-RIPE", "org": "Castlegem SRL", "pdb": null, "pfx": 1, "reg": "2014-11-28", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201446, "h": "PROFESIONALHOSTING", "n": "Soluciones web on line AS201446", "t": "Hosting & VPS", "w": 3, "cc": "ES", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 2, "web_bruteforce": 2}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.3696, "hi": 5.81, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}, "crowdsec": {"n": 3, "p": 0.5779, "hi": 7.03, "lo": 1.24, "ips": 3, "mean": 3.62, "above": false}}, "h2": [["2026-10-05", 4.964, 0.011, 0, false], ["2026-10-12", 3.042, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 0.260, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.042, "se": 0.766, "ts": 1.000, "map": 9.359, "obs": 3, "own": 1.867, "comp": {"cins": -0.4542, "dshield": -0.9197, "crowdsec": 7.9603, "vulncheck": -0.6375, "blocklist_de": -2.3189}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-SWOL5-RIPE", "org": "Soluciones web on line s.l.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.profesionalhosting.com"}, "pfx": 39, "reg": "2014-10-24", "rir": "ripencc", "s24": 39, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009229387924}, {"a": 201579, "h": "HOSTGNOME-AS", "n": "HOSTGNOME LTD", "t": "Hosting & VPS", "w": 26, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 8, "web_exploit": 17, "bad_crawling": 3, "ssh_bruteforce": 18, "web_bruteforce": 18, "home_connection": 3, "mail_bruteforce": 3}, "n": 23}, "ev": {"cins": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 4, "p": 0.8072, "hi": 9.01, "lo": 1.94, "ips": 23, "mean": 4.92, "above": true}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 53.468, 0.733, 1, false], ["2026-10-12", 79.865, 0.756, 1, false]], "sh": false, "uc": 34895.8, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.756, "se": 1.699, "ts": 1.000, "map": 10.084, "obs": 1, "own": 5.250, "comp": {"urlhaus": -0.0415, "threatfox": 4.084, "phishing_db": -0.1054}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 79.865, "se": 0.551, "ts": 0.571, "map": 165.960, "obs": 7, "own": 32.443, "comp": {"cins": 2.9458, "dshield": -1.7388, "crowdsec": 3.8278, "vulncheck": -0.8347, "blocklist_de": 2.3053}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.848, "det": {"threatfox": {"family:Remcos": 1, "family:PureRAT": 1}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-HL300-RIPE", "org": "HOSTGNOME LTD", "pdb": null, "pfx": 6, "reg": "2022-11-04", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 201592, "h": "MYBEC", "n": "MYBEC BILISIM TELEKOMUNIKASYON ELEKTRONIK ITHALAT IHRACAT LIMITED SIRKETI", "t": "Broadband & mobile", "w": 256, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 256, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.351, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.351, "se": 1.705, "ts": 1.000, "map": 21.964, "obs": 1, "own": 56.066, "comp": {"cins": -0.0302, "dshield": 5.0543, "crowdsec": -0.2892, "vulncheck": -0.0934, "blocklist_de": -0.1585}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.211, "det": null, "oid": "ORG-MBTE1-RIPE", "org": "MYBEC BILISIM TELEKOMUNIKASYON ELEKTRONIK ITHALAT IHRACAT LIMITED SIRKETI", "pdb": null, "pfx": 1, "reg": "2026-03-17", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011723005055}, {"a": 201601, "h": "Astrec-Data", "n": "Astrec Data OU", "t": "Other", "w": 0, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.394, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.641, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ADO2-RIPE", "org": "Astrec Data OU", "pdb": null, "pfx": 12, "reg": "2014-09-09", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000342555759}, {"a": 201626, "h": "PODILLIA-AS", "n": "Podillia-hotel PJSC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-PA1101-RIPE", "org": "Podillia-hotel PJSC", "pdb": null, "pfx": 1, "reg": "2018-06-28", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201637, "h": "Bartnet-AS", "n": "BARTNET Naruszewicz i Krawczun Spolka Jawna", "t": "Broadband & mobile", "w": 5, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4167, "hi": 6.24, "lo": 0.81, "ips": 5, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 4.214, 0.011, 0, false], ["2026-10-12", 4.693, 0.012, 0, false]], "sh": false, "uc": 4904.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.693, "se": 1.015, "ts": 1.000, "map": 23.309, "obs": 2, "own": 37.862, "comp": {"cins": -0.2728, "dshield": -0.5933, "crowdsec": -2.3423, "vulncheck": -0.4997, "blocklist_de": 8.2506}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.343, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "ORG-BART1-RIPE", "org": "Tomasz Naruszewicz", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.bartnet.pl"}, "pfx": 3, "reg": "2014-08-27", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201670, "h": "INFOTECH-GRUP", "n": "Infotech-Grup SRL", "t": "Enterprise, edu & gov", "w": 1, "cc": "MD", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "dshield": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.713, 8.587, 0, false], ["2026-10-12", 0.782, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 3.865, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.782, "se": 1.502, "ts": 1.000, "map": 9.549, "obs": 1, "own": 70.306, "comp": {"cins": -0.0652, "dshield": 4.853, "crowdsec": -0.6135, "vulncheck": -0.1833, "blocklist_de": -0.341}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.920, "det": {"shodan": {"c2": 1, "compromised": 1}}, "oid": "ORG-IS548-RIPE", "org": "S.C. INFOTECH-GRUP S.R.L.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Selective", "web": "https://avenacloud.com"}, "pfx": 4, "reg": "2022-11-02", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006960760485}, {"a": 201682, "h": "LIQUID-WEB-BV", "n": "Liquid Web B.V.", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.488, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.488, "se": 1.385, "ts": 1.000, "map": 4.854, "obs": 1, "own": 1.160, "comp": {"cins": 5.0056, "dshield": -0.2452, "crowdsec": -0.9709, "vulncheck": -0.2679, "blocklist_de": -0.5482}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.933, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-LWB2-RIPE", "org": "Liquid Web B.V.", "pdb": null, "pfx": 4, "reg": "2014-08-14", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201684, "h": "ODPASN", "n": "Oman Data Park SAOC", "t": "Other", "w": 0, "cc": "OM", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2441.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.150, "det": null, "oid": "ORG-ODPL1-RIPE", "org": "Oman Data Park SAOC", "pdb": null, "pfx": 16, "reg": "2014-08-14", "rir": "ripencc", "s24": 16, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007739374206}, {"a": 201688, "h": "BTKBTD", "n": "Bilgi Teknolojileri ve iletisim Kurumu", "t": "Other", "w": 10, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 10, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-8318": 8, "cve:CVE-2018-11776": 1, "cve:CVE-2019-18935": 2, "cve:CVE-2021-21234": 1}, "n": 10}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 10, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.704, "det": null, "oid": "ORG-BTVI2-RIPE", "org": "Bilgi Teknolojileri ve iletisim Kurumu", "pdb": null, "pfx": 4, "reg": "2014-08-13", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201692, "h": "ZONER-AS", "n": "Zoner Oy", "t": "Other", "w": 0, "cc": "FI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"c2": 1}}, "oid": "ORG-ZO4-RIPE", "org": "Zoner Oy", "pdb": null, "pfx": 8, "reg": "2014-08-13", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001489241922}, {"a": 201738, "h": "UFO-TECHNOLOGIES-LIMITED", "n": "UFO TECHNOLOGIES LIMITED", "t": "Other", "w": 17, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "web_bruteforce": 1}, "n": 4}, "ev": {"urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 4, "mean": 1.96, "above": false}, "threatfox": {"n": 3, "p": 0.6464, "hi": 7.74, "lo": 1.36, "ips": 4, "mean": 4.00, "above": false}, "phishing_db": {"n": 3, "p": 0.6446, "hi": 7.72, "lo": 1.36, "ips": 7, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 24.294, 90.724, 1, false], ["2026-10-12", 0.640, 101.095, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 3}, "lo": 101.095, "se": 0.795, "ts": 0.429, "map": 251.002, "obs": 7, "own": 213.771, "comp": {"urlhaus": 2.2346, "threatfox": 2.4912, "phishing_db": 2.4259}, "mass": 2.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.946, "det": {"threatfox": {"family:Amadey": 2, "family:AsyncRAT": 1, "family:Cobalt Strike": 1}}, "oid": "ORG-UTL18-RIPE", "org": "UFO TECHNOLOGIES LIMITED", "pdb": null, "pfx": 8, "reg": "2026-03-04", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 5, "drop": 8, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201746, "h": "OLIVENET-AS", "n": "Olivenet Network", "t": "Broadband & mobile", "w": 4, "cc": "ES", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3354, "hi": 5.52, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "vulncheck": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 3.362, 0.011, 0, false], ["2026-10-12", 1.899, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.190, "obs": 0, "own": 1.577, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.899, "se": 0.776, "ts": 0.667, "map": 5.862, "obs": 3, "own": 9.348, "comp": {"cins": -0.3925, "dshield": -0.814, "crowdsec": 4.8269, "vulncheck": 1.5538, "blocklist_de": -2.012}, "mass": 1.8, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-ETS6-RIPE", "org": "Olivenet Network S.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://olivenet.es"}, "pfx": 77, "reg": "2014-07-28", "rir": "ripencc", "s24": 53, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.004406492464}, {"a": 201749, "h": "iq-supercell", "n": "SuperCell Network", "t": "Broadband & mobile", "w": 4, "cc": "IQ", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3701, "hi": 5.82, "lo": 0.76, "ips": 2, "mean": 2.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 2, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.602, 0.011, 0, false], ["2026-10-12", 3.965, 0.012, 0, false]], "sh": false, "uc": 3427.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.965, "se": 0.774, "ts": 0.667, "map": 12.367, "obs": 3, "own": 19.382, "comp": {"cins": -0.4746, "dshield": -0.9537, "crowdsec": 3.8666, "vulncheck": -0.6491, "blocklist_de": 2.1196}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.226, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-SCNF1-RIPE", "org": "SUPER CELL NETWORK FOR INTERNET SERVICES LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": null, "pol": "Selective", "web": "https://supercell.iq/"}, "pfx": 31, "reg": "2018-06-27", "rir": "ripencc", "s24": 31, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00270510620094}, {"a": 201767, "h": "UZMOBILE-AS", "n": "Uzbektelekom (Uzmobile)", "t": "Broadband & mobile", "w": 1, "cc": "UZ", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 0.608, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.608, "se": 1.434, "ts": 1.000, "map": 6.618, "obs": 1, "own": 12.748, "comp": {"cins": -0.081, "dshield": 4.7638, "crowdsec": -0.7571, "vulncheck": -0.2189, "blocklist_de": -0.4234}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-JC7-RIPE", "org": "\"Uzbektelekom\" Joint Stock Company", "pdb": null, "pfx": 9, "reg": "2014-07-22", "rir": "ripencc", "s24": 9, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0130038210452}, {"a": 201771, "h": "NDC-CLOUD", "n": "Solutions by STC - Riyadh", "t": "Hosting & VPS", "w": 0, "cc": "SA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1273, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.011, "ts": null, "map": 0.185, "obs": 0, "own": 0.214, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.817, "ts": null, "map": 0.161, "obs": 0, "own": 0.065, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.644, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AFIS1-RIPE", "org": "ARABIAN INTERNET & COMMUNICATIONS SERVICES CO.LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "100-1000Mbps", "pol": "Open", "web": "https://solutions.com.sa"}, "pfx": 24, "reg": "2018-06-27", "rir": "ripencc", "s24": 91, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 23296, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001990691607}, {"a": 201776, "h": "MIRANDA-AS", "n": "Miranda-Media Ltd", "t": "Transit & backbone", "w": 7, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1557, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "dshield": {"n": 2, "p": 0.3370, "hi": 5.53, "lo": 0.72, "ips": 3, "mean": 2.64, "above": false}, "crowdsec": {"n": 2, "p": 0.1212, "hi": 3.75, "lo": 0.49, "ips": 2, "mean": 1.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1054, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.565, 0.010, 0, false], ["2026-10-12", 1.839, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 1.471, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.839, "se": 0.568, "ts": 0.333, "map": 3.910, "obs": 6, "own": 12.307, "comp": {"cins": 2.9368, "dshield": 3.6371, "crowdsec": -1.5154, "vulncheck": -0.8355, "blocklist_de": -1.4659}, "mass": 5.6, "listed": false}}, "abq": false, "bot": 0.469, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-ML281-RIPE", "org": "Miranda-Media Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.miranda-media.ru"}, "pfx": 98, "reg": "2014-07-16", "rir": "ripencc", "s24": 256, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00287462303934}, {"a": 201803, "h": "UCC-AS", "n": "Stratievska Olga Anatoliivna", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.148, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SOA32-RIPE", "org": "Stratievska Olga Anatoliivna", "pdb": null, "pfx": 1, "reg": "2014-07-08", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201813, "h": "Contrust-Solutions", "n": "Starhost", "t": "Hosting & VPS", "w": 0, "cc": "MD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CSS55-RIPE", "org": "Contrust Solutions S.R.L.", "pdb": null, "pfx": 3, "reg": "2018-07-16", "rir": "ripencc", "s24": 3, "sib": 35, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 201814, "h": "Mevspace", "n": "Mevspace", "t": "Hosting & VPS", "w": 77, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 24, "data_centre": 8, "web_exploit": 26, "bad_crawling": 21, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 20, "web_bruteforce": 22, "home_connection": 5, "mail_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2024-2473": 3, "cve:CVE-2021-32648": 13, "cve:CVE-2024-34351": 2, "cve:CVE-2026-63030": 2}, "n": 53}, "ev": {"cins": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "shodan": {"n": 3, "p": 0.5052, "hi": 6.38, "lo": 1.12, "ips": 3, "mean": 3.29, "above": false}, "dshield": {"n": 4, "p": 0.7871, "hi": 8.68, "lo": 1.87, "ips": 18, "mean": 4.74, "above": false}, "crowdsec": {"n": 16, "p": 1.0000, "hi": 19.16, "lo": 8.54, "ips": 53, "mean": 13.40, "above": true}, "threatfox": {"n": 2, "p": 0.4129, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.95, "above": false}, "vulncheck": {"n": 4, "p": 0.7879, "hi": 8.69, "lo": 1.87, "ips": 5, "mean": 4.75, "above": false}, "phishing_db": {"n": 1, "p": 0.1781, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.3545, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}}, "h2": [["2026-10-05", 21.144, 5.412, 1, false], ["2026-10-12", 23.086, 2.582, 1, false]], "sh": false, "uc": 231.6, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 1}, "lo": 2.582, "se": 1.007, "ts": 0.667, "map": 8.876, "obs": 3, "own": 3.362, "comp": {"urlhaus": -0.5221, "threatfox": 3.121, "phishing_db": 1.2106}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 4, "crowdsec": 16, "vulncheck": 4, "blocklist_de": 2}, "lo": 23.086, "se": 0.403, "ts": 0.571, "map": 36.950, "obs": 28, "own": 7.203, "comp": {"cins": 2.4575, "dshield": 1.8318, "crowdsec": 7.2342, "vulncheck": 0.1898, "blocklist_de": -6.7101}, "mass": 20.5, "listed": false}}, "abq": false, "bot": 0.860, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:Remcos": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 2, "botnet_node": 3}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-MSZO78-RIPE", "org": "MEVSPACE sp. z o.o.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://mevspace.com"}, "pfx": 48, "reg": "2014-07-03", "rir": "ripencc", "s24": 101, "sib": 3, "tor": 0, "w24": 19, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 57088, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.01007285835894}, {"a": 201838, "h": "ASN-COMMUNITYFIBRE", "n": "Community Fibre", "t": "Broadband & mobile", "w": 5, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"dshield": {"n": 2, "p": 0.1847, "hi": 4.29, "lo": 0.56, "ips": 3, "mean": 2.04, "above": false}, "crowdsec": {"n": 2, "p": 0.0030, "hi": 1.91, "lo": 0.25, "ips": 2, "mean": 0.91, "above": false}}, "h2": [["2026-10-12", 0.302, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.848, "ts": null, "map": 0.135, "obs": 0, "own": 0.684, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.302, "se": 0.642, "ts": 0.500, "map": 0.739, "obs": 4, "own": 1.154, "comp": {"cins": -0.7405, "dshield": 5.1679, "crowdsec": 1.1382, "vulncheck": -0.7594, "blocklist_de": -3.7147}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.147, "det": null, "oid": "ORG-CFL2-RIPE", "org": "Community Fibre Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.communityfibre.co.uk"}, "pfx": 101, "reg": "2014-06-30", "rir": "ripencc", "s24": 867, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 221952, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04485116776733}, {"a": 201898, "h": "AS-BLUEWAVE", "n": "BlueWave Communications Limited", "t": "Other", "w": 0, "cc": "IM", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.089, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-BCL24-RIPE", "org": "BlueWave Communications Limited", "pdb": null, "pfx": 1, "reg": "2014-06-10", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001634692664}, {"a": 201988, "h": "VPSPay-ASN", "n": "VPSPay Networks LTD", "t": "Hosting & VPS", "w": 4, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5991, "hi": 7.23, "lo": 1.27, "ips": 3, "mean": 3.73, "above": false}, "vulncheck": {"n": 1, "p": 0.1929, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.786, 2.978, 0, false], ["2026-10-12", 5.768, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.279, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 0}, "lo": 5.768, "se": 0.692, "ts": 0.750, "map": 15.497, "obs": 4, "own": 3.100, "comp": {"cins": -0.513, "dshield": -1.0162, "crowdsec": 7.1554, "vulncheck": 1.1181, "blocklist_de": -2.6099}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.737, "det": {"threatfox": {"family:Hook": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-VA33482-RIPE", "org": "VPSPay Networks LTD", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "https://vpspay.cloud"}, "pfx": 27, "reg": "2026-01-23", "rir": "ripencc", "s24": 27, "sib": 0, "tor": 1, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00048465828824}, {"a": 201999, "h": "Serverpars", "n": "Fanavari Serverpars Argham Gostar Company Ltd.", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 4.331, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.983, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-RPKS1-RIPE", "org": "Fanavari Serverpars Argham Gostar Company Ltd.", "pdb": null, "pfx": 8, "reg": "2014-05-08", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202015, "h": "HZ-US-AS", "n": "HZ Hosting Ltd", "t": "Hosting & VPS", "w": 3, "cc": "BG", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1806, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "threatfox": {"n": 1, "p": 0.1937, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.735, 0.309, 0, false], ["2026-10-12", 0.192, 0.322, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.322, "se": 1.473, "ts": 1.000, "map": 2.768, "obs": 1, "own": 1.255, "comp": {"urlhaus": -0.1469, "threatfox": 3.1052, "phishing_db": -0.314}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.192, "se": 1.222, "ts": 1.000, "map": 1.409, "obs": 1, "own": 0.311, "comp": {"cins": -0.1508, "dshield": 4.385, "crowdsec": -1.3656, "vulncheck": -0.3475, "blocklist_de": -0.7849}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:AdaptixC2": 1, "family:RansomHub": 1}}, "oid": "ORG-FNL9-RIPE", "org": "HZ Hosting Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.hostzealot.com/"}, "pfx": 53, "reg": "2014-05-02", "rir": "ripencc", "s24": 80, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202050, "h": "STIMO", "n": "STIMO.NET Sp. z o.o.", "t": "Transit & backbone", "w": 2, "cc": "PL", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.474, 0.011, 0, false], ["2026-10-12", 0.518, 0.012, 0, false]], "sh": false, "uc": 1510.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.869, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.518, "se": 1.397, "ts": 1.000, "map": 5.252, "obs": 1, "own": 20.125, "comp": {"cins": -0.0996, "dshield": -0.233, "crowdsec": -0.9227, "vulncheck": -0.2573, "blocklist_de": 4.5647}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.157, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-SSZO141-RIPE", "org": "STIMO.NET SP. Z O.O.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://stimo.net"}, "pfx": 14, "reg": "2014-04-24", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005310815289}, {"a": 202053, "h": "UPCLOUD", "n": "UpCloud", "t": "Hosting & VPS", "w": 6, "cc": "FI", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "first_seen_30d": 1, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2021-3129": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 21, "p": 1.0000, "hi": 17.78, "lo": 8.76, "ips": 21, "mean": 12.94, "above": true}, "urlhaus": {"n": 1, "p": 0.1860, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 2, "p": 0.0815, "hi": 3.36, "lo": 0.44, "ips": 2, "mean": 1.60, "above": false}, "threatfox": {"n": 1, "p": 0.1777, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "vulncheck": {"n": 2, "p": 0.3179, "hi": 5.37, "lo": 0.70, "ips": 2, "mean": 2.56, "above": false}, "phishing_db": {"n": 1, "p": 0.1379, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 1.166, 0.552, 0, false], ["2026-10-12", 0.523, 1.531, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 1}, "lo": 1.531, "se": 1.040, "ts": 0.333, "map": 5.499, "obs": 3, "own": 2.159, "comp": {"urlhaus": 2.4079, "threatfox": 0.6157, "phishing_db": 0.307}, "mass": 2.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.523, "se": 0.678, "ts": 0.500, "map": 1.337, "obs": 4, "own": 0.271, "comp": {"cins": -0.5347, "dshield": -1.0508, "crowdsec": 3.2011, "vulncheck": 2.7852, "blocklist_de": -2.7167}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.865, "det": {"shodan": {"c2": 4, "compromised": 17}, "threatfox": {"family:Mirai": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}}, "oid": "ORG-UL87-RIPE", "org": "UpCloud Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.upcloud.com"}, "pfx": 68, "reg": "2014-04-24", "rir": "ripencc", "s24": 328, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 83968, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00918903410261}, {"a": 202105, "h": "WafaiNet-AS", "n": "Wafai Net", "t": "Hosting & VPS", "w": 0, "cc": "SA", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3465, "hi": 5.61, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 0.240, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.877, "ts": null, "map": 0.182, "obs": 0, "own": 0.084, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-AICI1-RIPE", "org": "Al wafai International For Communication and Information Technology LLC", "pdb": {"t": "Content", "sc": "Middle East", "tr": null, "pol": "Open", "web": "https://wafaicloud.com"}, "pfx": 57, "reg": "2014-04-08", "rir": "ripencc", "s24": 57, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015790655382}, {"a": 202226, "h": "GreatFlower", "n": "Emil Vitukhnovskii trading as Great Flower", "t": "Other", "w": 2, "cc": "IL", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2026-4020": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "threatfox": {"n": 1, "p": 0.1983, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.513, 0.616, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.616, "se": 1.623, "ts": 1.000, "map": 7.289, "obs": 1, "own": 9.157, "comp": {"urlhaus": -0.0646, "threatfox": 3.8345, "phishing_db": -0.1574}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 3.557, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.761, "det": {"threatfox": {"family:Remcos": 1}}, "oid": "ORG-GF121-RIPE", "org": "Emil Vitukhnovskii trading as Great Flower", "pdb": null, "pfx": 13, "reg": "2026-01-15", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009958422264}, {"a": 202269, "h": "BitCommand", "n": "BitCommand LLC", "t": "Other", "w": 1, "cc": "AM", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 14.042, 0.011, 1, false], ["2026-10-12", 0.534, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 3.772, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.752, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BA1104-RIPE", "org": "BitCommand LLC", "pdb": null, "pfx": 12, "reg": "2018-06-14", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202302, "h": "NETH-AS", "n": "NETH LLC", "t": "Other", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.007, 0.011, 0, false], ["2026-10-12", 0.442, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.442, "se": 1.377, "ts": 1.000, "map": 4.186, "obs": 1, "own": 2.955, "comp": {"cins": -0.0685, "dshield": -0.1625, "crowdsec": -0.644, "vulncheck": 4.0589, "blocklist_de": -0.3584}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.682, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-NL365-RIPE", "org": "NETH LLC", "pdb": null, "pfx": 12, "reg": "2018-06-06", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202306, "h": "HOSTGLOBALPLUS-AS", "n": "HOSTGLOBAL.PLUS", "t": "Hosting & VPS", "w": 20, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 1, "web_exploit": 14, "bad_crawling": 6, "web_bruteforce": 13, "home_connection": 11, "cve:CVE-2014-8739": 1, "cve:CVE-2017-16894": 12, "cve:CVE-2019-17050": 12, "cve:CVE-2021-40655": 3, "cve:CVE-2021-41714": 12}, "n": 16}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "urlhaus": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 16, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 1.091, 0, false], ["2026-10-12", 19.114, 1.134, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.134, "se": 1.974, "ts": 1.000, "map": 18.025, "obs": 1, "own": 17.366, "comp": {"urlhaus": 4.5703, "threatfox": -0.0189, "phishing_db": -0.0334}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 19.114, "se": 1.138, "ts": 0.500, "map": 120.995, "obs": 2, "own": 25.672, "comp": {"cins": -0.1615, "dshield": 4.3289, "crowdsec": 3.226, "vulncheck": -0.3639, "blocklist_de": -0.84}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.434, "det": null, "oid": "ORG-HL257-RIPE", "org": "HOSTGLOBAL.PLUS LTD", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://hostglobal.plus"}, "pfx": 1, "reg": "2018-06-06", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202375, "h": "DIGITALBOX", "n": "Digital Albox SL", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2213.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.261, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-DAS10-RIPE", "org": "Digital Albox SL", "pdb": null, "pfx": 9, "reg": "2018-05-23", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202376, "h": "ARVID-LOGICUM", "n": "Arvid Logicum OU", "t": "Other", "w": 0, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.911, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ALO4-RIPE", "org": "Arvid Logicum OU", "pdb": null, "pfx": 8, "reg": "2018-05-23", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018816939862}, {"a": 202391, "h": "AfraRasa-AS-1", "n": "Cooperative Afra ertebatat-e-sabet-e Rasa Co", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1877, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 1, "p": 0.1471, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.238, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.613, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.238, "se": 1.255, "ts": 1.000, "map": 1.852, "obs": 1, "own": 1.193, "comp": {"cins": 4.9003, "dshield": -0.351, "crowdsec": -1.3887, "vulncheck": -0.3517, "blocklist_de": -0.799}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.592, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CAER1-RIPE", "org": "Cooperative Afra ertebatat-e-sabet-e Rasa Co", "pdb": null, "pfx": 51, "reg": "2018-05-22", "rir": "ripencc", "s24": 62, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024873984885}, {"a": 202412, "h": "OMEGATECH-AS", "n": "Omegatech LTD", "t": "Other", "w": 262, "cc": "SC", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.37}, "cs": {"c": {"http_flood": 83, "data_centre": 33, "web_exploit": 96, "bad_crawling": 64, "proxy_or_vpn": 13, "first_seen_30d": 19, "ssh_bruteforce": 46, "web_bruteforce": 79, "home_connection": 3, "mail_bruteforce": 63, "router_or_botnet": 2, "cve:CVE-2017-9841": 19, "cve:CVE-2021-3129": 6, "cve:CVE-2018-13379": 6, "cve:CVE-2018-20062": 6, "cve:CVE-2021-41773": 15}, "n": 201}, "ev": {"shodan": {"n": 5, "p": 0.8998, "hi": 10.00, "lo": 2.49, "ips": 5, "mean": 5.71, "above": true}, "dshield": {"n": 6, "p": 0.9645, "hi": 11.69, "lo": 3.24, "ips": 17, "mean": 6.91, "above": true}, "urlhaus": {"n": 5, "p": 0.9154, "hi": 10.49, "lo": 2.61, "ips": 7, "mean": 5.99, "above": true}, "crowdsec": {"n": 17, "p": 1.0000, "hi": 23.97, "lo": 10.94, "ips": 201, "mean": 16.92, "above": true}, "threatfox": {"n": 15, "p": 1.0000, "hi": 23.01, "lo": 10.00, "ips": 31, "mean": 15.94, "above": true}, "vulncheck": {"n": 2, "p": 0.4148, "hi": 6.22, "lo": 0.81, "ips": 5, "mean": 2.96, "above": false}, "phishing_db": {"n": 6, "p": 0.9647, "hi": 11.71, "lo": 3.25, "ips": 6, "mean": 6.92, "above": true}, "blocklist_de": {"n": 13, "p": 1.0000, "hi": 20.15, "lo": 8.25, "ips": 30, "mean": 13.65, "above": true}}, "h2": [["2026-10-05", 128.256, 214.130, 1, false], ["2026-10-12", 158.123, 223.727, 1, false]], "sh": true, "uc": 25944, "v2": {"band": 1, "host": {"n": {"urlhaus": 5, "threatfox": 15, "phishing_db": 6}, "lo": 223.727, "se": 0.671, "ts": 0.577, "map": 452.944, "obs": 26, "own": 367.832, "comp": {"urlhaus": 4.6107, "threatfox": 2.7449, "phishing_db": 0.3864}, "mass": 12.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 6, "crowdsec": 17, "vulncheck": 2, "blocklist_de": 13}, "lo": 158.123, "se": 0.380, "ts": 0.447, "map": 247.475, "obs": 38, "own": 137.687, "comp": {"cins": -2.8967, "dshield": 1.7059, "crowdsec": 1.3397, "vulncheck": -0.6118, "blocklist_de": 7.3678}, "mass": 32.5, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"c2": 3, "malware": 1, "compromised": 1}, "threatfox": {"family:Aisuru": 5, "family:Remcos": 7, "family:PureRAT": 3, "family:AsyncRAT": 5, "family:Cobalt Strike": 3}, "vulncheck": {"attack_tooling": 5}, "blocklist_de": {"ftp": 2, "ssh": 2, "bots": 4, "imap": 13, "mail": 16, "apache": 6, "bruteforcelogin": 4}}, "oid": "ORG-OL329-RIPE", "org": "Omegatech LTD", "pdb": null, "pfx": 24, "reg": "2026-01-12", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 2, "w24": 20, "drop": 15, "hist": [["2026-10-05", 0.9982], ["2026-10-12", 1.0000]], "ipv4": 6144, "abuse": null, "score": 1.0000, "groups": ["sensors", "abusech", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.0092474519326}, {"a": 202422, "h": "GHOST", "n": "Gcore", "t": "Hosting & VPS", "w": 33, "cc": "LU", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.1518, "hi": 4.01, "lo": 0.52, "ips": 2, "mean": 1.91, "above": false}, "crowdsec": {"n": 2, "p": 0.1148, "hi": 3.69, "lo": 0.48, "ips": 2, "mean": 1.76, "above": false}, "threatfox": {"n": 3, "p": 0.6198, "hi": 7.45, "lo": 1.31, "ips": 4, "mean": 3.84, "above": false}, "vulncheck": {"n": 1, "p": 0.1447, "hi": 4.16, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "phishing_db": {"n": 14, "p": 1.0000, "hi": 19.37, "lo": 8.18, "ips": 25, "mean": 13.27, "above": true}, "blocklist_de": {"n": 1, "p": 0.1028, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 1.263, 9.185, 0, false], ["2026-10-12", 0.788, 9.658, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 14}, "lo": 9.658, "se": 0.754, "ts": 0.824, "map": 20.606, "obs": 17, "own": 7.253, "comp": {"urlhaus": -1.7444, "threatfox": 0.7135, "phishing_db": 5.6827}, "mass": 7.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.788, "se": 0.671, "ts": 0.500, "map": 2.029, "obs": 4, "own": 0.407, "comp": {"cins": -0.6404, "dshield": -1.2114, "crowdsec": 2.1026, "vulncheck": 0.7759, "blocklist_de": 1.0745}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.381, "det": {"shodan": {"c2": 1, "malware": 1}, "threatfox": {"family:pupy": 2, "family:AdaptixC2": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-WIG6-RIPE", "org": "G-Core Labs S.A.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://gcore.com/"}, "pfx": 266, "reg": "2018-05-17", "rir": "ripencc", "s24": 266, "sib": 2, "tor": 1, "w24": 20, "drop": 1, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 68096, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00200569124339}, {"a": 202425, "h": "INT-NETWORK", "n": "IP Volume", "t": "Hosting & VPS", "w": 124, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 17, "data_centre": 16, "web_exploit": 18, "bad_crawling": 10, "proxy_or_vpn": 1, "ssh_bruteforce": 11, "web_bruteforce": 10, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2018-13379": 1, "cve:CVE-2023-23752": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 20}, "ev": {"cins": {"n": 7, "p": 0.9865, "hi": 12.85, "lo": 3.89, "ips": 90, "mean": 7.82, "above": true}, "dshield": {"n": 1, "p": 0.1862, "hi": 4.61, "lo": 0.35, "ips": 7, "mean": 1.94, "above": false}, "crowdsec": {"n": 13, "p": 1.0000, "hi": 18.03, "lo": 7.38, "ips": 20, "mean": 12.21, "above": true}, "vulncheck": {"n": 1, "p": 0.1866, "hi": 4.61, "lo": 0.35, "ips": 15, "mean": 1.94, "above": false}, "phishing_db": {"n": 1, "p": 0.1874, "hi": 4.62, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}, "blocklist_de": {"n": 4, "p": 0.7847, "hi": 8.64, "lo": 1.86, "ips": 4, "mean": 4.72, "above": false}}, "h2": [["2026-10-05", 58.387, 0.373, 1, false], ["2026-10-12", 52.252, 0.389, 1, false]], "sh": true, "uc": 930.4, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.389, "se": 1.506, "ts": 1.000, "map": 3.655, "obs": 1, "own": 1.649, "comp": {"urlhaus": -0.1339, "threatfox": -0.1596, "phishing_db": 3.2158}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 1, "crowdsec": 13, "vulncheck": 1, "blocklist_de": 4}, "lo": 52.252, "se": 0.403, "ts": 0.500, "map": 85.366, "obs": 26, "own": 16.600, "comp": {"cins": 12.2768, "dshield": -1.9645, "crowdsec": 0.8777, "vulncheck": -0.7405, "blocklist_de": -4.6089}, "mass": 25.8, "listed": false}}, "abq": false, "bot": 0.937, "det": {"vulncheck": {"botnet_node": 15}, "blocklist_de": {"ftp": 2, "ssh": 1, "mail": 1}}, "oid": "ORG-IVI1-RIPE", "org": "IP Volume inc", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "http://www.ipvolume.net/"}, "pfx": 55, "reg": "2018-05-17", "rir": "ripencc", "s24": 55, "sib": 0, "tor": 0, "w24": 17, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 14080, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "cins"], "traffic": 0.0015527426475}, {"a": 202448, "h": "mvps", "n": "MVPS", "t": "Hosting & VPS", "w": 4, "cc": "CY", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 4.49}, "cs": null, "ev": {"shodan": {"n": 18, "p": 1.0000, "hi": 22.67, "lo": 10.57, "ips": 18, "mean": 16.14, "above": true}, "phishing_db": {"n": 3, "p": 0.6200, "hi": 7.45, "lo": 1.31, "ips": 3, "mean": 3.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1627, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.185, 3.195, 0, false], ["2026-10-12", 0.199, 3.232, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 3.232, "se": 1.002, "ts": 1.000, "map": 11.145, "obs": 3, "own": 4.149, "comp": {"urlhaus": -0.536, "threatfox": -0.3735, "phishing_db": 4.9467}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.199, "se": 1.228, "ts": 1.000, "map": 1.470, "obs": 1, "own": 0.326, "comp": {"cins": -0.1628, "dshield": -0.3707, "crowdsec": -1.4663, "vulncheck": -0.3658, "blocklist_de": 4.1443}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.983, "det": {"shodan": {"c2": 4, "compromised": 14}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-ML501-RIPE", "org": "MVPS LTD", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.mvps.net"}, "pfx": 83, "reg": "2018-05-15", "rir": "ripencc", "s24": 83, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 21248, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.03040436969465}, {"a": 202468, "h": "AbrArvan-AS", "n": "Noyan Abr Arvan Co. ( Private Joint Stock)", "t": "Other", "w": 12, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 4, "ssh_bruteforce": 8, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2024-6387": 2, "cve:CVE-2018-20062": 2}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "shodan": {"n": 57, "p": 1.0000, "hi": 49.64, "lo": 32.18, "ips": 57, "mean": 40.52, "above": true}, "crowdsec": {"n": 9, "p": 0.9802, "hi": 10.22, "lo": 3.53, "ips": 9, "mean": 6.51, "above": true}, "vulncheck": {"n": 3, "p": 0.5764, "hi": 7.01, "lo": 1.24, "ips": 3, "mean": 3.62, "above": false}}, "h2": [["2026-10-05", 5.931, 0.203, 0, false], ["2026-10-12", 4.401, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.959, "ts": null, "map": 0.174, "obs": 0, "own": 0.448, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 9, "vulncheck": 3, "blocklist_de": 0}, "lo": 4.401, "se": 0.471, "ts": 0.692, "map": 8.006, "obs": 13, "own": 4.518, "comp": {"cins": 1.9946, "dshield": -2.1682, "crowdsec": 9.8417, "vulncheck": 0.9616, "blocklist_de": -7.156}, "mass": 9.0, "listed": false}}, "abq": false, "bot": 0.516, "det": {"shodan": {"c2": 2, "compromised": 55}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-NAAP1-RIPE", "org": "Noyan Abr Arvan Co. ( Private Joint Stock)", "pdb": null, "pfx": 86, "reg": "2018-05-09", "rir": "ripencc", "s24": 202, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 55808, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.0028298504223}, {"a": 202492, "h": "SGHL1-AS", "n": "SILVERHILL GROUP HOLDING LTD", "t": "Other", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 0.557, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.815, "ts": null, "map": 0.160, "obs": 0, "own": 0.186, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-SGHL1-RIPE", "org": "SILVERHILL GROUP HOLDING LTD", "pdb": null, "pfx": 36, "reg": "2018-05-07", "rir": "ripencc", "s24": 92, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23552, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000000637428}, {"a": 202502, "h": "Eurolir-AS", "n": "LLC \"ATOM3\"", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-LA1992-RIPE", "org": "LLC \"ATOM3\"", "pdb": null, "pfx": 6, "reg": "2018-05-04", "rir": "ripencc", "s24": 6, "sib": 3, "tor": 0, "w24": 0, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202520, "h": "SKYPASS-AS", "n": "SkyPass Solutions", "t": "Hosting & VPS", "w": 7, "cc": "PL", "cf": null, "cs": {"c": {"data_centre": 3, "ssh_bruteforce": 3, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"urlhaus": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 3, "mean": 2.91, "above": false}, "blocklist_de": {"n": 4, "p": 0.8087, "hi": 9.04, "lo": 1.95, "ips": 5, "mean": 4.94, "above": true}}, "h2": [["2026-10-12", 35.007, 0.817, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.817, "se": 1.744, "ts": 1.000, "map": 11.267, "obs": 1, "own": 6.405, "comp": {"urlhaus": 4.3787, "threatfox": -0.1177, "phishing_db": -0.2129}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 35.007, "se": 0.580, "ts": 0.667, "map": 77.588, "obs": 6, "own": 15.198, "comp": {"cins": -1.0009, "dshield": -1.6787, "crowdsec": -1.0769, "vulncheck": -0.8244, "blocklist_de": 10.326}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.849, "det": {"blocklist_de": {"ssh": 2, "mail": 3}}, "oid": "ORG-SSSZ10-RIPE", "org": "SkyPass Solutions Sp. z o.o.", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://skypass.tech/"}, "pfx": 11, "reg": "2022-12-28", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00036579316332}, {"a": 202561, "h": "highspeed", "n": "High Speed Telekomunikasyon", "t": "Broadband & mobile", "w": 6, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 6, "bad_crawling": 3, "proxy_or_vpn": 4, "ssh_bruteforce": 4, "web_bruteforce": 5, "mail_bruteforce": 2, "router_or_botnet": 5, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"crowdsec": {"n": 5, "p": 0.9078, "hi": 10.24, "lo": 2.55, "ips": 6, "mean": 5.84, "above": true}}, "h2": [["2026-10-05", 15.732, 0.011, 1, false], ["2026-10-12", 24.495, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 2.116, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 24.495, "se": 0.623, "ts": 1.000, "map": 58.643, "obs": 5, "own": 90.381, "comp": {"cins": -0.6873, "dshield": -1.2788, "crowdsec": 11.6325, "vulncheck": -0.742, "blocklist_de": -3.4592}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.352, "det": null, "oid": "ORG-HSTV1-RIPE", "org": "High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "https://highspeed.com.tr"}, "pfx": 10, "reg": "2018-05-02", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00215538557166}, {"a": 202602, "h": "GreenCloud", "n": "GreenCloud", "t": "Hosting & VPS", "w": 0, "cc": "VN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.855, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-OTJS2-RIPE", "org": "Greencloud LLC", "pdb": null, "pfx": 7, "reg": "2022-09-29", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202632, "h": "TXtv", "n": "TXTV d.o.o. Tuzla", "t": "Other", "w": 1, "cc": "BA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1366, "hi": 4.07, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "vulncheck": {"n": 1, "p": 0.1818, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.157, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.021, "ts": null, "map": 0.187, "obs": 0, "own": 0.583, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.157, "se": 1.214, "ts": 1.000, "map": 1.090, "obs": 1, "own": 0.717, "comp": {"cins": -0.1133, "dshield": -0.2635, "crowdsec": -1.0433, "vulncheck": 3.4908, "blocklist_de": -0.591}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.319, "det": {"shodan": {"doublepulsar": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-TDT1-RIPE", "org": "TXTV d.o.o. Tuzla", "pdb": null, "pfx": 23, "reg": "2016-07-07", "rir": "ripencc", "s24": 77, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29440, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00068717853058}, {"a": 202652, "h": "ELEVI-AS", "n": "Elevi AS", "t": "Other", "w": 1, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 11.964, 0.011, 1, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-STA98-RIPE", "org": "Elevi AS", "pdb": null, "pfx": 2, "reg": "2016-07-04", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010399845771}, {"a": 202656, "h": "XServerCloud", "n": "Ivanov Vitaliy Sergeevich", "t": "Hosting & VPS", "w": 2, "cc": "UA", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0012, "hi": 1.58, "lo": 0.12, "ips": 1, "mean": 0.66, "above": false}, "phishing_db": {"n": 1, "p": 0.0840, "hi": 3.46, "lo": 0.26, "ips": 1, "mean": 1.46, "above": false}}, "h2": [["2026-10-05", 0.219, 0.107, 0, false], ["2026-10-12", 0.044, 0.113, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.113, "se": 1.362, "ts": 1.000, "map": 0.720, "obs": 1, "own": 0.342, "comp": {"urlhaus": -0.3386, "threatfox": -0.2964, "phishing_db": 1.9328}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.044, "se": 1.064, "ts": 1.000, "map": 0.238, "obs": 1, "own": 0.050, "comp": {"cins": -0.2359, "dshield": -0.5208, "crowdsec": 2.3958, "vulncheck": -0.4606, "blocklist_de": -1.221}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.828, "det": null, "oid": "ORG-IVS6-RIPE", "org": "Ivanov Vitaliy Sergeevich", "pdb": null, "pfx": 752, "reg": "2023-04-12", "rir": "ripencc", "s24": 756, "sib": 1, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 193536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00341794483503}, {"a": 202660, "h": "BRM-DataCenter", "n": "\"Uzbektelekom\" Joint Stock Company", "t": "Hosting & VPS", "w": 9, "cc": "UZ", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "first_seen_30d": 3, "ssh_bruteforce": 6, "web_bruteforce": 3, "home_connection": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-20062": 3}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 5, "p": 0.8947, "hi": 9.86, "lo": 2.45, "ips": 5, "mean": 5.63, "above": true}, "crowdsec": {"n": 5, "p": 0.8891, "hi": 9.71, "lo": 2.41, "ips": 6, "mean": 5.54, "above": true}, "threatfox": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4123, "hi": 6.20, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 33.032, 0.471, 1, false], ["2026-10-12", 18.416, 0.464, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.464, "se": 1.545, "ts": 1.000, "map": 4.724, "obs": 1, "own": 2.172, "comp": {"urlhaus": -0.0987, "threatfox": 3.5048, "phishing_db": -0.2273}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 1}, "lo": 18.416, "se": 0.519, "ts": 0.556, "map": 36.216, "obs": 9, "own": 7.120, "comp": {"cins": 2.7294, "dshield": -1.8464, "crowdsec": 5.2854, "vulncheck": 0.8438, "blocklist_de": -2.029}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.780, "det": {"shodan": {"compromised": 5}, "threatfox": {"family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"apache": 1}}, "oid": "ORG-UNCN1-RIPE", "org": "\"Uzbektelekom\" Joint Stock Company", "pdb": null, "pfx": 14, "reg": "2016-07-01", "rir": "ripencc", "s24": 31, "sib": 2, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7936, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.000058110036}, {"a": 202662, "h": "AS-Hytron", "n": "Hytron Network Services (US) LLC - AS202662", "t": "Broadband & mobile", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3802, "hi": 5.90, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.897, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.431, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HNSL3-RIPE", "org": "Hytron Network Services Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Asia Pacific", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.hytron.io"}, "pfx": 49, "reg": "2022-09-28", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 21760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00505953621494}, {"a": 202670, "h": "cloudzmeasn1", "n": "CLOUDZME FZE", "t": "Hosting & VPS", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.745, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CF46-RIPE", "org": "CLOUDZME FZE", "pdb": null, "pfx": 2, "reg": "2016-06-30", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202736, "h": "WISDOM", "n": "WISDOM", "t": "Transit & backbone", "w": 0, "cc": "SG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.000, "ts": null, "map": 0.183, "obs": 0, "own": 1.881, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.793, "ts": null, "map": 0.152, "obs": 0, "own": 0.936, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.523, "det": null, "oid": "ORG-WCIT2-RIPE", "org": "WISDOM CLOUD INTERNET TECHNOLOGY PTE. LTD.", "pdb": {"t": "NSP", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.wisdomisp.com"}, "pfx": 108, "reg": "2022-09-22", "rir": "ripencc", "s24": 109, "sib": 2, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28416, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004845304389}, {"a": 202757, "h": "CASTLE-IT", "n": "CASTLE-IT", "t": "Other", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.782, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.422, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.367, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PCS21-RIPE", "org": "PLT Connectic SARL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://castle-it.fr"}, "pfx": 18, "reg": "2016-06-09", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202759, "h": "FairyHosting", "n": "RJ Network OU", "t": "Hosting & VPS", "w": 0, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.311, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.269, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.111, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.637, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RNO2-RIPE", "org": "RJ Network OU", "pdb": null, "pfx": 33, "reg": "2016-06-08", "rir": "ripencc", "s24": 33, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0018071569579}, {"a": 202799, "h": "SYSECT", "n": "SYSECT D.O.O.", "t": "Other", "w": 5, "cc": "ME", "cf": null, "cs": null, "ev": {"threatfox": {"n": 4, "p": 0.8147, "hi": 9.14, "lo": 1.97, "ips": 4, "mean": 4.99, "above": true}, "phishing_db": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.638, 20.455, 1, false], ["2026-10-12", 0.012, 52.244, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 1}, "lo": 52.244, "se": 0.844, "ts": 0.800, "map": 143.388, "obs": 5, "own": 123.680, "comp": {"urlhaus": -0.5735, "threatfox": 6.1132, "phishing_db": 1.052}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.480, "det": {"threatfox": {"family:Aisuru": 3, "family:PureRAT": 1}}, "oid": "ORG-SD317-RIPE", "org": "SYSECT D.O.O.", "pdb": null, "pfx": 6, "reg": "2022-09-20", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.1060]], "ipv4": 1792, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00000001338589}, {"a": 202843, "h": "PlayboxTechML", "n": "Playbox Technology ME Ltd.", "t": "Other", "w": 0, "cc": "BG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.269, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PTML1-RIPE", "org": "Playbox Technology ME Ltd.", "pdb": null, "pfx": 1, "reg": "2016-05-20", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202870, "h": "as_dimensione", "n": "Dimensione", "t": "Broadband & mobile", "w": 1, "cc": "IT", "cf": null, "cs": {"c": {"data_centre": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.2967, "hi": 5.20, "lo": 0.67, "ips": 2, "mean": 2.48, "above": false}, "crowdsec": {"n": 1, "p": 0.1083, "hi": 3.76, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}, "blocklist_de": {"n": 1, "p": 0.1564, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 1.350, 0.011, 0, false], ["2026-10-12", 0.703, 0.012, 0, false]], "sh": false, "uc": 1377.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.006, "ts": null, "map": 0.184, "obs": 0, "own": 1.357, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.703, "se": 0.903, "ts": 0.500, "map": 2.796, "obs": 2, "own": 4.472, "comp": {"cins": -0.3531, "dshield": -0.7436, "crowdsec": 1.1896, "vulncheck": -0.5699, "blocklist_de": 2.899}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.197, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"mail": 1}}, "oid": "ORG-DS258-RIPE", "org": "Dimensione S.r.l.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.dimensione.com"}, "pfx": 37, "reg": "2016-05-17", "rir": "ripencc", "s24": 99, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0034082880585}, {"a": 202914, "h": "adeodc", "n": "Adeo DC", "t": "Other", "w": 9, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1554, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 1, "p": 0.1875, "hi": 4.62, "lo": 0.35, "ips": 9, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.206, 0.011, 0, false], ["2026-10-12", 0.201, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 0.641, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.201, "se": 1.246, "ts": 1.000, "map": 1.486, "obs": 1, "own": 0.989, "comp": {"cins": -0.1025, "dshield": -0.2396, "crowdsec": -0.949, "vulncheck": 3.6161, "blocklist_de": -0.5353}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.814, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 9}}, "oid": "ORG-ADA25-RIPE", "org": "Adeo Datacenter ApS", "pdb": {"t": null, "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.adeodc.dk"}, "pfx": 33, "reg": "2016-05-04", "rir": "ripencc", "s24": 51, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035760000267}, {"a": 202958, "h": "Hoster-ALM", "n": "LLP \"Kompaniya Hoster.KZ\"", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 11, "p": 0.9998, "hi": 16.64, "lo": 6.33, "ips": 11, "mean": 10.97, "above": true}}, "h2": [["2026-10-05", 1.280, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.254, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.096, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.690, "det": {"shodan": {"compromised": 11}}, "oid": "ORG-LH46-RIPE", "org": "LLP \"Kompaniya Hoster.KZ\"", "pdb": null, "pfx": 44, "reg": "2016-04-26", "rir": "ripencc", "s24": 44, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 11264, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00013083026733}, {"a": 202972, "h": "ROKUNET", "n": "ROKUNET BILISIM HIZMETLERI ANONIM SIRKETI", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.647, "det": null, "oid": "ORG-RBHA3-RIPE", "org": "ROKUNET BILISIM HIZMETLERI ANONIM SIRKETI", "pdb": null, "pfx": 1, "reg": "2026-04-15", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 202987, "h": "FNS", "n": "Fiber Networks Services", "t": "Broadband & mobile", "w": 1, "cc": "LB", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 2832, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 13.830, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "ORG-FNSS2-RIPE", "org": "Fiber Networks Services S.A.R.L", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "http://www.fns-lb.com"}, "pfx": 8, "reg": "2018-04-25", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004106560689}, {"a": 203003, "h": "magna-capax", "n": "Magna Capax Finland Oy", "t": "Other", "w": 2, "cc": "FI", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1973, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 3.809, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 3.809, "se": 1.022, "ts": 0.500, "map": 18.499, "obs": 2, "own": 11.420, "comp": {"cins": 4.8082, "dshield": -0.44, "crowdsec": -1.7394, "vulncheck": 2.6996, "blocklist_de": -1.017}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.696, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-MCFO1-RIPE", "org": "Magna Capax Finland Oy", "pdb": null, "pfx": 3, "reg": "2016-04-18", "rir": "ripencc", "s24": 8, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023645601105}, {"a": 203020, "h": "HostRoyale", "n": "HostRoyale", "t": "Hosting & VPS", "w": 58, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 2.70, "waf": 5.47}, "cs": {"c": {"http_flood": 11, "data_centre": 10, "web_exploit": 12, "bad_crawling": 11, "web_bruteforce": 11, "cve:CVE-2017-9841": 2, "cve:CVE-2017-16894": 2, "cve:CVE-2022-35914": 6, "cve:CVE-2022-46604": 4, "cve:CVE-2024-28000": 5}, "n": 13}, "ev": {"dshield": {"n": 1, "p": 0.0011, "hi": 1.55, "lo": 0.12, "ips": 1, "mean": 0.65, "above": false}, "crowdsec": {"n": 7, "p": 0.0000, "hi": 1.18, "lo": 0.36, "ips": 13, "mean": 0.72, "above": false}, "phishing_db": {"n": 21, "p": 0.9999, "hi": 10.56, "lo": 5.20, "ips": 36, "mean": 7.68, "above": true}, "blocklist_de": {"n": 7, "p": 0.0154, "hi": 2.58, "lo": 0.78, "ips": 8, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.389, 1.092, 0, false], ["2026-10-12", 0.455, 1.099, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 21}, "lo": 1.099, "se": 0.828, "ts": 1.000, "map": 2.403, "obs": 21, "own": 0.964, "comp": {"urlhaus": -2.1379, "threatfox": -0.5612, "phishing_db": 5.2023}, "mass": 13.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 7}, "lo": 0.455, "se": 0.450, "ts": 0.467, "map": 0.794, "obs": 15, "own": 0.156, "comp": {"cins": -2.1641, "dshield": -1.3025, "crowdsec": -1.0352, "vulncheck": -0.9486, "blocklist_de": 6.6132}, "mass": 16.8, "listed": false}}, "abq": false, "bot": 0.689, "det": {"blocklist_de": {"bots": 4, "imap": 1, "mail": 2, "apache": 3, "bruteforcelogin": 2}}, "oid": "ORG-HTPL1-RIPE", "org": "HostRoyale Technologies Pvt Ltd", "pdb": null, "pfx": 1661, "reg": "2016-04-14", "rir": "ripencc", "s24": 3815, "sib": 7, "tor": 0, "w24": 36, "drop": 5, "hist": [["2026-10-05", 0.6580], ["2026-10-12", 0.7222]], "ipv4": 1240320, "abuse": null, "score": 0.7222, "groups": ["cloudflare", "phishing"], "sensors": [], "traffic": 0.104341}, {"a": 203084, "h": "MIKROTTI-NET", "n": "Mikrotti Kft", "t": "Other", "w": 0, "cc": "HU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.763, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MK84-RIPE", "org": "Mikrotti Kft", "pdb": null, "pfx": 2, "reg": "2016-04-01", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002613690636}, {"a": 203087, "h": "gohost-KZ", "n": "Fedinyak Sergey Vyacheslavovich", "t": "Hosting & VPS", "w": 3, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4006, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 2, "mean": 1.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1957, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.431, 0.575, 0, false], ["2026-10-12", 0.462, 0.597, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.597, "se": 1.612, "ts": 1.000, "map": 6.960, "obs": 1, "own": 3.305, "comp": {"urlhaus": -0.0756, "threatfox": -0.1005, "phishing_db": 3.7425}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 1.063, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.645, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-PFSV1-RIPE", "org": "Fedinyak Sergey Vyacheslavovich", "pdb": null, "pfx": 16, "reg": "2016-04-01", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021078287832}, {"a": 203090, "h": "BitsFlowCloud", "n": "BitsFlowCloud", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.498, 0, false], ["2026-10-12", 0.405, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.288, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.405, "se": 1.346, "ts": 1.000, "map": 3.741, "obs": 1, "own": 0.874, "comp": {"cins": -0.1161, "dshield": -0.2696, "crowdsec": -1.0675, "vulncheck": -0.2886, "blocklist_de": 4.4547}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.740, "det": {"shodan": {"c2": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-BL629-RIPE", "org": "BITSFLOWCLOUD LTD", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://bitsflow.cloud"}, "pfx": 21, "reg": "2026-02-23", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203120, "h": "GTGL", "n": "Global Telecom Group LLC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-GTGL1-RIPE", "org": "Global Telecom Group LLC", "pdb": null, "pfx": 3, "reg": "2016-03-29", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203154, "h": "MITELIS-DOWNSTREAM", "n": "MITELIS-DOWNSTREAM", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.534, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.534, "se": 1.402, "ts": 1.000, "map": 5.463, "obs": 1, "own": 1.314, "comp": {"cins": -0.089, "dshield": -0.2092, "crowdsec": 4.0906, "vulncheck": -0.2358, "blocklist_de": -0.4649}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.284, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-MSL55-RIPE", "org": "MITELIS SECURITY LIMITED", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://mitelis.net"}, "pfx": 12, "reg": "2025-12-05", "rir": "ripencc", "s24": 12, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203172, "h": "QUPRA-AS", "n": "Qupra B.V.", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4034, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.410, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.742, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-QB15-RIPE", "org": "Qupra B.V.", "pdb": {"t": null, "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.quprawholesale.com"}, "pfx": 10, "reg": "2022-08-25", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203183, "h": "FOBOSTELECOM", "n": "ARNOLD CALLE TELECOM, S.L.", "t": "Broadband & mobile", "w": 3, "cc": "ES", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 3, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.606, 0.011, 0, false], ["2026-10-12", 5.141, 0.012, 0, false]], "sh": false, "uc": 4052.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.141, "se": 1.021, "ts": 1.000, "map": 25.709, "obs": 2, "own": 41.809, "comp": {"cins": -0.2678, "dshield": -0.5836, "crowdsec": -2.3041, "vulncheck": -0.4946, "blocklist_de": 8.2907}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.159, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-ACTS1-RIPE", "org": "ARNOLD CALLE TELECOM, S.L.", "pdb": null, "pfx": 6, "reg": "2016-03-14", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203200, "h": "ALPEINSSAG", "n": "ALPEIN Software SWISS AG", "t": "Other", "w": 0, "cc": "CH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.959, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ASSA17-RIPE", "org": "ALPEIN Software SWISS AG", "pdb": null, "pfx": 3, "reg": "2016-03-10", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203214, "h": "HulumTele", "n": "Hulum Almustakbal", "t": "Other", "w": 82, "cc": "IQ", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 14, "proxy_or_vpn": 3, "ssh_bruteforce": 43, "web_bruteforce": 49, "mail_bruteforce": 52, "router_or_botnet": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-63030": 4}, "n": 54}, "ev": {"cins": {"n": 2, "p": 0.1805, "hi": 4.25, "lo": 0.55, "ips": 2, "mean": 2.03, "above": false}, "dshield": {"n": 1, "p": 0.0462, "hi": 2.94, "lo": 0.22, "ips": 2, "mean": 1.24, "above": false}, "crowdsec": {"n": 37, "p": 1.0000, "hi": 12.11, "lo": 7.08, "ips": 54, "mean": 9.45, "above": true}, "blocklist_de": {"n": 39, "p": 1.0000, "hi": 22.97, "lo": 13.62, "ips": 57, "mean": 18.04, "above": true}}, "h2": [["2026-10-05", 8.150, 0.008, 0, false], ["2026-10-12", 9.318, 0.009, 0, false]], "sh": false, "uc": 1877.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.126, "obs": 0, "own": 0.249, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 37, "vulncheck": 0, "blocklist_de": 39}, "lo": 9.318, "se": 0.366, "ts": 0.494, "map": 14.270, "obs": 79, "own": 7.992, "comp": {"cins": -1.9903, "dshield": -3.0469, "crowdsec": -1.4505, "vulncheck": -1.0032, "blocklist_de": 11.5427}, "mass": 89.3, "listed": false}}, "abq": false, "bot": 0.185, "det": {"blocklist_de": {"bots": 1, "imap": 46, "mail": 56}}, "oid": "ORG-HACF1-RIPE", "org": "Hulum Almustakbal Company for Communication Engineering and Services Ltd", "pdb": null, "pfx": 675, "reg": "2016-03-07", "rir": "ripencc", "s24": 1136, "sib": 0, "tor": 0, "w24": 51, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 555008, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.02765010738516}, {"a": 203217, "h": "HORIZON-SCOPE-IQ", "n": "Horizon Scope - IQ", "t": "Hosting & VPS", "w": 0, "cc": "IQ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 422.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 0.234, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.864, "ts": null, "map": 0.178, "obs": 0, "own": 0.080, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.233, "det": null, "oid": "ORG-HSMT1-RIPE", "org": "Horizon Scope Mobile Telecom WLL", "pdb": {"t": "Network Services", "sc": "Middle East", "tr": "300-500Gbps", "pol": "Selective", "web": "https://horizonscope.com/"}, "pfx": 94, "reg": "2016-03-07", "rir": "ripencc", "s24": 63, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 32256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00061590677928}, {"a": 203273, "h": "NetCraftersOU", "n": "NetCrafters OU", "t": "Other", "w": 12, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 13, "p": 0.9999, "hi": 15.09, "lo": 6.18, "ips": 13, "mean": 10.22, "above": true}, "crowdsec": {"n": 2, "p": 0.1876, "hi": 4.31, "lo": 0.56, "ips": 2, "mean": 2.06, "above": false}, "threatfox": {"n": 5, "p": 0.9078, "hi": 10.24, "lo": 2.55, "ips": 6, "mean": 5.84, "above": true}, "vulncheck": {"n": 2, "p": 0.3650, "hi": 5.77, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "phishing_db": {"n": 2, "p": 0.3688, "hi": 5.81, "lo": 0.75, "ips": 2, "mean": 2.77, "above": false}}, "h2": [["2026-10-05", 3.332, 6.051, 0, false], ["2026-10-12", 0.925, 5.191, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 2}, "lo": 5.191, "se": 0.840, "ts": 0.714, "map": 12.788, "obs": 7, "own": 12.155, "comp": {"urlhaus": -1.0406, "threatfox": 4.0893, "phishing_db": 1.126}, "mass": 3.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.925, "se": 0.684, "ts": 0.500, "map": 2.404, "obs": 4, "own": 1.400, "comp": {"cins": -0.5103, "dshield": -1.0118, "crowdsec": 3.4681, "vulncheck": 2.9212, "blocklist_de": -2.5964}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.604, "det": {"shodan": {"c2": 4, "compromised": 9}, "threatfox": {"family:DCRat": 3, "family:PureRAT": 3}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-NO63-RIPE", "org": "NetCrafters OU", "pdb": null, "pfx": 171, "reg": "2025-12-03", "rir": "ripencc", "s24": 173, "sib": 0, "tor": 0, "w24": 11, "drop": 2, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 44800, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.00190447923572}, {"a": 203346, "h": "AS-232WEB", "n": "Proper Support LLP", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.983, "ts": null, "map": 0.180, "obs": 0, "own": 0.497, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.759, "ts": null, "map": 0.139, "obs": 0, "own": 0.145, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.698, "det": null, "oid": "ORG-PSL18-RIPE", "org": "Proper Support LLP", "pdb": null, "pfx": 99, "reg": "2022-08-12", "rir": "ripencc", "s24": 141, "sib": 0, "tor": 0, "w24": 0, "drop": 66, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00140101438918}, {"a": 203363, "h": "KUROIT", "n": "Kuroit (UK)", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 3.849, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.851, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KURO1-RIPE", "org": "Kuroit Limited", "pdb": {"t": null, "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.kuroit.com/"}, "pfx": 9, "reg": "2022-08-12", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203380, "h": "DAInternationalGroup", "n": "DA International Group Ltd.", "t": "Other", "w": 3, "cc": "BG", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "first_seen_30d": 1, "web_bruteforce": 3}, "n": 3}, "ev": {"shodan": {"n": 7, "p": 0.9768, "hi": 11.59, "lo": 3.51, "ips": 7, "mean": 7.05, "above": true}, "crowdsec": {"n": 3, "p": 0.5361, "hi": 6.64, "lo": 1.17, "ips": 3, "mean": 3.43, "above": false}}, "h2": [["2026-10-05", 1.928, 0.344, 0, false], ["2026-10-12", 1.995, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.032, "ts": null, "map": 0.188, "obs": 0, "own": 0.611, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.995, "se": 0.757, "ts": 1.000, "map": 6.073, "obs": 3, "own": 3.480, "comp": {"cins": -0.4738, "dshield": -0.9523, "crowdsec": 7.6883, "vulncheck": -0.6487, "blocklist_de": -2.416}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"c2": 1, "compromised": 6}}, "oid": "ORG-DIGL1-RIPE", "org": "DA International Group Ltd.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://alphavps.com"}, "pfx": 62, "reg": "2016-02-01", "rir": "ripencc", "s24": 63, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 16128, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00068158986259}, {"a": 203410, "h": "COLOBIX", "n": "COLOBIX", "t": "Hosting & VPS", "w": 3, "cc": "CY", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4176, "hi": 6.24, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 1.741, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.741, "se": 0.979, "ts": 1.000, "map": 7.702, "obs": 2, "own": 1.662, "comp": {"cins": -0.1644, "dshield": -0.3741, "crowdsec": -1.4796, "vulncheck": 6.3082, "blocklist_de": -0.8549}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.972, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-CL701-RIPE", "org": "COLOBIX LTD", "pdb": {"t": null, "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "http://www.colobix.com"}, "pfx": 13, "reg": "2022-08-11", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023435417789}, {"a": 203443, "h": "INDERTCONNECTION", "n": "INDERT CONNECTION LP", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.403, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.720, "det": null, "oid": "ORG-ICL35-RIPE", "org": "INDERT CONNECTION LP", "pdb": null, "pfx": 9, "reg": "2016-01-19", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203446, "h": "AS203446", "n": "SMARTNET Germany GmbH", "t": "Enterprise, edu & gov", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6228, "hi": 7.48, "lo": 1.32, "ips": 3, "mean": 3.86, "above": false}}, "h2": [["2026-10-05", 0.011, 4.027, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 3.304, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 4.299, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.650, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:PureRAT": 1}}, "oid": "ORG-SGG9-RIPE", "org": "SMARTNET Germany GmbH", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "300-500Gbps", "pol": "Selective", "web": "http://as203446.net"}, "pfx": 17, "reg": "2022-08-04", "rir": "ripencc", "s24": 17, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00125491144215}, {"a": 203448, "h": "Telecom1-R01", "n": "Telecom 1 AS203448", "t": "Broadband & mobile", "w": 3, "cc": "GE", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 3.00, "above": false}}, "h2": [["2026-10-12", 5.988, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 5.988, "se": 1.057, "ts": 1.000, "map": 30.890, "obs": 2, "own": 53.004, "comp": {"cins": -0.1248, "dshield": -0.2887, "crowdsec": -1.143, "vulncheck": 7.0311, "blocklist_de": -0.6504}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.248, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-TL885-RIPE", "org": "Telecom 1 LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://telecomm1.com/"}, "pfx": 1, "reg": "2016-01-15", "rir": "ripencc", "s24": 3, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000383337864}, {"a": 203451, "h": "K-Telecom-Network", "n": "K-telekom LLC", "t": "Broadband & mobile", "w": 18, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 9, "p": 0.9988, "hi": 15.50, "lo": 5.36, "ips": 18, "mean": 9.87, "above": true}}, "h2": [["2026-10-12", 25.293, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 9, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 25.293, "se": 0.500, "ts": 1.000, "map": 48.766, "obs": 9, "own": 74.723, "comp": {"cins": -1.1897, "dshield": 20.4884, "crowdsec": -7.3526, "vulncheck": -0.8576, "blocklist_de": -5.8079}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.423, "det": null, "oid": "ORG-KL174-RIPE", "org": "K-telekom LLC", "pdb": null, "pfx": 26, "reg": "2016-01-15", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.00194680801253}, {"a": 203476, "h": "GANDI-AS-2", "n": "Gandi Hosting and Services", "t": "Hosting & VPS", "w": 4, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.5505, "hi": 6.77, "lo": 1.19, "ips": 3, "mean": 3.49, "above": false}, "crowdsec": {"n": 2, "p": 0.3131, "hi": 5.33, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}, "vulncheck": {"n": 1, "p": 0.1837, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.779, 0.343, 0, false], ["2026-10-12", 1.525, 0.357, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.357, "se": 1.490, "ts": 1.000, "map": 3.237, "obs": 1, "own": 1.457, "comp": {"urlhaus": -0.1461, "threatfox": -0.1705, "phishing_db": 3.1175}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.525, "se": 0.771, "ts": 0.667, "map": 4.688, "obs": 3, "own": 0.953, "comp": {"cins": -0.4019, "dshield": -0.8303, "crowdsec": 4.7146, "vulncheck": 1.5149, "blocklist_de": -2.0586}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.971, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-GA13-RIPE", "org": "GANDI SAS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "http://www.gandi.net"}, "pfx": 4, "reg": "2016-01-07", "rir": "ripencc", "s24": 68, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016845985104}, {"a": 203516, "h": "AltunHOST", "n": "AltunHOST", "t": "Hosting & VPS", "w": 4, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2022-39290": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 10.945, 0.011, 1, false], ["2026-10-12", 21.886, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 21.886, "se": 0.694, "ts": 0.750, "map": 59.373, "obs": 4, "own": 11.729, "comp": {"cins": -0.5735, "dshield": -1.1111, "crowdsec": 6.3659, "vulncheck": -0.6978, "blocklist_de": 1.494}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.820, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-AA3433-RIPE", "org": "AltunHOST LTD", "pdb": {"t": null, "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.altunhost.com/"}, "pfx": 8, "reg": "2025-11-24", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000590951911}, {"a": 203557, "h": "DATACLUB-NL", "n": "SIA RixHost", "t": "Hosting & VPS", "w": 11, "cc": "LV", "cf": null, "cs": {"c": {"http_flood": 6, "data_centre": 3, "web_exploit": 5, "bad_crawling": 7}, "n": 8}, "ev": {"crowdsec": {"n": 4, "p": 0.8085, "hi": 9.03, "lo": 1.94, "ips": 8, "mean": 4.93, "above": true}, "threatfox": {"n": 2, "p": 0.4227, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 16.063, 8.587, 1, false], ["2026-10-12", 31.054, 8.563, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 8.563, "se": 1.240, "ts": 1.000, "map": 51.229, "obs": 2, "own": 18.599, "comp": {"urlhaus": -0.1688, "threatfox": 6.0804, "phishing_db": -0.3492}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 31.054, "se": 0.699, "ts": 1.000, "map": 85.424, "obs": 4, "own": 16.851, "comp": {"cins": -0.5224, "dshield": -1.0313, "crowdsec": 10.7253, "vulncheck": -0.6741, "blocklist_de": -2.6562}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.810, "det": {"threatfox": {"family:Remcos": 3}}, "oid": "ORG-SD330-RIPE", "org": "SIA RixHost", "pdb": null, "pfx": 5, "reg": "2015-12-10", "rir": "ripencc", "s24": 5, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 203662, "h": "PL-3K33", "n": "3K33 sp. z o.o.", "t": "Enterprise, edu & gov", "w": 1, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2020-11738": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 50.239, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.670, "det": null, "oid": "ORG-SZO26-RIPE", "org": "3K33 sp. z o.o.", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://3k33.pl"}, "pfx": 5, "reg": "2025-11-17", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203695, "h": "ISP-AS", "n": "Saypudinov Ayatula", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 10.390, 0.011, 1, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": 6336.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 4.650, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.603, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SA4646-RIPE", "org": "Saypudinov Ayatula", "pdb": null, "pfx": 6, "reg": "2015-11-18", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203726, "h": "WirLab", "n": "Wirlab srl", "t": "Other", "w": 3, "cc": "IT", "cf": null, "cs": {"c": {"mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 6640.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 14.129, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.163, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-WS134-RIPE", "org": "Wirlab srl", "pdb": null, "pfx": 7, "reg": "2015-11-11", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203758, "h": "EUGameHost-LTD", "n": "EUGameHost", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.144, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.886, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-EA1545-RIPE", "org": "EUGAMEHOST LTD", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://eugamehost.com"}, "pfx": 19, "reg": "2022-07-22", "rir": "ripencc", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005822276202}, {"a": 203851, "h": "as_csd001", "n": "CSD Network Services Ltd", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.194, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CL296-RIPE", "org": "CSD Network Services Ltd", "pdb": {"t": null, "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.csd.co"}, "pfx": 5, "reg": "2015-10-20", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203861, "h": "MITEFLUX-AS", "n": "ServerExpress", "t": "Hosting & VPS", "w": 8, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 3, "web_exploit": 5, "bad_crawling": 5, "first_seen_30d": 3, "ssh_bruteforce": 4, "web_bruteforce": 5, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2024-0012": 2, "cve:CVE-2017-16894": 2, "cve:CVE-2019-17050": 2, "cve:CVE-2025-55182": 2}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 5, "mean": 2.97, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 20.234, 0.801, 1, false], ["2026-10-12", 16.843, 0.827, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.827, "se": 1.740, "ts": 1.000, "map": 11.627, "obs": 1, "own": 6.413, "comp": {"urlhaus": -0.032, "threatfox": 4.1941, "phishing_db": -0.0826}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 16.843, "se": 0.834, "ts": 0.667, "map": 58.361, "obs": 3, "own": 11.910, "comp": {"cins": -0.3015, "dshield": -0.6481, "crowdsec": 5.9695, "vulncheck": 1.9947, "blocklist_de": -1.5543}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.944, "det": {"threatfox": {"family:PureRAT": 2, "family:AsyncRAT": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "ORG-MTL87-RIPE", "org": "Miteflux Technologies Ltd", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.server.express/"}, "pfx": 4, "reg": "2025-11-13", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00159707112316}, {"a": 203877, "h": "astratelekom", "n": "Astra Telekom", "t": "Broadband & mobile", "w": 2, "cc": "RS", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3293, "hi": 5.47, "lo": 0.71, "ips": 2, "mean": 2.61, "above": false}}, "h2": [["2026-10-12", 1.008, 0.012, 0, false]], "sh": false, "uc": 452.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 1.551, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.008, "se": 0.920, "ts": 1.000, "map": 4.173, "obs": 2, "own": 6.675, "comp": {"cins": -0.3068, "dshield": -0.6582, "crowdsec": 5.9002, "vulncheck": -0.5316, "blocklist_de": -1.5812}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.226, "det": null, "oid": "ORG-ATDB1-RIPE", "org": "ASTRA TELEKOM DOO BEOGRAD", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.astratelekom.com"}, "pfx": 45, "reg": "2015-10-14", "rir": "ripencc", "s24": 57, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050125240125}, {"a": 203908, "h": "PIXAGILITY", "n": "PIXAGILITY SAS", "t": "Other", "w": 3, "cc": "FR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 6.496, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.148, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-PS247-RIPE", "org": "PIXAGILITY SAS", "pdb": null, "pfx": 1, "reg": "2016-05-06", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 203937, "h": "Cyfrotel", "n": "CYFROTEL SPOLKA JAWNA MARIUSZ ULIDOWSKI MAREK BZDZIUCH", "t": "Broadband & mobile", "w": 2, "cc": "PL", "cf": null, "cs": {"c": {"mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 3.092, 0.011, 0, false], ["2026-10-12", 3.341, 0.012, 0, false]], "sh": false, "uc": 3665.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.341, "se": 0.990, "ts": 0.500, "map": 15.842, "obs": 2, "own": 25.607, "comp": {"cins": -0.2681, "dshield": -0.5842, "crowdsec": 2.0521, "vulncheck": -0.495, "blocklist_de": 3.4515}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.167, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "ORG-CSJM2-RIPE", "org": "MAREK BZDZIUCH trading as CYFROTEL Sp. J.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://cyfrotel.pl"}, "pfx": 8, "reg": "2015-10-01", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034691690826}, {"a": 203953, "h": "Hiper", "n": "Hiper A/S", "t": "Other", "w": 2, "cc": "DK", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0022, "hi": 1.70, "lo": 0.13, "ips": 1, "mean": 0.72, "above": false}, "crowdsec": {"n": 2, "p": 0.0036, "hi": 1.95, "lo": 0.25, "ips": 2, "mean": 0.93, "above": false}}, "h2": [["2026-10-05", 0.111, 0.009, 0, false], ["2026-10-12", 0.115, 0.009, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.851, "ts": null, "map": 0.137, "obs": 0, "own": 0.279, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.115, "se": 0.832, "ts": 1.000, "map": 0.399, "obs": 2, "own": 0.232, "comp": {"cins": -0.4188, "dshield": -0.8597, "crowdsec": 4.5127, "vulncheck": -0.616, "blocklist_de": -2.1431}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.136, "det": {"shodan": {"malware": 1}}, "oid": "ORG-HA502-RIPE", "org": "Hiper A/S", "pdb": null, "pfx": 13, "reg": "2015-09-25", "rir": "ripencc", "s24": 836, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 214016, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01122937970983}, {"a": 203963, "h": "RubikDC", "n": "SPDNet Telekomunikasyon Hizmetleri Bilgi Teknolojileri Taahhut Sanayi Ve Ticaret A.S.", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 1.774, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 0.911, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.361, "det": null, "oid": "ORG-STHB1-RIPE", "org": "SPDNet Telekomunikasyon Hizmetleri Bilgi Teknolojileri Taahhut Sanayi Ve Ticaret A.S.", "pdb": null, "pfx": 24, "reg": "2015-09-23", "rir": "ripencc", "s24": 30, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015041532979}, {"a": 203972, "h": "LLC-TATAISNEFT-AS", "n": "LLC TatAISneft", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.233, 0.011, 0, false], ["2026-10-12", 2.433, 0.012, 0, false]], "sh": false, "uc": 2168, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.433, "se": 0.970, "ts": 0.500, "map": 11.012, "obs": 2, "own": 6.494, "comp": {"cins": -0.2856, "dshield": -0.6178, "crowdsec": 1.8703, "vulncheck": -0.512, "blocklist_de": 3.3378}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.517, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-LT71-RIPE", "org": "LLC TatAISneft", "pdb": null, "pfx": 20, "reg": "2015-09-21", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 204044, "h": "Onlyservers", "n": "Packet Star Networks Limited", "t": "Hosting & VPS", "w": 8, "cc": "GB", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "vulncheck": {"n": 6, "p": 0.9613, "hi": 11.47, "lo": 3.18, "ips": 7, "mean": 6.78, "above": true}}, "h2": [["2026-10-05", 3.297, 0.011, 0, false], ["2026-10-12", 3.624, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.235, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 6, "blocklist_de": 0}, "lo": 3.624, "se": 0.585, "ts": 0.857, "map": 7.846, "obs": 7, "own": 1.590, "comp": {"cins": -0.5855, "dshield": 2.4567, "crowdsec": -4.4378, "vulncheck": 8.9853, "blocklist_de": -2.9651}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.475, "det": {"vulncheck": {"botnet_node": 7}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SLCL1-RIPE", "org": "Packet Star Networks Limited", "pdb": null, "pfx": 16, "reg": "2015-09-08", "rir": "ripencc", "s24": 62, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0833]], "ipv4": 16896, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00652044915069}, {"a": 204094, "h": "I4W", "n": "I4W - Web Solutions, Lda", "t": "Hosting & VPS", "w": 0, "cc": "PT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.394, "det": {"shodan": {"c2": 1}}, "oid": "ORG-IWSL5-RIPE", "org": "I4W - Web Solutions, Lda", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://innov4web.pt/"}, "pfx": 5, "reg": "2015-08-27", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001941324032}, {"a": 204104, "h": "GSC", "n": "Giti Secure Cloud", "t": "Hosting & VPS", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6042, "hi": 7.29, "lo": 1.28, "ips": 3, "mean": 3.76, "above": false}, "crowdsec": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.315, 0.454, 0, false], ["2026-10-12", 1.781, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.274, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.781, "se": 0.951, "ts": 0.500, "map": 7.802, "obs": 2, "own": 1.599, "comp": {"cins": -0.3023, "dshield": -0.6495, "crowdsec": 1.6984, "vulncheck": -0.5275, "blocklist_de": 3.2289}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.726, "det": {"shodan": {"c2": 1, "compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-GSCL2-RIPE", "org": "Giti Secure Cloud LLC", "pdb": null, "pfx": 30, "reg": "2023-01-10", "rir": "ripencc", "s24": 30, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00057217342659}, {"a": 204139, "h": "NEXTGLOBALSERVICES", "n": "NEXT GLOBAL SERVICES L.P.", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.261, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.504, "det": null, "oid": "ORG-NGSL3-RIPE", "org": "NEXT GLOBAL SERVICES L.P.", "pdb": null, "pfx": 24, "reg": "2015-08-18", "rir": "ripencc", "s24": 49, "sib": 1, "tor": 0, "w24": 0, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00112183857954}, {"a": 204144, "h": "COMFORT-AS", "n": "Comfort XXI Century", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.3979, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-12", 0.859, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.026, "ts": null, "map": 0.187, "obs": 0, "own": 0.594, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.859, "se": 0.911, "ts": 1.000, "map": 3.477, "obs": 2, "own": 2.033, "comp": {"cins": -0.3176, "dshield": 7.8099, "crowdsec": -2.676, "vulncheck": -0.541, "blocklist_de": -1.6356}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CXCL1-RIPE", "org": "Comfort XXI Century Ltd.", "pdb": null, "pfx": 20, "reg": "2015-08-13", "rir": "ripencc", "s24": 71, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 204154, "h": "FIRST-SERVER-US-AS", "n": "FIRST SERVER LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.574, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.196, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.473, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FSL27-RIPE", "org": "FIRST SERVER LIMITED", "pdb": null, "pfx": 7, "reg": "2018-04-11", "rir": "ripencc", "s24": 9, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 204170, "h": "awasr", "n": "Awasr", "t": "Other", "w": 6, "cc": "OM", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.0209, "hi": 2.53, "lo": 0.33, "ips": 2, "mean": 1.21, "above": false}, "blocklist_de": {"n": 4, "p": 0.4768, "hi": 5.72, "lo": 1.23, "ips": 4, "mean": 3.13, "above": false}}, "h2": [["2026-10-05", 0.993, 0.009, 0, false], ["2026-10-12", 0.973, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.882, "ts": null, "map": 0.149, "obs": 0, "own": 0.323, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 0.973, "se": 0.565, "ts": 0.667, "map": 2.087, "obs": 6, "own": 1.183, "comp": {"cins": -1.1867, "dshield": -1.8806, "crowdsec": -2.4423, "vulncheck": -0.8571, "blocklist_de": 8.4958}, "mass": 6.5, "listed": false}}, "abq": false, "bot": 0.212, "det": {"blocklist_de": {"bots": 3, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-AOL7-RIPE", "org": "Awaser Oman LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.awasr.om"}, "pfx": 561, "reg": "2015-08-06", "rir": "ripencc", "s24": 559, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 266240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0090059434664}, {"a": 204203, "h": "Sepehr-Sabz-DC-TEH", "n": "Atrin Information & Communications Technology Company PJS", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 5.084, 0.011, 0, false], ["2026-10-12", 11.851, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 11.851, "se": 0.634, "ts": 0.400, "map": 28.755, "obs": 5, "own": 16.379, "comp": {"cins": -0.6761, "dshield": 2.1286, "crowdsec": 1.7513, "vulncheck": 0.6959, "blocklist_de": 0.8527}, "mass": 3.2, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-ACAI3-RIPE", "org": "Atrin Information & Communications Technology Company PJS", "pdb": null, "pfx": 20, "reg": "2015-07-28", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0022573352895}, {"a": 204213, "h": "netmihan", "n": "Netmihan Communication Company Ltd", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 2, "first_seen_30d": 2, "ssh_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-41940": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.3867, "hi": 5.96, "lo": 0.77, "ips": 3, "mean": 2.84, "above": false}, "blocklist_de": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 2.149, 0.011, 0, false], ["2026-10-12", 9.988, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.988, "se": 0.685, "ts": 0.500, "map": 26.654, "obs": 4, "own": 15.156, "comp": {"cins": 3.7996, "dshield": -1.2407, "crowdsec": 1.9019, "vulncheck": -0.7326, "blocklist_de": 0.9484}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.884, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-MGEC1-RIPE", "org": "Netmihan Communication Company Ltd", "pdb": null, "pfx": 21, "reg": "2015-07-24", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013201535445}, {"a": 204339, "h": "FIRSTSERVER-FL-AS", "n": "FIRST SERVER LIMITED", "t": "Hosting & VPS", "w": 8, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 5, "web_exploit": 3, "first_seen_30d": 4, "ssh_bruteforce": 4, "web_bruteforce": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2023-50164": 1, "cve:CVE-2025-54236": 1}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.5716, "hi": 6.97, "lo": 1.23, "ips": 3, "mean": 3.59, "above": false}, "dshield": {"n": 1, "p": 0.1867, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 5, "p": 0.8677, "hi": 9.21, "lo": 2.29, "ips": 5, "mean": 5.26, "above": true}, "threatfox": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1878, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 6.818, 1.961, 0, false], ["2026-10-12", 6.919, 1.983, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 1.983, "se": 1.159, "ts": 0.500, "map": 9.417, "obs": 2, "own": 3.624, "comp": {"urlhaus": -0.3132, "threatfox": 2.124, "phishing_db": 2.0579}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.919, "se": 0.570, "ts": 0.833, "map": 14.994, "obs": 6, "own": 2.947, "comp": {"cins": -0.8832, "dshield": 1.4514, "crowdsec": 8.7237, "vulncheck": -0.7985, "blocklist_de": -4.3921}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.556, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-FSL27-RIPE", "org": "FIRST SERVER LIMITED", "pdb": null, "pfx": 53, "reg": "2022-06-28", "rir": "ripencc", "s24": 53, "sib": 4, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13568, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00056794021911}, {"a": 204384, "h": "SweetTV", "n": "OTT UKRAINE", "t": "Hosting & VPS", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1498, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.007, 0.188, 0, false], ["2026-10-12", 0.007, 0.198, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.198, "se": 1.408, "ts": 1.000, "map": 1.451, "obs": 1, "own": 0.662, "comp": {"urlhaus": -0.2382, "threatfox": -0.2397, "phishing_db": 2.4761}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.681, "ts": null, "map": 0.110, "obs": 0, "own": 0.035, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.278, "det": null, "oid": "ORG-LU26-RIPE", "org": "LLC \"OTT UKRAINE\"", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://sweet.tv/"}, "pfx": 33, "reg": "2018-03-20", "rir": "ripencc", "s24": 255, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 67328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001759342641}, {"a": 204390, "h": "Magnetukas", "n": "Magnetukas", "t": "Broadband & mobile", "w": 5, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6416, "hi": 7.69, "lo": 1.35, "ips": 5, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 4.140, 0.011, 0, false], ["2026-10-12", 3.601, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 3.601, "se": 0.809, "ts": 1.000, "map": 11.601, "obs": 3, "own": 19.104, "comp": {"cins": -0.2431, "dshield": -0.5351, "crowdsec": -2.1138, "vulncheck": 7.9945, "blocklist_de": -1.2578}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.339, "det": {"vulncheck": {"botnet_node": 5}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-UA353-RIPE", "org": "UAB \"Magnetukas\"", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.magnetukas.lt"}, "pfx": 7, "reg": "2018-03-20", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000204515168}, {"a": 204391, "h": "nbestihosting", "n": "NBI SIA", "t": "Hosting & VPS", "w": 0, "cc": "LV", "cf": null, "cs": null, "ev": {"shodan": {"n": 37, "p": 1.0000, "hi": 47.96, "lo": 28.04, "ips": 37, "mean": 37.44, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 37}}, "oid": "ORG-NS424-RIPE", "org": "NBI SIA", "pdb": null, "pfx": 7, "reg": "2018-03-20", "rir": "ripencc", "s24": 7, "sib": 15, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1792, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 204428, "h": "SS-Net", "n": "SS-Net", "t": "Other", "w": 29, "cc": "BG", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 8, "bad_crawling": 3, "proxy_or_vpn": 1, "ssh_bruteforce": 10, "web_bruteforce": 14, "mail_bruteforce": 2, "cve:CVE-2023-1389": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-22947": 1}, "n": 26}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 26, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 65.195, 0.012, 1, false], ["2026-10-12", 69.325, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 69.325, "se": 0.867, "ts": 0.333, "map": 262.148, "obs": 3, "own": 150.881, "comp": {"cins": -0.3358, "dshield": 3.4829, "crowdsec": 1.3605, "vulncheck": -0.5562, "blocklist_de": 3.0111}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.995, "det": {"blocklist_de": {"sip": 1, "ssh": 3, "imap": 1, "mail": 1}}, "oid": "ORG-SA4107-RIPE", "org": "SS-Net", "pdb": null, "pfx": 1, "reg": "2018-03-13", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00040196340315}, {"a": 204457, "h": "ATLANTIS-CENTRAL", "n": "Atlantis Telekomünikasyon bil. hizm. san.tic.ltd.şti.", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 1.013, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ATBH1-RIPE", "org": "Atlantis Telekomunikasyon Bilisim Hizmetleri San. ve Tic. Ltd. Sti.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.atlantisnet.com.tr"}, "pfx": 24, "reg": "2018-03-07", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0030500968275}, {"a": 204490, "h": "ASKONTEL", "n": "Kontel LLC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3579, "hi": 5.71, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "threatfox": {"n": 1, "p": 0.1959, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.244, 0.381, 0, false], ["2026-10-12", 0.208, 0.395, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.395, "se": 1.510, "ts": 1.000, "map": 3.716, "obs": 1, "own": 4.413, "comp": {"urlhaus": -0.1194, "threatfox": 3.3245, "phishing_db": -0.2662}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.208, "se": 1.251, "ts": 1.000, "map": 1.554, "obs": 1, "own": 1.036, "comp": {"cins": -0.101, "dshield": -0.2362, "crowdsec": -0.9354, "vulncheck": 3.6347, "blocklist_de": -0.5273}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.745, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"other_infrastructure": 1}}, "oid": "ORG-KL236-RIPE", "org": "Kontel LLC", "pdb": null, "pfx": 41, "reg": "2018-03-02", "rir": "ripencc", "s24": 48, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003485870696}, {"a": 204548, "h": "CLOUDWEBMANAGE-IL-FR", "n": "Kamatera INC Germany ASN", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.8955, "hi": 9.88, "lo": 2.46, "ips": 5, "mean": 5.64, "above": true}, "crowdsec": {"n": 2, "p": 0.3718, "hi": 5.83, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "phishing_db": {"n": 2, "p": 0.4134, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.566, 2.973, 0, false], ["2026-10-12", 4.060, 3.031, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 3.031, "se": 1.173, "ts": 1.000, "map": 15.106, "obs": 2, "own": 5.667, "comp": {"urlhaus": -0.287, "threatfox": -0.2693, "phishing_db": 4.8975}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.060, "se": 0.775, "ts": 0.667, "map": 12.737, "obs": 3, "own": 2.544, "comp": {"cins": -0.4732, "dshield": -0.9514, "crowdsec": 3.8825, "vulncheck": -0.6484, "blocklist_de": 2.1286}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.443, "det": {"shodan": {"compromised": 5}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-KI35-RIPE", "org": "Kamatera Inc", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.kamatera.com"}, "pfx": 30, "reg": "2018-02-19", "rir": "ripencc", "s24": 30, "sib": 3, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7680, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00105732163455}, {"a": 204552, "h": "POPILNYANET-AS", "n": "POPILNYA.NET LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.394, "det": null, "oid": "ORG-PL570-RIPE", "org": "POPILNYA.NET LLC", "pdb": null, "pfx": 3, "reg": "2018-02-19", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 204601, "h": "PODAON", "n": "NovoServe B.V.", "t": "Other", "w": 7, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 4, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2014-8739": 1, "cve:CVE-2016-1555": 1, "cve:CVE-2016-15043": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"shodan": {"n": 8, "p": 0.9783, "hi": 10.79, "lo": 3.51, "ips": 8, "mean": 6.73, "above": true}, "crowdsec": {"n": 4, "p": 0.5782, "hi": 6.45, "lo": 1.39, "ips": 4, "mean": 3.52, "above": false}, "threatfox": {"n": 1, "p": 0.1885, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "phishing_db": {"n": 2, "p": 0.3733, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 1.404, 1.878, 0, false], ["2026-10-12", 1.416, 1.894, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 1.894, "se": 1.009, "ts": 0.667, "map": 6.406, "obs": 3, "own": 6.433, "comp": {"urlhaus": -0.5774, "threatfox": 1.2298, "phishing_db": 2.8311}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.416, "se": 0.657, "ts": 1.000, "map": 3.556, "obs": 4, "own": 2.025, "comp": {"cins": -0.6629, "dshield": -1.2439, "crowdsec": 8.6436, "vulncheck": -0.7334, "blocklist_de": -3.341}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"c2": 1, "compromised": 7}, "threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-ZB24-RIPE", "org": "NovoServe B.V.", "pdb": null, "pfx": 138, "reg": "2018-02-09", "rir": "ripencc", "s24": 158, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 40448, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00205788228}, {"a": 204650, "h": "ErtebatateSabeteAvaArvand", "n": "Toloe Rayaneh Loghman Educational and Cultural Co. LTD", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1689, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 0.698, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.202, "obs": 0, "own": 0.314, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.571, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TRLE1-RIPE", "org": "Toloe Rayaneh Loghman Educational and Cultural Co. LTD", "pdb": null, "pfx": 34, "reg": "2018-02-01", "rir": "ripencc", "s24": 34, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001189289115}, {"a": 204746, "h": "BITE-CLOUD", "n": "Bite Lithuania Cloud", "t": "Hosting & VPS", "w": 0, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.914, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BGIS1-RIPE", "org": "UAB \"Bite Lietuva\"", "pdb": null, "pfx": 5, "reg": "2022-06-08", "rir": "ripencc", "s24": 5, "sib": 5, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000654621}, {"a": 204770, "h": "CHERRYSERVERS3-AS", "n": "Cherry Servers US", "t": "Hosting & VPS", "w": 10, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1632, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 2, "p": 0.3540, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "vulncheck": {"n": 3, "p": 0.6328, "hi": 7.59, "lo": 1.34, "ips": 6, "mean": 3.92, "above": false}, "blocklist_de": {"n": 2, "p": 0.3943, "hi": 6.03, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 8.526, 0.011, 0, false], ["2026-10-12", 8.602, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.257, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 2}, "lo": 8.602, "se": 0.575, "ts": 0.429, "map": 18.494, "obs": 7, "own": 3.681, "comp": {"cins": -0.8504, "dshield": -1.4972, "crowdsec": 0.155, "vulncheck": 2.7036, "blocklist_de": 3.8001}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.753, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 6}, "blocklist_de": {"sip": 2}}, "oid": "ORG-UDC69-RIPE", "org": "UAB \"Cherry Servers\"", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "http://cherryservers.com"}, "pfx": 41, "reg": "2022-06-03", "rir": "ripencc", "s24": 41, "sib": 6, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00461179195882}, {"a": 204800, "h": "WHG-SGP", "n": "hosting.com SGP1", "t": "Hosting & VPS", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2024-2473": 1, "cve:CVE-2023-23752": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "crowdsec": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "phishing_db": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.218, 0.366, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.366, "se": 1.494, "ts": 1.000, "map": 3.352, "obs": 1, "own": 1.510, "comp": {"urlhaus": -0.1426, "threatfox": -0.1674, "phishing_db": 3.1457}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.218, "se": 1.241, "ts": 1.000, "map": 1.661, "obs": 1, "own": 0.369, "comp": {"cins": -0.1425, "dshield": -0.3273, "crowdsec": 3.4471, "vulncheck": -0.3342, "blocklist_de": -0.7421}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.951, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "http://hosting.com"}, "pfx": 25, "reg": "2018-01-05", "rir": "ripencc", "s24": 64, "sib": 11, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038781102243}, {"a": 204818, "h": "HOSTEUR-NET-CORE", "n": "HOSTEUR", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3670, "hi": 5.79, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.257, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.918, "ts": null, "map": 0.195, "obs": 0, "own": 0.100, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.809, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-AC31-RIPE", "org": "Hosteur SAS", "pdb": null, "pfx": 14, "reg": "2018-01-02", "rir": "ripencc", "s24": 41, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014588539055}, {"a": 204889, "h": "TOBI-AS", "n": "Online Business Technologies Ltd.", "t": "Enterprise, edu & gov", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 5.847, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.207, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-OBTL1-RIPE", "org": "Online Business Technologies Ltd.", "pdb": {"t": "Enterprise", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://tobi.net.ua"}, "pfx": 6, "reg": "2017-12-13", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024564304599}, {"a": 204914, "h": "LABIXE", "n": "LABIXE", "t": "Other", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "threatfox": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.012, 0.666, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.666, "se": 1.648, "ts": 1.000, "map": 8.197, "obs": 1, "own": 10.528, "comp": {"urlhaus": -0.056, "threatfox": 3.9245, "phishing_db": -0.1385}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.938, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}}, "oid": "ORG-LA1736-RIPE", "org": "LABIXE LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://labixe.host/"}, "pfx": 10, "reg": "2022-05-30", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042937242}, {"a": 204957, "h": "GREENFLOID-AS", "n": "GREEN FLOID", "t": "Other", "w": 10, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "ssh_bruteforce": 4}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1703, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "shodan": {"n": 1, "p": 0.0884, "hi": 3.52, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "crowdsec": {"n": 1, "p": 0.0719, "hi": 3.31, "lo": 0.25, "ips": 4, "mean": 1.40, "above": false}, "phishing_db": {"n": 4, "p": 0.7736, "hi": 8.48, "lo": 1.82, "ips": 5, "mean": 4.63, "above": false}}, "h2": [["2026-10-05", 0.970, 2.891, 0, false], ["2026-10-12", 0.475, 2.910, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 2.910, "se": 0.934, "ts": 1.000, "map": 8.606, "obs": 4, "own": 8.413, "comp": {"urlhaus": -0.7485, "threatfox": -0.4277, "phishing_db": 4.9549}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.475, "se": 0.887, "ts": 0.500, "map": 1.841, "obs": 2, "own": 1.077, "comp": {"cins": 4.4084, "dshield": -0.7922, "crowdsec": 0.9276, "vulncheck": -0.5899, "blocklist_de": -1.9502}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.882, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RL646-RIPE", "org": "ROUTE 95 LLC", "pdb": null, "pfx": 140, "reg": "2017-11-30", "rir": "ripencc", "s24": 163, "sib": 5, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0010749365046}, {"a": 204997, "h": "FIRSTBYTE-AS", "n": "FIRST SERVER LIMITED", "t": "Hosting & VPS", "w": 4, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5561, "hi": 6.82, "lo": 1.20, "ips": 3, "mean": 3.52, "above": false}, "crowdsec": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}, "vulncheck": {"n": 1, "p": 0.1846, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "phishing_db": {"n": 2, "p": 0.4025, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.882, 1.789, 0, false], ["2026-10-12", 0.730, 1.830, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.830, "se": 1.155, "ts": 1.000, "map": 8.560, "obs": 2, "own": 3.296, "comp": {"urlhaus": -0.3406, "threatfox": -0.2974, "phishing_db": 4.4113}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 0.926, "ts": 0.500, "map": 2.975, "obs": 2, "own": 0.624, "comp": {"cins": -0.249, "dshield": -0.5468, "crowdsec": 2.2547, "vulncheck": 2.3129, "blocklist_de": -1.2879}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.991, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-FSL27-RIPE", "org": "FIRST SERVER LIMITED", "pdb": null, "pfx": 64, "reg": "2017-11-22", "rir": "ripencc", "s24": 64, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00182674654085}, {"a": 205026, "h": "WVG-CLOUD-AS", "n": "wvg solution s.r.o.", "t": "Hosting & VPS", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.729, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WSS29-RIPE", "org": "wvg solution s.r.o.", "pdb": null, "pfx": 1, "reg": "2022-12-28", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205072, "h": "LAYERSHIFT", "n": "LAYERSHIFT", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.323, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LL120-RIPE", "org": "Layershift Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://layershift.com"}, "pfx": 4, "reg": "2017-11-10", "rir": "ripencc", "s24": 32, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205090, "h": "FIRST-SERVER-EUROPE", "n": "FIRST-SERVER-EUROPE", "t": "Hosting & VPS", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.5533, "hi": 6.80, "lo": 1.20, "ips": 3, "mean": 3.51, "above": false}, "crowdsec": {"n": 1, "p": 0.1331, "hi": 4.04, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "vulncheck": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.895, 0.011, 0, false], ["2026-10-12", 0.714, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 0.232, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.714, "se": 0.925, "ts": 0.500, "map": 2.898, "obs": 2, "own": 0.608, "comp": {"cins": -0.25, "dshield": -0.5489, "crowdsec": 2.2436, "vulncheck": 2.306, "blocklist_de": -1.2932}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.946, "det": {"shodan": {"compromised": 3}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-FSL27-RIPE", "org": "FIRST SERVER LIMITED", "pdb": null, "pfx": 66, "reg": "2017-11-09", "rir": "ripencc", "s24": 66, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090950652581}, {"a": 205100, "h": "F3NETZE", "n": "F3 Netze", "t": "Hosting & VPS", "w": 12, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 12, "data_centre": 11, "web_exploit": 12, "bad_crawling": 12, "proxy_or_vpn": 12, "ssh_bruteforce": 12, "web_bruteforce": 12, "mail_bruteforce": 10, "cve:CVE-2013-3827": 2, "cve:CVE-2015-9406": 4, "cve:CVE-2017-9841": 9, "cve:CVE-2018-13379": 4, "cve:CVE-2018-20062": 7}, "n": 12}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 12, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.706, "det": null, "oid": "ORG-FNE6-RIPE", "org": "F3 Netze e.V.", "pdb": {"t": "Non-Profit", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://f3netze.de"}, "pfx": 1, "reg": "2017-11-08", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 12, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205105, "h": "INFONET", "n": "INFONET", "t": "Broadband & mobile", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5566.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.142, "det": null, "oid": "ORG-MMTA7-RIPE", "org": "Multan Michal trading as INFO-NET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": null}, "pfx": 5, "reg": "2017-11-08", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205119, "h": "TELEKS-MK", "n": "TELEKS DOOEL Skopje", "t": "Other", "w": 23, "cc": "MK", "cf": null, "cs": {"c": {"http_flood": 18, "web_exploit": 2, "bad_crawling": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2012-0392": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2016-1555": 1, "cve:CVE-2022-22947": 1, "cve:CVE-2022-26134": 1}, "n": 23}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 23, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 4.177, 0.011, 0, false], ["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 13.105, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.443, "det": {"blocklist_de": {"bots": 6}}, "oid": "ORG-TDS11-RIPE", "org": "TELEKS DOOEL Skopje", "pdb": null, "pfx": 5, "reg": "2017-11-07", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016044199914}, {"a": 205166, "h": "MOBILELINKS-AS", "n": "Mobile Links Europe", "t": "Broadband & mobile", "w": 0, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.354, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MLEA1-RIPE", "org": "Mobile Links Europe AB", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.mobilelinks.se"}, "pfx": 2, "reg": "2017-10-25", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205196, "h": "BIGCORE-ASN", "n": "BIG CORE LLC", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.775, 0.011, 0, false], ["2026-10-12", 0.759, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.759, "se": 1.495, "ts": 1.000, "map": 9.114, "obs": 1, "own": 2.350, "comp": {"cins": 5.072, "dshield": -0.1762, "crowdsec": -0.6982, "vulncheck": -0.2046, "blocklist_de": -0.3895}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-BCL30-RIPE", "org": "BIG CORE LLC", "pdb": null, "pfx": 6, "reg": "2017-10-18", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001488931593}, {"a": 205244, "h": "Firstcom", "n": "FIRSTCOM", "t": "Hosting & VPS", "w": 0, "cc": "AL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5175.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.224, "det": null, "oid": "ORG-NS414-RIPE", "org": "NEXT-TV SHPK", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://firstcom.al"}, "pfx": 4, "reg": "2017-10-09", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00022823083266}, {"a": 205275, "h": "ROMARG", "n": "ROMARG", "t": "Hosting & VPS", "w": 2, "cc": "RO", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"shodan": {"n": 4, "p": 0.7447, "hi": 8.08, "lo": 1.74, "ips": 4, "mean": 4.42, "above": false}, "crowdsec": {"n": 2, "p": 0.3219, "hi": 5.41, "lo": 0.70, "ips": 2, "mean": 2.58, "above": false}}, "h2": [["2026-10-05", 0.901, 0.011, 0, false], ["2026-10-12", 0.945, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.033, "ts": null, "map": 0.189, "obs": 0, "own": 0.235, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.945, "se": 0.916, "ts": 1.000, "map": 3.881, "obs": 2, "own": 0.791, "comp": {"cins": -0.3102, "dshield": -0.6644, "crowdsec": 5.8571, "vulncheck": -0.5345, "blocklist_de": -1.5981}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.975, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-RS168-RIPE", "org": "ROMARG SRL", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.romarg.ro"}, "pfx": 62, "reg": "2017-10-03", "rir": "ripencc", "s24": 62, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029949775191}, {"a": 205334, "h": "Fiberplus2AS", "n": "FIBERPLUS COMUNICATIONS, SL", "t": "Broadband & mobile", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2313.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 1.327, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.182, "det": null, "oid": "ORG-FCS22-RIPE", "org": "FIBERPLUS COMUNICATIONS, SL", "pdb": null, "pfx": 13, "reg": "2022-04-28", "rir": "ripencc", "s24": 13, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027134716752}, {"a": 205397, "h": "AS-69HOST", "n": "69HOST", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.999, "det": null, "oid": "ORG-LA2035-RIPE", "org": "69HOST LLC", "pdb": null, "pfx": 1, "reg": "2025-08-15", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00090872897535}, {"a": 205399, "h": "HOSTIGGER", "n": "Hostigger INC.", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4034, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "phishing_db": {"n": 2, "p": 0.4186, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 0.011, 4.861, 0, false], ["2026-10-12", 0.012, 4.937, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 4.937, "se": 1.199, "ts": 1.000, "map": 26.575, "obs": 2, "own": 9.762, "comp": {"urlhaus": -0.2394, "threatfox": -0.2405, "phishing_db": 5.3861}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.524, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HI36-RIPE", "org": "Hostigger INC.", "pdb": null, "pfx": 14, "reg": "2017-09-05", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001720524617}, {"a": 205431, "h": "HostLab", "n": "HostLab LLC", "t": "Hosting & VPS", "w": 2, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3762, "hi": 5.87, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "dshield": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.3992, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 0.310, 0.011, 0, false], ["2026-10-12", 3.949, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 0.267, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.949, "se": 0.775, "ts": 0.667, "map": 12.322, "obs": 3, "own": 2.462, "comp": {"cins": -0.5136, "dshield": 2.7326, "crowdsec": -4.0007, "vulncheck": -0.6697, "blocklist_de": 6.3565}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.669, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "ORG-HL381-RIPE", "org": "HostLab LLC", "pdb": null, "pfx": 4, "reg": "2025-08-14", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004511420844}, {"a": 205463, "h": "VDSGLOBAL", "n": "Pembe Gul Isguzar Karagoz", "t": "Other", "w": 2, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6271, "hi": 7.53, "lo": 1.33, "ips": 3, "mean": 3.88, "above": false}, "threatfox": {"n": 2, "p": 0.4217, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.011, 4.534, 0, false], ["2026-10-12", 0.012, 4.536, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 4.536, "se": 1.197, "ts": 1.000, "map": 24.219, "obs": 2, "own": 23.453, "comp": {"urlhaus": -0.2197, "threatfox": 5.4563, "phishing_db": -0.4233}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.663, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:DCRat": 1, "family:PureRAT": 1}}, "oid": "ORG-PGIK2-RIPE", "org": "Pembe Gul Isguzar Karagoz", "pdb": null, "pfx": 14, "reg": "2023-04-11", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016076508535}, {"a": 205467, "h": "BASEIP-LAX", "n": "Base IP B.V.", "t": "Other", "w": 3, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 3, "mean": 2.87, "above": false}}, "h2": [["2026-10-05", 2.417, 0.011, 0, false], ["2026-10-12", 2.564, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.564, "se": 0.972, "ts": 1.000, "map": 11.735, "obs": 2, "own": 6.911, "comp": {"cins": -0.2602, "dshield": -0.5688, "crowdsec": 6.5171, "vulncheck": -0.4869, "blocklist_de": -1.3449}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.360, "det": null, "oid": "ORG-EA207-RIPE", "org": "Base IP B.V.", "pdb": null, "pfx": 11, "reg": "2022-04-22", "rir": "ripencc", "s24": 17, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000002199088}, {"a": 205516, "h": "NLS-ASTANA", "n": "NLS ASTANA LLP", "t": "Broadband & mobile", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.8843, "hi": 9.59, "lo": 2.38, "ips": 5, "mean": 5.47, "above": true}}, "h2": [["2026-10-05", 0.254, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.050, "ts": null, "map": 0.191, "obs": 0, "own": 1.634, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.907, "ts": null, "map": 0.192, "obs": 0, "own": 0.745, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.435, "det": {"shodan": {"compromised": 5}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-NAL14-RIPE", "org": "NLS ASTANA LLP", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://nls.kz"}, "pfx": 45, "reg": "2017-08-01", "rir": "ripencc", "s24": 45, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 11520, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00075545525734}, {"a": 205536, "h": "TENP", "n": "Tejarat Electronic Nojhan Pardazesh LLC", "t": "Other", "w": 7, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "first_seen_30d": 2, "ssh_bruteforce": 6, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-6387": 3, "cve:CVE-2018-20062": 1}, "n": 6}, "ev": {"crowdsec": {"n": 3, "p": 0.6365, "hi": 7.63, "lo": 1.34, "ips": 6, "mean": 3.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 40.153, 0.011, 1, false], ["2026-10-12", 28.285, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 28.285, "se": 0.698, "ts": 0.750, "map": 77.281, "obs": 4, "own": 43.820, "comp": {"cins": -0.5616, "dshield": -1.0927, "crowdsec": 6.5188, "vulncheck": -0.6925, "blocklist_de": 1.569}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.518, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-TENP4-RIPE", "org": "Tejarat Electronic Nojhan Pardazesh LLC", "pdb": null, "pfx": 6, "reg": "2025-08-12", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000571077999}, {"a": 205542, "h": "DATAHAUS", "n": "Datahaus GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.431, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MG27-RIPE", "org": "Datahaus GmbH", "pdb": null, "pfx": 1, "reg": "2017-07-26", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205544, "h": "LEASEWEB-UK-LON-11", "n": "LeaseWeb UK / LON-01", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.5988, "hi": 6.61, "lo": 1.42, "ips": 4, "mean": 3.61, "above": false}}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.967, "ts": null, "map": 0.176, "obs": 0, "own": 0.178, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.727, "ts": null, "map": 0.127, "obs": 0, "own": 0.044, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.834, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"bots": 2}}, "oid": "ORG-LUL9-RIPE", "org": "Leaseweb UK Limited", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.leaseweb.com/"}, "pfx": 63, "reg": "2017-07-26", "rir": "ripencc", "s24": 180, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 56320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00552892818511}, {"a": 205608, "h": "SERVIRE-AS", "n": "SERVIRE Adam Kozlowski", "t": "Other", "w": 3, "cc": "PL", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 3, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.148, "det": null, "oid": "ORG-SAK6-RIPE", "org": "SERVIRE Adam Kozlowski", "pdb": null, "pfx": 3, "reg": "2017-07-12", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205638, "h": "TM-AS-MSK", "n": "T-Mob", "t": "Enterprise, edu & gov", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.416, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 3.217, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.416, "se": 1.349, "ts": 1.000, "map": 3.869, "obs": 1, "own": 25.732, "comp": {"cins": -0.1047, "dshield": 4.6328, "crowdsec": -0.9678, "vulncheck": -0.2672, "blocklist_de": -0.5464}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TBJ1-RIPE", "org": "\"TBANK\" JSC", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "100-200Gbps", "pol": "Selective", "web": "https://www.tinkoff.ru/mobile-operator/"}, "pfx": 22, "reg": "2017-07-05", "rir": "ripencc", "s24": 20, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00159992747145}, {"a": 205654, "h": "ASN-LABTECH", "n": "Labtech Systems Ltd", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.691, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-LSL15-RIPE", "org": "Labtech Systems Ltd", "pdb": null, "pfx": 8, "reg": "2017-06-30", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205668, "h": "GREENMINIHOST", "n": "Green Mini host", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.450, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GMHB1-RIPE", "org": "Green Mini host BV", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.greenmini.nl"}, "pfx": 10, "reg": "2017-06-27", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205941, "h": "LSG", "n": "Lungu Stefan Gabriel", "t": "Transit & backbone", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 5.100, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.679, "det": null, "oid": "ORG-LS543-RIPE", "org": "Lungu Stefan Gabriel", "pdb": {"t": "NSP", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://lungustefan.com/network"}, "pfx": 2, "reg": "2025-08-01", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205948, "h": "CREOLINE-AS", "n": "creoline GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.805, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 0.457, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.933, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CREO2-RIPE", "org": "creoline GmbH", "pdb": null, "pfx": 8, "reg": "2017-04-28", "rir": "ripencc", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205958, "h": "Global-Network-Point-LLC", "n": "Global Network Point LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.587, "det": null, "oid": "ORG-GNPL3-RIPE", "org": "Global Network Point LLC", "pdb": null, "pfx": 4, "reg": "2017-04-26", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 205960, "h": "HDT", "n": "HDTIDC LIMITED", "t": "Other", "w": 6, "cc": "HK", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 4, "p": 0.8063, "hi": 9.00, "lo": 1.94, "ips": 6, "mean": 4.91, "above": true}}, "h2": [["2026-10-05", 0.010, 10.912, 1, false], ["2026-10-12", 0.010, 10.153, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 10.153, "se": 0.914, "ts": 1.000, "map": 30.395, "obs": 4, "own": 27.905, "comp": {"urlhaus": -0.6153, "threatfox": -0.3963, "phishing_db": 6.0521}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.305, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.762, "det": null, "oid": "ORG-HL172-RIPE", "org": "HDTIDC LIMITED", "pdb": null, "pfx": 36, "reg": "2022-04-13", "rir": "ripencc", "s24": 36, "sib": 1, "tor": 0, "w24": 4, "drop": 5, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 9216, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": null}, {"a": 205993, "h": "CAFETECNOLOGIA", "n": "Cafe Tecnologia LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.394, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.460, "det": null, "oid": "ORG-CTL49-RIPE", "org": "Cafe Tecnologia LLC", "pdb": null, "pfx": 12, "reg": "2017-04-20", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 0, "drop": 8, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206026, "h": "ipnet_kar-tel", "n": "Kar-Tel LLC", "t": "Other", "w": 5, "cc": "KZ", "cf": null, "cs": {"c": {"web_exploit": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-0012": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1810, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "dshield": {"n": 1, "p": 0.1762, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "urlhaus": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 2, "p": 0.2693, "hi": 4.97, "lo": 0.65, "ips": 2, "mean": 2.37, "above": false}, "blocklist_de": {"n": 1, "p": 0.1560, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.616, 0.417, 0, false], ["2026-10-12", 3.401, 0.447, 0, false]], "sh": false, "uc": 1058.6, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.447, "se": 1.546, "ts": 1.000, "map": 4.509, "obs": 1, "own": 5.446, "comp": {"urlhaus": 3.9064, "threatfox": -0.2685, "phishing_db": -0.5055}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.401, "se": 0.611, "ts": 0.400, "map": 7.927, "obs": 5, "own": 4.497, "comp": {"cins": 3.3205, "dshield": 1.4569, "crowdsec": -0.1088, "vulncheck": -0.7981, "blocklist_de": -0.4066}, "mass": 4.4, "listed": false}}, "abq": false, "bot": 0.094, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-KL166-RIPE", "org": "Kar-Tel LLC", "pdb": null, "pfx": 92, "reg": "2017-04-07", "rir": "ripencc", "s24": 100, "sib": 5, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01351280501242}, {"a": 206065, "h": "FDI", "n": "FDI", "t": "Other", "w": 2, "cc": "IR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1149, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.62, "above": false}, "shodan": {"n": 2, "p": 0.0395, "hi": 2.86, "lo": 0.37, "ips": 2, "mean": 1.36, "above": false}, "blocklist_de": {"n": 1, "p": 0.0472, "hi": 2.96, "lo": 0.22, "ips": 1, "mean": 1.25, "above": false}}, "h2": [["2026-10-12", 0.188, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.882, "ts": null, "map": 0.149, "obs": 0, "own": 0.322, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.188, "se": 0.852, "ts": 0.500, "map": 0.676, "obs": 2, "own": 0.395, "comp": {"cins": 4.208, "dshield": -0.9503, "crowdsec": -3.7399, "vulncheck": -0.648, "blocklist_de": 2.1329}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.464, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-PNEV1-RIPE", "org": "Tose'h Fanavari Ertebabat Pasargad Arian Co. PJS", "pdb": null, "pfx": 145, "reg": "2017-03-31", "rir": "ripencc", "s24": 564, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 163072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0058448475228}, {"a": 206067, "h": "H3GUK", "n": "Three UK AS206067", "t": "Broadband & mobile", "w": 2, "cc": "GB", "cf": {"rb": "hi", "wb": "hi", "rep": 0.72, "waf": 0.63}, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0000, "hi": 0.88, "lo": 0.07, "ips": 1, "mean": 0.37, "above": false}, "dshield": {"n": 1, "p": 0.0129, "hi": 2.24, "lo": 0.17, "ips": 1, "mean": 0.95, "above": false}, "phishing_db": {"n": 1, "p": 0.0169, "hi": 2.36, "lo": 0.18, "ips": 1, "mean": 1.00, "above": false}}, "h2": [["2026-10-05", 0.099, 0.060, 0, false], ["2026-10-12", 0.021, 0.064, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.064, "se": 1.337, "ts": 1.000, "map": 0.370, "obs": 1, "own": 1.201, "comp": {"urlhaus": -0.4568, "threatfox": -0.3467, "phishing_db": 1.4367}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.021, "se": 1.009, "ts": 1.000, "map": 0.104, "obs": 1, "own": 0.171, "comp": {"cins": -0.2791, "dshield": 3.7452, "crowdsec": -2.3897, "vulncheck": -0.5058, "blocklist_de": -1.4406}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.082, "det": {"shodan": {"doublepulsar": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-HUL1-RIPE", "org": "Hutchison 3G UK Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "https://www.three.co.uk/"}, "pfx": 309, "reg": "2017-03-31", "rir": "ripencc", "s24": 2067, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1104384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.101464}, {"a": 206075, "h": "HOLLANDER-JACOBSEN", "n": "Hollander & Jacobsen UG (haftungsbeschraenkt)", "t": "Other", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2021-26086": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.667, "det": null, "oid": "ORG-HJU2-RIPE", "org": "Hollander & Jacobsen UG (haftungsbeschraenkt)", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://hollander-jacobsen.de"}, "pfx": 4, "reg": "2017-03-29", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 2, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206092, "h": "SECFIREWALLAS", "n": "F.N.S. HOLDINGS LIMITED", "t": "Other", "w": 3668, "cc": "CY", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 1.75}, "cs": {"c": {"http_flood": 2732, "data_centre": 130, "web_exploit": 2947, "bad_crawling": 1173, "proxy_or_vpn": 943, "ssh_bruteforce": 174, "web_bruteforce": 3488, "home_connection": 56, "mail_bruteforce": 180, "cve:CVE-2017-9841": 2006, "cve:CVE-2017-16894": 580, "cve:CVE-2022-35914": 818, "cve:CVE-2022-46604": 776, "cve:CVE-2023-49103": 899}, "n": 3603}, "ev": {"dshield": {"n": 2, "p": 0.3464, "hi": 5.61, "lo": 0.73, "ips": 2, "mean": 2.67, "above": false}, "crowdsec": {"n": 63, "p": 1.0000, "hi": 48.54, "lo": 32.13, "ips": 3603, "mean": 39.98, "above": true}, "phishing_db": {"n": 1, "p": 0.1548, "hi": 4.27, "lo": 0.32, "ips": 14, "mean": 1.80, "above": false}, "blocklist_de": {"n": 19, "p": 1.0000, "hi": 22.44, "lo": 10.67, "ips": 110, "mean": 16.10, "above": true}}, "h2": [["2026-10-05", 37.246, 0.206, 1, false], ["2026-10-12", 38.189, 0.209, 2, false]], "sh": false, "uc": 134.2, "v2": {"band": 2, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.209, "se": 1.414, "ts": 1.000, "map": 1.565, "obs": 1, "own": 1.858, "comp": {"urlhaus": -0.2285, "threatfox": -0.2334, "phishing_db": 2.5361}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 63, "vulncheck": 0, "blocklist_de": 19}, "lo": 38.189, "se": 0.360, "ts": 0.750, "map": 56.917, "obs": 84, "own": 31.766, "comp": {"cins": -3.5741, "dshield": -2.5188, "crowdsec": 11.5773, "vulncheck": -0.9998, "blocklist_de": 0.9506}, "mass": 70.6, "listed": true}}, "abq": false, "bot": 0.731, "det": {"blocklist_de": {"bots": 91, "imap": 4, "mail": 7, "apache": 12, "bruteforcelogin": 10}}, "oid": "ORG-FHL17-RIPE", "org": "F.N.S. HOLDINGS LIMITED", "pdb": null, "pfx": 225, "reg": "2017-03-28", "rir": "ripencc", "s24": 226, "sib": 3, "tor": 0, "w24": 65, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 57856, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.04391453636874}, {"a": 206119, "h": "Veganet-Telekom", "n": "Veganet-Telekom", "t": "Broadband & mobile", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1076, "hi": 3.75, "lo": 0.28, "ips": 1, "mean": 1.58, "above": false}}, "h2": [["2026-10-05", 1.249, 0.011, 0, false], ["2026-10-12", 0.167, 0.012, 0, false]], "sh": false, "uc": 367.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.005, "ts": null, "map": 0.184, "obs": 0, "own": 1.353, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.167, "se": 1.204, "ts": 1.000, "map": 1.184, "obs": 1, "own": 2.039, "comp": {"cins": -0.1582, "dshield": -0.3609, "crowdsec": 3.264, "vulncheck": -0.3589, "blocklist_de": -0.8231}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.258, "det": null, "oid": "ORG-VTVH1-RIPE", "org": "Veganet Teknolojileri ve Hizmetleri LTD STI", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.veganet.com.tr/"}, "pfx": 100, "reg": "2017-03-23", "rir": "ripencc", "s24": 100, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0030213147137}, {"a": 206134, "h": "NEKO-AS", "n": "NEKOBYTE INTERNATIONAL LIMITED", "t": "Other", "w": 16, "cc": "GB", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 5, "p": 0.8788, "hi": 9.46, "lo": 2.35, "ips": 5, "mean": 5.40, "above": true}, "crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "threatfox": {"n": 9, "p": 0.9988, "hi": 15.58, "lo": 5.38, "ips": 13, "mean": 9.92, "above": true}, "vulncheck": {"n": 3, "p": 0.6289, "hi": 7.55, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}}, "h2": [["2026-10-05", 1.026, 17.243, 1, false], ["2026-10-12", 2.302, 19.235, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 9, "phishing_db": 0}, "lo": 19.235, "se": 0.779, "ts": 1.000, "map": 44.451, "obs": 9, "own": 39.750, "comp": {"urlhaus": -1.0717, "threatfox": 7.4528, "phishing_db": -0.9606}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 0}, "lo": 2.302, "se": 0.703, "ts": 0.750, "map": 6.119, "obs": 4, "own": 3.606, "comp": {"cins": -0.4012, "dshield": -0.8291, "crowdsec": 0.7283, "vulncheck": 5.7622, "blocklist_de": -2.0551}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.763, "det": {"shodan": {"c2": 5}, "threatfox": {"family:Sliver": 1, "family:AsyncRAT": 1, "family:Tsundere": 9, "family:AdaptixC2": 2}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}}, "oid": "ORG-NL676-RIPE", "org": "NEKOBYTE INTERNATIONAL LIMITED", "pdb": null, "pfx": 51, "reg": "2026-01-20", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.8755]], "ipv4": 13312, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.00176918089215}, {"a": 206142, "h": "InternetTV", "n": "Internet TV, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ITI9-RIPE", "org": "Internet TV, Inc.", "pdb": null, "pfx": 1, "reg": "2017-03-20", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206150, "h": "CubeFocus-AS", "n": "F.N.S. HOLDINGS LIMITED", "t": "Other", "w": 0, "cc": "CY", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 0.560, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.818, "ts": null, "map": 0.161, "obs": 0, "own": 0.188, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.221, "det": null, "oid": "ORG-FHL17-RIPE", "org": "F.N.S. HOLDINGS LIMITED", "pdb": null, "pfx": 90, "reg": "2017-03-17", "rir": "ripencc", "s24": 90, "sib": 3, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23040, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012735344461}, {"a": 206170, "h": "Inleed", "n": "Inleed", "t": "Broadband & mobile", "w": 1, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1766, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 2.124, 0.011, 0, false], ["2026-10-12", 0.415, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.415, "se": 1.349, "ts": 1.000, "map": 3.857, "obs": 1, "own": 7.060, "comp": {"cins": -0.1043, "dshield": -0.2436, "crowdsec": 3.9028, "vulncheck": -0.2666, "blocklist_de": -0.5446}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-IA1464-RIPE", "org": "Yelles AB", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://inleed.com"}, "pfx": 18, "reg": "2017-03-15", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056390710184}, {"a": 206182, "h": "GlobalComBasilicata", "n": "Global Com Basilicata", "t": "Broadband & mobile", "w": 9, "cc": "IT", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 3, "mean": 1.92, "above": false}, "blocklist_de": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 7, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 11.421, 0.011, 1, false], ["2026-10-12", 13.588, 0.012, 1, false]], "sh": false, "uc": 3466.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 13.588, "se": 0.688, "ts": 0.750, "map": 36.279, "obs": 4, "own": 56.264, "comp": {"cins": -0.6814, "dshield": -1.2704, "crowdsec": -1.6432, "vulncheck": -0.74, "blocklist_de": 9.3199}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.283, "det": {"blocklist_de": {"imap": 7, "mail": 7}}, "oid": "ORG-GCBS1-RIPE", "org": "Global Com Basilicata s.r.l.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.globalcombasilicata.it"}, "pfx": 20, "reg": "2017-03-14", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001504258555}, {"a": 206206, "h": "KNET", "n": "KNET", "t": "Broadband & mobile", "w": 3, "cc": "IQ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "router_or_botnet": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5639, "hi": 6.89, "lo": 1.21, "ips": 3, "mean": 3.56, "above": false}}, "h2": [["2026-10-05", 4.365, 0.011, 0, false], ["2026-10-12", 2.569, 0.012, 0, false]], "sh": false, "uc": 1554.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 1.619, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.569, "se": 0.763, "ts": 1.000, "map": 7.910, "obs": 3, "own": 12.385, "comp": {"cins": -0.4618, "dshield": -0.9324, "crowdsec": 7.8545, "vulncheck": -0.6419, "blocklist_de": -2.3565}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.202, "det": null, "oid": "ORG-KNCF1-RIPE", "org": "Kurdistan Net Company for Computer and Internet Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://knet-telecom.com"}, "pfx": 45, "reg": "2017-03-08", "rir": "ripencc", "s24": 47, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0149096452752}, {"a": 206216, "h": "ADVIN-AS", "n": "Advin Servers - AS206216", "t": "Hosting & VPS", "w": 18, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 9, "data_centre": 2, "web_exploit": 12, "bad_crawling": 8, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 12, "mail_bruteforce": 1, "cve:CVE-2023-50164": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 7, "cve:CVE-2026-75650": 2, "cve:CVE-2026-87902": 7}, "n": 14}, "ev": {"cins": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 6, "p": 0.9618, "hi": 11.50, "lo": 3.19, "ips": 6, "mean": 6.80, "above": true}, "crowdsec": {"n": 8, "p": 0.9952, "hi": 13.92, "lo": 4.53, "ips": 14, "mean": 8.68, "above": true}, "threatfox": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 3, "p": 0.6423, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 49.279, 4.534, 1, false], ["2026-10-12", 68.469, 0.602, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.602, "se": 1.616, "ts": 1.000, "map": 7.043, "obs": 1, "own": 3.372, "comp": {"urlhaus": -0.0671, "threatfox": 3.8082, "phishing_db": -0.1629}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 8, "vulncheck": 3, "blocklist_de": 2}, "lo": 68.469, "se": 0.460, "ts": 0.571, "map": 123.221, "obs": 14, "own": 24.045, "comp": {"cins": 1.8537, "dshield": -2.2232, "crowdsec": 6.9624, "vulncheck": 0.8516, "blocklist_de": -1.2368}, "mass": 9.5, "listed": false}}, "abq": false, "bot": 0.843, "det": {"shodan": {"c2": 4, "compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"ssh": 1, "bots": 1}}, "oid": "ORG-ASL83-RIPE", "org": "Advin Services LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://advinservers.com"}, "pfx": 13, "reg": "2022-04-08", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 3584, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00077785620446}, {"a": 206264, "h": "AMARUTU-TECHNOLOGY", "n": "Amarutu Technology Ltd.", "t": "Transit & backbone", "w": 17, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 1}, "n": 6}, "ev": {"cins": {"n": 2, "p": 0.4036, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "shodan": {"n": 2, "p": 0.3304, "hi": 5.48, "lo": 0.71, "ips": 2, "mean": 2.61, "above": false}, "dshield": {"n": 5, "p": 0.9042, "hi": 10.13, "lo": 2.52, "ips": 5, "mean": 5.78, "above": true}, "urlhaus": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 6, "p": 0.9301, "hi": 9.98, "lo": 2.77, "ips": 6, "mean": 5.90, "above": true}, "vulncheck": {"n": 3, "p": 0.6226, "hi": 7.48, "lo": 1.32, "ips": 5, "mean": 3.86, "above": false}, "phishing_db": {"n": 2, "p": 0.4006, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}}, "h2": [["2026-10-05", 15.753, 10.424, 1, false], ["2026-10-12", 16.938, 5.220, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 2}, "lo": 5.220, "se": 1.029, "ts": 0.667, "map": 19.164, "obs": 3, "own": 65.365, "comp": {"urlhaus": 2.8434, "threatfox": -0.4223, "phishing_db": 2.1581}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 5, "crowdsec": 6, "vulncheck": 3, "blocklist_de": 0}, "lo": 16.938, "se": 0.447, "ts": 0.375, "map": 29.386, "obs": 16, "own": 91.621, "comp": {"cins": 4.6532, "dshield": 6.5236, "crowdsec": 1.2439, "vulncheck": 0.5789, "blocklist_de": -8.2254}, "mass": 11.4, "listed": false}}, "abq": false, "bot": 0.917, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 5}}, "oid": "ORG-ATL58-RIPE", "org": "Amarutu Technology Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://koddos.net"}, "pfx": 63, "reg": "2017-02-22", "rir": "ripencc", "s24": 70, "sib": 0, "tor": 1, "w24": 11, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 18176, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield"], "traffic": 0.00191379002694}, {"a": 206378, "h": "STOLITOMSON-AS", "n": "FOP Dmytro Nedilskyi", "t": "Other", "w": 10, "cc": "UA", "cf": null, "cs": {"c": {"first_seen_30d": 8, "ssh_bruteforce": 9}, "n": 9}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 9, "mean": 1.99, "above": false}, "threatfox": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.999, 1, false], ["2026-10-12", 1.349, 1.030, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 1.030, "se": 1.880, "ts": 1.000, "map": 16.185, "obs": 1, "own": 30.902, "comp": {"urlhaus": -0.0112, "threatfox": 4.4516, "phishing_db": -0.0301}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:BianLian": 1}}, "oid": "ORG-FDN3-RIPE", "org": "FOP Dmytro Nedilskyi", "pdb": null, "pfx": 1, "reg": "2025-07-18", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206383, "h": "VOXLAN-AS", "n": "VOXLAN", "t": "Hosting & VPS", "w": 8, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 8, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.612, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.612, "se": 1.449, "ts": 1.000, "map": 6.620, "obs": 1, "own": 1.700, "comp": {"cins": -0.0543, "dshield": -0.1297, "crowdsec": -0.5143, "vulncheck": 4.2667, "blocklist_de": -0.2846}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.840, "det": {"vulncheck": {"botnet_node": 8}}, "oid": "ORG-VL409-RIPE", "org": "VOXLAN LTD.", "pdb": {"t": "Network Services", "sc": "North America", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.voxlan.com"}, "pfx": 6, "reg": "2017-01-31", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000000086544}, {"a": 206428, "h": "MEGADATA-AS", "n": "MEGADATA LLC", "t": "Other", "w": 0, "cc": "BY", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ML424-RIPE", "org": "MEGADATA LLC", "pdb": null, "pfx": 1, "reg": "2017-01-20", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000005095396}, {"a": 206446, "h": "CLOUDLEASE", "n": "CLOUD LEASE", "t": "Hosting & VPS", "w": 9, "cc": "IL", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "ssh_bruteforce": 2, "web_bruteforce": 3, "cve:CVE-2025-29927": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1662, "hi": 4.39, "lo": 0.33, "ips": 3, "mean": 1.85, "above": false}, "vulncheck": {"n": 2, "p": 0.4127, "hi": 6.20, "lo": 0.81, "ips": 6, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 6.262, 0.011, 0, false], ["2026-10-12", 2.530, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.274, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.530, "se": 0.795, "ts": 0.667, "map": 8.020, "obs": 3, "own": 1.660, "comp": {"cins": -0.3101, "dshield": -0.6643, "crowdsec": 1.6183, "vulncheck": 4.4296, "blocklist_de": -1.5978}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.715, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-CLL19-RIPE", "org": "CLOUD LEASE Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.cloudlease.co.il/"}, "pfx": 30, "reg": "2017-01-18", "rir": "ripencc", "s24": 30, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00029135772302}, {"a": 206479, "h": "AceRDP", "n": "AceRDP Ltd", "t": "Other", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2025-55182": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.911, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.930, "det": null, "oid": "ORG-AL1048-RIPE", "org": "AceRDP Ltd", "pdb": {"t": null, "sc": "North America", "tr": null, "pol": "Open", "web": "https://acerdp.io"}, "pfx": 1, "reg": "2025-07-15", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206498, "h": "diginet-it", "n": "diginet-it", "t": "Other", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.189, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DS296-RIPE", "org": "Diginet SRL", "pdb": null, "pfx": 2, "reg": "2017-01-10", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206557, "h": "ELTELE", "n": "ELTELE", "t": "Transit & backbone", "w": 0, "cc": "NO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1146, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 0.155, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 1.998, "ts": null, "map": 0.183, "obs": 0, "own": 1.867, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.789, "ts": null, "map": 0.151, "obs": 0, "own": 0.921, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.141, "det": {"shodan": {"c2": 1}}, "oid": "ORG-ENA1-RIPE", "org": "Eltele AS", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://eltele.no/"}, "pfx": 5, "reg": "2016-12-20", "rir": "ripencc", "s24": 112, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29696, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056809365468}, {"a": 206728, "h": "MEDIALAND-AS", "n": "Media Land LLC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.4225, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.013, 15.276, 1, false], ["2026-10-12", 0.013, 15.363, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 15.363, "se": 1.298, "ts": 1.000, "map": 106.827, "obs": 2, "own": 99.590, "comp": {"urlhaus": -0.142, "threatfox": -0.1669, "phishing_db": 6.6063}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.901, "det": null, "oid": "ORG-MLL13-RIPE", "org": "Media Land LLC", "pdb": null, "pfx": 2, "reg": "2016-11-17", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206757, "h": "tecnocolor", "n": "FIBROPTIC CAT TELECOM SL", "t": "Hosting & VPS", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.144, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.200, "det": null, "oid": "ORG-FCTS1-RIPE", "org": "FIBROPTIC CAT TELECOM SL", "pdb": null, "pfx": 20, "reg": "2020-03-19", "rir": "ripencc", "s24": 19, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008557345114}, {"a": 206791, "h": "SBY-Telecom-AS", "n": "Slobozhenyuk B.Y. PE", "t": "Hosting & VPS", "w": 7, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 7, "web_exploit": 2, "proxy_or_vpn": 1, "web_bruteforce": 7}, "n": 7}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.848, 0.012, 1, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.967, "det": null, "oid": "ORG-SBP4-RIPE", "org": "Slobozhenyuk B.Y. PE", "pdb": null, "pfx": 1, "reg": "2016-11-04", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206804, "h": "EstNOC-GLOBAL", "n": "EstNOC", "t": "Enterprise, edu & gov", "w": 54, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 38, "web_exploit": 44, "bad_crawling": 26, "proxy_or_vpn": 7, "ssh_bruteforce": 10, "web_bruteforce": 47, "mail_bruteforce": 9, "cve:CVE-2025-4396": 13, "cve:CVE-2018-20062": 17, "cve:CVE-2020-11738": 7, "cve:CVE-2021-44228": 7, "cve:CVE-2022-22965": 12}, "n": 52}, "ev": {"crowdsec": {"n": 11, "p": 0.9997, "hi": 15.78, "lo": 6.00, "ips": 52, "mean": 10.40, "above": true}, "blocklist_de": {"n": 2, "p": 0.3827, "hi": 5.93, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}}, "h2": [["2026-10-05", 16.587, 0.011, 1, false], ["2026-10-12", 18.281, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 2.606, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 11, "vulncheck": 0, "blocklist_de": 2}, "lo": 18.281, "se": 0.455, "ts": 0.846, "map": 32.214, "obs": 13, "own": 179.285, "comp": {"cins": -1.6391, "dshield": -2.29, "crowdsec": 11.5, "vulncheck": -0.9108, "blocklist_de": -1.7941}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.436, "det": {"blocklist_de": {"imap": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-EO51-RIPE", "org": "EstNOC OU", "pdb": {"t": "Enterprise", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.estnoc.ee"}, "pfx": 57, "reg": "2016-11-03", "rir": "ripencc", "s24": 58, "sib": 0, "tor": 3, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0019869259107}, {"a": 206813, "h": "AS4830org", "n": "4830.org e. V.", "t": "Enterprise, edu & gov", "w": 256, "cc": "DE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 256, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 87.583, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.132, "det": {"blocklist_de": {"mail": 256, "apache": 256}}, "oid": "ORG-FVFF1-RIPE", "org": "4830.org e. V.", "pdb": {"t": "Non-Profit", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "https://verein.4830.org"}, "pfx": 4, "reg": "2016-11-01", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206819, "h": "markahost-llc", "n": "Markahost LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.885, "det": null, "oid": "ORG-ML961-RIPE", "org": "Markahost LLC", "pdb": null, "pfx": 1, "reg": "2026-02-23", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206831, "h": null, "n": "AS206831", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": null, "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206842, "h": "Tactica", "n": "Tactica ehf", "t": "Other", "w": 1, "cc": "IS", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8109, "hi": 9.08, "lo": 1.95, "ips": 4, "mean": 4.96, "above": true}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.708, 0.011, 0, false], ["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 6.496, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.873, "det": {"shodan": {"c2": 4}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-TE45-RIPE", "org": "Tactica ehf", "pdb": null, "pfx": 1, "reg": "2016-10-25", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00000665738304}, {"a": 206888, "h": "HANMING-AS", "n": "HanMing HK Limited", "t": "Other", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7888, "hi": 8.71, "lo": 1.87, "ips": 4, "mean": 4.76, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "phishing_db": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1879, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.352, 0.506, 0, false], ["2026-10-12", 2.103, 0.528, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.528, "se": 1.574, "ts": 1.000, "map": 5.708, "obs": 1, "own": 6.900, "comp": {"urlhaus": -0.0925, "threatfox": -0.119, "phishing_db": 3.5795}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.103, "se": 0.961, "ts": 0.500, "map": 9.434, "obs": 2, "own": 5.557, "comp": {"cins": -0.293, "dshield": -0.632, "crowdsec": 1.793, "vulncheck": -0.5191, "blocklist_de": 3.289}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.925, "det": {"shodan": {"c2": 1, "compromised": 2, "doublepulsar": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HHL13-RIPE", "org": "HanMing HK Limited", "pdb": null, "pfx": 12, "reg": "2022-03-23", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014309226668}, {"a": 206951, "h": "BMBGreen", "n": "BMB-Green s.r.o.", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5957, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.166, "det": null, "oid": "ORG-BS329-RIPE", "org": "BMB-Green s.r.o.", "pdb": null, "pfx": 1, "reg": "2016-10-03", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 206996, "h": "zap-hosting", "n": "ZAP-Hosting GmbH", "t": "Hosting & VPS", "w": 4, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 13, "p": 1.0000, "hi": 17.34, "lo": 7.10, "ips": 13, "mean": 11.74, "above": true}, "vulncheck": {"n": 1, "p": 0.1790, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "phishing_db": {"n": 2, "p": 0.3943, "hi": 6.03, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "blocklist_de": {"n": 1, "p": 0.1599, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 0.009, 4.482, 0, false], ["2026-10-12", 0.590, 1.455, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.455, "se": 1.148, "ts": 1.000, "map": 6.620, "obs": 2, "own": 2.583, "comp": {"urlhaus": -0.367, "threatfox": -0.3099, "phishing_db": 4.1932}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.590, "se": 0.921, "ts": 0.500, "map": 2.376, "obs": 2, "own": 0.500, "comp": {"cins": -0.2778, "dshield": -0.6029, "crowdsec": -2.38, "vulncheck": 2.1315, "blocklist_de": 3.3883}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.636, "det": {"shodan": {"c2": 1, "malware": 2, "compromised": 9, "doublepulsar": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-ZHG2-RIPE", "org": "ZAP-Hosting GmbH", "pdb": null, "pfx": 90, "reg": "2025-06-13", "rir": "ripencc", "s24": 90, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23040, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00187514168505}, {"a": 207023, "h": "centrixweb1", "n": "Centrix Web Services LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 0.604, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.858, "ts": null, "map": 0.176, "obs": 0, "own": 0.223, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.289, "det": null, "oid": "ORG-CWSL8-RIPE", "org": "Centrix Web Services LLC", "pdb": null, "pfx": 29, "reg": "2016-09-19", "rir": "ripencc", "s24": 66, "sib": 0, "tor": 0, "w24": 0, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046992450245}, {"a": 207043, "h": "DEDIK-IO", "n": "DEDIK SERVICES LIMITED", "t": "Hosting & VPS", "w": 81, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 31, "data_centre": 8, "web_exploit": 44, "bad_crawling": 17, "proxy_or_vpn": 9, "first_seen_30d": 17, "ssh_bruteforce": 18, "web_bruteforce": 29, "mail_bruteforce": 3, "cve:CVE-2017-9841": 5, "cve:CVE-2022-3236": 12, "cve:CVE-2024-28000": 7, "cve:CVE-2025-22457": 5, "cve:CVE-2026-60137": 6}, "n": 47}, "ev": {"cins": {"n": 3, "p": 0.6364, "hi": 7.63, "lo": 1.34, "ips": 3, "mean": 3.94, "above": false}, "shodan": {"n": 5, "p": 0.8896, "hi": 9.72, "lo": 2.42, "ips": 5, "mean": 5.55, "above": true}, "dshield": {"n": 3, "p": 0.6335, "hi": 7.60, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "urlhaus": {"n": 8, "p": 0.9961, "hi": 14.38, "lo": 4.68, "ips": 8, "mean": 8.97, "above": true}, "crowdsec": {"n": 19, "p": 1.0000, "hi": 25.32, "lo": 12.04, "ips": 47, "mean": 18.17, "above": true}, "threatfox": {"n": 9, "p": 0.9988, "hi": 15.61, "lo": 5.39, "ips": 23, "mean": 9.94, "above": true}, "vulncheck": {"n": 3, "p": 0.6338, "hi": 7.60, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "blocklist_de": {"n": 5, "p": 0.9033, "hi": 10.10, "lo": 2.51, "ips": 5, "mean": 5.77, "above": true}}, "h2": [["2026-10-05", 57.309, 119.267, 1, false], ["2026-10-12", 80.706, 158.101, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 8, "threatfox": 9, "phishing_db": 0}, "lo": 158.101, "se": 0.695, "ts": 0.529, "map": 334.349, "obs": 17, "own": 104.795, "comp": {"urlhaus": 7.4662, "threatfox": 1.1415, "phishing_db": -1.1693}, "mass": 14.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 3, "crowdsec": 19, "vulncheck": 3, "blocklist_de": 5}, "lo": 80.706, "se": 0.390, "ts": 0.576, "map": 126.837, "obs": 33, "own": 24.635, "comp": {"cins": 3.6202, "dshield": -0.1137, "crowdsec": 6.0759, "vulncheck": -0.2963, "blocklist_de": -3.0496}, "mass": 26.4, "listed": false}}, "abq": false, "bot": 0.611, "det": {"shodan": {"c2": 3, "compromised": 2}, "threatfox": {"family:Havoc": 1, "family:Tsundere": 16, "family:AdaptixC2": 2, "family:RomulusLoader": 3, "family:Unknown malware": 1}, "vulncheck": {"attack_tooling": 3}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1, "apache": 2, "bruteforcelogin": 1}}, "oid": "ORG-DSL56-RIPE", "org": "DEDIK SERVICES LIMITED", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "http://dedik.io"}, "pfx": 38, "reg": "2025-06-12", "rir": "ripencc", "s24": 38, "sib": 1, "tor": 0, "w24": 22, "drop": 2, "hist": [["2026-10-05", 0.9972], ["2026-10-12", 0.9977]], "ipv4": 9728, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00350467521102}, {"a": 207088, "h": "ADOARD", "n": "ADOARD GLOBAL REACH LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.544, "det": null, "oid": "ORG-AGRL3-RIPE", "org": "ADOARD GLOBAL REACH LLC", "pdb": null, "pfx": 1, "reg": "2016-09-02", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207137, "h": "PACKETHUBSA", "n": "PacketHub AS207137", "t": "Other", "w": 3, "cc": "PA", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.6356, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-12", 3.604, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 0.706, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.604, "se": 0.771, "ts": 1.000, "map": 11.289, "obs": 3, "own": 6.465, "comp": {"cins": -0.45, "dshield": 10.7939, "crowdsec": -3.5932, "vulncheck": -0.6351, "blocklist_de": -2.2981}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.206, "det": null, "oid": "ORG-PS448-RIPE", "org": "PacketHub S.A.", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.packethub.net/"}, "pfx": 32, "reg": "2022-03-18", "rir": "ripencc", "s24": 32, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01838948915426}, {"a": 207143, "h": "hosttech-AS", "n": "Hosttech GmbH", "t": "Hosting & VPS", "w": 1, "cc": "CH", "cf": null, "cs": null, "ev": {"shodan": {"n": 14, "p": 1.0000, "hi": 20.36, "lo": 8.60, "ips": 14, "mean": 13.96, "above": true}, "vulncheck": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.250, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.266, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.250, "se": 1.277, "ts": 1.000, "map": 1.962, "obs": 1, "own": 0.460, "comp": {"cins": -0.0931, "dshield": -0.2185, "crowdsec": -0.8656, "vulncheck": 3.7314, "blocklist_de": -0.4865}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.877, "det": {"shodan": {"c2": 5, "compromised": 9}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-HG47-RIPE", "org": "hosttech GmbH", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://hosttech.eu"}, "pfx": 35, "reg": "2016-08-23", "rir": "ripencc", "s24": 35, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 12032, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00008176292324}, {"a": 207147, "h": "NETCOM-AS", "n": "Nexera SAS", "t": "Other", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.584, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.840, "ts": null, "map": 0.169, "obs": 0, "own": 0.206, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NGS6-RIPE", "org": "Nexera SAS", "pdb": null, "pfx": 89, "reg": "2016-08-23", "rir": "ripencc", "s24": 76, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 35840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00052748714512}, {"a": 207164, "h": "PRIMANET", "n": "PRIMANET SRL", "t": "Other", "w": 3, "cc": "MD", "cf": null, "cs": {"c": {"ssh_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 3, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 30.955, 0.011, 1, false], ["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 13.105, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.169, "det": null, "oid": "ORG-PS361-RIPE", "org": "PRIMANET SRL", "pdb": null, "pfx": 2, "reg": "2016-08-19", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002329451775}, {"a": 207223, "h": "GLOBALCON", "n": "Global Connections Network LLC", "t": "Other", "w": 147, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 144, "web_exploit": 147, "bad_crawling": 37, "proxy_or_vpn": 145, "web_bruteforce": 3, "home_connection": 5, "router_or_botnet": 145, "cve:CVE-2025-4396": 8}, "n": 147}, "ev": {"crowdsec": {"n": 5, "p": 0.9112, "hi": 10.35, "lo": 2.57, "ips": 147, "mean": 5.91, "above": true}}, "h2": [["2026-10-05", 37.227, 0.011, 1, false], ["2026-10-12", 39.224, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 39.224, "se": 0.627, "ts": 1.000, "map": 94.372, "obs": 5, "own": 53.175, "comp": {"cins": -0.6672, "dshield": -1.2501, "crowdsec": 11.9551, "vulncheck": -0.7349, "blocklist_de": -3.362}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.846, "det": null, "oid": "ORG-GCNL2-RIPE", "org": "Global Connections Network LLC", "pdb": null, "pfx": 6, "reg": "2016-08-08", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": null}, {"a": 207237, "h": "Sibiz", "n": "Sibiz S.R.L", "t": "Other", "w": 0, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.162, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SS640-RIPE", "org": "Sibiz S.R.L", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://sibizsrl.it"}, "pfx": 1, "reg": "2016-08-04", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207295, "h": "Akhtar", "n": "Akhtar Technologies Limited", "t": "Other", "w": 1, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-44228": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.732, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-ATL108-RIPE", "org": "Akhtar Technologies Limited", "pdb": null, "pfx": 1, "reg": "2025-07-29", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207333, "h": "Hoster-AST", "n": "LLP \"Kompaniya Hoster.KZ\"", "t": "Hosting & VPS", "w": 1, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 9, "p": 0.9977, "hi": 14.19, "lo": 4.90, "ips": 9, "mean": 9.03, "above": true}, "crowdsec": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 1.121, 0.011, 0, false], ["2026-10-12", 0.253, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 0.247, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.253, "se": 1.262, "ts": 1.000, "map": 1.996, "obs": 1, "own": 0.447, "comp": {"cins": -0.1341, "dshield": -0.309, "crowdsec": 3.5466, "vulncheck": -0.3202, "blocklist_de": -0.6985}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.738, "det": {"shodan": {"compromised": 9}}, "oid": "ORG-LH46-RIPE", "org": "LLP \"Kompaniya Hoster.KZ\"", "pdb": null, "pfx": 50, "reg": "2020-02-24", "rir": "ripencc", "s24": 50, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 12800, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00015476653808}, {"a": 207350, "h": "Faratechnology", "n": "Arshia Asadi", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.998, "det": null, "oid": "ORG-AA3313-RIPE", "org": "Arshia Asadi", "pdb": null, "pfx": 1, "reg": "2025-06-05", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207369, "h": "SKYNET-TELECOM-AS", "n": "Skynet Telecom, LLC", "t": "Broadband & mobile", "w": 1, "cc": "KG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3896, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.352, 0.011, 0, false], ["2026-10-12", 0.376, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.376, "se": 1.331, "ts": 1.000, "map": 3.394, "obs": 1, "own": 6.155, "comp": {"cins": -0.11, "dshield": -0.2563, "crowdsec": 3.8337, "vulncheck": -0.2774, "blocklist_de": -0.5742}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.348, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-STL128-RIPE", "org": "Skynet Telecom, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://skynet.kg/"}, "pfx": 8, "reg": "2020-02-18", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00102005167818}, {"a": 207408, "h": "servinga-EE", "n": "servinga GmbH - Estonia", "t": "Other", "w": 6, "cc": "DE", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.4222, "hi": 6.29, "lo": 0.82, "ips": 6, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.012, 12.207, 1, false], ["2026-10-12", 0.013, 12.301, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 12.301, "se": 1.273, "ts": 1.000, "map": 80.601, "obs": 2, "own": 75.324, "comp": {"urlhaus": -0.1598, "threatfox": -0.1821, "phishing_db": 6.3576}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.502, "det": null, "oid": "ORG-SG288-RIPE", "org": "servinga GmbH", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.servinga.com"}, "pfx": 3, "reg": "2020-02-06", "rir": "ripencc", "s24": 3, "sib": 5, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007397461316}, {"a": 207418, "h": "CloudHost", "n": "CLOUD HOST TECHNOLOGY LLC", "t": "Hosting & VPS", "w": 0, "cc": "AE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.758, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RSTA7-RIPE", "org": "CLOUD HOST TECHNOLOGY LLC", "pdb": null, "pfx": 2, "reg": "2020-02-04", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000709401961}, {"a": 207459, "h": "AS-TEKNOSOS-INT", "n": "TEKNOSOS BILISIM HIZMETLERI", "t": "Enterprise, edu & gov", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.491, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 3.441, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 4.822, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.633, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TBHV3-RIPE", "org": "TEKNOSOS BILISIM HIZMETLERI VE TIC. LTD. STI.", "pdb": {"t": "Enterprise", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.teknosos.com.tr"}, "pfx": 13, "reg": "2020-01-28", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002900201583}, {"a": 207513, "h": "HOSTOFF", "n": "HOSTOFF", "t": "Hosting & VPS", "w": 1, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1664, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1821, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.315, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.059, "ts": null, "map": 0.192, "obs": 0, "own": 0.263, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.315, "se": 1.300, "ts": 1.000, "map": 2.669, "obs": 1, "own": 0.610, "comp": {"cins": -0.1327, "dshield": -0.3061, "crowdsec": -1.2116, "vulncheck": -0.3179, "blocklist_de": 4.3438}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.481, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-LLCH4-RIPE", "org": "LLC \"HOSTOFF CSL\"", "pdb": {"t": "Network Services", "sc": null, "tr": "1-5Tbps", "pol": "Selective", "web": "https://hostoff.net"}, "pfx": 37, "reg": "2025-06-02", "rir": "ripencc", "s24": 37, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00133015448958}, {"a": 207560, "h": "VIKHOST", "n": "Zubritska Valeriia Nikolaevna", "t": "Hosting & VPS", "w": 1, "cc": "UA", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.731, "det": {"shodan": {"c2": 1}}, "oid": "ORG-ZVN1-RIPE", "org": "Zubritska Valeriia Nikolaevna", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://vikhost.com"}, "pfx": 2, "reg": "2020-01-13", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207569, "h": "I-SERVERS-NORTH-EU", "n": "IHOR HOSTING LTD", "t": "Hosting & VPS", "w": 6, "cc": "GB", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1435, "hi": 4.15, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}, "crowdsec": {"n": 1, "p": 0.1323, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}, "phishing_db": {"n": 2, "p": 0.4015, "hi": 6.10, "lo": 0.79, "ips": 3, "mean": 2.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.3767, "hi": 5.87, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}}, "h2": [["2026-10-05", 6.126, 1.729, 0, false], ["2026-10-12", 2.172, 1.768, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.768, "se": 1.154, "ts": 1.000, "map": 8.270, "obs": 2, "own": 3.189, "comp": {"urlhaus": -0.3441, "threatfox": -0.2991, "phishing_db": 4.3819}, "mass": 0.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.172, "se": 0.761, "ts": 0.667, "map": 6.669, "obs": 3, "own": 1.333, "comp": {"cins": -0.5436, "dshield": -1.0648, "crowdsec": -0.5404, "vulncheck": -0.6843, "blocklist_de": 6.1243}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.483, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-IHL38-RIPE", "org": "IHOR HOSTING LTD", "pdb": null, "pfx": 67, "reg": "2020-01-13", "rir": "ripencc", "s24": 67, "sib": 2, "tor": 0, "w24": 5, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17152, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00078645383576}, {"a": 207582, "h": "BUULDY", "n": "Emre Mert Delidere trading as Buuldy Bilisim", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.856, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-EMDT1-RIPE", "org": "Emre Mert Delidere trading as Buuldy Bilisim", "pdb": null, "pfx": 6, "reg": "2020-01-10", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207598, "h": "iraqcell", "n": "iraqcell", "t": "Hosting & VPS", "w": 1, "cc": "IQ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 10.935, 0.011, 1, false], ["2026-10-12", 4.382, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.382, "se": 1.009, "ts": 0.500, "map": 21.561, "obs": 2, "own": 4.456, "comp": {"cins": -0.2535, "dshield": -0.5557, "crowdsec": 2.2066, "vulncheck": -0.4799, "blocklist_de": 3.547}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-ICCL5-RIPE", "org": "Iraqcell Communications Co. Ltd.", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "200-300Gbps", "pol": "Open", "web": "http://www.iraqcell.iq"}, "pfx": 9, "reg": "2025-09-25", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000217644999}, {"a": 207656, "h": "EPINATURA", "n": "Ukrainian Data Network", "t": "Other", "w": 2, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.903, "det": null, "oid": "ORG-EL355-RIPE", "org": "Epinatura LLC", "pdb": {"t": null, "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.urdn.com.ua"}, "pfx": 2, "reg": "2019-12-20", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 3, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207676, "h": "BEST-LINE-AS", "n": "Best Line Ltd.", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 3.796, 0.012, 0, false]], "sh": false, "uc": 2308.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.796, "se": 0.999, "ts": 0.500, "map": 18.227, "obs": 2, "own": 10.796, "comp": {"cins": -0.2615, "dshield": -0.5712, "crowdsec": 2.1224, "vulncheck": -0.4882, "blocklist_de": 3.4951}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.397, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-BLL8-RIPE", "org": "Best Line Ltd.", "pdb": null, "pfx": 11, "reg": "2019-12-18", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207695, "h": "dataflair", "n": "Mario Kurz trading as LUME Solutions", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.528, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-DA1458-RIPE", "org": "Mario Kurz trading as LUME Solutions", "pdb": null, "pfx": 3, "reg": "2025-05-30", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008721012051}, {"a": 207713, "h": "GIR-AS", "n": "GLOBAL INTERNET SOLUTIONS", "t": "Hosting & VPS", "w": 9, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1664, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "vulncheck": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "phishing_db": {"n": 5, "p": 0.9105, "hi": 10.33, "lo": 2.57, "ips": 7, "mean": 5.89, "above": true}, "blocklist_de": {"n": 1, "p": 0.1821, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 8.952, 30.916, 1, false], ["2026-10-12", 1.187, 13.985, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 5}, "lo": 13.985, "se": 0.861, "ts": 1.000, "map": 37.731, "obs": 5, "own": 13.087, "comp": {"urlhaus": -0.7457, "threatfox": -0.4271, "phishing_db": 6.4295}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.187, "se": 0.953, "ts": 0.500, "map": 5.070, "obs": 2, "own": 1.073, "comp": {"cins": -0.2455, "dshield": -0.54, "crowdsec": -2.1328, "vulncheck": 2.336, "blocklist_de": 3.5993}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.784, "det": {"shodan": {"c2": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-GIR1-RIPE", "org": "GLOBAL INTERNET SOLUTIONS LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://gir.network"}, "pfx": 37, "reg": "2022-05-24", "rir": "ripencc", "s24": 37, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.0810]], "ipv4": 9472, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.0003351666549}, {"a": 207810, "h": "VTelecom", "n": "VirusNet LLC", "t": "Broadband & mobile", "w": 3, "cc": "AM", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.425, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.425, "se": 1.369, "ts": 1.000, "map": 3.963, "obs": 1, "own": 7.612, "comp": {"cins": -0.0702, "dshield": -0.1665, "crowdsec": -0.6597, "vulncheck": 4.0346, "blocklist_de": -0.3674}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.159, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-NL435-RIPE", "org": "\"Virus Net\" LLC", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.vtelecom.am"}, "pfx": 7, "reg": "2019-11-20", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00141711804654}, {"a": 207812, "h": "DM_AUTO", "n": "DM AUTO EOOD", "t": "Other", "w": 5, "cc": "BG", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.848, 0.012, 1, false], ["2026-10-12", 19.114, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 19.114, "se": 1.138, "ts": 0.500, "map": 120.995, "obs": 2, "own": 73.706, "comp": {"cins": -0.1615, "dshield": 4.3289, "crowdsec": 3.226, "vulncheck": -0.3639, "blocklist_de": -0.84}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.692, "det": null, "oid": "ORG-DAE2-RIPE", "org": "DM AUTO EOOD", "pdb": null, "pfx": 1, "reg": "2019-11-20", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207841, "h": "INFERNO", "n": "Inferno Communications", "t": "Transit & backbone", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.936, "det": null, "oid": "ORG-ICL64-RIPE", "org": "Inferno Communications Ltd", "pdb": {"t": "NSP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://inferno.co.uk"}, "pfx": 4, "reg": "2019-11-18", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207847, "h": "CloudBlast", "n": "CloudBlast", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4143, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 33.070, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 33.070, "se": 0.701, "ts": 0.500, "map": 91.591, "obs": 4, "own": 18.083, "comp": {"cins": -0.5555, "dshield": 2.5701, "crowdsec": 2.9788, "vulncheck": -0.6897, "blocklist_de": 1.6073}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.590, "det": {"blocklist_de": {"apache": 3}}, "oid": "ORG-CL809-RIPE", "org": "CloudBlast LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://cloudblast.io/"}, "pfx": 5, "reg": "2025-07-23", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 1, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000732060173}, {"a": 207957, "h": "ServHost-AS", "n": "SERV.HOST GROUP", "t": "Hosting & VPS", "w": 13, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "cve:CVE-2017-3506": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2017-12149": 1, "cve:CVE-2025-54236": 1, "cve:CVE-2026-75650": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1702, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}, "shodan": {"n": 2, "p": 0.2307, "hi": 4.66, "lo": 0.61, "ips": 2, "mean": 2.22, "above": false}, "dshield": {"n": 1, "p": 0.1629, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "crowdsec": {"n": 4, "p": 0.5690, "hi": 6.37, "lo": 1.37, "ips": 5, "mean": 3.48, "above": false}, "threatfox": {"n": 2, "p": 0.4065, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "vulncheck": {"n": 4, "p": 0.7702, "hi": 8.43, "lo": 1.81, "ips": 4, "mean": 4.60, "above": false}, "phishing_db": {"n": 1, "p": 0.1660, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "blocklist_de": {"n": 2, "p": 0.3158, "hi": 5.35, "lo": 0.70, "ips": 2, "mean": 2.55, "above": false}}, "h2": [["2026-10-05", 2.643, 2.728, 0, false], ["2026-10-12", 5.071, 1.770, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 1}, "lo": 1.770, "se": 1.011, "ts": 0.667, "map": 6.007, "obs": 3, "own": 2.327, "comp": {"urlhaus": -0.5647, "threatfox": 2.906, "phishing_db": 1.0779}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 4, "blocklist_de": 2}, "lo": 5.071, "se": 0.489, "ts": 0.333, "map": 9.307, "obs": 12, "own": 1.833, "comp": {"cins": 2.1181, "dshield": 0.0252, "crowdsec": 0.1636, "vulncheck": 1.7161, "blocklist_de": -0.3986}, "mass": 8.5, "listed": false}}, "abq": false, "bot": 0.531, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:PureRAT": 1, "family:SmartLoader": 1}, "vulncheck": {"c2_server": 3, "botnet_node": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-SGL71-RIPE", "org": "SERV.HOST GROUP LTD", "pdb": {"t": "NSP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://serv.host/"}, "pfx": 164, "reg": "2022-05-24", "rir": "ripencc", "s24": 164, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00411500383897}, {"a": 207986, "h": "OZON-BANK-AS", "n": "LLC OZON BANK", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.913, "det": null, "oid": "ORG-LEB1-RIPE", "org": "LLC OZON BANK", "pdb": null, "pfx": 8, "reg": "2022-08-10", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 207990, "h": "HR-CUSTOMER", "n": "HostRoyale Technologies Pvt Ltd", "t": "Hosting & VPS", "w": 3, "cc": "IN", "cf": {"rb": "", "wb": "", "rep": 1.39, "waf": 2.05}, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.1570, "hi": 4.06, "lo": 0.53, "ips": 3, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.365, 0.234, 0, false], ["2026-10-12", 0.004, 0.243, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.243, "se": 1.139, "ts": 1.000, "map": 0.978, "obs": 2, "own": 0.434, "comp": {"urlhaus": -0.6192, "threatfox": -0.3974, "phishing_db": 2.6203}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.004, "se": 1.492, "ts": null, "map": 0.050, "obs": 0, "own": 0.013, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.387, "det": null, "oid": "ORG-HTPL1-RIPE", "org": "HostRoyale Technologies Pvt Ltd", "pdb": null, "pfx": 1073, "reg": "2019-10-21", "rir": "ripencc", "s24": 1128, "sib": 7, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 292864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.052895}, {"a": 207992, "h": "feelb", "n": "Feelb", "t": "Other", "w": 2, "cc": "FR", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "phishing_db": {"n": 1, "p": 0.1942, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.514, 0, false], ["2026-10-12", 0.384, 0.536, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.536, "se": 1.578, "ts": 1.000, "map": 5.832, "obs": 1, "own": 7.065, "comp": {"urlhaus": -0.0906, "threatfox": -0.117, "phishing_db": 3.5972}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 2.326, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.786, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-FS285-RIPE", "org": "FEELB SARL", "pdb": {"t": null, "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://feelb.io"}, "pfx": 19, "reg": "2019-10-21", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055484529022}, {"a": 207994, "h": "Blockchain-Creek", "n": "ServCity", "t": "Hosting & VPS", "w": 5, "cc": "BE", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 2, "bad_crawling": 4, "first_seen_30d": 1, "web_bruteforce": 4}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 4, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1939, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 3.796, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.796, "se": 0.999, "ts": 0.500, "map": 18.227, "obs": 2, "own": 3.760, "comp": {"cins": -0.2615, "dshield": -0.5712, "crowdsec": 2.1224, "vulncheck": -0.4882, "blocklist_de": 3.4951}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.897, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-BC258-RIPE", "org": "Blockchain Creek B.V.", "pdb": {"t": "Content", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "https://servcity.org"}, "pfx": 11, "reg": "2023-03-07", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000071756881}, {"a": 208000, "h": "MEGACOM", "n": "Roberto Cardone trading as Megacom", "t": "Other", "w": 7, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 5, "proxy_or_vpn": 2, "web_bruteforce": 7, "mail_bruteforce": 7, "router_or_botnet": 1, "cve:CVE-2026-63030": 1}, "n": 7}, "ev": {"crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 7, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 10.978, 0.011, 1, false], ["2026-10-12", 11.989, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.989, "se": 1.090, "ts": 1.000, "map": 69.245, "obs": 2, "own": 41.678, "comp": {"cins": -0.1839, "dshield": -0.415, "crowdsec": 7.5814, "vulncheck": -0.396, "blocklist_de": -0.9552}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.597, "det": null, "oid": "ORG-RCTA1-RIPE", "org": "Roberto Cardone trading as Megacom", "pdb": null, "pfx": 2, "reg": "2019-10-18", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208087, "h": "EDINOS-AS", "n": "Novosibirsk Telecommunication Company (Ulan Ude)", "t": "Broadband & mobile", "w": 5, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 9.870, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 9.870, "se": 0.830, "ts": 0.667, "map": 33.460, "obs": 3, "own": 54.518, "comp": {"cins": -0.2618, "dshield": 3.8276, "crowdsec": -2.2581, "vulncheck": 4.9491, "blocklist_de": -1.3528}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.470, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-EOSL2-RIPE", "org": "Ediniy Operator Svyazi LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "No", "web": "https://edinos.ru"}, "pfx": 9, "reg": "2019-10-04", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003337605579}, {"a": 208137, "h": "FPS12", "n": "Feo Prest SRL", "t": "Other", "w": 52, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 28, "web_exploit": 34, "bad_crawling": 9, "ssh_bruteforce": 39, "web_bruteforce": 30, "mail_bruteforce": 13, "cve:CVE-2017-9841": 7, "cve:CVE-2024-6387": 12, "cve:CVE-2021-32648": 2, "cve:CVE-2026-63030": 2, "cve:CVE-2026-87902": 9}, "n": 50}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 13, "mean": 3.00, "above": false}, "crowdsec": {"n": 3, "p": 0.6419, "hi": 7.69, "lo": 1.36, "ips": 50, "mean": 3.97, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4210, "hi": 6.28, "lo": 0.82, "ips": 18, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 75.568, 0.849, 1, false], ["2026-10-12", 141.302, 0.878, 1, false]], "sh": true, "uc": 31901, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.878, "se": 1.769, "ts": 1.000, "map": 12.702, "obs": 1, "own": 19.185, "comp": {"urlhaus": -0.0263, "threatfox": 4.2628, "phishing_db": -0.0685}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 141.302, "se": 0.551, "ts": 0.429, "map": 298.649, "obs": 7, "own": 167.287, "comp": {"cins": -0.9713, "dshield": 4.0251, "crowdsec": 1.9493, "vulncheck": -0.8184, "blocklist_de": 2.9082}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"sip": 9, "ssh": 6, "bots": 1, "imap": 1, "mail": 1, "apache": 1}}, "oid": "ORG-FPS12-RIPE", "org": "Feo Prest SRL", "pdb": null, "pfx": 3, "reg": "2025-08-05", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 3, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00727643681055}, {"a": 208161, "h": "parsvds", "n": "Pars Shabakeh Azarakhsh LLC", "t": "Other", "w": 2, "cc": "IR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 8, "p": 0.9938, "hi": 13.35, "lo": 4.34, "ips": 8, "mean": 8.32, "above": true}, "crowdsec": {"n": 2, "p": 0.3588, "hi": 5.72, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}}, "h2": [["2026-10-05", 1.306, 0.011, 0, false], ["2026-10-12", 1.389, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.682, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.389, "se": 0.936, "ts": 1.000, "map": 5.913, "obs": 2, "own": 3.467, "comp": {"cins": -0.291, "dshield": -0.6281, "crowdsec": 6.1078, "vulncheck": -0.5171, "blocklist_de": -1.5008}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.832, "det": {"shodan": {"c2": 4, "compromised": 4}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-PSAL1-RIPE", "org": "Pars Shabakeh Azarakhsh LLC", "pdb": null, "pfx": 38, "reg": "2019-09-23", "rir": "ripencc", "s24": 38, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 9728, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00007518767385}, {"a": 208172, "h": "PV-HOSTED", "n": "Proton AG", "t": "Hosting & VPS", "w": 29, "cc": "CH", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 12, "bad_crawling": 9, "proxy_or_vpn": 2, "web_bruteforce": 12, "mail_bruteforce": 1, "cve:CVE-2017-9841": 4, "cve:CVE-2019-8318": 1, "cve:CVE-2025-4396": 2, "cve:CVE-2016-15043": 1, "cve:CVE-2024-28000": 4}, "n": 12}, "ev": {"dshield": {"n": 12, "p": 1.0000, "hi": 18.53, "lo": 7.33, "ips": 16, "mean": 12.39, "above": true}, "crowdsec": {"n": 8, "p": 0.9857, "hi": 11.62, "lo": 3.78, "ips": 12, "mean": 7.25, "above": true}, "blocklist_de": {"n": 1, "p": 0.1595, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 23.901, 0.011, 1, false], ["2026-10-12", 19.038, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.011, "ts": null, "map": 0.185, "obs": 0, "own": 0.214, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 12, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 19.038, "se": 0.413, "ts": 0.571, "map": 31.510, "obs": 21, "own": 6.142, "comp": {"cins": -2.1032, "dshield": 14.3161, "crowdsec": 0.8714, "vulncheck": -0.9451, "blocklist_de": -7.2953}, "mass": 15.8, "listed": false}}, "abq": false, "bot": 0.220, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PTA40-RIPE", "org": "Proton AG", "pdb": null, "pfx": 91, "reg": "2025-05-20", "rir": "ripencc", "s24": 91, "sib": 1, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0719]], "ipv4": 23296, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "dshield"], "traffic": 0.0360788341077}, {"a": 208198, "h": "Eylul-NET", "n": "Nese Mala", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.178, "det": null, "oid": "ORG-NMTA2-RIPE", "org": "Nese Mala", "pdb": null, "pfx": 1, "reg": "2019-09-16", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208220, "h": "offerhostinc", "n": "offerhostinc", "t": "Hosting & VPS", "w": 3, "cc": "SC", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.4212, "hi": 6.28, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.012, 8.208, 0, false], ["2026-10-12", 0.012, 8.305, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 8.305, "se": 1.236, "ts": 1.000, "map": 49.248, "obs": 2, "own": 17.786, "comp": {"urlhaus": -0.1931, "threatfox": -0.2084, "phishing_db": 5.9246}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.899, "det": null, "oid": "ORG-OSI10-RIPE", "org": "Offerhost Solutions Inc", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "200-300Gbps", "pol": "Open", "web": "https://offerhost.com/"}, "pfx": 6, "reg": "2025-05-19", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208226, "h": "OUIHEBERG", "n": "OuiHeberg", "t": "Other", "w": 1, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.458, 0.011, 0, false], ["2026-10-12", 0.518, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.518, "se": 1.397, "ts": 1.000, "map": 5.252, "obs": 1, "own": 3.625, "comp": {"cins": -0.0996, "dshield": -0.233, "crowdsec": -0.9227, "vulncheck": -0.2573, "blocklist_de": 4.5647}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.706, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-OS306-RIPE", "org": "Ouiheberg SARL", "pdb": {"t": null, "sc": null, "tr": "20-50Gbps", "pol": "Open", "web": "https://www.ouiheberg.com"}, "pfx": 14, "reg": "2019-09-12", "rir": "ripencc", "s24": 14, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015511239237}, {"a": 208241, "h": "RADIO-LINK-PLUS", "n": "\"RADIO-LINK PLUS\" LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.129, "det": null, "oid": "ORG-PL585-RIPE", "org": "\"RADIO-LINK PLUS\" LLC", "pdb": null, "pfx": 1, "reg": "2025-06-24", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025751453496}, {"a": 208313, "h": "Ibernet", "n": "IBERNET FIBRA S.L.", "t": "Broadband & mobile", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 9277.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.184, "det": null, "oid": "ORG-IFS10-RIPE", "org": "IBERNET FIBRA S.L.", "pdb": null, "pfx": 4, "reg": "2019-08-28", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208323, "h": "APPLIEDPRIVACY-AS", "n": "Foundation for Applied Privacy", "t": "Hosting & VPS", "w": 15, "cc": "AT", "cf": null, "cs": {"c": {"http_flood": 15, "data_centre": 13, "web_exploit": 15, "bad_crawling": 15, "proxy_or_vpn": 15, "web_bruteforce": 15, "mail_bruteforce": 2, "cve:CVE-2011-3600": 4, "cve:CVE-2014-2383": 4, "cve:CVE-2015-4455": 3, "cve:CVE-2015-9406": 9, "cve:CVE-2017-9841": 8}, "n": 15}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 15, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 27.480, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.669, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PRIV3-RIPE", "org": "Foundation for Applied Privacy", "pdb": {"t": "Non-Profit", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://applied-privacy.net"}, "pfx": 1, "reg": "2019-08-27", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 15, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208337, "h": "TELEMANAPOLI", "n": "TELEMANAPOLI", "t": "Other", "w": 1, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.812, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.812, "se": 1.514, "ts": 1.000, "map": 10.069, "obs": 1, "own": 7.565, "comp": {"cins": -0.0687, "dshield": -0.1629, "crowdsec": -0.6454, "vulncheck": -0.1914, "blocklist_de": 4.7715}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.201, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-TS490-RIPE", "org": "TELEMANAPOLI S.R.L.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.telemanapoli.it"}, "pfx": 5, "reg": "2019-08-22", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208367, "h": "CSPACEHOSTINGS", "n": "CSpace Hostings", "t": "Hosting & VPS", "w": 0, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CHO1-RIPE", "org": "CSpace Hostings OU", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://cspacehostings.com"}, "pfx": 1, "reg": "2019-08-19", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208394, "h": "ETERNAL-GROUP-DENIZCILIK-EGITIM-MAKINE-DANISMANLIK-DIS-TICARET-LIMITED-SIRKETI", "n": "ETERNAL GROUP DENIZCILIK EGITIM MAKINE DANISMANLIK DIS TICARET LIMITED SIRKETI", "t": "Other", "w": 4, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4225, "hi": 6.29, "lo": 0.82, "ips": 4, "mean": 3.00, "above": false}}, "h2": [["2026-10-12", 12.054, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.054, "se": 1.091, "ts": 1.000, "map": 69.699, "obs": 2, "own": 41.949, "comp": {"cins": -0.1851, "dshield": 8.8321, "crowdsec": -1.6505, "vulncheck": -0.3976, "blocklist_de": -0.9611}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.549, "det": null, "oid": "ORG-EGDE1-RIPE", "org": "ETERNAL GROUP DENIZCILIK EGITIM MAKINE DANISMANLIK DIS TICARET LIMITED SIRKETI", "pdb": null, "pfx": 2, "reg": "2026-04-28", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000027183877}, {"a": 208397, "h": "INFOSTROY-AS", "n": "INFOSTROY LLC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1869, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1452, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}, "blocklist_de": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.233, 0.011, 0, false], ["2026-10-12", 2.531, 0.012, 0, false]], "sh": false, "uc": 1044.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.531, "se": 0.763, "ts": 0.333, "map": 7.790, "obs": 3, "own": 4.468, "comp": {"cins": -0.4985, "dshield": 2.7926, "crowdsec": -0.1535, "vulncheck": -0.662, "blocklist_de": 1.9678}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.478, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-IL610-RIPE", "org": "INFOSTROY LLC", "pdb": null, "pfx": 9, "reg": "2019-08-12", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208398, "h": "TELETECH", "n": "Teletech", "t": "Other", "w": 1, "cc": "RS", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0768, "hi": 3.37, "lo": 0.25, "ips": 1, "mean": 1.42, "above": false}}, "h2": [["2026-10-05", 0.539, 0.009, 0, false], ["2026-10-12", 0.044, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.859, "ts": null, "map": 0.140, "obs": 0, "own": 0.290, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.044, "se": 1.065, "ts": 1.000, "map": 0.240, "obs": 1, "own": 0.145, "comp": {"cins": -0.2366, "dshield": 3.9497, "crowdsec": -2.0628, "vulncheck": -0.4614, "blocklist_de": -1.2245}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TDB4-RIPE", "org": "Edge Technology Plus d.o.o. Beograd", "pdb": null, "pfx": 34, "reg": "2023-01-24", "rir": "ripencc", "s24": 753, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 207872, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003800345689}, {"a": 208450, "h": "MEGAHOST_KZ", "n": "MEGAHOST_KZ", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.290, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MKT3-RIPE", "org": "Megahost Kazakhstan TOO", "pdb": null, "pfx": 10, "reg": "2019-08-01", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023993124274}, {"a": 208462, "h": "BISUP", "n": "COSMIC STORE LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.960, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CSL97-RIPE", "org": "COSMIC STORE LLC", "pdb": null, "pfx": 1, "reg": "2026-05-07", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208473, "h": "ASN-furrera", "n": "Furrera For Telecommunication & Internet Services", "t": "Broadband & mobile", "w": 4, "cc": "PS", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 28.487, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.691, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-FFTI1-RIPE", "org": "Furrera For Telecommunication & Internet Services Co. Private Shareholding Company", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://furrera.ps"}, "pfx": 2, "reg": "2019-07-29", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000678913713}, {"a": 208525, "h": "AIRULIMITED", "n": "Airu Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.023, "ts": null, "map": 0.187, "obs": 0, "own": 0.588, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.843, "ts": null, "map": 0.171, "obs": 0, "own": 0.209, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.588, "det": null, "oid": "ORG-AL1035-RIPE", "org": "Airu Limited", "pdb": null, "pfx": 29, "reg": "2025-05-14", "rir": "ripencc", "s24": 74, "sib": 0, "tor": 0, "w24": 0, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208582, "h": "EASYNAME", "n": "dogado GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.965, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DIG4-RIPE", "org": "dogado GmbH", "pdb": null, "pfx": 1, "reg": "2019-07-09", "rir": "ripencc", "s24": 4, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000037819665}, {"a": 208626, "h": "serv-tech", "n": "Serv-Tech", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.833, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SL1045-RIPE", "org": "ServTech LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://serv-tech.ru"}, "pfx": 16, "reg": "2019-07-01", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208630, "h": "InfotelecomAlbania-AS", "n": "INFO-Telecom Shpk", "t": "Broadband & mobile", "w": 0, "cc": "AL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 2.961, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.692, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IS459-RIPE", "org": "INFO-Telecom Shpk", "pdb": null, "pfx": 1, "reg": "2019-07-01", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208637, "h": "Vendeta4-LTD", "n": "4 Vendeta Ltd", "t": "Other", "w": 5, "cc": "BG", "cf": null, "cs": {"c": {"home_connection": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 18.137, 0.012, 1, false], ["2026-10-12", 70.122, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 70.122, "se": 0.868, "ts": 0.333, "map": 265.512, "obs": 3, "own": 153.033, "comp": {"cins": 4.4961, "dshield": 3.465, "crowdsec": 1.321, "vulncheck": -0.5594, "blocklist_de": -1.7474}, "mass": 1.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-AA2536-RIPE", "org": "4 Vendeta Ltd", "pdb": null, "pfx": 1, "reg": "2025-07-10", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208642, "h": "it-winet", "n": "WI-NET S.R.L.", "t": "Other", "w": 3, "cc": "IT", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.579, 0.011, 0, false], ["2026-10-12", 0.670, 0.012, 0, false]], "sh": false, "uc": 4296.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 5.435, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.191, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "ORG-WS178-RIPE", "org": "WI-NET S.R.L.", "pdb": null, "pfx": 2, "reg": "2019-06-28", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000068843215}, {"a": 208677, "h": "CLOUDRU-AS", "n": "\"Cloud Technologies\" LLC trading as Cloud.ru", "t": "Hosting & VPS", "w": 9, "cc": "RU", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 6, "p": 0.9409, "hi": 10.40, "lo": 2.88, "ips": 7, "mean": 6.15, "above": true}, "blocklist_de": {"n": 1, "p": 0.1031, "hi": 3.69, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}}, "h2": [["2026-10-05", 1.431, 0.178, 0, false], ["2026-10-12", 0.977, 0.184, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.184, "se": 1.404, "ts": 1.000, "map": 1.327, "obs": 1, "own": 0.614, "comp": {"urlhaus": -0.2272, "threatfox": 2.5697, "phishing_db": -0.4335}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 6, "blocklist_de": 1}, "lo": 0.977, "se": 0.589, "ts": 0.857, "map": 2.123, "obs": 7, "own": 0.432, "comp": {"cins": -0.6635, "dshield": -1.2447, "crowdsec": -4.886, "vulncheck": 8.0093, "blocklist_de": 0.9312}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.935, "det": {"threatfox": {"family:Sliver": 1}, "vulncheck": {"botnet_node": 6, "attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CTL61-RIPE", "org": "\"Cloud Technologies\" LLC trading as Cloud.ru", "pdb": null, "pfx": 102, "reg": "2019-06-21", "rir": "ripencc", "s24": 265, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 68352, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.0018365032917}, {"a": 208795, "h": "YANDEXCLOUDKZ", "n": "Yandex Cloud Kazakhstan", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 6.28}, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7659, "hi": 8.37, "lo": 1.80, "ips": 4, "mean": 4.57, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.254, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.096, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.985, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-YKL1-RIPE", "org": "\"Cloud Services Kazakhstan\" LLP", "pdb": null, "pfx": 12, "reg": "2023-04-25", "rir": "ripencc", "s24": 44, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01011270031443}, {"a": 208805, "h": "SpolNet", "n": "INTERCONNECT s.r.o.", "t": "Other", "w": 0, "cc": "CZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false]], "sh": false, "uc": null, "v2": null, "abq": false, "bot": null, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IS186-RIPE", "org": "INTERCONNECT s.r.o.", "pdb": null, "pfx": 1, "reg": "2019-05-31", "rir": "ripencc", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208939, "h": "servitecnic", "n": "TELEDISTRIBUCIONES SERVITECNIC SL", "t": "Other", "w": 1, "cc": "ES", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 6.735, 0.013, 0, false]], "sh": false, "uc": 5937.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.735, "se": 1.041, "ts": 0.500, "map": 35.126, "obs": 2, "own": 20.964, "comp": {"cins": -0.2307, "dshield": -0.5105, "crowdsec": 2.4519, "vulncheck": -0.4547, "blocklist_de": 3.6966}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-TSS56-RIPE", "org": "TELEDISTRIBUCIONES SERVITECNIC SL", "pdb": null, "pfx": 2, "reg": "2019-05-09", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208949, "h": "hbing-as", "n": "hbing-as", "t": "Other", "w": 12, "cc": "GB", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 3, "p": 0.6412, "hi": 7.69, "lo": 1.35, "ips": 11, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 20.490, 0.011, 1, false], ["2026-10-12", 6.219, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 0}, "lo": 6.219, "se": 0.715, "ts": 0.750, "map": 16.930, "obs": 4, "own": 9.976, "comp": {"cins": -0.366, "dshield": -0.7668, "crowdsec": 1.0643, "vulncheck": 6.1703, "blocklist_de": -1.879}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.961, "det": {"vulncheck": {"botnet_node": 11}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HA1037-RIPE", "org": "HBING LIMITED", "pdb": null, "pfx": 16, "reg": "2023-04-11", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208951, "h": "AS-ITGLOBALCOM", "n": "ITGLOBAL.COM", "t": "Other", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 4, "p": 0.7808, "hi": 8.58, "lo": 1.85, "ips": 4, "mean": 4.69, "above": false}}, "h2": [["2026-10-05", 1.742, 0.011, 0, false], ["2026-10-12", 0.349, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.710, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.349, "se": 1.319, "ts": 1.000, "map": 3.066, "obs": 1, "own": 2.032, "comp": {"cins": 4.956, "dshield": -0.2956, "crowdsec": -1.17, "vulncheck": -0.3097, "blocklist_de": -0.6666}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.509, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-INB13-RIPE", "org": "ITGLOBAL.COM NL B.V.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.itglobal.com"}, "pfx": 32, "reg": "2019-05-07", "rir": "ripencc", "s24": 31, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033195782194}, {"a": 208955, "h": "URALNET-AS", "n": "UralNet LLC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.983, 0.013, 0, false]], "sh": false, "uc": 13281.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.983, "se": 1.576, "ts": 1.000, "map": 13.454, "obs": 1, "own": 10.722, "comp": {"cins": -0.0552, "dshield": -0.1318, "crowdsec": -0.5223, "vulncheck": -0.1594, "blocklist_de": 4.8616}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.478, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-UL189-RIPE", "org": "UralNet LLC", "pdb": null, "pfx": 3, "reg": "2019-05-07", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 208972, "h": "gibirnet-tr", "n": "GIBIRNET", "t": "Hosting & VPS", "w": 266, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 6, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 5, "ssh_bruteforce": 2, "web_bruteforce": 7, "mail_bruteforce": 2, "router_or_botnet": 4, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "dshield": {"n": 1, "p": 0.1804, "hi": 4.55, "lo": 0.34, "ips": 256, "mean": 1.92, "above": false}, "crowdsec": {"n": 6, "p": 0.9229, "hi": 9.74, "lo": 2.70, "ips": 7, "mean": 5.76, "above": true}, "vulncheck": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 3, "p": 0.5891, "hi": 7.13, "lo": 1.26, "ips": 3, "mean": 3.68, "above": false}}, "h2": [["2026-10-05", 6.981, 0.011, 0, false], ["2026-10-12", 12.531, 0.012, 1, false]], "sh": false, "uc": 1398.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 0.220, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 3}, "lo": 12.531, "se": 0.472, "ts": 0.500, "map": 22.889, "obs": 12, "own": 4.480, "comp": {"cins": 1.6933, "dshield": -0.3812, "crowdsec": 2.3042, "vulncheck": -0.3616, "blocklist_de": 1.2697}, "mass": 10.2, "listed": false}}, "abq": false, "bot": 0.211, "det": {"vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-GIHS2-RIPE", "org": "GIBIRNET ILETISIM HIZMETLERI SANAYI VE TICARET LIMITED SIRKETI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "1-5Tbps", "pol": "Open", "web": "https://gibir.net.tr"}, "pfx": 84, "reg": "2019-05-02", "rir": "ripencc", "s24": 81, "sib": 1, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 38144, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00679607223715}, {"a": 209024, "h": "MTS-CLOUD-A", "n": "MTS PJSC", "t": "Hosting & VPS", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3431, "hi": 5.58, "lo": 0.73, "ips": 2, "mean": 2.66, "above": false}, "blocklist_de": {"n": 2, "p": 0.3895, "hi": 5.99, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-12", 4.698, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 4.698, "se": 0.674, "ts": 0.500, "map": 12.277, "obs": 4, "own": 2.432, "comp": {"cins": -0.6902, "dshield": -1.2829, "crowdsec": 1.6144, "vulncheck": -0.743, "blocklist_de": 5.0031}, "mass": 3.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": "ORG-ZM1-RIPE", "org": "MTS PJSC", "pdb": null, "pfx": 46, "reg": "2019-04-23", "rir": "ripencc", "s24": 48, "sib": 95, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209050, "h": "DIGIMAGICAL", "n": "Digimagical", "t": "Hosting & VPS", "w": 1, "cc": "AT", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 2.263, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.794, "det": {"shodan": {"c2": 2}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-DG178-RIPE", "org": "Digimagical GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.digimagical.com"}, "pfx": 1, "reg": "2019-04-16", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209101, "h": "ipvendettainc", "n": "IP Vendetta Inc.", "t": "Other", "w": 4, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-75650": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}, "threatfox": {"n": 2, "p": 0.4223, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 26.628, 5.989, 1, false], ["2026-10-12", 0.607, 5.982, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 5.982, "se": 1.214, "ts": 1.000, "map": 33.483, "obs": 2, "own": 32.079, "comp": {"urlhaus": -0.1967, "threatfox": 5.7251, "phishing_db": -0.3912}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 4.650, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:PureRAT": 1, "family:Cobalt Strike": 1}, "blocklist_de": {"apache": 1}}, "oid": "ORG-IVI3-RIPE", "org": "IP Vendetta Inc.", "pdb": null, "pfx": 9, "reg": "2025-05-19", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0017982156535}, {"a": 209103, "h": "ProtonVPN", "n": "Proton", "t": "Hosting & VPS", "w": 1, "cc": "CH", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.533, 0.011, 0, false], ["2026-10-12", 0.727, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.727, "se": 1.480, "ts": 1.000, "map": 8.547, "obs": 1, "own": 2.170, "comp": {"cins": -0.0699, "dshield": 4.8261, "crowdsec": -0.6569, "vulncheck": -0.1943, "blocklist_de": -0.3657}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-PA891-RIPE", "org": "Proton AG", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://proton.me"}, "pfx": 6, "reg": "2019-04-05", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00133602600104}, {"a": 209150, "h": "POINTER", "n": "Pointer", "t": "Hosting & VPS", "w": 0, "cc": "GR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.821, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TVGG1-RIPE", "org": "TH.PAPAMICHAIL VAINAS - G.PSALTAKIS G.P", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.pointer.gr"}, "pfx": 8, "reg": "2019-03-28", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001403179794}, {"a": 209160, "h": "Miti2000", "n": "Miti 2000 EOOD", "t": "Other", "w": 3, "cc": "BG", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 66.039, 0.012, 1, false], ["2026-10-12", 70.122, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 70.122, "se": 0.868, "ts": 0.333, "map": 265.512, "obs": 3, "own": 153.033, "comp": {"cins": 4.4961, "dshield": 3.465, "crowdsec": 1.321, "vulncheck": -0.5594, "blocklist_de": -1.7474}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.873, "det": null, "oid": "ORG-ME98-RIPE", "org": "Miti 2000 EOOD", "pdb": null, "pfx": 1, "reg": "2019-03-27", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209193, "h": "SuperCell-FTTH", "n": "SuperCell-FTTH", "t": "Broadband & mobile", "w": 1, "cc": "IQ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1714, "hi": 4.45, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.346, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.346, "se": 1.317, "ts": 1.000, "map": 3.030, "obs": 1, "own": 5.472, "comp": {"cins": -0.1264, "dshield": -0.2924, "crowdsec": -1.1574, "vulncheck": -0.3071, "blocklist_de": 4.3857}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"c2": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SCNF1-RIPE", "org": "SUPER CELL NETWORK FOR INTERNET SERVICES LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": null, "pol": "Open", "web": "https://supercell.iq/"}, "pfx": 31, "reg": "2022-02-01", "rir": "ripencc", "s24": 31, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00642114538338}, {"a": 209207, "h": "DHOST-AS", "n": "Digital Hosting Provider LLC", "t": "Hosting & VPS", "w": 5, "cc": "RU", "cf": null, "cs": null, "ev": {"threatfox": {"n": 4, "p": 0.8143, "hi": 9.14, "lo": 1.97, "ips": 5, "mean": 4.99, "above": true}}, "h2": [["2026-10-05", 0.011, 30.753, 1, false], ["2026-10-12", 0.012, 20.962, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 20.962, "se": 0.910, "ts": 1.000, "map": 63.802, "obs": 4, "own": 21.890, "comp": {"urlhaus": -0.489, "threatfox": 6.9621, "phishing_db": -0.6911}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.169, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.719, "det": {"threatfox": {"family:PureRAT": 4, "family:AsyncRAT": 1}}, "oid": "ORG-DA1445-RIPE", "org": "Digital Hosting Provider LLC", "pdb": null, "pfx": 13, "reg": "2026-01-19", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 3328, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00054990733534}, {"a": 209209, "h": "FABNET-AS", "n": "FABNET", "t": "Enterprise, edu & gov", "w": 1, "cc": "IT", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8142, "hi": 9.13, "lo": 1.97, "ips": 4, "mean": 4.99, "above": true}, "vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 4.322, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 162.426, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.423, "det": {"shodan": {"c2": 4}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-FA975-RIPE", "org": "Fabrizio Lanotte", "pdb": {"t": "Educational/Research", "sc": "Global", "tr": null, "pol": "Open", "web": "http://as209209.net"}, "pfx": 1, "reg": "2019-03-18", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 256, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 209272, "h": "AS-ALVIVA", "n": "Alviva Holding Limited", "t": "Other", "w": 5, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 4, "mean": 2.95, "above": false}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 41.855, 0.733, 1, false], ["2026-10-12", 5.536, 0.756, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.756, "se": 1.699, "ts": 1.000, "map": 10.084, "obs": 1, "own": 13.698, "comp": {"urlhaus": -0.0415, "threatfox": 4.084, "phishing_db": -0.1054}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 16.699, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.837, "det": {"threatfox": {"family:Cobalt Strike": 1}}, "oid": "ORG-AHL11-RIPE", "org": "Alviva Holding Limited", "pdb": null, "pfx": 6, "reg": "2019-03-07", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000037695926}, {"a": 209275, "h": "NetMax", "n": "NetmaxTR", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.175, "det": {"shodan": {"malware": 1}}, "oid": "ORG-NTIH1-RIPE", "org": "NETMAX TELEKOMUNIKASYON ILETISIM HIZMETLERI TICARET LIMITED SIRKETI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.netmax.com.tr"}, "pfx": 7, "reg": "2019-03-06", "rir": "ripencc", "s24": 7, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209334, "h": "MODAT-01", "n": "Modat B.V.", "t": "Other", "w": 3, "cc": "NL", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "dshield": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 9.321, 0.011, 0, false], ["2026-10-12", 28.876, 0.013, 1, false]], "sh": false, "uc": 76041.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 28.876, "se": 0.834, "ts": 0.667, "map": 101.309, "obs": 3, "own": 58.252, "comp": {"cins": 4.3986, "dshield": 7.3325, "crowdsec": -3.1533, "vulncheck": -0.5931, "blocklist_de": -1.9729}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.935, "det": null, "oid": "ORG-MB333-RIPE", "org": "Modat B.V.", "pdb": null, "pfx": 3, "reg": "2025-09-18", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209341, "h": "WHG-FRA", "n": "hosting.com FRA1", "t": "Hosting & VPS", "w": 7, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "web_bruteforce": 4, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 2}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1223, "hi": 3.92, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "crowdsec": {"n": 4, "p": 0.6699, "hi": 7.25, "lo": 1.56, "ips": 4, "mean": 3.96, "above": false}, "phishing_db": {"n": 3, "p": 0.6148, "hi": 7.40, "lo": 1.30, "ips": 3, "mean": 3.82, "above": false}}, "h2": [["2026-10-05", 2.039, 2.769, 0, false], ["2026-10-12", 2.139, 2.808, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 2.808, "se": 1.003, "ts": 1.000, "map": 9.665, "obs": 3, "own": 3.625, "comp": {"urlhaus": -0.5513, "threatfox": -0.3782, "phishing_db": 4.8241}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.139, "se": 0.662, "ts": 1.000, "map": 5.478, "obs": 4, "own": 1.085, "comp": {"cins": -0.6431, "dshield": -1.2152, "crowdsec": 8.924, "vulncheck": -0.7261, "blocklist_de": -3.2452}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.867, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-WHSL1-RIPE", "org": "WHG Hosting Services Ltd", "pdb": {"t": "Content", "sc": null, "tr": null, "pol": "Open", "web": "http://hosting.com"}, "pfx": 34, "reg": "2019-02-25", "rir": "ripencc", "s24": 99, "sib": 11, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25344, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00065381570655}, {"a": 209353, "h": "LABEL", "n": "Maurizio Giuseppe Fanari trading as LABEL SISTEMI TECNOLOGICI", "t": "Other", "w": 94, "cc": "IT", "cf": null, "cs": {"c": {"mail_bruteforce": 88, "router_or_botnet": 1}, "n": 88}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 88, "mean": 2.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 24, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 38.964, 0.011, 1, false], ["2026-10-12", 42.926, 0.013, 1, false]], "sh": false, "uc": 130078.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 42.926, "se": 0.707, "ts": 0.500, "map": 120.082, "obs": 4, "own": 68.088, "comp": {"cins": -0.5791, "dshield": -1.1197, "crowdsec": 2.7296, "vulncheck": -0.7002, "blocklist_de": 5.8512}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.181, "det": {"blocklist_de": {"imap": 24, "mail": 24}}, "oid": "ORG-MGFT1-RIPE", "org": "Maurizio Giuseppe Fanari trading as LABEL SISTEMI TECNOLOGICI", "pdb": null, "pfx": 1, "reg": "2019-02-22", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209366, "h": "SEMRUSH-AS", "n": "SEMrush CY LTD", "t": "Other", "w": 0, "cc": "CY", "cf": {"rb": "lo", "wb": "lo", "rep": 4.02, "waf": 1.99}, "cs": null, "ev": {}, "h2": [["2026-10-05", 6.056, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-SCL66-RIPE", "org": "SEMrush CY LTD", "pdb": null, "pfx": 5, "reg": "2019-02-21", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.04451378257746}, {"a": 209372, "h": "WSTelecom_Customers", "n": "WS Telecom Inc", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 3.65}, "cs": {"c": {"http_flood": 4, "web_exploit": 5, "bad_crawling": 5, "first_seen_30d": 2, "cve:CVE-2021-3129": 5, "cve:CVE-2024-34351": 1}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.1186, "hi": 3.63, "lo": 0.64, "ips": 5, "mean": 1.87, "above": false}, "blocklist_de": {"n": 2, "p": 0.1884, "hi": 4.32, "lo": 0.56, "ips": 2, "mean": 2.06, "above": false}}, "h2": [["2026-10-05", 0.006, 0.142, 0, false], ["2026-10-12", 0.890, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.903, "ts": null, "map": 0.157, "obs": 0, "own": 0.877, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.890, "se": 0.601, "ts": 0.600, "map": 2.005, "obs": 5, "own": 3.116, "comp": {"cins": -0.9372, "dshield": -1.604, "crowdsec": 2.2827, "vulncheck": -0.811, "blocklist_de": 3.1588}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.569, "det": {"blocklist_de": {"apache": 2, "bruteforcelogin": 2}}, "oid": "ORG-WTI4-RIPE", "org": "WS Telecom Inc", "pdb": null, "pfx": 235, "reg": "2019-08-23", "rir": "ripencc", "s24": 427, "sib": 4, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 111616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0174266146705}, {"a": 209373, "h": "SWISSNET-AS", "n": "SWISSNET LLC", "t": "Hosting & VPS", "w": 44, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 5, "web_exploit": 5, "bad_crawling": 4, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 4, "web_bruteforce": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41773": 1}, "n": 8}, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "urlhaus": {"n": 3, "p": 0.6470, "hi": 7.75, "lo": 1.37, "ips": 6, "mean": 4.00, "above": false}, "crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 8, "mean": 3.96, "above": false}, "threatfox": {"n": 4, "p": 0.8150, "hi": 9.15, "lo": 1.97, "ips": 29, "mean": 5.00, "above": true}, "vulncheck": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 84.105, 285.253, 1, false], ["2026-10-12", 58.490, 292.593, 1, false]], "sh": true, "uc": 17773.4, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 4, "phishing_db": 0}, "lo": 292.593, "se": 0.788, "ts": 0.571, "map": 768.566, "obs": 7, "own": 235.313, "comp": {"urlhaus": 7.0076, "threatfox": 2.2787, "phishing_db": -1.0156}, "mass": 3.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 0}, "lo": 58.490, "se": 0.605, "ts": 0.500, "map": 133.982, "obs": 6, "own": 26.527, "comp": {"cins": -0.6366, "dshield": 2.2691, "crowdsec": 5.5791, "vulncheck": 2.2935, "blocklist_de": -3.2137}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.907, "det": {"threatfox": {"family:Hermes": 1, "family:Remcos": 4, "family:PureRAT": 19, "family:AsyncRAT": 3, "family:AdaptixC2": 1}, "vulncheck": {"c2_server": 3, "other_infrastructure": 1}}, "oid": "ORG-SL1399-RIPE", "org": "SWISSNET LLC", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://swissnetwork.io/"}, "pfx": 4, "reg": "2026-02-18", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 4, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 1024, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": null}, {"a": 209378, "h": "INIOS-AS", "n": "Inios Oy", "t": "Other", "w": 1, "cc": "FI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.340, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.340, "se": 1.327, "ts": 1.000, "map": 2.935, "obs": 1, "own": 2.021, "comp": {"cins": -0.0799, "dshield": -0.1885, "crowdsec": -0.7468, "vulncheck": 3.903, "blocklist_de": -0.4175}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.603, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-IO44-RIPE", "org": "Inios Oy", "pdb": null, "pfx": 17, "reg": "2019-02-20", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00051803671171}, {"a": 209380, "h": "AratTelekom", "n": "AratTelekom", "t": "Broadband & mobile", "w": 12, "cc": "TR", "cf": null, "cs": {"c": {"mail_bruteforce": 5}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 5, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.848, 0.011, 1, false], ["2026-10-12", 6.735, 0.013, 0, false]], "sh": false, "uc": 23203.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 6.735, "se": 1.041, "ts": 0.500, "map": 35.126, "obs": 2, "own": 57.288, "comp": {"cins": -0.2307, "dshield": -0.5105, "crowdsec": 2.4519, "vulncheck": -0.4547, "blocklist_de": 3.6966}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.173, "det": {"blocklist_de": {"imap": 7, "mail": 7}}, "oid": "ORG-ATTB2-RIPE", "org": "Arat Telekominikasyon Tek. Bil.Hiz.San. ve Tic. Ltd.Sti", "pdb": null, "pfx": 5, "reg": "2019-02-20", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005435477139}, {"a": 209413, "h": "DEDIK-CH", "n": "DEDIK SERVICES LIMITED", "t": "Other", "w": 8, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2023-28121": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-27007": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 43.932, 0.849, 1, false], ["2026-10-12", 46.439, 15.610, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 15.610, "se": 1.330, "ts": 0.500, "map": 109.458, "obs": 2, "own": 109.593, "comp": {"urlhaus": 4.0825, "threatfox": 2.6536, "phishing_db": -0.4145}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 46.439, "se": 0.730, "ts": 0.250, "map": 133.004, "obs": 4, "own": 76.704, "comp": {"cins": 4.1661, "dshield": -0.982, "crowdsec": -0.0954, "vulncheck": 1.1854, "blocklist_de": 2.01}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.545, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-DSL56-RIPE", "org": "DEDIK SERVICES LIMITED", "pdb": null, "pfx": 3, "reg": "2026-01-06", "rir": "ripencc", "s24": 3, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003409843884}, {"a": 209425, "h": "KOI-AS", "n": "KOI CLOUD SERVICES (Pty) Ltd", "t": "Hosting & VPS", "w": 5, "cc": "ZA", "cf": null, "cs": {"c": {"data_centre": 3, "first_seen_30d": 3, "web_bruteforce": 1, "mail_bruteforce": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 1.009, 1, false], ["2026-10-12", 69.325, 1.043, 1, false]], "sh": true, "uc": 191406.3, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 1.043, "se": 1.890, "ts": 1.000, "map": 16.456, "obs": 1, "own": 12.334, "comp": {"urlhaus": -0.0114, "threatfox": -0.0173, "phishing_db": 4.4556}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 69.325, "se": 0.867, "ts": 0.333, "map": 262.148, "obs": 3, "own": 52.551, "comp": {"cins": -0.3358, "dshield": 3.4829, "crowdsec": 1.3605, "vulncheck": -0.5562, "blocklist_de": 3.0111}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.980, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "ORG-KCSL2-RIPE", "org": "KOI CLOUD SERVICES (Pty) Ltd", "pdb": null, "pfx": 1, "reg": "2025-12-31", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000002213618}, {"a": 209442, "h": "FastNet-Korce", "n": "FASTNET ALBANIA Sh.p.k", "t": "Other", "w": 1, "cc": "AL", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2021-41773": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": 40625, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 7.060, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.310, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-FAS29-RIPE", "org": "FASTNET ALBANIA Sh.p.k", "pdb": null, "pfx": 6, "reg": "2019-02-11", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038861354668}, {"a": 209482, "h": "FOXCLOUDMD", "n": "FOXCLOUD COMMUNICATIONS SRL", "t": "Hosting & VPS", "w": 0, "cc": "MD", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.857, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FCS19-RIPE", "org": "FOXCLOUD COMMUNICATIONS SRL", "pdb": null, "pfx": 3, "reg": "2019-02-01", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001708340445}, {"a": 209553, "h": "NETVAZ", "n": "NETVAZ LIMITED", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.729, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 7910.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.546, "det": null, "oid": "ORG-NL693-RIPE", "org": "NETVAZ LIMITED", "pdb": null, "pfx": 4, "reg": "2026-04-23", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209589, "h": "VOITICSL", "n": "VOITIC, SL", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.201, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-VS229-RIPE", "org": "VOITIC, SL", "pdb": null, "pfx": 2, "reg": "2019-01-14", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209604, "h": "TWO-E-Telekom", "n": "2E Telekom (TWO E Telekom)", "t": "Broadband & mobile", "w": 4, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5396, "hi": 6.67, "lo": 1.18, "ips": 3, "mean": 3.44, "above": false}, "threatfox": {"n": 1, "p": 0.1950, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 5.334, 0.358, 0, false], ["2026-10-12", 2.048, 0.358, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.358, "se": 1.492, "ts": 1.000, "map": 3.242, "obs": 1, "own": 9.525, "comp": {"urlhaus": -0.1319, "threatfox": 3.2226, "phishing_db": -0.2883}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.048, "se": 0.757, "ts": 1.000, "map": 6.253, "obs": 3, "own": 9.791, "comp": {"cins": -0.4724, "dshield": -0.9501, "crowdsec": 7.7066, "vulncheck": -0.6479, "blocklist_de": -2.4094}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.609, "det": {"threatfox": {"family:AsyncRAT": 1}}, "oid": "ORG-TLS9-RIPE", "org": "2E TELEKOMUNIKASYON LTD STI", "pdb": {"t": "Network Services", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.2etelekom.com"}, "pfx": 60, "reg": "2019-01-10", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00084674180716}, {"a": 209605, "h": "hostbaltic", "n": "UAB Host Baltic", "t": "Hosting & VPS", "w": 92, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 20, "data_centre": 38, "web_exploit": 23, "bad_crawling": 14, "proxy_or_vpn": 4, "first_seen_30d": 3, "ssh_bruteforce": 10, "web_bruteforce": 19, "home_connection": 1, "mail_bruteforce": 29, "cve:CVE-2017-16894": 3, "cve:CVE-2019-17050": 3, "cve:CVE-2024-28000": 8, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 4}, "n": 83}, "ev": {"dshield": {"n": 3, "p": 0.6440, "hi": 7.72, "lo": 1.36, "ips": 4, "mean": 3.98, "above": false}, "urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 5, "p": 0.9087, "hi": 10.27, "lo": 2.55, "ips": 83, "mean": 5.86, "above": true}, "threatfox": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 3, "p": 0.6408, "hi": 7.68, "lo": 1.35, "ips": 7, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 89.358, 38.616, 1, false], ["2026-10-12", 94.293, 8.540, 1, false]], "sh": true, "uc": 8029.5, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 8.540, "se": 1.271, "ts": 0.500, "map": 51.930, "obs": 2, "own": 19.991, "comp": {"urlhaus": 3.8834, "threatfox": 2.2089, "phishing_db": -0.5162}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 3}, "lo": 94.293, "se": 0.474, "ts": 0.455, "map": 173.702, "obs": 11, "own": 33.811, "comp": {"cins": -1.4588, "dshield": 4.2008, "crowdsec": 2.0381, "vulncheck": -0.8927, "blocklist_de": 2.6636}, "mass": 8.6, "listed": false}}, "abq": false, "bot": 0.982, "det": {"threatfox": {"family:Kimwolf": 1}, "blocklist_de": {"imap": 4, "mail": 7}}, "oid": "ORG-UHB3-RIPE", "org": "UAB Host Baltic", "pdb": null, "pfx": 9, "reg": "2019-01-10", "rir": "ripencc", "s24": 9, "sib": 1, "tor": 1, "w24": 5, "drop": 8, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0018763317595}, {"a": 209630, "h": "KREDIT-AS", "n": "LLC VASH KREDIT BANK", "t": "Other", "w": 19, "cc": "UA", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 16, "bad_crawling": 5, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 11, "web_bruteforce": 3, "mail_bruteforce": 4, "cve:CVE-2024-6387": 2, "cve:CVE-2024-48914": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-63030": 1}, "n": 19}, "ev": {"cins": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 9, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6329, "hi": 7.59, "lo": 1.34, "ips": 19, "mean": 3.92, "above": false}}, "h2": [["2026-10-05", 12.953, 0.011, 1, false], ["2026-10-12", 32.334, 0.012, 1, false]], "sh": false, "uc": 2441.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 32.334, "se": 0.627, "ts": 0.600, "map": 78.149, "obs": 5, "own": 44.131, "comp": {"cins": 3.6591, "dshield": 1.9586, "crowdsec": 4.5315, "vulncheck": -0.7547, "blocklist_de": -3.6422}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.880, "det": {"blocklist_de": {"ssh": 7}}, "oid": "ORG-LVKB1-RIPE", "org": "LLC VASH KREDIT BANK", "pdb": null, "pfx": 8, "reg": "2019-01-04", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209641, "h": "I-SERVERS-EAST", "n": "Tomas Kempinsky", "t": "Hosting & VPS", "w": 6, "cc": "GB", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.3879, "hi": 5.97, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "phishing_db": {"n": 4, "p": 0.7893, "hi": 8.71, "lo": 1.88, "ips": 4, "mean": 4.76, "above": false}}, "h2": [["2026-10-05", 2.242, 4.210, 0, false], ["2026-10-12", 0.409, 4.246, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 4.246, "se": 0.927, "ts": 1.000, "map": 12.614, "obs": 4, "own": 4.629, "comp": {"urlhaus": -0.7053, "threatfox": -0.4184, "phishing_db": 5.2846}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.409, "se": 0.912, "ts": 1.000, "map": 1.580, "obs": 2, "own": 0.338, "comp": {"cins": -0.2146, "dshield": -0.4781, "crowdsec": -1.8893, "vulncheck": 5.5457, "blocklist_de": -1.1124}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.915, "det": {"vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-IHL38-RIPE", "org": "IHOR HOSTING LTD", "pdb": {"t": "Educational/Research", "sc": "Not Disclosed", "tr": "20-100Mbps", "pol": "Restrictive", "web": null}, "pfx": 73, "reg": "2022-05-11", "rir": "ripencc", "s24": 103, "sib": 2, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 30208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00240607412815}, {"a": 209658, "h": "MEOHOST", "n": "MEOHOST VERI MERKEZI ve YAZILIM TICARET LIMITED SIRKETI", "t": "Hosting & VPS", "w": 3, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4214, "hi": 6.28, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 6.387, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.387, "se": 1.035, "ts": 1.000, "map": 32.928, "obs": 2, "own": 6.823, "comp": {"cins": -0.217, "dshield": 8.5758, "crowdsec": -1.908, "vulncheck": -0.4385, "blocklist_de": -1.1244}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.865, "det": null, "oid": "ORG-MVMV1-RIPE", "org": "MEOHOST VERI MERKEZI ve YAZILIM TICARET LIMITED SIRKETI", "pdb": null, "pfx": 5, "reg": "2025-09-25", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209693, "h": "OC-NETWORK", "n": "OC NETWORKS LIMITED", "t": "Hosting & VPS", "w": 6, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.3365, "hi": 5.53, "lo": 0.72, "ips": 2, "mean": 2.63, "above": false}, "crowdsec": {"n": 3, "p": 0.5327, "hi": 6.61, "lo": 1.17, "ips": 3, "mean": 3.41, "above": false}, "vulncheck": {"n": 2, "p": 0.4007, "hi": 6.09, "lo": 0.79, "ips": 2, "mean": 2.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.3780, "hi": 5.89, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}}, "h2": [["2026-10-05", 8.207, 0.011, 0, false], ["2026-10-12", 6.316, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 0.232, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 2}, "lo": 6.316, "se": 0.564, "ts": 0.429, "map": 13.351, "obs": 7, "own": 2.643, "comp": {"cins": -0.9473, "dshield": -1.616, "crowdsec": 2.1832, "vulncheck": 1.2809, "blocklist_de": 3.0845}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.400, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-ONL26-RIPE", "org": "OC NETWORKS LIMITED", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "200-300Gbps", "pol": "Open", "web": "http://1cent.host"}, "pfx": 65, "reg": "2025-04-30", "rir": "ripencc", "s24": 65, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00356779300944}, {"a": 209702, "h": "SOLDATOV-AS", "n": "SOLDATOV ALEXEY VALEREVICH", "t": "Other", "w": 3, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2024-6387": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.339, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.806, "det": {"shodan": {"c2": 1}}, "oid": "ORG-SAV2-RIPE", "org": "SOLDATOV ALEXEY VALEREVICH", "pdb": null, "pfx": 2, "reg": "2025-04-25", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002190532708}, {"a": 209711, "h": "MUVHost", "n": "MUV Bilisim ve Telekomunikasyon Hizmetleri Ltd. Sti.", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 3, "p": 0.6214, "hi": 7.47, "lo": 1.32, "ips": 3, "mean": 3.85, "above": false}, "crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.397, 0.011, 0, false], ["2026-10-12", 0.437, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.437, "se": 1.360, "ts": 1.000, "map": 4.149, "obs": 1, "own": 0.974, "comp": {"cins": -0.1011, "dshield": -0.2364, "crowdsec": 3.9422, "vulncheck": -0.2603, "blocklist_de": -0.5278}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.862, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-MBVT3-RIPE", "org": "MUV Bilisim ve Telekomunikasyon Hizmetleri Ltd. Sti.", "pdb": null, "pfx": 18, "reg": "2018-12-18", "rir": "ripencc", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002411406691}, {"a": 209723, "h": "AS_Expert", "n": "EXPERT NETCLOUD LLP", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.691, "det": null, "oid": "ORG-ENL26-RIPE", "org": "EXPERT NETCLOUD LLP", "pdb": null, "pfx": 2, "reg": "2018-12-17", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044547415683}, {"a": 209737, "h": "AS209737", "n": "Meric Internet Teknolojileri", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.570, "det": {"shodan": {"c2": 1}}, "oid": "ORG-MITA10-RIPE", "org": "Meric Internet Teknolojileri A.S.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://meric.net.tr"}, "pfx": 11, "reg": "2018-12-13", "rir": "ripencc", "s24": 11, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001983850339}, {"a": 209767, "h": "SAMTECO", "n": "SAMTECO SERV SRL", "t": "Other", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 0.698, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.202, "obs": 0, "own": 0.314, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.685, "det": null, "oid": "ORG-SSS90-RIPE", "org": "SAMTECO SERV SRL", "pdb": null, "pfx": 17, "reg": "2018-12-07", "rir": "ripencc", "s24": 34, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009853777899}, {"a": 209809, "h": "ROCO-HOST", "n": "ROCO HOST LTD", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.786, "det": null, "oid": "ORG-RHL24-RIPE", "org": "ROCO HOST LTD", "pdb": null, "pfx": 5, "reg": "2025-12-09", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209828, "h": "ASGENCBT", "n": "Genc BT Bilisim Teknolojileri", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.842, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.520, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.866, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GBBT1-RIPE", "org": "Genc BT Bilisim Teknolojileri Limited Sirketi", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://genc.net.tr/"}, "pfx": 11, "reg": "2018-11-26", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014812767755}, {"a": 209847, "h": "THE", "n": "THE Hosting", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.482, "det": null, "oid": "ORG-WB96-RIPE", "org": "WorkTitans B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": null, "pol": "Open", "web": "http://the.hosting"}, "pfx": 2, "reg": "2025-06-24", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023248117488}, {"a": 209854, "h": "Cyberzonehub", "n": "Cyberzonehub", "t": "Other", "w": 38, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 34, "web_exploit": 34, "bad_crawling": 28, "proxy_or_vpn": 1, "ssh_bruteforce": 7, "web_bruteforce": 33, "mail_bruteforce": 2, "cve:CVE-2017-9841": 15, "cve:CVE-2022-35914": 18, "cve:CVE-2022-46604": 16, "cve:CVE-2024-28000": 19, "cve:CVE-2026-63030": 6}, "n": 36}, "ev": {"crowdsec": {"n": 10, "p": 0.9660, "hi": 8.81, "lo": 3.20, "ips": 36, "mean": 5.71, "above": true}, "blocklist_de": {"n": 2, "p": 0.2212, "hi": 4.59, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}}, "h2": [["2026-10-05", 5.467, 0.010, 0, false], ["2026-10-12", 3.010, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.919, "ts": null, "map": 0.162, "obs": 0, "own": 0.378, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 10, "vulncheck": 0, "blocklist_de": 2}, "lo": 3.010, "se": 0.467, "ts": 0.833, "map": 5.355, "obs": 12, "own": 3.018, "comp": {"cins": -1.6365, "dshield": -2.2879, "crowdsec": 9.6831, "vulncheck": -0.9106, "blocklist_de": -1.7763}, "mass": 10.3, "listed": false}}, "abq": false, "bot": 0.509, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CS741-RIPE", "org": "Cyberzone S.A.", "pdb": null, "pfx": 348, "reg": "2018-11-21", "rir": "ripencc", "s24": 348, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 89088, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.02248892874962}, {"a": 209874, "h": "TECHTIDE", "n": "Tech Tide Portugal Unipessoal LDA", "t": "Other", "w": 2, "cc": "PT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "vulncheck": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 6.259, 0.011, 0, false], ["2026-10-12", 0.369, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.369, "se": 1.343, "ts": 1.000, "map": 3.291, "obs": 1, "own": 2.282, "comp": {"cins": -0.0762, "dshield": -0.1801, "crowdsec": -0.7135, "vulncheck": 3.9527, "blocklist_de": -0.3983}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.881, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 2}}, "oid": "ORG-MWUL2-RIPE", "org": "Tech Tide Portugal Unipessoal LDA", "pdb": null, "pfx": 17, "reg": "2025-04-24", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0735], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000856306355}, {"a": 209881, "h": "ASVASHINTPART", "n": "LLC \"Vash internet partner\"", "t": "Other", "w": 9, "cc": "BY", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6451, "hi": 7.73, "lo": 1.36, "ips": 9, "mean": 3.99, "above": false}}, "h2": [["2026-10-12", 8.323, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 8.323, "se": 0.830, "ts": 1.000, "map": 27.609, "obs": 3, "own": 16.655, "comp": {"cins": -0.2182, "dshield": -0.4854, "crowdsec": -1.9181, "vulncheck": 8.4645, "blocklist_de": -1.1309}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.521, "det": {"vulncheck": {"botnet_node": 9}}, "oid": "ORG-LIP5-RIPE", "org": "LLC \"Vash internet partner\"", "pdb": null, "pfx": 7, "reg": "2025-12-17", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001595625512}, {"a": 209883, "h": "Contrust-Solutions", "n": "Contrust Solutions S.R.L.", "t": "Other", "w": 1, "cc": "MD", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2025-30208": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.964, "det": {"shodan": {"c2": 1}}, "oid": "ORG-CSS55-RIPE", "org": "Contrust Solutions S.R.L.", "pdb": null, "pfx": 1, "reg": "2018-11-15", "rir": "ripencc", "s24": 1, "sib": 35, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209944, "h": "EJX", "n": "Contrust Solutions S.R.L.", "t": "Other", "w": 0, "cc": "MD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.170, "det": null, "oid": "ORG-CSS55-RIPE", "org": "Contrust Solutions S.R.L.", "pdb": null, "pfx": 2, "reg": "2018-11-06", "rir": "ripencc", "s24": 2, "sib": 35, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 209974, "h": "AS-ITGLOBALCOM-RU", "n": "ITGLOBAL.COM RUS Ltd", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6364, "hi": 7.63, "lo": 1.34, "ips": 4, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 1.467, 6.601, 0, false], ["2026-10-12", 0.011, 6.652, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 6.652, "se": 1.001, "ts": 1.000, "map": 23.514, "obs": 3, "own": 22.025, "comp": {"urlhaus": -0.462, "threatfox": -0.3486, "phishing_db": 5.5944}, "mass": 1.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.318, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.806, "det": null, "oid": "ORG-OI27-RIPE", "org": "ITGLOBAL.COM RUS Ltd", "pdb": null, "pfx": 27, "reg": "2018-11-01", "rir": "ripencc", "s24": 33, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210006, "h": "ASKZ", "n": "Shereverov Marat Ahmedovich", "t": "Other", "w": 11, "cc": "KZ", "cf": null, "cs": {"c": {"data_centre": 3, "web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2020-11738": 1, "cve:CVE-2022-39290": 1}, "n": 8}, "ev": {"dshield": {"n": 2, "p": 0.4217, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 8, "mean": 3.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 67.885, 0.011, 1, false], ["2026-10-12", 81.678, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 81.678, "se": 0.584, "ts": 0.500, "map": 181.387, "obs": 6, "own": 101.861, "comp": {"cins": -0.8205, "dshield": 4.7522, "crowdsec": 3.4814, "vulncheck": -0.7825, "blocklist_de": -0.0362}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.981, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-SMA119-RIPE", "org": "Shereverov Marat Ahmedovich", "pdb": null, "pfx": 4, "reg": "2025-05-14", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016128565978}, {"a": 210021, "h": "DIL", "n": "DIL Technology AS210021", "t": "Broadband & mobile", "w": 1, "cc": "IQ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-12", 0.426, 0.012, 0, false]], "sh": false, "uc": 1562.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.426, "se": 1.354, "ts": 1.000, "map": 3.997, "obs": 1, "own": 7.336, "comp": {"cins": -0.1028, "dshield": -0.2401, "crowdsec": 3.922, "vulncheck": -0.2635, "blocklist_de": -0.5364}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.220, "det": null, "oid": "ORG-DTCF1-RIPE", "org": "DIL Technology Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.diltechnology.com/"}, "pfx": 19, "reg": "2018-10-23", "rir": "ripencc", "s24": 19, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005384412423}, {"a": 210079, "h": "EUROBYTE", "n": "EUROBYTE", "t": "Hosting & VPS", "w": 6, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.4918, "hi": 6.27, "lo": 1.10, "ips": 3, "mean": 3.23, "above": false}, "vulncheck": {"n": 5, "p": 0.8975, "hi": 9.93, "lo": 2.47, "ips": 5, "mean": 5.67, "above": true}, "phishing_db": {"n": 1, "p": 0.1761, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 1.067, 0.278, 0, false], ["2026-10-12", 1.289, 0.290, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.290, "se": 1.456, "ts": 1.000, "map": 2.425, "obs": 1, "own": 1.091, "comp": {"urlhaus": -0.1768, "threatfox": -0.1959, "phishing_db": 2.8846}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 5, "blocklist_de": 0}, "lo": 1.289, "se": 0.649, "ts": 1.000, "map": 3.099, "obs": 5, "own": 0.638, "comp": {"cins": -0.4305, "dshield": -0.8797, "crowdsec": -3.4643, "vulncheck": 9.5006, "blocklist_de": -2.2014}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.884, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:Sliver": 2}, "vulncheck": {"c2_server": 2, "botnet_node": 3}}, "oid": "ORG-EL485-RIPE", "org": "EuroByte LLC", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.ihc.ru"}, "pfx": 87, "reg": "2018-10-11", "rir": "ripencc", "s24": 111, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 28928, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": null}, {"a": 210083, "h": "Privex", "n": "Privex", "t": "Hosting & VPS", "w": 2, "cc": "BZ", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2020-5902": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2023-22515": 1}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4062, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 3.545, 0.643, 0, false], ["2026-10-12", 3.328, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.328, "se": 0.988, "ts": 1.000, "map": 15.748, "obs": 2, "own": 3.238, "comp": {"cins": -0.2473, "dshield": -0.5434, "crowdsec": 6.6931, "vulncheck": -0.4732, "blocklist_de": -1.2789}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.798, "det": {"shodan": {"c2": 1, "malware": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PI82-RIPE", "org": "Privex Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.privex.io/"}, "pfx": 11, "reg": "2018-10-11", "rir": "ripencc", "s24": 12, "sib": 1, "tor": 2, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010959792021}, {"a": 210100, "h": "Adam-Chodkowski", "n": "Adam-Chodkowski", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.737, "det": null, "oid": "ORG-AC315-RIPE", "org": "Adam Chodkowski", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://sq5wep.pl"}, "pfx": 1, "reg": "2025-04-22", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210175, "h": "LIPTA-AS", "n": "Lietuvos Interneto Paslaugu Teikeju Asociacija", "t": "Enterprise, edu & gov", "w": 1, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.118, 0.012, 0, false], ["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 4.322, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 162.426, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.367, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-LIPT1-RIPE", "org": "Lietuvos Interneto Paslaugu Teikeju Asociacija", "pdb": {"t": "Non-Profit", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://lipta.lt"}, "pfx": 1, "reg": "2018-09-26", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210227, "h": "jessazh", "n": "Jessa Ziekenhuis vzw", "t": "Other", "w": 0, "cc": "BE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-JZV2-RIPE", "org": "Jessa Ziekenhuis vzw", "pdb": null, "pfx": 2, "reg": "2018-09-13", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002931178139}, {"a": 210238, "h": "Dieffeitalia", "n": "Dieffeitalia.it S.r.l.", "t": "Other", "w": 12, "cc": "IT", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 6, "p": 0.9652, "hi": 11.74, "lo": 3.26, "ips": 11, "mean": 6.94, "above": true}}, "h2": [["2026-10-05", 106.007, 0.011, 1, false], ["2026-10-12", 70.886, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 6}, "lo": 70.886, "se": 0.548, "ts": 0.857, "map": 149.390, "obs": 7, "own": 83.640, "comp": {"cins": -1.208, "dshield": -1.9024, "crowdsec": -5.0068, "vulncheck": -0.8604, "blocklist_de": 15.3778}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"imap": 11, "mail": 11}}, "oid": "ORG-DS241-RIPE", "org": "Dieffeitalia.it S.r.l.", "pdb": null, "pfx": 2, "reg": "2018-09-11", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0863], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 210240, "h": "NTC-AS", "n": "New Communication Technologies LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.455, "det": null, "oid": "ORG-NCTL2-RIPE", "org": "New Communication Technologies LLC", "pdb": null, "pfx": 3, "reg": "2018-09-11", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210278, "h": "SKYIT-BB", "n": "Sky Italia AS210278", "t": "Broadband & mobile", "w": 3, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 1}, "n": 3}, "ev": {"urlhaus": {"n": 1, "p": 0.1519, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "crowdsec": {"n": 3, "p": 0.0009, "hi": 1.76, "lo": 0.31, "ips": 3, "mean": 0.91, "above": false}}, "h2": [["2026-10-05", 0.471, 0.131, 0, false], ["2026-10-12", 0.142, 0.144, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.144, "se": 1.380, "ts": 1.000, "map": 1.015, "obs": 1, "own": 2.938, "comp": {"urlhaus": 2.8821, "threatfox": -0.4188, "phishing_db": -0.8219}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.142, "se": 0.708, "ts": 1.000, "map": 0.392, "obs": 3, "own": 0.617, "comp": {"cins": -0.6037, "dshield": -1.157, "crowdsec": 5.9839, "vulncheck": -0.7106, "blocklist_de": -3.0541}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.116, "det": null, "oid": "ORG-SIS99-RIPE", "org": "Sky Italia srl", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": null, "pol": "Open", "web": "http://www.sky.it"}, "pfx": 11, "reg": "2018-09-04", "rir": "ripencc", "s24": 1284, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 590848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02998047680875}, {"a": 210316, "h": "ELEKOMS-AS", "n": "CJSC \"SCIENTIFIC AND PRODUCTION FIRM \"ELEKOMS\"\"", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CAPF3-RIPE", "org": "CJSC \"SCIENTIFIC AND PRODUCTION FIRM \"ELEKOMS\"\"", "pdb": null, "pfx": 1, "reg": "2018-08-24", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210320, "h": "FEXXIO-DIGITAL", "n": "Fexxio Digital", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.963, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-FC168-RIPE", "org": "Cedric Hoogendoorn", "pdb": {"t": "Content", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.fexxio.nl"}, "pfx": 2, "reg": "2025-04-16", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210328, "h": "ALMAZ", "n": "ALMAZCLOUD", "t": "Hosting & VPS", "w": 151, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 6, "first_seen_30d": 86, "ssh_bruteforce": 137, "web_bruteforce": 8, "cve:CVE-2024-4577": 1}, "n": 146}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 5, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 146, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 72.210, 0.011, 1, false], ["2026-10-12", 75.621, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 75.621, "se": 0.716, "ts": 0.500, "map": 214.399, "obs": 4, "own": 42.346, "comp": {"cins": 4.0957, "dshield": 2.6908, "crowdsec": 3.315, "vulncheck": -0.675, "blocklist_de": -2.6651}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.930, "det": null, "oid": "ORG-ZA238-RIPE", "org": "AO ALMAZ", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Restrictive", "web": "https://almazcloud.network"}, "pfx": 2, "reg": "2021-12-27", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210329, "h": "CloudWebManage-UK-1", "n": "Kamatera INC UK", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6351, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 0.010, 5.997, 0, false], ["2026-10-12", 0.010, 6.057, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 6.057, "se": 1.001, "ts": 1.000, "map": 21.432, "obs": 3, "own": 7.726, "comp": {"urlhaus": -0.4707, "threatfox": -0.3518, "phishing_db": 5.5135}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.931, "ts": null, "map": 0.199, "obs": 0, "own": 0.105, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.555, "det": null, "oid": "ORG-KI35-RIPE", "org": "Kamatera Inc", "pdb": {"t": "Network Services", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://www.kamatera.com"}, "pfx": 37, "reg": "2018-08-21", "rir": "ripencc", "s24": 37, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00171110228381}, {"a": 210356, "h": "BattleHost", "n": "KAUA REIS DA SILVA trading as BattleHost", "t": "Hosting & VPS", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.408, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 1.501, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.736, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KRDS1-RIPE", "org": "KAUA REIS DA SILVA trading as BattleHost", "pdb": null, "pfx": 7, "reg": "2021-12-16", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210387, "h": "GUARDY", "n": "Guardy Limited", "t": "Other", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1981, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.816, 0, false], ["2026-10-12", 0.012, 0.807, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.807, "se": 1.727, "ts": 1.000, "map": 11.195, "obs": 1, "own": 15.757, "comp": {"urlhaus": -0.0385, "threatfox": -0.0551, "phishing_db": 4.1352}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-GRDY1-RIPE", "org": "Guardy Limited", "pdb": null, "pfx": 5, "reg": "2025-09-30", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210390, "h": "ARSENAL-D-AS", "n": "Arsenal D Ltd.", "t": "Other", "w": 0, "cc": "UZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.967, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ADL15-RIPE", "org": "Arsenal D Ltd.", "pdb": null, "pfx": 2, "reg": "2021-12-06", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000045926136}, {"a": 210392, "h": "AriaOxin-AS", "n": "Azarakhsh Ava-e Ahvaz Co", "t": "Other", "w": 1, "cc": "IR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1852, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1820, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 2.759, 0.011, 0, false], ["2026-10-12", 3.022, 0.012, 0, false]], "sh": false, "uc": 3750, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.805, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.022, "se": 0.983, "ts": 0.500, "map": 14.043, "obs": 2, "own": 8.298, "comp": {"cins": -0.2739, "dshield": -0.5953, "crowdsec": 1.9918, "vulncheck": -0.5007, "blocklist_de": 3.4139}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.672, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"mail": 1}}, "oid": "ORG-AAA78-RIPE", "org": "Azarakhsh Ava-e Ahvaz Co", "pdb": null, "pfx": 15, "reg": "2021-12-06", "rir": "ripencc", "s24": 15, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005108523495}, {"a": 210402, "h": "Halasat-FTTX", "n": "Halasat FTTX", "t": "Other", "w": 5, "cc": "IQ", "cf": null, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.8076, "hi": 9.02, "lo": 1.94, "ips": 4, "mean": 4.93, "above": true}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 10.299, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 10.299, "se": 0.616, "ts": 0.800, "map": 24.182, "obs": 5, "own": 13.669, "comp": {"cins": -0.7752, "dshield": 11.3692, "crowdsec": -5.4857, "vulncheck": -0.7699, "blocklist_de": 0.2409}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.185, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-HARC1-RIPE", "org": "Hala Al Rafidain Company for Communications and Internet LTD.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://halasat-ftth.iq/ar"}, "pfx": 28, "reg": "2021-12-02", "rir": "ripencc", "s24": 28, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.0022634974089}, {"a": 210403, "h": "LWS", "n": "Groupe LWS SARL", "t": "Other", "w": 5, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.5815, "hi": 7.06, "lo": 1.24, "ips": 3, "mean": 3.64, "above": false}, "urlhaus": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 2, "p": 0.3909, "hi": 6.00, "lo": 0.78, "ips": 3, "mean": 2.86, "above": false}}, "h2": [["2026-10-05", 1.211, 3.350, 0, false], ["2026-10-12", 1.375, 3.302, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 3.302, "se": 1.205, "ts": 0.500, "map": 17.325, "obs": 2, "own": 17.480, "comp": {"urlhaus": 3.4519, "threatfox": -0.3525, "phishing_db": 1.379}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.375, "se": 0.938, "ts": 1.000, "map": 5.870, "obs": 2, "own": 3.449, "comp": {"cins": -0.3451, "dshield": -0.729, "crowdsec": -2.8747, "vulncheck": -0.5636, "blocklist_de": 7.676}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.961, "det": {"shodan": {"compromised": 3}, "blocklist_de": {"ftp": 1, "mail": 2}}, "oid": "ORG-LWSE1-RIPE", "org": "Groupe LWS SARL", "pdb": null, "pfx": 46, "reg": "2021-12-02", "rir": "ripencc", "s24": 46, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028433126761}, {"a": 210429, "h": "HIZAKURA-NL", "n": "QDE", "t": "Broadband & mobile", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4076, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 1.421, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.763, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HB140-RIPE", "org": "Hizakura B.V.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://qde.com/"}, "pfx": 11, "reg": "2021-11-25", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210457, "h": "KYONIX", "n": "Kyonix Networks Limited", "t": "Hosting & VPS", "w": 7, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 4, "cve:CVE-2017-9841": 2, "cve:CVE-2018-20062": 1, "cve:CVE-2021-43798": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-61511": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.4198, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "crowdsec": {"n": 4, "p": 0.7989, "hi": 8.87, "lo": 1.91, "ips": 4, "mean": 4.85, "above": true}, "phishing_db": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 27.544, 43.625, 1, false], ["2026-10-12", 31.648, 0.651, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.651, "se": 1.639, "ts": 1.000, "map": 7.937, "obs": 1, "own": 3.857, "comp": {"urlhaus": -0.0649, "threatfox": -0.0881, "phishing_db": 3.8507}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 31.648, "se": 0.582, "ts": 0.667, "map": 70.276, "obs": 6, "own": 13.802, "comp": {"cins": 7.3731, "dshield": -1.5906, "crowdsec": 5.2653, "vulncheck": -0.8085, "blocklist_de": -4.5932}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.876, "det": {"threatfox": {"family:Hermes": 1}}, "oid": "ORG-KYOX1-RIPE", "org": "Kyonix Networks Limited", "pdb": {"t": "Content", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "http://kyonix.com"}, "pfx": 12, "reg": "2025-04-14", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0008204620536}, {"a": 210528, "h": "Navox", "n": "Navox co.,Ltd", "t": "Other", "w": 2, "cc": "KR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1213, "hi": 3.90, "lo": 0.29, "ips": 1, "mean": 1.65, "above": false}, "phishing_db": {"n": 1, "p": 0.1821, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1635, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.181, 0.320, 0, false], ["2026-10-12", 0.820, 0.334, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.334, "se": 1.477, "ts": 1.000, "map": 2.924, "obs": 1, "own": 3.431, "comp": {"urlhaus": -0.1566, "threatfox": -0.1795, "phishing_db": 3.0352}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.820, "se": 0.911, "ts": 0.500, "map": 3.326, "obs": 2, "own": 1.948, "comp": {"cins": -0.3444, "dshield": -0.7278, "crowdsec": 1.2753, "vulncheck": -0.5631, "blocklist_de": 2.9554}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.587, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-NC150-RIPE", "org": "Navox co.,Ltd", "pdb": null, "pfx": 20, "reg": "2025-10-08", "rir": "ripencc", "s24": 81, "sib": 1, "tor": 0, "w24": 2, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001872472616}, {"a": 210530, "h": "ip2con", "n": "IP Connect Inc", "t": "Other", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.977, "det": null, "oid": "ORG-ICI6-RIPE", "org": "IP Connect Inc", "pdb": null, "pfx": 1, "reg": "2021-11-04", "rir": "ripencc", "s24": 1, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210538, "h": "KEYUBU", "n": "KEYUBU Internet ve Bilisim Tic. Ltd. Sti.", "t": "Other", "w": 2, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2023-50164": 1, "cve:CVE-2026-56290": 1, "cve:CVE-2026-60137": 1}, "n": 1}, "ev": {"shodan": {"n": 12, "p": 1.0000, "hi": 18.35, "lo": 7.26, "ips": 12, "mean": 12.27, "above": true}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "phishing_db": {"n": 1, "p": 0.1931, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.327, 0.479, 0, false], ["2026-10-12", 0.347, 0.499, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.499, "se": 1.561, "ts": 1.000, "map": 5.274, "obs": 1, "own": 6.330, "comp": {"urlhaus": -0.0995, "threatfox": -0.1263, "phishing_db": 3.5148}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.347, "se": 1.316, "ts": 1.000, "map": 3.042, "obs": 1, "own": 2.004, "comp": {"cins": -0.115, "dshield": -0.2672, "crowdsec": 3.7746, "vulncheck": -0.2866, "blocklist_de": -0.5996}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.776, "det": {"shodan": {"compromised": 12}}, "oid": "ORG-KIVB6-RIPE", "org": "KEYUBU Internet ve Bilisim Tic. Ltd. Sti.", "pdb": null, "pfx": 28, "reg": "2021-11-03", "rir": "ripencc", "s24": 28, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 7168, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0010086265895}, {"a": 210546, "h": "CHSL-ONE", "n": "CHSL ONE LTD", "t": "Hosting & VPS", "w": 20, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 4, "bad_crawling": 6, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 11, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 2, "p": 0.3092, "hi": 5.30, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}, "urlhaus": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 15, "p": 1.0000, "hi": 18.72, "lo": 8.13, "ips": 15, "mean": 12.97, "above": true}, "threatfox": {"n": 1, "p": 0.1932, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1794, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 8, "p": 0.9933, "hi": 13.19, "lo": 4.29, "ips": 8, "mean": 8.22, "above": true}}, "h2": [["2026-10-05", 12.325, 0.011, 1, false], ["2026-10-12", 29.310, 2.061, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 2.061, "se": 1.193, "ts": 0.500, "map": 10.318, "obs": 2, "own": 4.088, "comp": {"urlhaus": 3.3181, "threatfox": 1.3604, "phishing_db": -0.7183}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 15, "vulncheck": 1, "blocklist_de": 8}, "lo": 29.310, "se": 0.406, "ts": 0.600, "map": 46.955, "obs": 25, "own": 9.143, "comp": {"cins": -0.2146, "dshield": -2.8559, "crowdsec": 4.5617, "vulncheck": -0.7047, "blocklist_de": 4.4564}, "mass": 22.7, "listed": false}}, "abq": false, "bot": 0.563, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Evilginx": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 7, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CHSL3-RIPE", "org": "CHSL ONE LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://chsl.one/"}, "pfx": 88, "reg": "2026-02-04", "rir": "ripencc", "s24": 88, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 22528, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00161826681654}, {"a": 210554, "h": "METEORCLOUD", "n": "METEORCLOUD", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 10.553, 1, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.625, "det": {"shodan": {"c2": 1}}, "oid": "ORG-MCL141-RIPE", "org": "Meteor Cloud LTDA", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "No", "web": "http://meteorcloud.com.br"}, "pfx": 6, "reg": "2025-04-11", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210555, "h": "D2CLOUD-ZA-AS", "n": "D2CLOUD NETWORK SERVICES (PTY) LTD", "t": "Hosting & VPS", "w": 13, "cc": "ZA", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 13, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.118, 0.012, 0, false], ["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 5.699, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.980, "det": {"vulncheck": {"botnet_node": 13}}, "oid": "ORG-DNSL7-RIPE", "org": "D2CLOUD NETWORK SERVICES (PTY) LTD", "pdb": null, "pfx": 1, "reg": "2021-10-29", "rir": "ripencc", "s24": 1, "sib": 6, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210558, "h": "services-1337-gmbh", "n": "1337 Services GmbH", "t": "Hosting & VPS", "w": 86, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 49, "data_centre": 17, "web_exploit": 54, "bad_crawling": 46, "proxy_or_vpn": 7, "first_seen_30d": 8, "ssh_bruteforce": 7, "web_bruteforce": 43, "home_connection": 20, "mail_bruteforce": 2, "cve:CVE-2017-9841": 14, "cve:CVE-2017-16894": 12, "cve:CVE-2019-17050": 12, "cve:CVE-2024-28000": 17, "cve:CVE-2026-63030": 3}, "n": 61}, "ev": {"shodan": {"n": 7, "p": 0.9841, "hi": 12.46, "lo": 3.77, "ips": 7, "mean": 7.58, "above": true}, "dshield": {"n": 1, "p": 0.1930, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 14, "p": 1.0000, "hi": 20.47, "lo": 8.65, "ips": 61, "mean": 14.03, "above": true}, "threatfox": {"n": 7, "p": 0.9878, "hi": 13.10, "lo": 3.97, "ips": 14, "mean": 7.97, "above": true}, "vulncheck": {"n": 2, "p": 0.4141, "hi": 6.21, "lo": 0.81, "ips": 3, "mean": 2.96, "above": false}, "phishing_db": {"n": 2, "p": 0.4147, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "blocklist_de": {"n": 6, "p": 0.9621, "hi": 11.52, "lo": 3.20, "ips": 8, "mean": 6.81, "above": true}}, "h2": [["2026-10-05", 69.660, 45.821, 1, false], ["2026-10-12", 77.527, 37.295, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 2}, "lo": 37.295, "se": 0.762, "ts": 0.778, "map": 84.421, "obs": 9, "own": 28.175, "comp": {"urlhaus": -1.0351, "threatfox": 5.9567, "phishing_db": 1.1403}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 14, "vulncheck": 2, "blocklist_de": 6}, "lo": 77.527, "se": 0.410, "ts": 0.609, "map": 126.107, "obs": 23, "own": 24.507, "comp": {"cins": -2.2529, "dshield": -1.4345, "crowdsec": 6.9536, "vulncheck": -0.3037, "blocklist_de": 3.2682}, "mass": 18.0, "listed": false}}, "abq": false, "bot": 0.958, "det": {"shodan": {"c2": 7}, "threatfox": {"family:DCRat": 2, "family:Remcos": 2, "family:PureRAT": 6, "family:AsyncRAT": 4}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"ftp": 1, "ssh": 1, "imap": 1, "mail": 1, "apache": 5, "bruteforcelogin": 4}}, "oid": "ORG-SG394-RIPE", "org": "1337 Services GmbH", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://rdp.sh"}, "pfx": 26, "reg": "2021-10-28", "rir": "ripencc", "s24": 26, "sib": 0, "tor": 1, "w24": 18, "drop": 24, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.9977]], "ipv4": 6656, "abuse": null, "score": 0.9977, "groups": ["sensors", "abusech", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00345699042887}, {"a": 210574, "h": "POYRAZ", "n": "Poyraz Hosting", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.634, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.634, "se": 1.446, "ts": 1.000, "map": 7.011, "obs": 1, "own": 1.740, "comp": {"cins": -0.0857, "dshield": -0.2018, "crowdsec": -0.7995, "vulncheck": -0.229, "blocklist_de": 4.6572}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-PBTL6-RIPE", "org": "PH Bilisim Teknolojileri Limited Sirketi", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.poyrazhosting.com.tr/"}, "pfx": 9, "reg": "2021-10-27", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00015297108935}, {"a": 210580, "h": "GEORGIAIXP", "n": "IXP.ge Services", "t": "Other", "w": 1, "cc": "GE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 54296.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 78.899, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.778, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-IEAO1-RIPE", "org": "Internet Exchange Association of Georgia", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "https://ixp.ge"}, "pfx": 1, "reg": "2021-10-26", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210602, "h": "marbell", "n": "marbell", "t": "Other", "w": 0, "cc": "CH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1722, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.715, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 0.333, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.929, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MA1886-RIPE", "org": "Marbell AG", "pdb": null, "pfx": 4, "reg": "2021-10-21", "rir": "ripencc", "s24": 30, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002878201558}, {"a": 210616, "h": "SIBMEDVED-AS", "n": "SM Ltd.", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4046, "hi": 6.12, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-12", 1.096, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.096, "se": 0.924, "ts": 1.000, "map": 4.548, "obs": 2, "own": 2.662, "comp": {"cins": -0.3052, "dshield": 7.9011, "crowdsec": -2.5847, "vulncheck": -0.5301, "blocklist_de": -1.5728}, "mass": 1.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-LS491-RIPE", "org": "SM Ltd.", "pdb": null, "pfx": 54, "reg": "2022-06-27", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0040099230479}, {"a": 210644, "h": "AEZA-AS", "n": "Aéza", "t": "Hosting & VPS", "w": 27, "cc": "RU", "cf": {"rb": "lo", "wb": null, "rep": 1.98, "waf": null}, "cs": {"c": {"http_flood": 3, "data_centre": 2, "web_exploit": 3, "bad_crawling": 1, "ssh_bruteforce": 2, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2026-53787": 1}, "n": 4}, "ev": {"shodan": {"n": 24, "p": 1.0000, "hi": 18.90, "lo": 9.73, "ips": 24, "mean": 14.00, "above": true}, "dshield": {"n": 2, "p": 0.3035, "hi": 5.25, "lo": 0.68, "ips": 2, "mean": 2.50, "above": false}, "crowdsec": {"n": 4, "p": 0.2939, "hi": 4.63, "lo": 1.00, "ips": 4, "mean": 2.53, "above": false}, "threatfox": {"n": 3, "p": 0.6093, "hi": 7.34, "lo": 1.29, "ips": 3, "mean": 3.79, "above": false}, "vulncheck": {"n": 10, "p": 0.9988, "hi": 14.22, "lo": 5.17, "ips": 10, "mean": 9.22, "above": true}, "phishing_db": {"n": 4, "p": 0.7180, "hi": 7.76, "lo": 1.67, "ips": 4, "mean": 4.24, "above": false}, "blocklist_de": {"n": 4, "p": 0.5931, "hi": 6.56, "lo": 1.41, "ips": 4, "mean": 3.59, "above": false}}, "h2": [["2026-10-05", 3.338, 3.193, 0, false], ["2026-10-12", 3.376, 2.760, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 4}, "lo": 2.760, "se": 0.858, "ts": 0.571, "map": 6.911, "obs": 7, "own": 2.602, "comp": {"urlhaus": -1.141, "threatfox": 1.957, "phishing_db": 2.7433}, "mass": 3.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 4, "vulncheck": 10, "blocklist_de": 4}, "lo": 3.376, "se": 0.449, "ts": 0.500, "map": 5.897, "obs": 20, "own": 1.160, "comp": {"cins": -1.7973, "dshield": 1.0213, "crowdsec": -2.6478, "vulncheck": 3.8346, "blocklist_de": 2.7573}, "mass": 12.1, "listed": false}}, "abq": false, "bot": 0.642, "det": {"shodan": {"c2": 1, "compromised": 23}, "threatfox": {"family:PureRAT": 1, "family:AdaptixC2": 1, "family:Unknown Stealer": 1}, "vulncheck": {"c2_server": 7, "botnet_node": 3}, "blocklist_de": {"ftp": 1, "ssh": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-AGL50-RIPE", "org": "AEZA GROUP LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": "0-20Mbps", "pol": "Selective", "web": "https://aeza.net"}, "pfx": 314, "reg": "2021-10-13", "rir": "ripencc", "s24": 368, "sib": 0, "tor": 0, "w24": 25, "drop": 1, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.8435]], "ipv4": 95232, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.01595587560015}, {"a": 210654, "h": "CUSTOMER-AS", "n": "Des Capital B.V.", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.371, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.533, "det": null, "oid": "ORG-DCB8-RIPE", "org": "Des Capital B.V.", "pdb": null, "pfx": 12, "reg": "2021-10-11", "rir": "ripencc", "s24": 24, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210670, "h": "CLOUDGAL", "n": "INFORMATICA Y NETWORKING COMPOSTELA SL", "t": "Hosting & VPS", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.267, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-IYNC1-RIPE", "org": "INFORMATICA Y NETWORKING COMPOSTELA SL", "pdb": null, "pfx": 1, "reg": "2021-10-06", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210676, "h": "Appline_Group_LLC", "n": "Appline Group LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-AGL46-RIPE", "org": "Appline Group LLC", "pdb": null, "pfx": 1, "reg": "2025-04-10", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210699, "h": "WEDEPLOY-SAS", "n": "WEDEPLOY (INFRAWIRE.NET)", "t": "Hosting & VPS", "w": 2, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2014-8739": 1, "cve:CVE-2016-1555": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 5.337, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.337, "se": 1.024, "ts": 0.500, "map": 26.930, "obs": 2, "own": 5.588, "comp": {"cins": 4.6982, "dshield": -0.5422, "crowdsec": 2.2796, "vulncheck": -0.4726, "blocklist_de": -1.276}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-WS329-RIPE", "org": "WEDEPLOY SAS", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://infrawire.net/"}, "pfx": 6, "reg": "2025-11-04", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00097160103391}, {"a": 210705, "h": "AliMonfared", "n": "Ali Monfared", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.426, "det": null, "oid": "ORG-AM419-RIPE", "org": "Ali Monfared", "pdb": null, "pfx": 1, "reg": "2025-04-09", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004604430546}, {"a": 210712, "h": "GRAPESC-ISP", "n": "ISP Alliance a.s.", "t": "Other", "w": 3, "cc": "CZ", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2018-13379": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3309, "hi": 5.48, "lo": 0.71, "ips": 2, "mean": 2.61, "above": false}}, "h2": [["2026-10-05", 4.725, 0.509, 0, false], ["2026-10-12", 1.022, 0.546, 0, false]], "sh": false, "uc": 2176.3, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.546, "se": 1.596, "ts": 1.000, "map": 6.020, "obs": 1, "own": 7.535, "comp": {"urlhaus": 4.0696, "threatfox": -0.2266, "phishing_db": -0.4217}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.022, "se": 0.920, "ts": 1.000, "map": 4.237, "obs": 2, "own": 2.480, "comp": {"cins": -0.3061, "dshield": -0.6569, "crowdsec": 5.9093, "vulncheck": -0.531, "blocklist_de": -1.5777}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.183, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-GSA22-RIPE", "org": "ISP Alliance a.s.", "pdb": null, "pfx": 7, "reg": "2021-09-24", "rir": "ripencc", "s24": 56, "sib": 16, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00094494887045}, {"a": 210714, "h": "WORLD-NET-ISP-Provider", "n": "Orhan Turkan", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.188, "det": null, "oid": "ORG-TA1962-RIPE", "org": "Orhan Turkan", "pdb": null, "pfx": 1, "reg": "2026-02-03", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210731, "h": "DOTSRC", "n": "Forening for DotSrc", "t": "Hosting & VPS", "w": 11, "cc": "DK", "cf": null, "cs": {"c": {"http_flood": 11, "data_centre": 9, "web_exploit": 11, "bad_crawling": 11, "proxy_or_vpn": 11, "ssh_bruteforce": 11, "web_bruteforce": 11, "home_connection": 1, "mail_bruteforce": 4, "cve:CVE-2015-9406": 2, "cve:CVE-2017-9841": 9, "cve:CVE-2018-20062": 8, "cve:CVE-2021-41773": 5, "cve:CVE-2022-26134": 2}, "n": 11}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 11, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.749, "det": null, "oid": "ORG-DA1194-RIPE", "org": "Forening for DotSrc", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://dotsrc.org"}, "pfx": 1, "reg": "2021-09-21", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 11, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000072237524}, {"a": 210734, "h": "IPHOSTER", "n": "IPHOSTER OU", "t": "Hosting & VPS", "w": 1, "cc": "EE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 0.470, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.470, "se": 1.377, "ts": 1.000, "map": 4.607, "obs": 1, "own": 1.094, "comp": {"cins": -0.1059, "dshield": -0.2471, "crowdsec": -0.9786, "vulncheck": -0.2696, "blocklist_de": 4.5224}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.464, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-IO78-RIPE", "org": "IPHOSTER OU", "pdb": null, "pfx": 17, "reg": "2025-04-08", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000160728723}, {"a": 210814, "h": "VUNIFY", "n": "VUNIFY", "t": "Enterprise, edu & gov", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 3.304, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 4.299, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.155, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VL458-RIPE", "org": "VUNIFY LTD", "pdb": {"t": "Enterprise", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://vunify.org"}, "pfx": 17, "reg": "2025-06-10", "rir": "ripencc", "s24": 17, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000126053685}, {"a": 210848, "h": "TK-NET", "n": "Telkom Internet LTD", "t": "Broadband & mobile", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.706, "det": null, "oid": "ORG-TIL23-RIPE", "org": "Telkom Internet LTD", "pdb": null, "pfx": 8, "reg": "2021-08-25", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000122842076}, {"a": 210899, "h": "neftm-as", "n": "Torgovyi Dom Neftmagistral LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.817, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-TDNL1-RIPE", "org": "Torgovyi Dom Neftmagistral LLC", "pdb": null, "pfx": 1, "reg": "2021-08-16", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210924, "h": "SSDNetworks", "n": "ssd networks", "t": "Other", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.942, "det": null, "oid": "ORG-SNL70-RIPE", "org": "SSD Networks Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://SSDnetworks.com"}, "pfx": 2, "reg": "2021-08-10", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 210976, "h": "TWC-EU", "n": "Timeweb, LLP", "t": "Hosting & VPS", "w": 21, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 3, "first_seen_30d": 3, "ssh_bruteforce": 3, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2025-55182": 1}, "n": 9}, "ev": {"shodan": {"n": 16, "p": 1.0000, "hi": 14.01, "lo": 6.24, "ips": 16, "mean": 9.80, "above": true}, "dshield": {"n": 2, "p": 0.3105, "hi": 5.31, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}, "crowdsec": {"n": 9, "p": 0.9326, "hi": 8.20, "lo": 2.83, "ips": 9, "mean": 5.22, "above": true}, "threatfox": {"n": 2, "p": 0.3887, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}, "vulncheck": {"n": 4, "p": 0.7176, "hi": 7.75, "lo": 1.67, "ips": 4, "mean": 4.24, "above": false}, "phishing_db": {"n": 2, "p": 0.3201, "hi": 5.39, "lo": 0.70, "ips": 4, "mean": 2.57, "above": false}, "blocklist_de": {"n": 2, "p": 0.2230, "hi": 4.60, "lo": 0.60, "ips": 2, "mean": 2.19, "above": false}}, "h2": [["2026-10-05", 2.854, 1.483, 0, false], ["2026-10-12", 3.611, 1.490, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 2}, "lo": 1.490, "se": 0.953, "ts": 0.500, "map": 4.397, "obs": 4, "own": 1.720, "comp": {"urlhaus": -0.7925, "threatfox": 2.01, "phishing_db": 1.8896}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 9, "vulncheck": 4, "blocklist_de": 2}, "lo": 3.611, "se": 0.445, "ts": 0.529, "map": 6.277, "obs": 17, "own": 1.232, "comp": {"cins": -1.792, "dshield": 1.0365, "crowdsec": 5.818, "vulncheck": 0.9882, "blocklist_de": -2.8201}, "mass": 12.0, "listed": false}}, "abq": false, "bot": 0.547, "det": {"shodan": {"c2": 1, "compromised": 15}, "threatfox": {"family:Havoc": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 3, "attack_tooling": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-TL861-RIPE", "org": "Timeweb, LLP", "pdb": null, "pfx": 344, "reg": "2025-04-02", "rir": "ripencc", "s24": 344, "sib": 1, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 88064, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.009791312926}, {"a": 211001, "h": "TTR-GROUP", "n": "TTR IT Holdings Limited", "t": "Other", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TIHL2-RIPE", "org": "TTR IT Holdings Limited", "pdb": null, "pfx": 3, "reg": "2025-03-28", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211043, "h": "Dedifix", "n": "Dedifix", "t": "Other", "w": 5, "cc": "NL", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6441, "hi": 7.72, "lo": 1.36, "ips": 5, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 11.143, 0.011, 1, false], ["2026-10-12", 5.856, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 5.856, "se": 0.821, "ts": 1.000, "map": 19.303, "obs": 3, "own": 11.639, "comp": {"cins": -0.2283, "dshield": -0.5057, "crowdsec": -1.9981, "vulncheck": 8.2685, "blocklist_de": -1.1825}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.943, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-OSTA1-RIPE", "org": "Dedifix BV", "pdb": null, "pfx": 9, "reg": "2021-07-13", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000030752949}, {"a": 211066, "h": "RYZEHOSTING-TRADING", "n": "Simon Mariacher", "t": "Hosting & VPS", "w": 1, "cc": "AT", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.548, "det": null, "oid": "ORG-RA1166-RIPE", "org": "Simon Mariacher", "pdb": null, "pfx": 2, "reg": "2025-03-28", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211121, "h": "India", "n": "Tiger Network AS211121", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 0.403, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-TNL41-RIPE", "org": "Tiger Network Limited", "pdb": null, "pfx": 5, "reg": "2021-06-23", "rir": "ripencc", "s24": 20, "sib": 1, "tor": 0, "w24": 0, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211212, "h": "GBD-AS", "n": "GBD Software as a Service Private Limited Company", "t": "Other", "w": 0, "cc": "HU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 20117.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.143, "det": null, "oid": "ORG-GCAS1-RIPE", "org": "GBD Software as a Service Private Limited Company", "pdb": null, "pfx": 2, "reg": "2021-06-04", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211238, "h": "DCYBER", "n": "Dedicated Cyber Limited", "t": "Hosting & VPS", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.903, "det": null, "oid": "ORG-DCBR1-RIPE", "org": "Dedicated Cyber Limited", "pdb": null, "pfx": 1, "reg": "2021-06-01", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211273, "h": "csoft", "n": "Cloud Software - FZCO", "t": "Hosting & VPS", "w": 8, "cc": "AE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1899, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 11, "p": 0.9998, "hi": 16.45, "lo": 6.26, "ips": 11, "mean": 10.84, "above": true}, "crowdsec": {"n": 1, "p": 0.1470, "hi": 4.19, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "threatfox": {"n": 2, "p": 0.4181, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "vulncheck": {"n": 3, "p": 0.6296, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}, "blocklist_de": {"n": 2, "p": 0.3882, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 4.324, 6.980, 0, false], ["2026-10-12", 7.596, 1.979, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.979, "se": 1.161, "ts": 1.000, "map": 9.392, "obs": 2, "own": 3.629, "comp": {"urlhaus": -0.2964, "threatfox": 4.6801, "phishing_db": -0.5176}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 3, "blocklist_de": 2}, "lo": 7.596, "se": 0.579, "ts": 0.429, "map": 16.566, "obs": 7, "own": 3.300, "comp": {"cins": 3.252, "dshield": -1.5748, "crowdsec": -3.2677, "vulncheck": 2.4543, "blocklist_de": 3.3372}, "mass": 4.7, "listed": false}}, "abq": false, "bot": 0.542, "det": {"shodan": {"c2": 2, "compromised": 9}, "threatfox": {"family:pupy": 1, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-CSF5-RIPE", "org": "Cloud Software - FZCO", "pdb": null, "pfx": 50, "reg": "2026-01-21", "rir": "ripencc", "s24": 50, "sib": 1, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.0690]], "ipv4": 12800, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00030482801894}, {"a": 211298, "h": "DRIFTNET", "n": "Driftnet Ltd", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 28320.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.998, "det": null, "oid": "ORG-DL595-RIPE", "org": "Driftnet Ltd", "pdb": null, "pfx": 4, "reg": "2021-05-19", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00130794467051}, {"a": 211301, "h": "UNESTY", "n": "Unesty", "t": "Enterprise, edu & gov", "w": 2, "cc": "DE", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 140.252, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.622, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-UC59-RIPE", "org": "Collin Schneeweiss trading as Unesty Company", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://server.unesty.net"}, "pfx": 8, "reg": "2021-05-19", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211305, "h": "HOSTBITS", "n": "HOSTBITS SOLUCOES EM NUVEM LTDA", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.925, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HSEN1-RIPE", "org": "HOSTBITS SOLUCOES EM NUVEM LTDA", "pdb": null, "pfx": 6, "reg": "2025-03-24", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211356, "h": "mytvalb", "n": "MyTv-Alb SH.P.K.", "t": "Other", "w": 7, "cc": "AL", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 3, "first_seen_30d": 1, "ssh_bruteforce": 5, "home_connection": 1, "router_or_botnet": 2, "cve:CVE-2019-8318": 3, "cve:CVE-2024-12847": 3}, "n": 7}, "ev": {"urlhaus": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 7, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 35.879, 0.011, 1, false], ["2026-10-12", 11.989, 1.068, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.068, "se": 1.917, "ts": 1.000, "map": 16.822, "obs": 1, "own": 35.847, "comp": {"urlhaus": 4.5442, "threatfox": -0.0344, "phishing_db": -0.0609}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 11.989, "se": 1.090, "ts": 1.000, "map": 69.245, "obs": 2, "own": 41.678, "comp": {"cins": -0.1839, "dshield": -0.415, "crowdsec": 7.5814, "vulncheck": -0.396, "blocklist_de": -0.9552}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.159, "det": null, "oid": "ORG-MS743-RIPE", "org": "MyTv-Alb SH.P.K.", "pdb": null, "pfx": 2, "reg": "2021-05-06", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00024596346495}, {"a": 211381, "h": "PODAON", "n": "Podaon SIA", "t": "Enterprise, edu & gov", "w": 6, "cc": "LV", "cf": null, "cs": null, "ev": {"shodan": {"n": 23, "p": 1.0000, "hi": 25.59, "lo": 13.00, "ips": 23, "mean": 18.85, "above": true}, "threatfox": {"n": 4, "p": 0.8053, "hi": 8.98, "lo": 1.93, "ips": 4, "mean": 4.90, "above": true}, "phishing_db": {"n": 1, "p": 0.1728, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 1, "p": 0.1455, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.437, 3.275, 0, false], ["2026-10-12", 0.153, 4.375, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 1}, "lo": 4.375, "se": 0.889, "ts": 0.800, "map": 11.967, "obs": 5, "own": 48.088, "comp": {"urlhaus": -0.8001, "threatfox": 4.4098, "phishing_db": 0.4987}, "mass": 2.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.153, "se": 1.193, "ts": 1.000, "map": 1.057, "obs": 1, "own": 6.598, "comp": {"cins": -0.1798, "dshield": -0.4064, "crowdsec": -1.6069, "vulncheck": -0.3903, "blocklist_de": 4.032}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.869, "det": {"shodan": {"compromised": 23}, "threatfox": {"family:AsyncRAT": 3, "family:Unknown Stealer": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-PS469-RIPE", "org": "Podaon SIA", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://fotbo.com"}, "pfx": 128, "reg": "2023-04-03", "rir": "ripencc", "s24": 128, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8755]], "ipv4": 32768, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": [], "traffic": 0.0036795494525}, {"a": 211407, "h": "AS_Perwira_Media", "n": "PT Perwira Media Solusi", "t": "Hosting & VPS", "w": 1, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3910, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.360, 0.011, 0, false], ["2026-10-12", 0.384, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.288, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 0.810, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.566, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-PPMS1-RIPE", "org": "PT Perwira Media Solusi", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://perwiramedia.co.id"}, "pfx": 23, "reg": "2022-02-22", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008966346545}, {"a": 211421, "h": "MOBINONE", "n": "Asiatech Data Transmission company", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.528, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AI34-RIPE", "org": "Asiatech Data Transmission company", "pdb": null, "pfx": 8, "reg": "2021-04-26", "rir": "ripencc", "s24": 9, "sib": 6, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011732735985}, {"a": 211422, "h": "OnlineInternet", "n": "Emre Aydogan", "t": "Other", "w": 25, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 13, "p": 1.0000, "hi": 20.44, "lo": 8.37, "ips": 23, "mean": 13.84, "above": true}, "phishing_db": {"n": 1, "p": 0.1946, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.522, 0, false], ["2026-10-12", 45.320, 0.551, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.551, "se": 1.586, "ts": 1.000, "map": 6.103, "obs": 1, "own": 7.431, "comp": {"urlhaus": -0.0867, "threatfox": -0.1128, "phishing_db": 3.6344}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 13, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 45.320, "se": 0.452, "ts": 1.000, "map": 80.018, "obs": 13, "own": 44.732, "comp": {"cins": -1.5306, "dshield": 24.0976, "crowdsec": -8.5672, "vulncheck": -0.9003, "blocklist_de": -7.3235}, "mass": 9.2, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-EA1539-RIPE", "org": "Emre Aydogan", "pdb": null, "pfx": 21, "reg": "2021-04-23", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 13, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": null}, {"a": 211443, "h": "SINOWORLDWIDE", "n": "SINO WORLDWIDE TRADING LIMITED", "t": "Other", "w": 22, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 7, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "mail_bruteforce": 2, "cve:CVE-2017-9841": 4, "cve:CVE-2017-16894": 2, "cve:CVE-2019-17050": 2, "cve:CVE-2026-41940": 1, "cve:CVE-2026-60137": 1}, "n": 9}, "ev": {"cins": {"n": 2, "p": 0.4206, "hi": 6.27, "lo": 0.81, "ips": 3, "mean": 2.99, "above": false}, "dshield": {"n": 2, "p": 0.4199, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 4, "p": 0.8031, "hi": 8.94, "lo": 1.92, "ips": 9, "mean": 4.88, "above": true}, "threatfox": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 10, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 2, "p": 0.4167, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 72.354, 0.663, 1, false], ["2026-10-12", 94.161, 0.686, 1, false]], "sh": true, "uc": 2213.5, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.686, "se": 1.658, "ts": 1.000, "map": 8.575, "obs": 1, "own": 11.126, "comp": {"urlhaus": -0.0528, "threatfox": 3.9591, "phishing_db": -0.1313}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 2}, "lo": 94.161, "se": 0.483, "ts": 0.364, "map": 175.781, "obs": 11, "own": 98.430, "comp": {"cins": 5.5542, "dshield": 2.0473, "crowdsec": -0.1344, "vulncheck": -0.2626, "blocklist_de": -0.6416}, "mass": 8.7, "listed": false}}, "abq": false, "bot": 0.692, "det": {"threatfox": {"family:Remcos": 6, "family:PureRAT": 4}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "ORG-SWTL1-RIPE", "org": "SINO WORLDWIDE TRADING LIMITED", "pdb": null, "pfx": 9, "reg": "2025-11-27", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00047612469204}, {"a": 211484, "h": "YSZ", "n": "YSZ TRADING CO., LIMITED", "t": "Other", "w": 6, "cc": "HK", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6398, "hi": 7.67, "lo": 1.35, "ips": 6, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 8.906, 0.011, 0, false], ["2026-10-12", 2.862, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 2.862, "se": 0.804, "ts": 1.000, "map": 9.115, "obs": 3, "own": 5.491, "comp": {"cins": -0.2503, "dshield": -0.5493, "crowdsec": -2.1694, "vulncheck": 7.8667, "blocklist_de": -1.2942}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.953, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-YSZ2-RIPE", "org": "YSZ TRADING CO., LIMITED", "pdb": null, "pfx": 21, "reg": "2025-03-19", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003493254175}, {"a": 211486, "h": "AAA-AS", "n": "Alferov Aleksey Aleksandrovich", "t": "Other", "w": 27, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 2, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 5, "ssh_bruteforce": 15, "web_bruteforce": 13, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2024-6387": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-32648": 1}, "n": 23}, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 23, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 115.001, 0.011, 1, false], ["2026-10-12", 75.621, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 75.621, "se": 0.716, "ts": 0.500, "map": 214.399, "obs": 4, "own": 121.581, "comp": {"cins": 4.0957, "dshield": 2.6908, "crowdsec": 3.315, "vulncheck": -0.675, "blocklist_de": -2.6651}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.979, "det": {"shodan": {"c2": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AAA94-RIPE", "org": "Alferov Aleksey Aleksandrovich", "pdb": null, "pfx": 2, "reg": "2025-04-01", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211507, "h": "Aluy", "n": "Julian Achter", "t": "Broadband & mobile", "w": 26, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 25, "data_centre": 5, "web_exploit": 25, "bad_crawling": 19, "proxy_or_vpn": 24, "first_seen_30d": 1, "ssh_bruteforce": 7, "web_bruteforce": 25, "home_connection": 18, "mail_bruteforce": 12, "cve:CVE-2017-9841": 9, "cve:CVE-2018-20062": 14, "cve:CVE-2021-41773": 8, "cve:CVE-2021-44228": 8, "cve:CVE-2024-28000": 6}, "n": 25}, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "urlhaus": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 6, "p": 0.9610, "hi": 11.45, "lo": 3.18, "ips": 25, "mean": 6.77, "above": true}}, "h2": [["2026-10-05", 24.181, 6.702, 1, false], ["2026-10-12", 25.445, 0.803, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.803, "se": 1.736, "ts": 1.000, "map": 10.972, "obs": 1, "own": 39.893, "comp": {"urlhaus": 4.3668, "threatfox": -0.1229, "phishing_db": -0.2225}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 25.445, "se": 0.576, "ts": 1.000, "map": 56.160, "obs": 6, "own": 86.345, "comp": {"cins": -0.8247, "dshield": -1.4642, "crowdsec": 12.61, "vulncheck": -0.7837, "blocklist_de": -4.1155}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.652, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Sliver": 1, "family:Unknown malware": 3}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-JA600-RIPE", "org": "Julian Achter", "pdb": {"t": null, "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://aluy.net"}, "pfx": 13, "reg": "2025-03-17", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 20, "w24": 6, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00061503772223}, {"a": 211557, "h": "TAYNET", "n": "TAYNET", "t": "Enterprise, edu & gov", "w": 2, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "dshield": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 5.298, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 3.728, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.298, "se": 1.022, "ts": 0.500, "map": 26.679, "obs": 2, "own": 157.481, "comp": {"cins": -0.2445, "dshield": 3.911, "crowdsec": -2.1248, "vulncheck": -0.4702, "blocklist_de": 3.606}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.768, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TBYI1-RIPE", "org": "TAYNET TEKNOLOJI TICARET LIMITED SIRKETI", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "https://tay.net.tr/"}, "pfx": 7, "reg": "2021-03-25", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002358797218}, {"a": 211560, "h": "UGUR-OZTURK", "n": "Datafex Bilisim Teknolojileri Ticaret Limited Sirketi", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.890, "det": null, "oid": "ORG-FEX1-RIPE", "org": "Datafex Bilisim Teknolojileri Ticaret Limited Sirketi", "pdb": null, "pfx": 2, "reg": "2021-03-25", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211590, "h": "BUCKLOG", "n": "Bucklog SARL", "t": "Other", "w": 36, "cc": "FR", "cf": {"rb": "", "wb": "", "rep": 3.77, "waf": 11.80}, "cs": {"c": {"http_flood": 36, "web_exploit": 36, "bad_crawling": 36, "ssh_bruteforce": 27, "web_bruteforce": 36, "mail_bruteforce": 3, "cve:CVE-2017-3506": 25, "cve:CVE-2017-9841": 31, "cve:CVE-2017-12149": 7, "cve:CVE-2018-20062": 21, "cve:CVE-2019-1003030": 4}, "n": 36}, "ev": {"dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 36, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 12, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 31.067, 0.011, 1, false], ["2026-10-12", 62.117, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 62.117, "se": 0.731, "ts": 0.250, "map": 177.841, "obs": 4, "own": 102.288, "comp": {"cins": -0.4437, "dshield": 3.0154, "crowdsec": 0.3343, "vulncheck": 1.352, "blocklist_de": 2.3166}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.742, "det": {"vulncheck": {"other_infrastructure": 3}, "blocklist_de": {"bots": 3, "apache": 9, "bruteforcelogin": 4}}, "oid": "ORG-BA1710-RIPE", "org": "Bucklog SARL", "pdb": null, "pfx": 2, "reg": "2025-03-13", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0274], ["2026-10-12", 0.0355]], "ipv4": 512, "abuse": null, "score": 0.0355, "groups": ["cloudflare"], "sensors": [], "traffic": 0.125577}, {"a": 211607, "h": "RECORDEDFUTURE", "n": "Securitytrails, LLC", "t": "Other", "w": 18, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 2, "p": 0.4223, "hi": 6.29, "lo": 0.82, "ips": 18, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 55.805, 0.011, 1, false], ["2026-10-12", 10.542, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.542, "se": 1.082, "ts": 1.000, "map": 59.174, "obs": 2, "own": 35.759, "comp": {"cins": 9.6886, "dshield": -0.5152, "crowdsec": -2.0353, "vulncheck": -0.4574, "blocklist_de": -1.2066}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-SL1028-RIPE", "org": "Securitytrails, LLC", "pdb": null, "pfx": 3, "reg": "2021-03-17", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211611, "h": "eximhost", "n": "eximhost", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.976, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-EHS5-RIPE", "org": "Exim Host SRL", "pdb": null, "pfx": 7, "reg": "2021-03-17", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004821087114}, {"a": 211619, "h": "MAXKO", "n": "MAXKO", "t": "Hosting & VPS", "w": 26, "cc": "HR", "cf": null, "cs": {"c": {"http_flood": 20, "data_centre": 20, "web_exploit": 22, "bad_crawling": 16, "proxy_or_vpn": 23, "first_seen_30d": 2, "ssh_bruteforce": 11, "web_bruteforce": 22, "mail_bruteforce": 9, "cve:CVE-2015-9406": 6, "cve:CVE-2017-9841": 6, "cve:CVE-2018-20062": 11, "cve:CVE-2020-11738": 3, "cve:CVE-2021-41773": 4}, "n": 26}, "ev": {"crowdsec": {"n": 5, "p": 0.8891, "hi": 9.71, "lo": 2.41, "ips": 26, "mean": 5.54, "above": true}, "blocklist_de": {"n": 1, "p": 0.1847, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 25.196, 0.011, 1, false], ["2026-10-12", 12.007, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 0.272, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.007, "se": 0.574, "ts": 0.833, "map": 26.323, "obs": 6, "own": 5.170, "comp": {"cins": -0.9021, "dshield": -1.5616, "crowdsec": 8.4629, "vulncheck": -0.803, "blocklist_de": -0.532}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.601, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-MJ181-RIPE", "org": "MAXKO d.o.o.", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.maxko-hosting.com/"}, "pfx": 31, "reg": "2021-03-16", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 29, "w24": 5, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00037002806691}, {"a": 211632, "h": "ORG-ISI14-RIPE", "n": "Internet Solutions & Innovations LTD.", "t": "Other", "w": 4, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 3, "web_bruteforce": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.848, 0.012, 1, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.989, "det": null, "oid": "ORG-ISI14-RIPE", "org": "Internet Solutions & Innovations LTD.", "pdb": null, "pfx": 1, "reg": "2021-03-15", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000057009865}, {"a": 211644, "h": "QazCloud", "n": "QazCloud LLP", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.497, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-QL155-RIPE", "org": "QazCloud LLP", "pdb": null, "pfx": 5, "reg": "2021-03-11", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000398130859}, {"a": 211663, "h": "GALEON-AS", "n": "GALEON LLC", "t": "Other", "w": 2, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2022-26134": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 19.114, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 19.114, "se": 1.138, "ts": 0.500, "map": 120.995, "obs": 2, "own": 73.706, "comp": {"cins": -0.1615, "dshield": 4.3289, "crowdsec": 3.226, "vulncheck": -0.3639, "blocklist_de": -0.84}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.971, "det": null, "oid": "ORG-GL550-RIPE", "org": "GALEON LLC", "pdb": null, "pfx": 1, "reg": "2025-03-11", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211680, "h": "AS-BITSIGHT", "n": "NSEC - Sistemas Informaticos, S.A.", "t": "Other", "w": 4, "cc": "PT", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 4, "bad_crawling": 2, "web_bruteforce": 4, "cve:CVE-2024-4040": 1, "cve:CVE-2019-18935": 4, "cve:CVE-2021-41773": 3, "cve:CVE-2022-35914": 1, "cve:CVE-2024-20767": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 21.463, 0.011, 1, false], ["2026-10-12", 7.969, 0.013, 0, false]], "sh": false, "uc": 16601.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.969, "se": 1.056, "ts": 0.500, "map": 42.744, "obs": 2, "own": 25.622, "comp": {"cins": 4.7455, "dshield": -0.4988, "crowdsec": 2.5151, "vulncheck": -0.448, "blocklist_de": -1.1649}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.998, "det": null, "oid": "ORG-NSIS5-RIPE", "org": "NSEC - Sistemas Informaticos, S.A.", "pdb": null, "pfx": 4, "reg": "2021-03-05", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004941415675}, {"a": 211709, "h": "turbonet", "n": "turbonet", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 31640.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.181, "det": null, "oid": "ORG-TNTE1-RIPE", "org": "TURBO NET TELEKOMUNIKASYON ELEKTRONIK HABERLESME BILISIM HIZMETLERI SANAYI TICARET LTD STI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.turbo.net.tr"}, "pfx": 6, "reg": "2021-03-02", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003485307997}, {"a": 211720, "h": "DATASHIELD_CH", "n": "Datashield, Inc.", "t": "Hosting & VPS", "w": 9, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 8, "web_exploit": 7, "bad_crawling": 4, "proxy_or_vpn": 5, "first_seen_30d": 4, "ssh_bruteforce": 6, "web_bruteforce": 7, "mail_bruteforce": 1, "cve:CVE-2017-9841": 4, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2019-18935": 1, "cve:CVE-2021-44228": 1}, "n": 8}, "ev": {"cins": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}, "dshield": {"n": 2, "p": 0.4217, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6401, "hi": 7.67, "lo": 1.35, "ips": 8, "mean": 3.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 61.387, 0.011, 1, false], ["2026-10-12", 140.525, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 140.525, "se": 0.526, "ts": 0.375, "map": 283.826, "obs": 8, "own": 55.378, "comp": {"cins": 6.5806, "dshield": 3.1946, "crowdsec": 0.2054, "vulncheck": -0.8535, "blocklist_de": -2.0851}, "mass": 6.3, "listed": false}}, "abq": false, "bot": 0.700, "det": {"blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-DI60-RIPE", "org": "Datashield, Inc.", "pdb": null, "pfx": 4, "reg": "2021-03-01", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 6, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211750, "h": "MC-NODE-AS", "n": "MC-Node", "t": "Enterprise, edu & gov", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1889, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 3.523, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 5.164, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.648, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SHAW1-RIPE", "org": "Stef Herman Anton Wolters trading as MC-Node", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "5-10Gbps", "pol": "Selective", "web": "https://mc-node.net"}, "pfx": 11, "reg": "2021-02-23", "rir": "ripencc", "s24": 11, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211826, "h": "ISTQSERVERS-AS", "n": "ISTQSERVERS", "t": "Hosting & VPS", "w": 7, "cc": "JO", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1544, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "vulncheck": {"n": 4, "p": 0.8040, "hi": 8.96, "lo": 1.93, "ips": 6, "mean": 4.89, "above": true}}, "h2": [["2026-10-05", 3.133, 0.011, 0, false], ["2026-10-12", 3.612, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 0.256, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 4, "blocklist_de": 0}, "lo": 3.612, "se": 0.651, "ts": 0.800, "map": 8.798, "obs": 5, "own": 1.796, "comp": {"cins": -0.4592, "dshield": -0.9282, "crowdsec": 0.1941, "vulncheck": 7.1056, "blocklist_de": -2.344}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.956, "det": {"vulncheck": {"botnet_node": 6}}, "oid": "ORG-IFSS3-RIPE", "org": "Stability for Integrated Server Hosting Ltd", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "5-10Tbps", "pol": "Open", "web": "https://istqservers.com/"}, "pfx": 42, "reg": "2021-02-11", "rir": "ripencc", "s24": 42, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0833]], "ipv4": 10752, "abuse": null, "score": 0.0833, "groups": ["vulncheck"], "sensors": [], "traffic": 0.00000041215984}, {"a": 211857, "h": "NSHOST", "n": "NSHOST SRL", "t": "Hosting & VPS", "w": 4, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 1.009, 0, false], ["2026-10-12", 0.013, 1.043, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 1.043, "se": 1.890, "ts": 1.000, "map": 16.456, "obs": 1, "own": 12.334, "comp": {"urlhaus": -0.0114, "threatfox": -0.0173, "phishing_db": 4.4556}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.870, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NS430-RIPE", "org": "NSHOST SRL", "pdb": null, "pfx": 1, "reg": "2021-02-05", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211860, "h": "VPSDEDIC-AS", "n": "Nerushenko Vyacheslav Nikolaevich", "t": "Hosting & VPS", "w": 10, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "cve:CVE-2022-39290": 2}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}, "dshield": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 3.00, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 5, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 8.804, 0.977, 0, false], ["2026-10-12", 80.285, 1.021, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.021, "se": 1.880, "ts": 1.000, "map": 15.849, "obs": 1, "own": 11.776, "comp": {"urlhaus": 4.5211, "threatfox": -0.0475, "phishing_db": -0.0843}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 80.285, "se": 0.636, "ts": 0.400, "map": 195.072, "obs": 5, "own": 38.302, "comp": {"cins": 3.7443, "dshield": 5.464, "crowdsec": 1.6537, "vulncheck": -0.7416, "blocklist_de": -3.4534}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.897, "det": null, "oid": "ORG-NVN2-RIPE", "org": "Nerushenko Vyacheslav Nikolaevich", "pdb": null, "pfx": 2, "reg": "2025-03-06", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211895, "h": "Serverius-Users-as", "n": "Serverius Holding B.V.", "t": "Hosting & VPS", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.670, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 1.893, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.772, "det": {"shodan": {"c2": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-SHB2-RIPE", "org": "Serverius Holding B.V.", "pdb": null, "pfx": 8, "reg": "2021-02-03", "rir": "ripencc", "s24": 8, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211922, "h": "IPDISTR", "n": "IP Connect Inc", "t": "Other", "w": 0, "cc": "SC", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.982, "det": null, "oid": "ORG-ICI6-RIPE", "org": "IP Connect Inc", "pdb": null, "pfx": 4, "reg": "2021-01-28", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211955, "h": "NOTBADHOSTING", "n": "NOTBAD HOSTING LTD", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.380, "det": null, "oid": "ORG-NA1585-RIPE", "org": "NOTBAD HOSTING LTD", "pdb": null, "pfx": 3, "reg": "2025-03-04", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 211971, "h": "GOODHOSTKZ", "n": "Goodhost.KZ LLP", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.001, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.621, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-GL445-RIPE", "org": "Goodhost.KZ LLP", "pdb": null, "pfx": 2, "reg": "2021-01-20", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002942482249}, {"a": 211995, "h": "a2z", "n": "a2z", "t": "Broadband & mobile", "w": 1, "cc": "AZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1569, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.241, 0.011, 0, false], ["2026-10-12", 0.256, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.256, "se": 1.264, "ts": 1.000, "map": 2.026, "obs": 1, "own": 3.565, "comp": {"cins": -0.1334, "dshield": -0.3075, "crowdsec": 3.5546, "vulncheck": -0.3191, "blocklist_de": -0.695}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-AAC11-RIPE", "org": "A2Z Technologies CJSC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://a2z.az/"}, "pfx": 49, "reg": "2021-01-15", "rir": "ripencc", "s24": 49, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00044822816808}, {"a": 212027, "h": "PebbleHost", "n": "PebbleHost", "t": "Hosting & VPS", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "cve:CVE-2021-3129": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1791, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1744, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "vulncheck": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 1.669, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.290, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.669, "se": 0.967, "ts": 0.500, "map": 7.379, "obs": 2, "own": 1.558, "comp": {"cins": -0.2141, "dshield": -0.4769, "crowdsec": 2.6338, "vulncheck": 2.5591, "blocklist_de": -1.1096}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.790, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}}, "oid": "ORG-PEBL1-RIPE", "org": "PebbleHost Ltd", "pdb": {"t": "Content", "sc": "Europe", "tr": null, "pol": "Open", "web": "https://pebblehost.com"}, "pfx": 24, "reg": "2021-01-11", "rir": "ripencc", "s24": 22, "sib": 2, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00161106317381}, {"a": 212098, "h": "INFRAPOD", "n": "Jeroen van Brink trading as Infrapod", "t": "Other", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.927, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-JVBT1-RIPE", "org": "Jeroen van Brink trading as Infrapod", "pdb": null, "pfx": 1, "reg": "2020-12-24", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212128, "h": "HORIZON", "n": "LLC \"HORIZON\"", "t": "Other", "w": 3, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.383, 0.011, 0, false], ["2026-10-12", 0.381, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.381, "se": 1.348, "ts": 1.000, "map": 3.433, "obs": 1, "own": 2.388, "comp": {"cins": -0.0748, "dshield": -0.177, "crowdsec": -0.7012, "vulncheck": 3.9713, "blocklist_de": -0.3912}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.706, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-LA1598-RIPE", "org": "LLC \"HORIZON\"", "pdb": null, "pfx": 8, "reg": "2020-12-18", "rir": "ripencc", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212136, "h": "NUBES", "n": "NUBES LLC", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 7.867, 0.011, 0, false], ["2026-10-12", 0.494, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.494, "se": 1.386, "ts": 1.000, "map": 4.926, "obs": 1, "own": 3.368, "comp": {"cins": -0.0935, "dshield": -0.2194, "crowdsec": 4.0349, "vulncheck": -0.2452, "blocklist_de": -0.4885}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-NL466-RIPE", "org": "NUBES LLC", "pdb": null, "pfx": 13, "reg": "2020-12-17", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212165, "h": "kvmka", "n": "Alex Group LLC", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6430, "hi": 7.71, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 8.870, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 1}, "lo": 8.870, "se": 0.725, "ts": 0.750, "map": 24.579, "obs": 4, "own": 14.557, "comp": {"cins": -0.3743, "dshield": -0.7817, "crowdsec": -3.0809, "vulncheck": 6.0702, "blocklist_de": 2.7623}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.676, "det": {"threatfox": {"family:Mirai": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 1, "other_infrastructure": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AGL35-RIPE", "org": "Alex Group LLC", "pdb": null, "pfx": 11, "reg": "2020-12-14", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212171, "h": "Local-as", "n": "Local NCC Ltd.", "t": "Other", "w": 7, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 3, "ssh_bruteforce": 2, "web_bruteforce": 2, "cve:CVE-2011-3600": 1, "cve:CVE-2014-8739": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 4}, "ev": {"cins": {"n": 3, "p": 0.6407, "hi": 7.68, "lo": 1.35, "ips": 3, "mean": 3.96, "above": false}, "shodan": {"n": 9, "p": 0.9984, "hi": 14.97, "lo": 5.17, "ips": 9, "mean": 9.53, "above": true}, "crowdsec": {"n": 3, "p": 0.6062, "hi": 7.31, "lo": 1.29, "ips": 4, "mean": 3.77, "above": false}}, "h2": [["2026-10-05", 17.777, 0.498, 1, false], ["2026-10-12", 18.711, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 18.711, "se": 0.580, "ts": 0.500, "map": 41.253, "obs": 6, "own": 23.295, "comp": {"cins": 11.1188, "dshield": -1.6956, "crowdsec": 1.5278, "vulncheck": -0.8274, "blocklist_de": -5.0102}, "mass": 5.3, "listed": false}}, "abq": false, "bot": 0.850, "det": {"shodan": {"c2": 1, "compromised": 8}, "blocklist_de": {"bots": 1}}, "oid": "ORG-LNL43-RIPE", "org": "Local NCC Ltd.", "pdb": null, "pfx": 24, "reg": "2025-03-03", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 6400, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00069603530233}, {"a": 212175, "h": "STELIA", "n": "Stelia", "t": "Transit & backbone", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 3.049, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 3.126, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.262, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SL1166-RIPE", "org": "Stelia Ltd", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://stelia.ai"}, "pfx": 9, "reg": "2020-12-11", "rir": "ripencc", "s24": 9, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212219, "h": "HostingDunyam", "n": "Hosting Dunyam", "t": "Hosting & VPS", "w": 17, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 4, "web_exploit": 2, "ssh_bruteforce": 4, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 5}, "ev": {"shodan": {"n": 3, "p": 0.5928, "hi": 7.17, "lo": 1.26, "ips": 3, "mean": 3.70, "above": false}, "dshield": {"n": 2, "p": 0.4096, "hi": 6.17, "lo": 0.80, "ips": 3, "mean": 2.94, "above": false}, "crowdsec": {"n": 5, "p": 0.8825, "hi": 9.55, "lo": 2.37, "ips": 5, "mean": 5.45, "above": true}, "threatfox": {"n": 2, "p": 0.4193, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1904, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 8, "p": 0.9951, "hi": 13.87, "lo": 4.51, "ips": 13, "mean": 8.65, "above": true}}, "h2": [["2026-10-05", 14.399, 0.418, 1, false], ["2026-10-12", 41.019, 2.393, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 2.393, "se": 1.167, "ts": 1.000, "map": 11.536, "obs": 2, "own": 4.413, "comp": {"urlhaus": -0.2784, "threatfox": 4.8471, "phishing_db": -0.4971}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 5, "vulncheck": 1, "blocklist_de": 8}, "lo": 41.019, "se": 0.438, "ts": 0.500, "map": 71.139, "obs": 16, "own": 13.850, "comp": {"cins": -2.0377, "dshield": 0.3678, "crowdsec": -2.8027, "vulncheck": -0.5521, "blocklist_de": 10.683}, "mass": 14.9, "listed": false}}, "abq": false, "bot": 0.921, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:AdaptixC2": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 2, "ssh": 11}}, "oid": "ORG-HDBT5-RIPE", "org": "HOSTING DUNYAM BILISIM TEKNOLOJILERI TICARET LIMITED SIRKETI", "pdb": {"t": "Network Services", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.hostingdunyam.com.tr"}, "pfx": 38, "reg": "2020-12-07", "rir": "ripencc", "s24": 38, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 9728, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0013448540098}, {"a": 212228, "h": "servinga-UK", "n": "servinga GmbH", "t": "Other", "w": 3, "cc": "DE", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6453, "hi": 7.73, "lo": 1.36, "ips": 3, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 0.012, 24.384, 1, false], ["2026-10-12", 0.012, 24.434, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 24.434, "se": 1.012, "ts": 1.000, "map": 93.456, "obs": 3, "own": 82.794, "comp": {"urlhaus": -0.3477, "threatfox": -0.3008, "phishing_db": 6.8122}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.644, "det": null, "oid": "ORG-SG288-RIPE", "org": "servinga GmbH", "pdb": null, "pfx": 6, "reg": "2020-12-02", "rir": "ripencc", "s24": 6, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212238, "h": "CDNEXT", "n": "Datacamp Limited", "t": "Hosting & VPS", "w": 1090, "cc": "GB", "cf": {"rb": "", "wb": "", "rep": 1.27, "waf": 1.21}, "cs": {"c": {"http_flood": 690, "data_centre": 255, "web_exploit": 836, "bad_crawling": 451, "proxy_or_vpn": 940, "first_seen_30d": 8, "ssh_bruteforce": 107, "web_bruteforce": 885, "home_connection": 66, "mail_bruteforce": 180, "cve:CVE-2017-9841": 392, "cve:CVE-2017-16894": 143, "cve:CVE-2018-20062": 132, "cve:CVE-2019-17050": 130, "cve:CVE-2023-49103": 128}, "n": 940}, "ev": {"cins": {"n": 8, "p": 0.5610, "hi": 5.26, "lo": 1.71, "ips": 15, "mean": 3.28, "above": false}, "shodan": {"n": 11, "p": 0.0001, "hi": 1.86, "lo": 0.71, "ips": 11, "mean": 1.22, "above": false}, "dshield": {"n": 42, "p": 1.0000, "hi": 16.84, "lo": 10.17, "ips": 48, "mean": 13.33, "above": true}, "crowdsec": {"n": 163, "p": 1.0000, "hi": 15.52, "lo": 12.00, "ips": 940, "mean": 13.71, "above": true}, "threatfox": {"n": 6, "p": 0.7768, "hi": 7.25, "lo": 2.01, "ips": 8, "mean": 4.29, "above": false}, "vulncheck": {"n": 16, "p": 0.9824, "hi": 7.68, "lo": 3.42, "ips": 31, "mean": 5.37, "above": true}, "phishing_db": {"n": 7, "p": 0.3186, "hi": 4.36, "lo": 1.32, "ips": 10, "mean": 2.65, "above": false}, "blocklist_de": {"n": 37, "p": 1.0000, "hi": 8.98, "lo": 5.25, "ips": 58, "mean": 7.01, "above": true}}, "h2": [["2026-10-05", 6.424, 0.735, 0, false], ["2026-10-12", 6.525, 0.616, 0, false]], "sh": false, "uc": 66.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 6, "phishing_db": 7}, "lo": 0.616, "se": 0.874, "ts": 0.538, "map": 1.447, "obs": 13, "own": 0.606, "comp": {"urlhaus": -1.8121, "threatfox": 1.7759, "phishing_db": 2.0321}, "mass": 9.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 8, "dshield": 42, "crowdsec": 163, "vulncheck": 16, "blocklist_de": 37}, "lo": 6.525, "se": 0.354, "ts": 0.613, "map": 9.494, "obs": 266, "own": 1.854, "comp": {"cins": -0.9413, "dshield": 2.2944, "crowdsec": 8.338, "vulncheck": -0.5494, "blocklist_de": -5.4973}, "mass": 215.9, "listed": false}}, "abq": false, "bot": 0.493, "det": {"shodan": {"c2": 1, "compromised": 10}, "threatfox": {"family:DCRat": 2, "family:Remcos": 3, "family:AdaptixC2": 2, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 3, "botnet_node": 28}, "blocklist_de": {"ftp": 2, "ssh": 5, "bots": 29, "imap": 10, "mail": 13, "apache": 9, "bruteforcelogin": 3}}, "oid": "ORG-DL201-RIPE", "org": "Datacamp Limited", "pdb": null, "pfx": 3581, "reg": "2020-12-02", "rir": "ripencc", "s24": 4124, "sib": 3, "tor": 0, "w24": 235, "drop": 7, "hist": [["2026-10-05", 0.9980], ["2026-10-12", 0.8493]], "ipv4": 1058560, "abuse": null, "score": 0.8493, "groups": ["sensors", "vulncheck"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 0.432606}, {"a": 212241, "h": "threefold", "n": "TF Tech NV", "t": "Other", "w": 0, "cc": "BE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.716, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TTN4-RIPE", "org": "TF Tech NV", "pdb": null, "pfx": 2, "reg": "2020-12-02", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212271, "h": "C1V", "n": "C1V hosting", "t": "Hosting & VPS", "w": 4, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 3, "web_exploit": 4, "bad_crawling": 4, "ssh_bruteforce": 1, "web_bruteforce": 4, "cve:CVE-2024-0012": 3, "cve:CVE-2025-30208": 4, "cve:CVE-2025-54236": 3, "cve:CVE-2026-60137": 2}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.4090, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 3, "p": 0.6294, "hi": 7.55, "lo": 1.33, "ips": 4, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 9.021, 0.011, 0, false], ["2026-10-12", 9.610, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.610, "se": 0.797, "ts": 1.000, "map": 31.733, "obs": 3, "own": 6.332, "comp": {"cins": -0.4002, "dshield": -0.8273, "crowdsec": 8.7323, "vulncheck": -0.6037, "blocklist_de": -2.0501}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.852, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:XWorm": 1}}, "oid": "ORG-CTTA1-RIPE", "org": "Cinzia Tocci trading as Lumanex Srl", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://www.c1vhosting.it/"}, "pfx": 3, "reg": "2020-11-26", "rir": "ripencc", "s24": 10, "sib": 3, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027474389375}, {"a": 212317, "h": "HETZNER-CLOUD3-AS", "n": "Hetzner Online Cloud 3", "t": "Hosting & VPS", "w": 7, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 4, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1}, "n": 4}, "ev": {"shodan": {"n": 36, "p": 1.0000, "hi": 30.73, "lo": 17.84, "ips": 36, "mean": 23.92, "above": true}, "crowdsec": {"n": 4, "p": 0.4333, "hi": 5.45, "lo": 1.17, "ips": 4, "mean": 2.98, "above": false}, "vulncheck": {"n": 3, "p": 0.5577, "hi": 6.84, "lo": 1.20, "ips": 3, "mean": 3.53, "above": false}}, "h2": [["2026-10-05", 3.853, 0.010, 0, false], ["2026-10-12", 1.390, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.160, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 3, "blocklist_de": 0}, "lo": 1.390, "se": 0.565, "ts": 0.571, "map": 2.930, "obs": 7, "own": 0.584, "comp": {"cins": -0.843, "dshield": -1.4877, "crowdsec": 6.2663, "vulncheck": 2.7352, "blocklist_de": -4.2022}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.974, "det": {"shodan": {"c2": 5, "compromised": 28, "doublepulsar": 3}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1, "attack_tooling": 1}}, "oid": "ORG-HOA1-RIPE", "org": "Hetzner Online GmbH", "pdb": {"t": "Content", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.hetzner.com"}, "pfx": 206, "reg": "2022-05-09", "rir": "ripencc", "s24": 256, "sib": 3, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 119808, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.01326962748854}, {"a": 212336, "h": "BYTEVIRTLLC", "n": "ByteVirt LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "threatfox": {"n": 1, "p": 0.1964, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.010, 0.424, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.424, "se": 1.524, "ts": 1.000, "map": 4.114, "obs": 1, "own": 4.901, "comp": {"urlhaus": -0.1105, "threatfox": 3.4007, "phishing_db": -0.2497}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.475, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-BL604-RIPE", "org": "ByteVirt LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://bytevirt.com"}, "pfx": 33, "reg": "2025-07-22", "rir": "ripencc", "s24": 40, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0013834610953}, {"a": 212369, "h": "tamm", "n": "Tem Technology Communication Services and Electronic System Co. LTD", "t": "Other", "w": 0, "cc": "IQ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false]], "sh": false, "uc": null, "v2": null, "abq": false, "bot": null, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-TA1952-RIPE", "org": "Tem Technology Communication Services and Electronic System Co. LTD", "pdb": null, "pfx": 2, "reg": "2025-12-29", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212416, "h": "Proximity", "n": "Proximity", "t": "Other", "w": 26, "cc": "BG", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6455, "hi": 7.73, "lo": 1.36, "ips": 26, "mean": 3.99, "above": false}}, "h2": [["2026-10-05", 4.449, 0.011, 0, false], ["2026-10-12", 9.592, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 9.592, "se": 0.834, "ts": 1.000, "map": 32.420, "obs": 3, "own": 19.562, "comp": {"cins": -0.2138, "dshield": -0.4764, "crowdsec": -1.8826, "vulncheck": 8.5533, "blocklist_de": -1.1081}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.704, "det": {"vulncheck": {"botnet_node": 26}}, "oid": "ORG-PE86-RIPE", "org": "Proximity EOOD", "pdb": null, "pfx": 5, "reg": "2020-11-04", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212477, "h": "ROYALE-AS", "n": "RoyaleHosting", "t": "Hosting & VPS", "w": 10, "cc": "NL", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "home_connection": 1, "cve:CVE-2026-75650": 1}, "n": 3}, "ev": {"shodan": {"n": 6, "p": 0.8541, "hi": 8.24, "lo": 2.28, "ips": 6, "mean": 4.87, "above": true}, "crowdsec": {"n": 3, "p": 0.3201, "hi": 5.02, "lo": 0.88, "ips": 3, "mean": 2.59, "above": false}, "threatfox": {"n": 3, "p": 0.6261, "hi": 7.52, "lo": 1.32, "ips": 3, "mean": 3.88, "above": false}, "vulncheck": {"n": 2, "p": 0.3549, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "phishing_db": {"n": 1, "p": 0.1585, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}, "blocklist_de": {"n": 1, "p": 0.1200, "hi": 3.89, "lo": 0.29, "ips": 1, "mean": 1.64, "above": false}}, "h2": [["2026-10-05", 5.810, 2.378, 0, false], ["2026-10-12", 1.604, 2.210, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 1}, "lo": 2.210, "se": 0.944, "ts": 0.750, "map": 6.562, "obs": 4, "own": 2.509, "comp": {"urlhaus": -0.7246, "threatfox": 3.5716, "phishing_db": 0.6606}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 2, "blocklist_de": 1}, "lo": 1.604, "se": 0.590, "ts": 0.500, "map": 3.570, "obs": 6, "own": 0.712, "comp": {"cins": -0.8262, "dshield": -1.4663, "crowdsec": 3.4199, "vulncheck": 1.6102, "blocklist_de": -0.0714}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.887, "det": {"shodan": {"c2": 2, "compromised": 4}, "threatfox": {"family:AdaptixC2": 1, "family:Cobalt Strike": 1, "family:Unknown malware": 1}, "vulncheck": {"botnet_node": 1, "other_infrastructure": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-RB164-RIPE", "org": "RoyaleHosting BV", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://royalehosting.net"}, "pfx": 180, "reg": "2020-10-20", "rir": "ripencc", "s24": 205, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 54272, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00252461349426}, {"a": 212508, "h": "LOWHOSTING-AS", "n": "Lowhosting Services", "t": "Hosting & VPS", "w": 2, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 2, "cve:CVE-2024-28000": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 2.459, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.933, "det": null, "oid": "ORG-LNL30-RIPE", "org": "Lowhosting services of Davide Gennari", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://lowhosting.com/"}, "pfx": 5, "reg": "2020-10-14", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212512, "h": "DETAI", "n": "Detai Prosperous Technologies Limited", "t": "Other", "w": 48, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 5, "ssh_bruteforce": 8, "home_connection": 3, "mail_bruteforce": 2}, "n": 8}, "ev": {"cins": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 39, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 8, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 15.424, 0.011, 1, false], ["2026-10-12", 30.605, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 30.605, "se": 0.702, "ts": 0.250, "map": 84.320, "obs": 4, "own": 47.873, "comp": {"cins": 3.9188, "dshield": 2.3814, "crowdsec": -1.0517, "vulncheck": -0.7114, "blocklist_de": 1.2913}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.809, "det": {"blocklist_de": {"ssh": 3}}, "oid": "ORG-DPTL6-RIPE", "org": "Detai Prosperous Technologies Limited", "pdb": null, "pfx": 6, "reg": "2025-04-23", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212531, "h": "Interneto-vizija", "n": "UAB \"Interneto vizija\"", "t": "Other", "w": 4, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 3, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 9, "p": 0.9919, "hi": 11.78, "lo": 4.07, "ips": 9, "mean": 7.50, "above": true}, "crowdsec": {"n": 3, "p": 0.3873, "hi": 5.48, "lo": 0.97, "ips": 3, "mean": 2.83, "above": false}, "phishing_db": {"n": 1, "p": 0.1675, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1357, "hi": 4.06, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 1.693, 0.238, 0, false], ["2026-10-12", 1.523, 0.250, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.250, "se": 1.435, "ts": 1.000, "map": 1.971, "obs": 1, "own": 2.323, "comp": {"urlhaus": -0.2005, "threatfox": -0.2138, "phishing_db": 2.719}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.523, "se": 0.659, "ts": 0.750, "map": 3.855, "obs": 4, "own": 2.196, "comp": {"cins": -0.7021, "dshield": -1.2996, "crowdsec": 4.8002, "vulncheck": -0.747, "blocklist_de": 0.6915}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.942, "det": {"shodan": {"c2": 3, "compromised": 6}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-UV2-RIPE", "org": "UAB \"Interneto vizija\"", "pdb": null, "pfx": 17, "reg": "2021-04-07", "rir": "ripencc", "s24": 156, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 39936, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0018771099435}, {"a": 212552, "h": "BitCommand", "n": "BitCommand LLC", "t": "Other", "w": 9, "cc": "AM", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 6, "web_bruteforce": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 7}, "ev": {"shodan": {"n": 35, "p": 1.0000, "hi": 41.52, "lo": 23.92, "ips": 35, "mean": 32.21, "above": true}, "crowdsec": {"n": 7, "p": 0.9756, "hi": 11.47, "lo": 3.47, "ips": 7, "mean": 6.98, "above": true}, "blocklist_de": {"n": 3, "p": 0.6077, "hi": 7.32, "lo": 1.29, "ips": 3, "mean": 3.78, "above": false}}, "h2": [["2026-10-05", 14.839, 0.011, 1, false], ["2026-10-12", 14.880, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.630, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 3}, "lo": 14.880, "se": 0.488, "ts": 0.700, "map": 27.957, "obs": 10, "own": 15.701, "comp": {"cins": -1.4425, "dshield": -2.1247, "crowdsec": 6.386, "vulncheck": -0.8909, "blocklist_de": 2.7965}, "mass": 8.5, "listed": false}}, "abq": false, "bot": 0.714, "det": {"shodan": {"compromised": 35}, "blocklist_de": {"ssh": 2, "bots": 1}}, "oid": "ORG-BL465-RIPE", "org": "BitCommand LLC", "pdb": null, "pfx": 55, "reg": "2020-10-06", "rir": "ripencc", "s24": 55, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 14080, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00105674336972}, {"a": 212600, "h": "newnet-samara", "n": "newnet-samara", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-LNN1-RIPE", "org": "LLC NEW NETWORK", "pdb": null, "pfx": 1, "reg": "2020-09-28", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212607, "h": "POUYANIT-AS", "n": "Saeid Shahrokhi", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.594, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SS1126-RIPE", "org": "Saeid Shahrokhi", "pdb": null, "pfx": 5, "reg": "2020-09-24", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000549886365}, {"a": 212616, "h": "KMA-Technology", "n": "K.M.A ADVANCED TECHNOLOGIES", "t": "Broadband & mobile", "w": 1, "cc": "IL", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1824, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.200, 0.011, 0, false], ["2026-10-12", 0.160, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.023, "ts": null, "map": 0.187, "obs": 0, "own": 1.459, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.160, "se": 1.217, "ts": 1.000, "map": 1.123, "obs": 1, "own": 2.021, "comp": {"cins": -0.1122, "dshield": -0.2612, "crowdsec": -1.0341, "vulncheck": 3.5028, "blocklist_de": -0.5855}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-KTCL1-RIPE", "org": "K.M.A ADVANCED TECHNOLOGIES LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.kma.net.il"}, "pfx": 42, "reg": "2021-10-25", "rir": "ripencc", "s24": 74, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24320, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00158532552214}, {"a": 212651, "h": "D-CONECT-AS", "n": "D-CONECT LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-DL437-RIPE", "org": "D-CONECT LLC", "pdb": null, "pfx": 4, "reg": "2020-09-16", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212653, "h": "HOSTERFY", "n": "HOSTERFY", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.783, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NS598-RIPE", "org": "NETFY SARL", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.hosterfy.com/fr"}, "pfx": 3, "reg": "2020-09-15", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212700, "h": "it-totalconn", "n": "Totalconn", "t": "Broadband & mobile", "w": 3, "cc": "IT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 4.887, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.887, "se": 1.042, "ts": 1.000, "map": 24.402, "obs": 2, "own": 41.752, "comp": {"cins": -0.1312, "dshield": -0.3028, "crowdsec": -1.1987, "vulncheck": 6.9048, "blocklist_de": -0.6838}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.225, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-TS466-RIPE", "org": "In Aria! Italia Srl", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://totalconn.com"}, "pfx": 3, "reg": "2020-09-07", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212706, "h": "LIVI-HOSTING-AS", "n": "LIVI HOSTING LTD", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1640, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "phishing_db": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.010, 0.423, 0, false], ["2026-10-12", 0.010, 0.440, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.440, "se": 1.531, "ts": 1.000, "map": 4.362, "obs": 1, "own": 1.981, "comp": {"urlhaus": -0.1169, "threatfox": -0.1437, "phishing_db": 3.3596}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.446, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LHL20-RIPE", "org": "LIVI HOSTING LTD", "pdb": null, "pfx": 40, "reg": "2026-02-18", "rir": "ripencc", "s24": 40, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010291405831}, {"a": 212743, "h": "ETERNITY-AS", "n": "Gleb Didenco", "t": "Other", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3924, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "urlhaus": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.712, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.712, "se": 1.684, "ts": 1.000, "map": 9.055, "obs": 1, "own": 12.376, "comp": {"urlhaus": 4.2779, "threatfox": -0.1586, "phishing_db": -0.2899}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.992, "ts": null, "map": 0.215, "obs": 0, "own": 0.386, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.522, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Unknown Loader": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-EIL20-RIPE", "org": "ETERNITY INTERNATIONAL LIMITED", "pdb": null, "pfx": 20, "reg": "2025-09-23", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004433999126}, {"a": 212835, "h": "SHESTERNIN-AS", "n": "Shesternin Vladimir Anatolievich", "t": "Other", "w": 13, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 9, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 2, "cve:CVE-2026-87902": 1}, "n": 12}, "ev": {"crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 12, "mean": 2.98, "above": false}, "threatfox": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 112.520, 0.911, 1, false], ["2026-10-12", 80.006, 0.938, 1, false]], "sh": false, "uc": 15625, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.938, "se": 1.811, "ts": 1.000, "map": 14.132, "obs": 1, "own": 23.079, "comp": {"urlhaus": -0.0195, "threatfox": 4.3458, "phishing_db": -0.0516}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 80.006, "se": 0.717, "ts": 0.500, "map": 226.094, "obs": 4, "own": 128.133, "comp": {"cins": -0.5493, "dshield": -1.0737, "crowdsec": 3.0442, "vulncheck": -0.6869, "blocklist_de": 6.0803}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.957, "det": {"threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SVA71-RIPE", "org": "Shesternin Vladimir Anatolievich", "pdb": null, "pfx": 2, "reg": "2025-07-09", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212849, "h": "jctecnics", "n": "J.C. TECNICS, S.L.", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 8420.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.148, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-JTS12-RIPE", "org": "J.C. TECNICS, S.L.", "pdb": null, "pfx": 6, "reg": "2020-07-29", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212860, "h": "AIRNET-AS", "n": "AIRNET llc", "t": "Other", "w": 1, "cc": "UZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 9, "p": 0.9987, "hi": 15.38, "lo": 5.31, "ips": 9, "mean": 9.79, "above": true}, "vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.482, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.482, "se": 1.395, "ts": 1.000, "map": 4.736, "obs": 1, "own": 3.377, "comp": {"cins": -0.0646, "dshield": -0.1536, "crowdsec": -0.6088, "vulncheck": 4.1141, "blocklist_de": -0.3383}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.742, "det": {"shodan": {"compromised": 9}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-AL786-RIPE", "org": "AIRNET llc", "pdb": null, "pfx": 8, "reg": "2020-07-27", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0000761909436}, {"a": 212872, "h": "Serverio", "n": "Serverio technologijos MB", "t": "Hosting & VPS", "w": 0, "cc": "LT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.594, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-STM10-RIPE", "org": "Serverio technologijos MB", "pdb": null, "pfx": 11, "reg": "2020-07-24", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212904, "h": "Freshplanners", "n": "FRESHPLANNERS Sp. z o.o.", "t": "Other", "w": 0, "cc": "PL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-FSZO47-RIPE", "org": "FRESHPLANNERS Sp. z o.o.", "pdb": null, "pfx": 8, "reg": "2025-10-01", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 212939, "h": "Lamerdict", "n": "Lamerd Information & Communication Technology Co.,ltd", "t": "Other", "w": 2, "cc": "IR", "cf": null, "cs": {"c": {"web_bruteforce": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 9.067, 0.013, 0, false]], "sh": false, "uc": 26302.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.067, "se": 1.065, "ts": 1.000, "map": 49.793, "obs": 2, "own": 29.801, "comp": {"cins": -0.1977, "dshield": -0.4436, "crowdsec": 7.3833, "vulncheck": -0.4145, "blocklist_de": -1.026}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.633, "det": null, "oid": "ORG-LICT1-RIPE", "org": "Lamerd Information & Communication Technology Co.,ltd", "pdb": null, "pfx": 3, "reg": "2020-07-14", "rir": "ripencc", "s24": 3, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000901862355}, {"a": 212980, "h": "UAB-ATLANTIS-CAPITAL", "n": "Atlantis Capital, UAB", "t": "Hosting & VPS", "w": 74, "cc": "LT", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1838, "hi": 4.58, "lo": 0.34, "ips": 74, "mean": 1.93, "above": false}}, "h2": [["2026-10-12", 0.215, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.030, "ts": null, "map": 0.188, "obs": 0, "own": 0.232, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.215, "se": 1.238, "ts": 1.000, "map": 1.629, "obs": 1, "own": 0.362, "comp": {"cins": -0.1441, "dshield": 4.4206, "crowdsec": -1.3084, "vulncheck": -0.3367, "blocklist_de": -0.7501}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.997, "det": null, "oid": "ORG-UC68-RIPE", "org": "UAB \"Atlantis Capital\"", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://atlantisgames.lt/"}, "pfx": 23, "reg": "2025-07-02", "rir": "ripencc", "s24": 66, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16896, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000071832167}, {"a": 213010, "h": "GENING-AS", "n": "Gening Nikita Dmitrievich", "t": "Other", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-87902": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 26.498, 0.011, 1, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-GND3-RIPE", "org": "Gening Nikita Dmitrievich", "pdb": null, "pfx": 3, "reg": "2025-03-18", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213035, "h": "AS-SERVERION", "n": "Serverion", "t": "Hosting & VPS", "w": 1, "cc": "NL", "cf": null, "cs": {"c": {"web_exploit": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 1.309, 0.011, 0, false], ["2026-10-12", 0.376, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.285, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.376, "se": 1.331, "ts": 1.000, "map": 3.394, "obs": 1, "own": 0.785, "comp": {"cins": -0.11, "dshield": -0.2563, "crowdsec": 3.8337, "vulncheck": -0.2774, "blocklist_de": -0.5742}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.843, "det": null, "oid": "ORG-DCB8-RIPE", "org": "Des Capital B.V.", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.serverion.com"}, "pfx": 24, "reg": "2020-06-25", "rir": "ripencc", "s24": 24, "sib": 1, "tor": 0, "w24": 1, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213038, "h": "DREAMVPS", "n": "DREAM VPS LTD", "t": "Hosting & VPS", "w": 0, "cc": "IL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.303, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.889, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-LSSL4-RIPE", "org": "DREAM VPS LTD", "pdb": null, "pfx": 17, "reg": "2020-06-24", "rir": "ripencc", "s24": 17, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005869803394}, {"a": 213062, "h": "HELIOS-IT", "n": "Helios Kliniken GmbH", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.353, "det": {"shodan": {"doublepulsar": 2}}, "oid": "ORG-HKG2-RIPE", "org": "Helios Kliniken GmbH", "pdb": null, "pfx": 6, "reg": "2020-06-19", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213081, "h": "ungleich-place10", "n": "ungleich glarus ag", "t": "Other", "w": 0, "cc": "CH", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.707, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-UGA8-RIPE", "org": "ungleich glarus ag", "pdb": null, "pfx": 4, "reg": "2020-06-16", "rir": "ripencc", "s24": 5, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213122, "h": "HYONIX", "n": "Hyonix (Legacy)", "t": "Transit & backbone", "w": 7, "cc": "SG", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2022-39290": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3572, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "threatfox": {"n": 5, "p": 0.9143, "hi": 10.45, "lo": 2.60, "ips": 5, "mean": 5.96, "above": true}}, "h2": [["2026-10-05", 1.280, 5.295, 0, false], ["2026-10-12", 1.359, 11.758, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 0}, "lo": 11.758, "se": 0.868, "ts": 1.000, "map": 32.089, "obs": 5, "own": 103.750, "comp": {"urlhaus": -0.6849, "threatfox": 6.5904, "phishing_db": -0.8108}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.359, "se": 0.935, "ts": 1.000, "map": 5.783, "obs": 2, "own": 18.821, "comp": {"cins": -0.292, "dshield": -0.63, "crowdsec": 6.0945, "vulncheck": -0.5181, "blocklist_de": -1.5059}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.833, "det": {"threatfox": {"family:PureRAT": 3, "family:Evilginx": 1, "family:Unknown RAT": 1}}, "oid": "ORG-KPL9-RIPE", "org": "Krixe Pte. Ltd.", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://hyonix.com/"}, "pfx": 39, "reg": "2020-06-08", "rir": "ripencc", "s24": 39, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.1060]], "ipv4": 9984, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": null}, {"a": 213155, "h": "YETTEL-HU", "n": "Yettel Hungary Ltd.", "t": "Other", "w": 4, "cc": "HU", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0006, "hi": 1.70, "lo": 0.30, "ips": 3, "mean": 0.87, "above": false}, "blocklist_de": {"n": 2, "p": 0.0232, "hi": 2.58, "lo": 0.34, "ips": 2, "mean": 1.23, "above": false}}, "h2": [["2026-10-05", 0.283, 0.008, 0, false], ["2026-10-12", 0.305, 0.009, 0, false]], "sh": false, "uc": 57.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.009, "se": 1.814, "ts": null, "map": 0.120, "obs": 0, "own": 0.234, "comp": null, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.305, "se": 0.595, "ts": 0.600, "map": 0.685, "obs": 5, "own": 0.391, "comp": {"cins": -0.9925, "dshield": -1.669, "crowdsec": 1.7466, "vulncheck": -0.8228, "blocklist_de": 2.7534}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.083, "det": {"blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-PGTP1-RIPE", "org": "Yettel Hungary Ltd.", "pdb": null, "pfx": 7, "reg": "2020-05-29", "rir": "ripencc", "s24": 1344, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 344064, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01291089743016}, {"a": 213166, "h": "UA-HOSTING", "n": "UA-Hosting SIA", "t": "Hosting & VPS", "w": 3, "cc": "LV", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.820, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.820, "se": 1.527, "ts": 1.000, "map": 10.128, "obs": 1, "own": 2.760, "comp": {"cins": -0.0417, "dshield": -0.1001, "crowdsec": -0.3969, "vulncheck": 4.4661, "blocklist_de": -0.2185}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.998, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-US101-RIPE", "org": "UA-Hosting SIA", "pdb": null, "pfx": 3, "reg": "2020-05-27", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213169, "h": "Catixs-Edge", "n": "Catixs Edge Network", "t": "Enterprise, edu & gov", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3910, "hi": 6.00, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 3.141, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 3.752, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.482, "det": {"shodan": {"c2": 2}}, "oid": "ORG-CL826-RIPE", "org": "Catixs Ltd", "pdb": {"t": "Enterprise", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://catixs.net"}, "pfx": 10, "reg": "2022-01-17", "rir": "ripencc", "s24": 23, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000380854553}, {"a": 213173, "h": "NSP_LLC", "n": "NSP LLC", "t": "Other", "w": 0, "cc": "KG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.786, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NL447-RIPE", "org": "NSP LLC", "pdb": null, "pfx": 4, "reg": "2020-05-26", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001520545278}, {"a": 213186, "h": "AYSTOR", "n": "Yanoor Islam Khan", "t": "Other", "w": 7, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 3, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2002-1131": 1, "cve:CVE-2007-0885": 1, "cve:CVE-2009-1558": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 3, "p": 0.6347, "hi": 7.61, "lo": 1.34, "ips": 5, "mean": 3.93, "above": false}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 12.643, 20.455, 1, false], ["2026-10-12", 24.506, 7.237, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 7.237, "se": 1.227, "ts": 0.500, "map": 42.068, "obs": 2, "own": 39.935, "comp": {"urlhaus": -0.1925, "threatfox": 2.7844, "phishing_db": 2.7736}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 24.506, "se": 0.696, "ts": 0.750, "map": 67.103, "obs": 4, "own": 38.055, "comp": {"cins": -0.5679, "dshield": -1.1025, "crowdsec": 6.4368, "vulncheck": -0.6953, "blocklist_de": 1.5289}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.708, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-YIK1-RIPE", "org": "Yanoor Islam Khan", "pdb": null, "pfx": 8, "reg": "2020-05-25", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213200, "h": "FZink", "n": "Ferdinand Zink trading as Tube-Hosting", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.983, "det": null, "oid": "ORG-FZTA2-RIPE", "org": "Ferdinand Zink trading as Tube-Hosting", "pdb": null, "pfx": 6, "reg": "2023-01-03", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005463370274}, {"a": 213220, "h": "DATA-DELTA-AS", "n": "Datacheap.ru (Delta Ltd)", "t": "Other", "w": 4, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 1}, "n": 4}, "ev": {"shodan": {"n": 2, "p": 0.3566, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "crowdsec": {"n": 4, "p": 0.7459, "hi": 8.10, "lo": 1.74, "ips": 4, "mean": 4.42, "above": false}}, "h2": [["2026-10-05", 3.864, 0.011, 0, false], ["2026-10-12", 4.063, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.063, "se": 0.670, "ts": 1.000, "map": 10.483, "obs": 4, "own": 5.956, "comp": {"cins": -0.6138, "dshield": -1.172, "crowdsec": 9.3468, "vulncheck": -0.7147, "blocklist_de": -3.1029}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.378, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-DL98-RIPE", "org": "Delta Ltd", "pdb": null, "pfx": 45, "reg": "2020-05-18", "rir": "ripencc", "s24": 49, "sib": 0, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12800, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00141482261305}, {"a": 213229, "h": "MITELIS", "n": "MITELIS", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "ORG-MSL55-RIPE", "org": "MITELIS SECURITY LIMITED", "pdb": {"t": null, "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://mitelis.net"}, "pfx": 6, "reg": "2025-06-26", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213230, "h": "HETZNER-CLOUD2-AS", "n": "Hetzner Online Cloud 2", "t": "Hosting & VPS", "w": 22, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 4, "web_exploit": 3, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 4, "home_connection": 3, "router_or_botnet": 1}, "n": 7}, "ev": {"shodan": {"n": 38, "p": 1.0000, "hi": 23.79, "lo": 14.01, "ips": 38, "mean": 18.63, "above": true}, "crowdsec": {"n": 7, "p": 0.5864, "hi": 5.57, "lo": 1.69, "ips": 7, "mean": 3.39, "above": false}, "vulncheck": {"n": 9, "p": 0.9941, "hi": 12.38, "lo": 4.28, "ips": 10, "mean": 7.88, "above": true}, "phishing_db": {"n": 4, "p": 0.6774, "hi": 7.32, "lo": 1.58, "ips": 4, "mean": 4.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.0542, "hi": 3.06, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}}, "h2": [["2026-10-05", 3.826, 1.119, 0, false], ["2026-10-12", 1.819, 1.138, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 1.138, "se": 0.958, "ts": 1.000, "map": 3.339, "obs": 4, "own": 1.326, "comp": {"urlhaus": -0.8678, "threatfox": -0.4504, "phishing_db": 4.15}, "mass": 2.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 9, "blocklist_de": 1}, "lo": 1.819, "se": 0.462, "ts": 0.529, "map": 3.193, "obs": 17, "own": 0.631, "comp": {"cins": -1.5031, "dshield": -2.1775, "crowdsec": 5.6478, "vulncheck": 4.6226, "blocklist_de": -4.0351}, "mass": 9.1, "listed": false}}, "abq": false, "bot": 0.970, "det": {"shodan": {"c2": 4, "malware": 2, "compromised": 30, "doublepulsar": 2}, "vulncheck": {"c2_server": 8, "botnet_node": 1, "attack_tooling": 1}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-HOA1-RIPE", "org": "Hetzner Online GmbH", "pdb": {"t": "Content", "sc": "North America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.hetzner.com"}, "pfx": 390, "reg": "2020-05-14", "rir": "ripencc", "s24": 512, "sib": 3, "tor": 0, "w24": 21, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8435]], "ipv4": 233472, "abuse": null, "score": 0.8435, "groups": ["vulncheck", "shodan"], "sensors": [], "traffic": 0.03584347395774}, {"a": 213250, "h": "ITP-SOLUTIONS", "n": "ITP-SOLUTIONS", "t": "Hosting & VPS", "w": 6, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 5, "bad_crawling": 4, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"shodan": {"n": 4, "p": 0.7565, "hi": 8.24, "lo": 1.77, "ips": 4, "mean": 4.50, "above": false}, "crowdsec": {"n": 5, "p": 0.8687, "hi": 9.24, "lo": 2.30, "ips": 5, "mean": 5.27, "above": true}, "threatfox": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.834, 4.219, 0, false], ["2026-10-12", 5.404, 0.382, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.382, "se": 1.504, "ts": 1.000, "map": 3.552, "obs": 1, "own": 1.615, "comp": {"urlhaus": -0.1235, "threatfox": 3.2907, "phishing_db": -0.2735}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.404, "se": 0.611, "ts": 1.000, "map": 12.596, "obs": 5, "own": 2.482, "comp": {"cins": -0.7541, "dshield": -1.3712, "crowdsec": 10.5957, "vulncheck": -0.7636, "blocklist_de": -3.7798}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.862, "det": {"shodan": {"c2": 1, "compromised": 3}, "threatfox": {"family:Evilginx": 1}}, "oid": "ORG-DSTA4-RIPE", "org": "Dominic Scholz trading as ITP-Solutions GmbH & Co. KG", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://itp-solutions.de/"}, "pfx": 32, "reg": "2020-05-11", "rir": "ripencc", "s24": 52, "sib": 0, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0010526380836}, {"a": 213251, "h": "de-Metaliance-GRA", "n": "Netherlands", "t": "Hosting & VPS", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 2, "p": 0.4182, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 21.744, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 2}, "lo": 21.744, "se": 0.717, "ts": 0.500, "map": 60.789, "obs": 4, "own": 12.190, "comp": {"cins": -0.5207, "dshield": -1.0285, "crowdsec": -0.3457, "vulncheck": 1.0945, "blocklist_de": 6.3015}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.716, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-MAZT1-RIPE", "org": "Marcel Andrew Zaiser trading as Metaliance ISP Systems e.k", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://metaliance.net"}, "pfx": 6, "reg": "2020-05-11", "rir": "ripencc", "s24": 7, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213274, "h": "VERINOMI", "n": "VERINOMI", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.949, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VBTS3-RIPE", "org": "Verinomi Bilisim Tek. San. ve Tic. Ltd. Sti.", "pdb": {"t": "Content", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.verinomi.com/"}, "pfx": 4, "reg": "2020-05-06", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000594013838}, {"a": 213282, "h": "ADAHOST", "n": "Ada Yüksek Teknoloji Limited Şirketi", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.755, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-AYTL1-RIPE", "org": "Ada Yuksek Teknoloji Limited Sirketi", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "No", "web": "https://adahost.net/"}, "pfx": 5, "reg": "2025-02-18", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005724411705}, {"a": 213354, "h": "International-Hosting-Solutions-AS", "n": "INTERNATIONAL HOSTING SOLUTIONS LLP", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 3, "first_seen_30d": 1, "web_bruteforce": 3, "cve:CVE-2013-3827": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-44228": 1, "cve:CVE-2022-22956": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3987, "hi": 6.07, "lo": 0.79, "ips": 3, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 2.770, 0.011, 0, false], ["2026-10-12", 2.979, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.312, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.979, "se": 0.981, "ts": 1.000, "map": 13.829, "obs": 2, "own": 2.840, "comp": {"cins": -0.253, "dshield": -0.5546, "crowdsec": 6.6153, "vulncheck": -0.4793, "blocklist_de": -1.308}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.882, "det": null, "oid": "ORG-IHSL4-RIPE", "org": "INTERNATIONAL HOSTING SOLUTIONS LLP", "pdb": null, "pfx": 6, "reg": "2020-04-17", "rir": "ripencc", "s24": 14, "sib": 1, "tor": 5, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213369, "h": "SFERA-AS", "n": "Sfera Telecom LLC", "t": "Broadband & mobile", "w": 1, "cc": "RU", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-STL162-RIPE", "org": "Sfera Telecom LLC", "pdb": null, "pfx": 4, "reg": "2020-04-15", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213373, "h": "IPCONNECT", "n": "IPCONNECT", "t": "Hosting & VPS", "w": 3, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2020-5902": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "urlhaus": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 8.102, 0.773, 0, false], ["2026-10-12", 3.328, 0.817, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.817, "se": 1.744, "ts": 1.000, "map": 11.267, "obs": 1, "own": 6.405, "comp": {"urlhaus": 4.3787, "threatfox": -0.1177, "phishing_db": -0.2129}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.328, "se": 0.988, "ts": 1.000, "map": 15.748, "obs": 2, "own": 3.238, "comp": {"cins": -0.2473, "dshield": -0.5434, "crowdsec": 6.6931, "vulncheck": -0.4732, "blocklist_de": -1.2789}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.960, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ICI6-RIPE", "org": "IP Connect Inc", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://ipconnect.services"}, "pfx": 12, "reg": "2020-04-14", "rir": "ripencc", "s24": 12, "sib": 2, "tor": 1, "w24": 2, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00064349481734}, {"a": 213388, "h": "IIC-AS", "n": "Miguel Viegas", "t": "Other", "w": 13, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 7, "ssh_bruteforce": 5, "web_bruteforce": 6, "cve:CVE-2025-0282": 1, "cve:CVE-2025-5777": 1, "cve:CVE-2025-22457": 1}, "n": 12}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 12, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 19.114, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 19.114, "se": 1.138, "ts": 0.500, "map": 120.995, "obs": 2, "own": 73.706, "comp": {"cins": -0.1615, "dshield": 4.3289, "crowdsec": 3.226, "vulncheck": -0.3639, "blocklist_de": -0.84}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.991, "det": null, "oid": "ORG-IA2168-RIPE", "org": "IIC RAIL LIMITED", "pdb": null, "pfx": 1, "reg": "2025-09-11", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213389, "h": "ASPODOLSK", "n": "Podolskie opticheskie seti Ltd.", "t": "Broadband & mobile", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.295, "det": null, "oid": "ORG-PODO2-RIPE", "org": "Podolskie opticheskie seti Ltd.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "http://netip.com.ua/"}, "pfx": 3, "reg": "2020-04-07", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213412, "h": "ONYPHE", "n": "ONYPHE SAS", "t": "Other", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 49140.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.959, "det": null, "oid": "ORG-OS381-RIPE", "org": "ONYPHE SAS", "pdb": null, "pfx": 5, "reg": "2025-02-14", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213426, "h": "ONEFIREHOSTING", "n": "Danny Lotz", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.873, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DL605-RIPE", "org": "Danny Lotz", "pdb": null, "pfx": 3, "reg": "2025-02-13", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213438, "h": "colocatel-inc", "n": "colocatel-inc", "t": "Hosting & VPS", "w": 18, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 6, "web_exploit": 6, "bad_crawling": 6, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 7, "home_connection": 1, "cve:CVE-2024-0012": 2, "cve:CVE-2024-28000": 2, "cve:CVE-2024-48914": 3, "cve:CVE-2025-30208": 2, "cve:CVE-2026-63030": 2}, "n": 11}, "ev": {"dshield": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "urlhaus": {"n": 1, "p": 0.1983, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 9, "p": 0.9984, "hi": 14.91, "lo": 5.15, "ips": 11, "mean": 9.50, "above": true}, "threatfox": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 4, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 61.757, 5.310, 1, false], ["2026-10-12", 41.296, 12.457, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 12.457, "se": 1.041, "ts": 0.667, "map": 47.892, "obs": 3, "own": 17.403, "comp": {"urlhaus": 3.2597, "threatfox": 2.9696, "phishing_db": -0.7342}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 1}, "lo": 41.296, "se": 0.468, "ts": 0.750, "map": 75.264, "obs": 12, "own": 14.683, "comp": {"cins": -1.4218, "dshield": 0.0549, "crowdsec": 10.8864, "vulncheck": -0.229, "blocklist_de": -3.5757}, "mass": 8.3, "listed": false}}, "abq": false, "bot": 0.929, "det": {"threatfox": {"family:PureRAT": 1, "family:Cobalt Strike": 1}, "vulncheck": {"botnet_node": 4}, "blocklist_de": {"bots": 1}}, "oid": "ORG-CI158-RIPE", "org": "ColocaTel Inc.", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://colocatel.com"}, "pfx": 19, "reg": "2025-02-11", "rir": "ripencc", "s24": 20, "sib": 0, "tor": 0, "w24": 12, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00749294038452}, {"a": 213441, "h": "SLAYER-AS", "n": "SLAYER GROUP LIMITED", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.879, "det": null, "oid": "ORG-SGL72-RIPE", "org": "SLAYER GROUP LIMITED", "pdb": null, "pfx": 3, "reg": "2025-02-10", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213455, "h": "ASN-ALFOLDNET", "n": "Alfold.NET Ltd.", "t": "Other", "w": 0, "cc": "HU", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4048, "hi": 6.13, "lo": 0.80, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.167, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-AL1025-RIPE", "org": "Alfold.NET Ltd.", "pdb": null, "pfx": 8, "reg": "2025-02-07", "rir": "ripencc", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006040096022}, {"a": 213474, "h": null, "n": "AS213474", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.955, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": null, "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213479, "h": "Cloupard-AS", "n": "Cloupard LLC", "t": "Other", "w": 0, "cc": "UZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.626, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CL771-RIPE", "org": "Cloupard LLC", "pdb": null, "pfx": 3, "reg": "2025-01-31", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000062114}, {"a": 213520, "h": "SENKO-AS", "n": "Senko Digital", "t": "Hosting & VPS", "w": 7, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2}, "n": 3}, "ev": {"shodan": {"n": 4, "p": 0.7267, "hi": 7.86, "lo": 1.69, "ips": 4, "mean": 4.29, "above": false}, "crowdsec": {"n": 3, "p": 0.5123, "hi": 6.44, "lo": 1.13, "ips": 3, "mean": 3.32, "above": false}, "threatfox": {"n": 3, "p": 0.6393, "hi": 7.66, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1818, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 7.396, 1.474, 0, false], ["2026-10-12", 2.269, 3.107, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 3.107, "se": 1.007, "ts": 1.000, "map": 10.665, "obs": 3, "own": 4.009, "comp": {"urlhaus": -0.4849, "threatfox": 5.1663, "phishing_db": -0.6881}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 0}, "lo": 2.269, "se": 0.680, "ts": 0.750, "map": 5.927, "obs": 4, "own": 1.187, "comp": {"cins": -0.5538, "dshield": -1.0806, "crowdsec": 6.6195, "vulncheck": 0.9979, "blocklist_de": -2.8099}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.472, "det": {"shodan": {"c2": 2, "compromised": 2}, "threatfox": {"family:AdaptixC2": 3}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-SDL38-RIPE", "org": "Senko Digital LLC", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://senko.digital"}, "pfx": 47, "reg": "2025-01-27", "rir": "ripencc", "s24": 77, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19712, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00256280740751}, {"a": 213529, "h": "SCULK-AS", "n": "Sculk Ltd", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6157, "hi": 7.41, "lo": 1.30, "ips": 3, "mean": 3.82, "above": false}, "vulncheck": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.290, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.324, "se": 1.319, "ts": 1.000, "map": 2.743, "obs": 1, "own": 0.655, "comp": {"cins": -0.0821, "dshield": -0.1935, "crowdsec": -0.7665, "vulncheck": 3.8738, "blocklist_de": -0.4289}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.860, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-SCLK1-RIPE", "org": "Sculk Ltd.", "pdb": {"t": "Network Services", "sc": "Europe", "tr": null, "pol": "Selective", "web": "https://sculk.ltd/"}, "pfx": 21, "reg": "2025-01-23", "rir": "ripencc", "s24": 22, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072883258245}, {"a": 213535, "h": "YOTTASRC", "n": "YOTTASRC", "t": "Hosting & VPS", "w": 6, "cc": "SA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2011-3600": 1, "cve:CVE-2012-3153": 1, "cve:CVE-2014-8739": 1}, "n": 2}, "ev": {"shodan": {"n": 14, "p": 1.0000, "hi": 19.47, "lo": 8.23, "ips": 14, "mean": 13.35, "above": true}, "crowdsec": {"n": 2, "p": 0.3278, "hi": 5.45, "lo": 0.71, "ips": 2, "mean": 2.60, "above": false}, "vulncheck": {"n": 2, "p": 0.4031, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "blocklist_de": {"n": 2, "p": 0.3827, "hi": 5.93, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}}, "h2": [["2026-10-05", 0.192, 0.011, 0, false], ["2026-10-12", 5.489, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 0.239, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 2}, "lo": 5.489, "se": 0.598, "ts": 0.333, "map": 12.402, "obs": 6, "own": 2.468, "comp": {"cins": -0.8147, "dshield": -1.4514, "crowdsec": 0.4663, "vulncheck": 1.6452, "blocklist_de": 4.0662}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.552, "det": {"shodan": {"c2": 6, "compromised": 8}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 1}}, "oid": "ORG-YA189-RIPE", "org": "YottaSrc", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://yottasrc.com/"}, "pfx": 58, "reg": "2025-01-22", "rir": "ripencc", "s24": 58, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 14848, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00400462110829}, {"a": 213541, "h": "ws-telecom-sdn", "n": "WS Telecom Inc", "t": "Broadband & mobile", "w": 10, "cc": "US", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 5.95}, "cs": {"c": {"web_exploit": 9, "proxy_or_vpn": 9, "first_seen_30d": 1, "web_bruteforce": 9}, "n": 9}, "ev": {"crowdsec": {"n": 4, "p": 0.2290, "hi": 4.26, "lo": 0.92, "ips": 9, "mean": 2.32, "above": false}, "blocklist_de": {"n": 1, "p": 0.0667, "hi": 3.24, "lo": 0.24, "ips": 1, "mean": 1.37, "above": false}}, "h2": [["2026-10-05", 0.786, 0.009, 0, false], ["2026-10-12", 0.814, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.902, "ts": null, "map": 0.156, "obs": 0, "own": 0.873, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.814, "se": 0.600, "ts": 0.800, "map": 1.851, "obs": 5, "own": 2.877, "comp": {"cins": -0.8894, "dshield": -1.5459, "crowdsec": 5.7, "vulncheck": -0.8, "blocklist_de": -0.455}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.571, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-WTI4-RIPE", "org": "WS Telecom Inc", "pdb": null, "pfx": 215, "reg": "2025-01-21", "rir": "ripencc", "s24": 433, "sib": 4, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 118784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02295007807097}, {"a": 213652, "h": "Sunucun-Cloud", "n": "Sunucun Bilgi Iletisim Teknolojileri ve Ticaret Ltd. Sti.", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.645, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SBIT4-RIPE", "org": "Sunucun Bilgi Iletisim Teknolojileri ve Ticaret Ltd. Sti.", "pdb": null, "pfx": 1, "reg": "2024-12-31", "rir": "ripencc", "s24": 1, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213654, "h": "AS209737", "n": "ESA LIVA Bilgi Teknolojileri San. Ve Tic. LTD. STI", "t": "Other", "w": 4, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "dshield": {"n": 2, "p": 0.4225, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 3.00, "above": false}, "urlhaus": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 12.054, 1.068, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 1.068, "se": 1.917, "ts": 1.000, "map": 16.822, "obs": 1, "own": 35.847, "comp": {"urlhaus": 4.5442, "threatfox": -0.0344, "phishing_db": -0.0609}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.054, "se": 1.091, "ts": 1.000, "map": 69.699, "obs": 2, "own": 41.949, "comp": {"cins": -0.1851, "dshield": 8.8321, "crowdsec": -1.6505, "vulncheck": -0.3976, "blocklist_de": -0.9611}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.923, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-ELBT1-RIPE", "org": "ESA LIVA Bilgi Teknolojileri San. Ve Tic. LTD. STI", "pdb": null, "pfx": 2, "reg": "2024-12-30", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213657, "h": "VPS-COM-TR---HOSTAVRUPA-NET", "n": "HZD TEKNOLOJI VE INOVASYON SAN. VE TIC. LTD. STI.", "t": "Hosting & VPS", "w": 1, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 1.763, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.804, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HTVI2-RIPE", "org": "HZD TEKNOLOJI VE INOVASYON SAN. VE TIC. LTD. STI.", "pdb": null, "pfx": 8, "reg": "2024-12-30", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001079190089}, {"a": 213665, "h": "ParminCloud-IaaS", "n": "PARMIN CLOUD COMPUTING LLC", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.357, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-PCCL4-RIPE", "org": "PARMIN CLOUD COMPUTING LLC", "pdb": null, "pfx": 6, "reg": "2024-12-27", "rir": "ripencc", "s24": 6, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000726483315}, {"a": 213683, "h": "host-al-asn", "n": "Host.AL", "t": "Hosting & VPS", "w": 0, "cc": "AL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.430, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HS382-RIPE", "org": "Host.AL Shpk", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://host.al"}, "pfx": 9, "reg": "2024-12-19", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000666197215}, {"a": 213693, "h": "IDPerformance-idhosting", "n": "Imad Nabil Daher trading as ID Performance", "t": "Hosting & VPS", "w": 1, "cc": "DK", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 24023.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.542, "det": null, "oid": "ORG-HI99-RIPE", "org": "Imad Nabil Daher trading as ID Performance", "pdb": null, "pfx": 2, "reg": "2024-12-18", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003747456329}, {"a": 213702, "h": "QWINS-LTD", "n": "QWINS LTD", "t": "Other", "w": 3, "cc": "GB", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 2, "p": 0.4225, "hi": 6.29, "lo": 0.82, "ips": 3, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.013, 15.276, 1, false], ["2026-10-12", 0.013, 15.363, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 15.363, "se": 1.298, "ts": 1.000, "map": 106.827, "obs": 2, "own": 99.590, "comp": {"urlhaus": -0.142, "threatfox": -0.1669, "phishing_db": 6.6063}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.456, "det": null, "oid": "ORG-QL189-RIPE", "org": "QWINS LTD", "pdb": null, "pfx": 2, "reg": "2024-12-17", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035483794864}, {"a": 213724, "h": "FnA", "n": "Maximum-Net LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.822, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.486, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.960, "det": null, "oid": "ORG-ML441-RIPE", "org": "Maximum-Net LLC", "pdb": null, "pfx": 13, "reg": "2024-12-10", "rir": "ripencc", "s24": 13, "sib": 2, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213732, "h": "PEP-AS", "n": "Peyman Ertebatat Pouya Company (Ltd)", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 2, "p": 0.4206, "hi": 6.27, "lo": 0.81, "ips": 3, "mean": 2.99, "above": false}, "dshield": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 11.229, 0.011, 1, false], ["2026-10-12", 33.504, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 33.504, "se": 0.630, "ts": 0.400, "map": 81.300, "obs": 5, "own": 45.939, "comp": {"cins": 7.707, "dshield": 1.6287, "crowdsec": -2.689, "vulncheck": -0.7841, "blocklist_de": -0.0708}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.373, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-PEP4-RIPE", "org": "Peyman Ertebatat Pouya Company (Ltd)", "pdb": null, "pfx": 9, "reg": "2024-12-09", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000536245773}, {"a": 213753, "h": "interedge", "n": "InterEdge B.V.", "t": "Enterprise, edu & gov", "w": 1, "cc": "NL", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.747, 0, false], ["2026-10-12", 0.013, 0.953, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.953, "se": 1.821, "ts": 1.000, "map": 14.495, "obs": 1, "own": 100.990, "comp": {"urlhaus": -0.02, "threatfox": -0.0299, "phishing_db": 4.3499}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 9.119, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.514, "det": null, "oid": "ORG-IA1947-RIPE", "org": "InterEdge B.V.", "pdb": {"t": "Enterprise", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.interedge.com"}, "pfx": 2, "reg": "2024-12-05", "rir": "ripencc", "s24": 2, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213772, "h": "BK-CUST", "n": "BK Customers", "t": "Other", "w": 4, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"urlhaus": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4038, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "phishing_db": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.513, 5.459, 0, false], ["2026-10-12", 3.548, 7.961, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 7.961, "se": 1.260, "ts": 0.500, "map": 47.818, "obs": 2, "own": 47.445, "comp": {"urlhaus": 3.8026, "threatfox": -0.2913, "phishing_db": 1.9823}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.548, "se": 0.993, "ts": 1.000, "map": 16.944, "obs": 2, "own": 10.009, "comp": {"cins": -0.244, "dshield": -0.537, "crowdsec": 6.7369, "vulncheck": -0.4697, "blocklist_de": -1.2626}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.646, "det": null, "oid": "ORG-BA18-RIPE", "org": "UAB \"Baltnetos komunikacijos\"", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.balt.net"}, "pfx": 8, "reg": "2024-12-03", "rir": "ripencc", "s24": 11, "sib": 6, "tor": 0, "w24": 3, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000400262621}, {"a": 213790, "h": "LimitedNetwork-AS", "n": "Limited Network LTD", "t": "Other", "w": 110, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 56, "data_centre": 1, "web_exploit": 65, "bad_crawling": 36, "proxy_or_vpn": 7, "first_seen_30d": 3, "ssh_bruteforce": 59, "web_bruteforce": 51, "home_connection": 20, "mail_bruteforce": 48, "cve:CVE-2017-9841": 9, "cve:CVE-2024-6387": 6, "cve:CVE-2017-16894": 4, "cve:CVE-2021-41773": 5, "cve:CVE-2026-87902": 4}, "n": 102}, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "dshield": {"n": 3, "p": 0.6458, "hi": 7.74, "lo": 1.36, "ips": 10, "mean": 3.99, "above": false}, "crowdsec": {"n": 4, "p": 0.8099, "hi": 9.06, "lo": 1.95, "ips": 102, "mean": 4.95, "above": true}, "threatfox": {"n": 2, "p": 0.4228, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 4, "p": 0.8131, "hi": 9.11, "lo": 1.96, "ips": 21, "mean": 4.98, "above": true}}, "h2": [["2026-10-05", 113.934, 9.751, 1, false], ["2026-10-12", 223.826, 9.713, 1, false]], "sh": true, "uc": 37109.4, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 9.713, "se": 1.252, "ts": 1.000, "map": 60.084, "obs": 2, "own": 56.734, "comp": {"urlhaus": -0.1589, "threatfox": 6.2143, "phishing_db": -0.3335}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 4}, "lo": 223.826, "se": 0.469, "ts": 0.333, "map": 406.506, "obs": 12, "own": 226.853, "comp": {"cins": -1.4977, "dshield": 4.0189, "crowdsec": -0.361, "vulncheck": -0.2806, "blocklist_de": 5.5217}, "mass": 8.9, "listed": false}}, "abq": false, "bot": 0.993, "det": {"shodan": {"c2": 2}, "threatfox": {"family:Remcos": 1, "family:Unknown malware": 1}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"ftp": 2, "sip": 2, "ssh": 6, "imap": 5, "mail": 5, "apache": 6, "bruteforcelogin": 3}}, "oid": "ORG-LA1969-RIPE", "org": "Limited Network LTD", "pdb": null, "pfx": 4, "reg": "2024-11-29", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 3, "w24": 4, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 1024, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00428230976584}, {"a": 213795, "h": "Mustafa-Cakir", "n": "Mustafa Cakir", "t": "Other", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.9658, "hi": 11.79, "lo": 3.27, "ips": 6, "mean": 6.97, "above": true}, "dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.911, 0, false], ["2026-10-12", 1.099, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.099, "se": 1.615, "ts": 1.000, "map": 15.896, "obs": 1, "own": 13.183, "comp": {"cins": -0.0436, "dshield": 4.9765, "crowdsec": -0.4147, "vulncheck": -0.1299, "blocklist_de": -0.2285}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.621, "det": {"shodan": {"c2": 4, "malware": 1, "compromised": 1}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-MC318-RIPE", "org": "Mustafa Cakir", "pdb": null, "pfx": 2, "reg": "2024-11-28", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 512, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 213802, "h": "TF", "n": "Tianfeng (Hong Kong) Communications Limited", "t": "Other", "w": 3, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3775, "hi": 5.88, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "crowdsec": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "threatfox": {"n": 1, "p": 0.1969, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.433, 0.435, 0, false], ["2026-10-12", 0.319, 0.454, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.454, "se": 1.540, "ts": 1.000, "map": 4.568, "obs": 1, "own": 5.469, "comp": {"urlhaus": -0.1015, "threatfox": 3.4796, "phishing_db": -0.2327}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.319, "se": 1.300, "ts": 1.000, "map": 2.704, "obs": 1, "own": 1.769, "comp": {"cins": -0.1203, "dshield": -0.2789, "crowdsec": 3.7108, "vulncheck": -0.2962, "blocklist_de": -0.6271}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.781, "det": {"shodan": {"c2": 1, "compromised": 1}, "threatfox": {"family:DCRat": 2}}, "oid": "ORG-TKCL1-RIPE", "org": "Tianfeng (Hong Kong) Communications Limited", "pdb": null, "pfx": 33, "reg": "2024-11-26", "rir": "ripencc", "s24": 33, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213840, "h": "DDOS-PROTECTION-LTD", "n": "DDOS PROTECTION", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8088, "hi": 9.04, "lo": 1.95, "ips": 4, "mean": 4.94, "above": true}}, "h2": [["2026-10-05", 14.699, 0.011, 1, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.813, "det": {"shodan": {"c2": 4}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TL915-RIPE", "org": "DDOS PROTECTION LTD", "pdb": {"t": null, "sc": "Global", "tr": "10-20Tbps", "pol": "Open", "web": "https://yafeiyun.com"}, "pfx": 6, "reg": "2024-11-18", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1536, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 213850, "h": "NEXOSYSTEMS", "n": "NEXOSYSTEMS", "t": "Other", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.846, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-JHTA4-RIPE", "org": "Justin Harth", "pdb": null, "pfx": 6, "reg": "2024-11-15", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213852, "h": "LIARA", "n": "Tose'e Shabakeh Azad Ltd", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.8044, "hi": 8.96, "lo": 1.93, "ips": 4, "mean": 4.90, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.918, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-TSAL5-RIPE", "org": "Tose'e Shabakeh Azad Ltd", "pdb": null, "pfx": 10, "reg": "2024-11-15", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2560, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0000245287074}, {"a": 213861, "h": "Vostrik-AS", "n": "Vostrikov Rodion", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.574, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2213.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.231, "det": null, "oid": "ORG-IVRY1-RIPE", "org": "Vostrikov Rodion", "pdb": null, "pfx": 9, "reg": "2024-11-14", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213873, "h": "OUIDO-Hosting", "n": "MOJI SAS", "t": "Hosting & VPS", "w": 2, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2011-3600": 1, "cve:CVE-2012-0392": 1, "cve:CVE-2013-3827": 1, "cve:CVE-2014-2383": 2, "cve:CVE-2017-1000170": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.737, "det": null, "oid": "ORG-MS374-RIPE", "org": "MOJI SAS", "pdb": null, "pfx": 2, "reg": "2024-11-12", "rir": "ripencc", "s24": 2, "sib": 3, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213877, "h": "U1DS-AS", "n": "u1host", "t": "Hosting & VPS", "w": 14, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 3, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 3, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2023-50164": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-54236": 1}, "n": 4}, "ev": {"cins": {"n": 2, "p": 0.3922, "hi": 6.01, "lo": 0.78, "ips": 2, "mean": 2.86, "above": false}, "crowdsec": {"n": 4, "p": 0.6497, "hi": 7.05, "lo": 1.52, "ips": 4, "mean": 3.85, "above": false}, "vulncheck": {"n": 2, "p": 0.3849, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "phishing_db": {"n": 2, "p": 0.3874, "hi": 5.97, "lo": 0.78, "ips": 3, "mean": 2.84, "above": false}, "blocklist_de": {"n": 4, "p": 0.7516, "hi": 8.17, "lo": 1.76, "ips": 4, "mean": 4.46, "above": false}}, "h2": [["2026-10-05", 4.501, 2.456, 0, false], ["2026-10-12", 9.561, 1.242, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.242, "se": 1.145, "ts": 1.000, "map": 5.612, "obs": 2, "own": 2.209, "comp": {"urlhaus": -0.3848, "threatfox": -0.3178, "phishing_db": 4.0537}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 4, "vulncheck": 2, "blocklist_de": 4}, "lo": 9.561, "se": 0.478, "ts": 0.333, "map": 17.683, "obs": 12, "own": 3.465, "comp": {"cins": 4.7873, "dshield": -2.3379, "crowdsec": -1.9451, "vulncheck": 0.1176, "blocklist_de": 3.6443}, "mass": 11.0, "listed": false}}, "abq": false, "bot": 0.538, "det": {"vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 3, "imap": 1, "mail": 1}}, "oid": "ORG-UDSL5-RIPE", "org": "U1 DIGITAL SERVICES LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://u1host.com/"}, "pfx": 112, "reg": "2024-11-11", "rir": "ripencc", "s24": 112, "sib": 0, "tor": 2, "w24": 13, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28672, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00232294248335}, {"a": 213887, "h": "WAICORE-LTD", "n": "WAICORE", "t": "Enterprise, edu & gov", "w": 2, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 1, "p": 0.1373, "hi": 4.08, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}, "vulncheck": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.222, 0.011, 0, false], ["2026-10-12", 0.757, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.189, "obs": 0, "own": 2.576, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.757, "se": 0.927, "ts": 0.500, "map": 3.100, "obs": 2, "own": 18.541, "comp": {"cins": -0.2474, "dshield": -0.5436, "crowdsec": 2.272, "vulncheck": 2.3236, "blocklist_de": -1.2796}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.434, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-WL627-RIPE", "org": "WAIcore Ltd", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://waicore.com/"}, "pfx": 62, "reg": "2024-11-08", "rir": "ripencc", "s24": 61, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16128, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00356218634319}, {"a": 213888, "h": "CharterDigital-AS", "n": "CharterDigital", "t": "Broadband & mobile", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CL790-RIPE", "org": "CharterDigital Ltd", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "https://www.charter.digital/"}, "pfx": 2, "reg": "2024-11-08", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213896, "h": "CHERRYSERVERS6-AS", "n": "Cherry Servers DE", "t": "Hosting & VPS", "w": 4, "cc": "LT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "vulncheck": {"n": 2, "p": 0.4158, "hi": 6.23, "lo": 0.81, "ips": 3, "mean": 2.97, "above": false}}, "h2": [["2026-10-12", 3.417, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 3.417, "se": 0.803, "ts": 0.667, "map": 11.013, "obs": 3, "own": 2.281, "comp": {"cins": -0.2989, "dshield": -0.6432, "crowdsec": 1.7328, "vulncheck": 4.543, "blocklist_de": -1.541}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.672, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-UDC69-RIPE", "org": "UAB \"Cherry Servers\"", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Restrictive", "web": "http://www.cherryservers.com"}, "pfx": 22, "reg": "2024-11-08", "rir": "ripencc", "s24": 21, "sib": 6, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00453483819975}, {"a": 213905, "h": "ISPLABS", "n": "ISPLABS", "t": "Transit & backbone", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6415, "hi": 7.69, "lo": 1.35, "ips": 3, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.533, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-IL943-RIPE", "org": "ISPLABS LIMITED", "pdb": {"t": "NSP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://as213905.com/"}, "pfx": 4, "reg": "2025-09-05", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213920, "h": "FONSECA", "n": "FONSECA", "t": "Other", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 2}, "n": 2}, "ev": {"shodan": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.664, 0.887, 0, false], ["2026-10-12", 23.503, 0.928, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.928, "se": 1.813, "ts": 1.000, "map": 13.743, "obs": 1, "own": 23.000, "comp": {"urlhaus": 4.4638, "threatfox": -0.0778, "phishing_db": -0.1393}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 23.503, "se": 0.715, "ts": 0.250, "map": 65.538, "obs": 4, "own": 37.685, "comp": {"cins": -0.4855, "dshield": 2.8447, "crowdsec": -0.0396, "vulncheck": 1.2063, "blocklist_de": 2.0504}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.741, "det": {"shodan": {"compromised": 2}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-FATL2-RIPE", "org": "FONSECA ALVES TECNOLOGIA LTDA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://servla.com.br"}, "pfx": 6, "reg": "2024-11-04", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 213954, "h": "GTS-AS", "n": "Global Transit Systems LLC", "t": "Other", "w": 53, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 11, "web_exploit": 36, "bad_crawling": 8, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 50, "cve:CVE-2021-41773": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-21859": 1, "cve:CVE-2026-60137": 10, "cve:CVE-2026-63030": 17}, "n": 51}, "ev": {"dshield": {"n": 2, "p": 0.4028, "hi": 6.11, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "crowdsec": {"n": 18, "p": 1.0000, "hi": 23.18, "lo": 10.81, "ips": 51, "mean": 16.50, "above": true}}, "h2": [["2026-10-05", 34.339, 0.011, 1, false], ["2026-10-12", 27.368, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.038, "ts": null, "map": 0.189, "obs": 0, "own": 0.625, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 18, "vulncheck": 0, "blocklist_de": 0}, "lo": 27.368, "se": 0.415, "ts": 0.900, "map": 45.330, "obs": 20, "own": 25.346, "comp": {"cins": -1.9877, "dshield": 0.4976, "crowdsec": 16.8987, "vulncheck": -0.9379, "blocklist_de": -9.2631}, "mass": 14.2, "listed": false}}, "abq": false, "bot": 0.605, "det": {"blocklist_de": {"bots": 1, "apache": 1}}, "oid": "ORG-GTSL8-RIPE", "org": "Global Transit Systems LLC", "pdb": null, "pfx": 44, "reg": "2025-10-30", "rir": "ripencc", "s24": 57, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00283660847864}, {"a": 213995, "h": "FROSTYHOSTING-AS", "n": "Belenkii Ivan Alexandrovich", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.696, "det": null, "oid": "ORG-FA1359-RIPE", "org": "Belenkii Ivan Alexandrovich", "pdb": null, "pfx": 1, "reg": "2024-10-21", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214000, "h": "VOXNET", "n": "Voxnet Bilisim Teknolojileri Sanayi Ve Ticaret Limited Sirketi", "t": "Other", "w": 4, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4225, "hi": 6.29, "lo": 0.82, "ips": 4, "mean": 3.00, "above": false}}, "h2": [["2026-10-12", 12.054, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 12.054, "se": 1.091, "ts": 1.000, "map": 69.699, "obs": 2, "own": 41.949, "comp": {"cins": -0.1851, "dshield": 8.8321, "crowdsec": -1.6505, "vulncheck": -0.3976, "blocklist_de": -0.9611}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.933, "det": null, "oid": "ORG-VBTS5-RIPE", "org": "Voxnet Bilisim Teknolojileri Sanayi Ve Ticaret Limited Sirketi", "pdb": null, "pfx": 2, "reg": "2024-10-21", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214036, "h": "ULTAHOST-AS", "n": "Ultahost, Inc.", "t": "Hosting & VPS", "w": 16, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 5, "bad_crawling": 3, "proxy_or_vpn": 1, "first_seen_30d": 3, "web_bruteforce": 3, "mail_bruteforce": 2, "cve:CVE-2026-8181": 1, "cve:CVE-2024-28000": 1}, "n": 7}, "ev": {"shodan": {"n": 1, "p": 0.1286, "hi": 3.99, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "urlhaus": {"n": 1, "p": 0.1955, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 7, "p": 0.9643, "hi": 10.63, "lo": 3.22, "ips": 7, "mean": 6.47, "above": true}, "threatfox": {"n": 3, "p": 0.6381, "hi": 7.65, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1792, "hi": 4.53, "lo": 0.34, "ips": 2, "mean": 1.91, "above": false}, "phishing_db": {"n": 1, "p": 0.1805, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1603, "hi": 4.33, "lo": 0.32, "ips": 2, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 8.476, 9.865, 0, false], ["2026-10-12", 6.929, 8.139, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 1}, "lo": 8.139, "se": 0.902, "ts": 0.600, "map": 23.204, "obs": 5, "own": 8.376, "comp": {"urlhaus": 2.188, "threatfox": 2.4237, "phishing_db": 0.1588}, "mass": 2.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 1}, "lo": 6.929, "se": 0.508, "ts": 0.778, "map": 13.425, "obs": 9, "own": 2.637, "comp": {"cins": -1.2078, "dshield": -1.9021, "crowdsec": 9.5015, "vulncheck": -0.0558, "blocklist_de": -2.345}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.679, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 2, "family:AsyncRAT": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ftp": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-UI46-RIPE", "org": "Ultahost, Inc.", "pdb": {"t": null, "sc": "Global", "tr": null, "pol": "Open", "web": "https://ultahost.com/"}, "pfx": 89, "reg": "2024-10-15", "rir": "ripencc", "s24": 89, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.8699], ["2026-10-12", 0.0012]], "ipv4": 22784, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00520616125764}, {"a": 214062, "h": "ITITANHOSTING", "n": "ITITAN HOSTING SOLUTIONS SRL", "t": "Hosting & VPS", "w": 0, "cc": "RO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.782, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IHS25-RIPE", "org": "ITITAN HOSTING SOLUTIONS SRL", "pdb": null, "pfx": 3, "reg": "2024-10-09", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00003261638259}, {"a": 214094, "h": "OSSERVATORIO-NESSUNO", "n": "Association Osservatorio Nessuno ODV", "t": "Hosting & VPS", "w": 8, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 8, "web_exploit": 8, "bad_crawling": 7, "proxy_or_vpn": 8, "ssh_bruteforce": 7, "web_bruteforce": 8, "mail_bruteforce": 2, "cve:CVE-2010-2861": 1, "cve:CVE-2015-9415": 1, "cve:CVE-2017-9841": 8, "cve:CVE-2018-13379": 7, "cve:CVE-2018-20062": 5}, "n": 8}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 8, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.745, "det": null, "oid": "ORG-ON69-RIPE", "org": "Davide Silvetti trading as 'Association Osservatorio Nessuno ODV'", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://osservatorionessuno.org"}, "pfx": 1, "reg": "2024-10-03", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 8, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214126, "h": "T-Systems", "n": "T-systems Limited Liability Company", "t": "Other", "w": 5, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 5, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.446, "det": {"vulncheck": {"botnet_node": 5}}, "oid": "ORG-TLLC5-RIPE", "org": "T-systems Limited Liability Company", "pdb": null, "pfx": 2, "reg": "2024-09-27", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214159, "h": "CHERRYSERVERS5-AS", "n": "Cherry Servers SE", "t": "Hosting & VPS", "w": 3, "cc": "LT", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4137, "hi": 6.21, "lo": 0.81, "ips": 3, "mean": 2.96, "above": false}}, "h2": [["2026-10-12", 1.169, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.279, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.169, "se": 0.958, "ts": 1.000, "map": 4.953, "obs": 2, "own": 1.065, "comp": {"cins": -0.1779, "dshield": -0.4023, "crowdsec": -1.5911, "vulncheck": 6.089, "blocklist_de": -0.924}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.324, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "ORG-UDC69-RIPE", "org": "UAB \"Cherry Servers\"", "pdb": {"t": "Content", "sc": null, "tr": null, "pol": "Restrictive", "web": "http://www.cherryservers.com"}, "pfx": 24, "reg": "2024-09-23", "rir": "ripencc", "s24": 27, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00457256599926}, {"a": 214209, "h": "INTERNET-MAGNATE", "n": "INTERNET-MAGNATE", "t": "Other", "w": 13, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 1, "web_exploit": 6, "bad_crawling": 6, "proxy_or_vpn": 7, "ssh_bruteforce": 5, "web_bruteforce": 4, "mail_bruteforce": 3, "cve:CVE-2020-5902": 1, "cve:CVE-2018-13379": 1, "cve:CVE-2018-20062": 3, "cve:CVE-2020-11738": 2, "cve:CVE-2021-26084": 1}, "n": 9}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 4, "p": 0.8099, "hi": 9.06, "lo": 1.95, "ips": 9, "mean": 4.95, "above": true}, "threatfox": {"n": 2, "p": 0.4228, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 55.391, 13.201, 1, false], ["2026-10-12", 60.671, 41.191, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 41.191, "se": 1.058, "ts": 0.667, "map": 169.355, "obs": 3, "own": 154.672, "comp": {"urlhaus": 3.6022, "threatfox": 3.7854, "phishing_db": -0.6294}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 60.671, "se": 0.632, "ts": 0.800, "map": 146.561, "obs": 5, "own": 82.589, "comp": {"cins": -0.6872, "dshield": -1.2786, "crowdsec": 8.3049, "vulncheck": -0.7419, "blocklist_de": 0.7839}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.889, "det": {"shodan": {"malware": 1}, "threatfox": {"family:Mirai": 1, "family:Remcos": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-IA2087-RIPE", "org": "Internet Magnate (Pty) Ltd", "pdb": null, "pfx": 4, "reg": "2024-09-12", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 5, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00014533795899}, {"a": 214238, "h": "iwihost", "n": "HOST TELECOM LTD", "t": "Hosting & VPS", "w": 1, "cc": "GB", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0239, "hi": 2.53, "lo": 0.19, "ips": 1, "mean": 1.07, "above": false}}, "h2": [["2026-10-05", 0.238, 0.010, 0, false], ["2026-10-12", 0.078, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.923, "ts": null, "map": 0.164, "obs": 0, "own": 0.148, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.078, "se": 1.116, "ts": 1.000, "map": 0.466, "obs": 1, "own": 0.100, "comp": {"cins": -0.2027, "dshield": -0.4538, "crowdsec": 2.7592, "vulncheck": -0.4209, "blocklist_de": -1.0516}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-HTL27-RIPE", "org": "HOST TELECOM LTD", "pdb": null, "pfx": 329, "reg": "2024-09-09", "rir": "ripencc", "s24": 329, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 84224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025226466346}, {"a": 214243, "h": "PacketsDecreaserNET", "n": "PacketsDecreaserNET", "t": "Other", "w": 1, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "threatfox": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.938, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.938, "se": 1.811, "ts": 1.000, "map": 14.132, "obs": 1, "own": 23.079, "comp": {"urlhaus": -0.0195, "threatfox": 4.3458, "phishing_db": -0.0516}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.606, "det": {"shodan": {"compromised": 1, "doublepulsar": 1}, "threatfox": {"family:Remus": 1}}, "oid": "ORG-PA1612-RIPE", "org": "Marc Fischer", "pdb": {"t": null, "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://packets-decreaser.net/"}, "pfx": 2, "reg": "2024-09-09", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214331, "h": "Teske-Virtual-System", "n": "Teske Virtual System", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6444, "hi": 7.72, "lo": 1.36, "ips": 3, "mean": 3.98, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 5.100, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.904, "det": {"shodan": {"c2": 3}}, "oid": "ORG-TVS5-RIPE", "org": "TESKE VIRTUAL SYSTEM LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "https://www.teske.com.br"}, "pfx": 2, "reg": "2024-08-20", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214351, "h": "FEMOIT", "n": "FEMO IT SOLUTIONS LIMITED", "t": "Other", "w": 14, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 2, "web_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 3, "p": 0.6415, "hi": 7.69, "lo": 1.35, "ips": 3, "mean": 3.97, "above": false}, "urlhaus": {"n": 3, "p": 0.6470, "hi": 7.75, "lo": 1.37, "ips": 5, "mean": 4.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}, "threatfox": {"n": 2, "p": 0.4228, "hi": 6.29, "lo": 0.82, "ips": 6, "mean": 3.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1983, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.774, 244.611, 1, false], ["2026-10-12", 0.856, 254.380, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 2, "phishing_db": 1}, "lo": 254.380, "se": 0.817, "ts": 0.500, "map": 707.707, "obs": 6, "own": 567.978, "comp": {"urlhaus": 7.3414, "threatfox": 0.9937, "phishing_db": -0.1468}, "mass": 3.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.972, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:DCRat": 1, "family:CECbot": 1, "family:Remcos": 1, "family:PureRAT": 1, "family:AsyncRAT": 1}}, "oid": "ORG-FI86-RIPE", "org": "FEMO IT SOLUTIONS LIMITED", "pdb": null, "pfx": 4, "reg": "2024-08-15", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 5, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214379, "h": "SPN", "n": "SPN", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.680, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SPNL1-RIPE", "org": "South Park Networks LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://spnet.work"}, "pfx": 9, "reg": "2024-08-09", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214403, "h": "ISI-ENDUSERS-ASN", "n": "Layer7 Networks GmbH", "t": "Other", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}, "threatfox": {"n": 1, "p": 0.1991, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.848, 0.999, 1, false], ["2026-10-12", 1.349, 1.030, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 1.030, "se": 1.880, "ts": 1.000, "map": 16.185, "obs": 1, "own": 30.902, "comp": {"urlhaus": -0.0112, "threatfox": 4.4516, "phishing_db": -0.0301}, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Cobalt Strike": 1}}, "oid": "ORG-LNG5-RIPE", "org": "Layer7 Networks GmbH", "pdb": null, "pfx": 1, "reg": "2024-08-06", "rir": "ripencc", "s24": 1, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007752938544}, {"a": 214437, "h": "nexgen-eu1", "n": "NexGen Cloud Ltd", "t": "Hosting & VPS", "w": 7, "cc": "GB", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 7, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 2.263, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.915, "det": {"vulncheck": {"c2_server": 7}}, "oid": "ORG-NCL38-RIPE", "org": "NexGen Cloud Ltd", "pdb": null, "pfx": 3, "reg": "2024-08-01", "rir": "ripencc", "s24": 4, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214461, "h": "Cloudpard-AS", "n": "Cloudpard LLC", "t": "Hosting & VPS", "w": 0, "cc": "KZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.585, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CL782-RIPE", "org": "Cloudpard LLC", "pdb": null, "pfx": 3, "reg": "2024-07-26", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000084499331}, {"a": 214481, "h": "wczapkowicz-as", "n": "Wojciech Czapkowicz", "t": "Hosting & VPS", "w": 6, "cc": "PL", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "cve:CVE-2024-34102": 1, "cve:CVE-2025-30208": 1, "cve:CVE-2025-54236": 1, "cve:CVE-2025-55182": 1, "cve:CVE-2026-53787": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 4, "p": 0.8017, "hi": 8.92, "lo": 1.92, "ips": 5, "mean": 4.87, "above": true}, "vulncheck": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 7.884, 0.011, 0, false], ["2026-10-12", 30.352, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 1, "blocklist_de": 1}, "lo": 30.352, "se": 0.592, "ts": 0.667, "map": 68.067, "obs": 6, "own": 13.414, "comp": {"cins": -0.7786, "dshield": -1.4039, "crowdsec": 7.082, "vulncheck": 0.4945, "blocklist_de": 0.2202}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.659, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-CA2436-RIPE", "org": "Wojciech Czapkowicz", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://chunkserve.com"}, "pfx": 10, "reg": "2024-07-23", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.000446143225}, {"a": 214483, "h": "FIBERPOWER-AS", "n": "FIBERPOWER LLC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 43.15, "waf": 10.16}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 1.180, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.738, "ts": null, "map": 0.131, "obs": 0, "own": 0.361, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.613, "det": null, "oid": "ORG-FL399-RIPE", "org": "FiberPower LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://usfiberpower.com"}, "pfx": 121, "reg": "2024-07-23", "rir": "ripencc", "s24": 165, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0274], ["2026-10-12", 0.0355]], "ipv4": 46848, "abuse": null, "score": 0.0355, "groups": ["cloudflare"], "sensors": [], "traffic": 0.083855}, {"a": 214503, "h": "QUXLABS", "n": "r0cket.cloud", "t": "Hosting & VPS", "w": 7, "cc": "SE", "cf": null, "cs": {"c": {"http_flood": 7, "data_centre": 7, "web_exploit": 7, "bad_crawling": 7, "proxy_or_vpn": 1, "ssh_bruteforce": 7, "web_bruteforce": 7, "mail_bruteforce": 4, "cve:CVE-2013-3827": 3, "cve:CVE-2014-2383": 2, "cve:CVE-2015-9406": 3, "cve:CVE-2017-9841": 4, "cve:CVE-2018-13379": 2}, "n": 7}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 7, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 2.459, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.627, "det": null, "oid": "ORG-QA154-RIPE", "org": "QuxLabs AB", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://r0cket.cloud/"}, "pfx": 5, "reg": "2024-07-18", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214640, "h": "HOSTUP", "n": "Hostup", "t": "Hosting & VPS", "w": 2, "cc": "SE", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7728, "hi": 8.47, "lo": 1.82, "ips": 4, "mean": 4.62, "above": false}, "vulncheck": {"n": 2, "p": 0.4099, "hi": 6.17, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 0.983, 0.011, 0, false], ["2026-10-12", 0.898, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.262, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.898, "se": 0.945, "ts": 1.000, "map": 3.706, "obs": 2, "own": 0.796, "comp": {"cins": -0.1869, "dshield": -0.4212, "crowdsec": -1.6655, "vulncheck": 5.9478, "blocklist_de": -0.9705}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.758, "det": {"shodan": {"c2": 4}, "vulncheck": {"attack_tooling": 2}}, "oid": "ORG-HA1004-RIPE", "org": "Hostup AB", "pdb": {"t": null, "sc": "Europe", "tr": "10-20Gbps", "pol": "Selective", "web": "https://hostup.se/en/"}, "pfx": 19, "reg": "2024-06-24", "rir": "ripencc", "s24": 38, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00121982473952}, {"a": 214664, "h": "Buduschee", "n": "JSC \"F6\"", "t": "Other", "w": 5, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 2, "web_exploit": 4, "bad_crawling": 4, "ssh_bruteforce": 4, "web_bruteforce": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2022-22947": 1}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 66.527, 0.012, 1, false], ["2026-10-12", 75.004, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 75.004, "se": 0.872, "ts": 0.333, "map": 284.841, "obs": 3, "own": 164.360, "comp": {"cins": 4.4468, "dshield": -0.7606, "crowdsec": 1.0981, "vulncheck": -0.577, "blocklist_de": 2.8384}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.404, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-JB165-RIPE", "org": "JSC \"F6\"", "pdb": null, "pfx": 1, "reg": "2025-07-30", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214677, "h": "DeluxHost", "n": "DeluxHost", "t": "Hosting & VPS", "w": 13, "cc": "IT", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 2, "home_connection": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2021-41773": 2, "cve:CVE-2021-42013": 1, "cve:CVE-2021-44228": 1}, "n": 5}, "ev": {"cins": {"n": 1, "p": 0.1941, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 3, "p": 0.6085, "hi": 7.33, "lo": 1.29, "ips": 3, "mean": 3.78, "above": false}, "dshield": {"n": 1, "p": 0.1927, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "urlhaus": {"n": 2, "p": 0.4215, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "crowdsec": {"n": 4, "p": 0.7779, "hi": 8.54, "lo": 1.84, "ips": 5, "mean": 4.67, "above": false}, "vulncheck": {"n": 3, "p": 0.6377, "hi": 7.65, "lo": 1.35, "ips": 3, "mean": 3.94, "above": false}, "blocklist_de": {"n": 2, "p": 0.4040, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 10.769, 4.259, 1, false], ["2026-10-12", 26.657, 7.373, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 7.373, "se": 1.235, "ts": 1.000, "map": 44.648, "obs": 2, "own": 15.887, "comp": {"urlhaus": 6.6343, "threatfox": -0.4089, "phishing_db": -0.8004}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 3, "blocklist_de": 2}, "lo": 26.657, "se": 0.495, "ts": 0.364, "map": 50.616, "obs": 11, "own": 9.930, "comp": {"cins": 2.3472, "dshield": 0.2631, "crowdsec": 1.0957, "vulncheck": 1.2745, "blocklist_de": 0.3375}, "mass": 7.6, "listed": false}}, "abq": false, "bot": 0.815, "det": {"shodan": {"compromised": 3}, "vulncheck": {"c2_server": 2, "attack_tooling": 1}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-DDMM1-RIPE", "org": "Matteo Martelloni trading as DELUXHOST", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://deluxhost.net"}, "pfx": 24, "reg": "2024-06-18", "rir": "ripencc", "s24": 27, "sib": 0, "tor": 2, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004469643475}, {"a": 214694, "h": "TVPLUS", "n": "TVPLUS LLC", "t": "Other", "w": 4, "cc": "UZ", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.204, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.204, "se": 1.661, "ts": 1.000, "map": 18.174, "obs": 1, "own": 16.363, "comp": {"cins": -0.025, "dshield": -0.0605, "crowdsec": -0.2402, "vulncheck": 4.7507, "blocklist_de": -0.1313}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.611, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "ORG-TL907-RIPE", "org": "TVPLUS LLC", "pdb": null, "pfx": 1, "reg": "2024-06-17", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214707, "h": "Rcell", "n": "Rcell", "t": "Broadband & mobile", "w": 2, "cc": "SY", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3540, "hi": 5.68, "lo": 0.74, "ips": 2, "mean": 2.71, "above": false}, "blocklist_de": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 6.973, 0.011, 0, false], ["2026-10-12", 3.115, 0.012, 0, false]], "sh": false, "uc": 2782, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 1.667, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.115, "se": 0.768, "ts": 0.667, "map": 9.618, "obs": 3, "own": 15.074, "comp": {"cins": -0.4867, "dshield": -0.9736, "crowdsec": 3.7305, "vulncheck": -0.6557, "blocklist_de": 2.0428}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.252, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-RL625-RIPE", "org": "RCell LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Middle East", "tr": "100-200Gbps", "pol": "Open", "web": "https://rcell.me"}, "pfx": 46, "reg": "2024-06-13", "rir": "ripencc", "s24": 41, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00211536455232}, {"a": 214785, "h": "INTONET369", "n": "369 IntoNet Limited", "t": "Other", "w": 1, "cc": "HK", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1946, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 2.226, 0.530, 0, false], ["2026-10-12", 0.011, 0.551, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.551, "se": 1.586, "ts": 1.000, "map": 6.103, "obs": 1, "own": 7.431, "comp": {"urlhaus": -0.0867, "threatfox": -0.1128, "phishing_db": 3.6344}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 0.394, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-IL884-RIPE", "org": "369 IntoNet Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://369-intonet.com"}, "pfx": 21, "reg": "2024-06-03", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214790, "h": "BRAINOZA", "n": "Brainoza OU", "t": "Transit & backbone", "w": 1, "cc": "EE", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1782, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1734, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.320, 0.011, 0, false], ["2026-10-12", 0.384, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 2.648, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.384, "se": 1.335, "ts": 1.000, "map": 3.498, "obs": 1, "own": 12.913, "comp": {"cins": -0.1087, "dshield": -0.2533, "crowdsec": 3.8499, "vulncheck": -0.2749, "blocklist_de": -0.5672}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.393, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BO102-RIPE", "org": "Brainoza OU", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://llhost.eu"}, "pfx": 24, "reg": "2024-05-31", "rir": "ripencc", "s24": 23, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00059802841056}, {"a": 214798, "h": "VPS1", "n": "Digital City FZE", "t": "Hosting & VPS", "w": 1, "cc": "AE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2020-17496": 1, "cve:CVE-2023-50164": 1, "cve:CVE-2025-27007": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.4090, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.537, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 1.501, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.529, "det": {"shodan": {"c2": 1, "compromised": 1}}, "oid": "ORG-DCF5-RIPE", "org": "Digital City FZE", "pdb": null, "pfx": 10, "reg": "2024-05-30", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214803, "h": "BRNCHOST", "n": "Brnchost Bilisim Teknolojileri", "t": "Hosting & VPS", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.907, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-BA1734-RIPE", "org": "Baran Cirak", "pdb": {"t": "Content", "sc": "Europe", "tr": "50-100Gbps", "pol": "Open", "web": "https://brnchost.com"}, "pfx": 1, "reg": "2025-07-01", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214838, "h": "osiomagency", "n": "OSIOM AGENCY", "t": "Hosting & VPS", "w": 7, "cc": "FR", "cf": null, "cs": {"c": {"data_centre": 6}, "n": 7}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 7, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 7.126, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.275, "det": null, "oid": "ORG-OAS7-RIPE", "org": "OSIOM AGENCY SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://swizcloud.fr"}, "pfx": 1, "reg": "2024-05-23", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214854, "h": "VULUT", "n": "VULUT", "t": "Other", "w": 1, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.571, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.571, "se": 1.432, "ts": 1.000, "map": 5.994, "obs": 1, "own": 4.372, "comp": {"cins": -0.0574, "dshield": -0.1368, "crowdsec": -0.5421, "vulncheck": 4.221, "blocklist_de": -0.3003}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.934, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-VBTL4-RIPE", "org": "VULUT BILISIM TEKNOLOJILERI LIMITED SIRKETI", "pdb": null, "pfx": 7, "reg": "2024-05-21", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001877239608}, {"a": 214882, "h": "ArenHost", "n": "ArenHost", "t": "Hosting & VPS", "w": 3, "cc": "ID", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2026-8181": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.909, "det": null, "oid": "ORG-PDKH4-RIPE", "org": "PT Data Kencang Hutama", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://arenhost.com/"}, "pfx": 2, "reg": "2024-05-17", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214902, "h": "PFWEBSOLUTIONS", "n": "Philip Fjaera trading as PFWeb Solutions", "t": "Other", "w": 1, "cc": "DK", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6257, "hi": 7.51, "lo": 1.32, "ips": 3, "mean": 3.88, "above": false}, "vulncheck": {"n": 1, "p": 0.1957, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.583, 0, false], ["2026-10-12", 0.395, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.805, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.395, "se": 1.355, "ts": 1.000, "map": 3.591, "obs": 1, "own": 2.505, "comp": {"cins": -0.0734, "dshield": -0.1737, "crowdsec": -0.6882, "vulncheck": 3.991, "blocklist_de": -0.3837}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.714, "det": {"shodan": {"c2": 1, "malware": 1, "compromised": 1}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-PS495-RIPE", "org": "Philip Fjaera trading as PFWeb Solutions", "pdb": null, "pfx": 15, "reg": "2024-05-15", "rir": "ripencc", "s24": 15, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009580063362}, {"a": 214915, "h": "PawHost", "n": "PawHost", "t": "Hosting & VPS", "w": 0, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.606, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.691, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HA1109-RIPE", "org": "Jan Smyrek", "pdb": {"t": "NSP", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://PawHost.de"}, "pfx": 8, "reg": "2024-05-14", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214922, "h": "FanAvaran_Mihan_Mizban", "n": "FanAvaran Mihan Mizban PJSC", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 0.371, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.319, "det": null, "oid": "ORG-FMM5-RIPE", "org": "FanAvaran Mihan Mizban PJSC", "pdb": null, "pfx": 24, "reg": "2024-05-13", "rir": "ripencc", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008249756967}, {"a": 214927, "h": "PSB-AS", "n": "PSB HOSTING LTD", "t": "Hosting & VPS", "w": 5, "cc": "GB", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "threatfox": {"n": 2, "p": 0.4227, "hi": 6.29, "lo": 0.82, "ips": 4, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.012, 8.587, 0, false], ["2026-10-12", 0.781, 8.563, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 8.563, "se": 1.240, "ts": 1.000, "map": 51.229, "obs": 2, "own": 18.599, "comp": {"urlhaus": -0.1688, "threatfox": 6.0804, "phishing_db": -0.3492}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 2.459, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.743, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:AdaptixC2": 4}}, "oid": "ORG-PHL17-RIPE", "org": "PSB HOSTING LTD", "pdb": null, "pfx": 5, "reg": "2024-05-10", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 214941, "h": "TR-UPCELL-TELEKOM", "n": "UPCELL TELEKOMUNIKASYON LIMITED SIRKETI", "t": "Broadband & mobile", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6372, "hi": 7.64, "lo": 1.35, "ips": 3, "mean": 3.94, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false]], "sh": false, "uc": null, "v2": null, "abq": false, "bot": null, "det": {"shodan": {"compromised": 3}}, "oid": "ORG-UTLS2-RIPE", "org": "UPCELL TELEKOMUNIKASYON LIMITED SIRKETI", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://upcell.com.tr"}, "pfx": 7, "reg": "2024-05-10", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009265597224}, {"a": 214961, "h": "STELLARGROUPSAS", "n": "Stellar Group SAS", "t": "Broadband & mobile", "w": 26, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 5, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 3, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1, "cve:CVE-2024-20767": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"crowdsec": {"n": 4, "p": 0.8058, "hi": 8.99, "lo": 1.93, "ips": 6, "mean": 4.91, "above": true}, "threatfox": {"n": 6, "p": 0.9663, "hi": 11.83, "lo": 3.28, "ips": 20, "mean": 6.99, "above": true}}, "h2": [["2026-10-05", 23.783, 68.933, 1, false], ["2026-10-12", 23.184, 67.338, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 6, "phishing_db": 0}, "lo": 67.338, "se": 0.805, "ts": 1.000, "map": 171.692, "obs": 6, "own": 364.036, "comp": {"urlhaus": -0.6633, "threatfox": 8.2347, "phishing_db": -0.7995}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 23.184, "se": 0.694, "ts": 1.000, "map": 62.756, "obs": 4, "own": 97.166, "comp": {"cins": -0.5355, "dshield": -1.0521, "crowdsec": 10.5216, "vulncheck": -0.6804, "blocklist_de": -2.7206}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.906, "det": {"threatfox": {"family:DCRat": 1, "family:Remcos": 3, "family:PureRAT": 12, "family:AsyncRAT": 1, "family:Unknown malware": 2}}, "oid": "ORG-SGS38-RIPE", "org": "Stellar Group SAS", "pdb": null, "pfx": 7, "reg": "2024-05-06", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 6, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 1792, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00024890385143}, {"a": 214996, "h": "netcup", "n": "netcup GmbH - Manassas", "t": "Hosting & VPS", "w": 8, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 3, "web_exploit": 4, "bad_crawling": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-53787": 1, "cve:CVE-2026-75650": 1}, "n": 5}, "ev": {"shodan": {"n": 41, "p": 1.0000, "hi": 45.27, "lo": 27.18, "ips": 41, "mean": 35.74, "above": true}, "crowdsec": {"n": 5, "p": 0.8366, "hi": 8.63, "lo": 2.15, "ips": 5, "mean": 4.93, "above": true}, "vulncheck": {"n": 3, "p": 0.6183, "hi": 7.43, "lo": 1.31, "ips": 3, "mean": 3.84, "above": false}}, "h2": [["2026-10-05", 9.272, 0.011, 0, false], ["2026-10-12", 5.017, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.017, "ts": null, "map": 0.186, "obs": 0, "own": 0.220, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 0}, "lo": 5.017, "se": 0.542, "ts": 0.625, "map": 10.125, "obs": 8, "own": 2.005, "comp": {"cins": -0.9147, "dshield": -1.5768, "crowdsec": 8.2921, "vulncheck": 2.4479, "blocklist_de": -4.5398}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.955, "det": {"shodan": {"c2": 3, "compromised": 36, "doublepulsar": 2}, "vulncheck": {"c2_server": 1, "attack_tooling": 1, "other_infrastructure": 1}}, "oid": "ORG-NG51-RIPE", "org": "netcup GmbH", "pdb": null, "pfx": 24, "reg": "2024-04-30", "rir": "ripencc", "s24": 82, "sib": 1, "tor": 1, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 22272, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.01829820375892}, {"a": 215100, "h": "IQDC-AS", "n": "SoftLine Direct LLC", "t": "Other", "w": 0, "cc": "BY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.855, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SDL27-RIPE", "org": "SoftLine Direct LLC", "pdb": null, "pfx": 2, "reg": "2024-04-15", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002925929696}, {"a": 215114, "h": "PLB-NET", "n": "SLBCLOUD", "t": "Hosting & VPS", "w": 2, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2017-17762": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2020-11738": 1, "cve:CVE-2020-17496": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 2, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 1.619, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-SA5475-RIPE", "org": "Stevan Durand--L'Hours t/a SLBCLOUD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://slbcloud.fr"}, "pfx": 9, "reg": "2024-04-11", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027206155405}, {"a": 215117, "h": "HOSTERDADDY", "n": "HosterDaddy Private Limited", "t": "Hosting & VPS", "w": 6, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 2, "web_exploit": 2, "bad_crawling": 2, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"shodan": {"n": 8, "p": 0.9957, "hi": 14.16, "lo": 4.61, "ips": 8, "mean": 8.83, "above": true}, "dshield": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4073, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "threatfox": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.849, 8.365, 0, false], ["2026-10-12", 24.576, 8.540, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 8.540, "se": 1.271, "ts": 0.500, "map": 51.930, "obs": 2, "own": 19.991, "comp": {"urlhaus": 3.8834, "threatfox": 2.2089, "phishing_db": -0.5162}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 24.576, "se": 0.640, "ts": 0.400, "map": 60.321, "obs": 5, "own": 11.956, "comp": {"cins": -0.6437, "dshield": 2.2436, "crowdsec": 2.0705, "vulncheck": 0.7685, "blocklist_de": 1.0544}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.936, "det": {"shodan": {"c2": 8}, "threatfox": {"family:Tofsee": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-HPL12-RIPE", "org": "HosterDaddy Private Limited", "pdb": null, "pfx": 9, "reg": "2024-04-11", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 2304, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 215125, "h": "Cyberology-AS", "n": "Church of Cyberology", "t": "Enterprise, edu & gov", "w": 68, "cc": "NL", "cf": null, "cs": {"c": {"http_flood": 68, "data_centre": 6, "web_exploit": 68, "bad_crawling": 68, "proxy_or_vpn": 68, "ssh_bruteforce": 68, "web_bruteforce": 68, "home_connection": 3, "mail_bruteforce": 67, "router_or_botnet": 1, "cve:CVE-2011-3600": 19, "cve:CVE-2013-3827": 30, "cve:CVE-2014-2383": 28, "cve:CVE-2015-9406": 48, "cve:CVE-2017-9841": 21}, "n": 68}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 68, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 9, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 42187.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 4.322, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 783.209, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.646, "det": {"blocklist_de": {"imap": 4, "mail": 4, "apache": 5, "bruteforcelogin": 5}}, "oid": "ORG-COC3-RIPE", "org": "Church of Cyberology", "pdb": {"t": "Educational/Research", "sc": "Europe", "tr": "50-100Gbps", "pol": "Selective", "web": "https://cyberology.church"}, "pfx": 1, "reg": "2024-04-10", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 68, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215136, "h": "Ryzehosting", "n": "Finn Hess trading as Ryzehosting", "t": "Hosting & VPS", "w": 2, "cc": "AT", "cf": null, "cs": null, "ev": {"urlhaus": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "threatfox": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 5.332, 11.637, 1, false], ["2026-10-12", 0.012, 11.855, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 11.855, "se": 1.300, "ts": 0.500, "map": 77.680, "obs": 2, "own": 29.828, "comp": {"urlhaus": 3.9952, "threatfox": 2.4454, "phishing_db": -0.4618}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.780, "det": {"threatfox": {"family:Mirai": 1}}, "oid": "ORG-FHTA5-RIPE", "org": "Finn Hess trading as Ryzehosting", "pdb": null, "pfx": 5, "reg": "2025-09-09", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215148, "h": "DT-SMB", "n": "Delta Telecom Ltd", "t": "Broadband & mobile", "w": 1, "cc": "AZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1181, "hi": 3.87, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "crowdsec": {"n": 1, "p": 0.1036, "hi": 3.70, "lo": 0.28, "ips": 1, "mean": 1.56, "above": false}, "blocklist_de": {"n": 1, "p": 0.1537, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.624, 0.011, 0, false], ["2026-10-12", 0.665, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.002, "ts": null, "map": 0.183, "obs": 0, "own": 1.333, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.665, "se": 0.901, "ts": 0.500, "map": 2.636, "obs": 2, "own": 4.214, "comp": {"cins": -0.3561, "dshield": -0.749, "crowdsec": 1.1604, "vulncheck": -0.5721, "blocklist_de": 2.8797}, "mass": 1.6, "listed": false}}, "abq": false, "bot": 0.180, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-AL1-RIPE", "org": "Delta Telecom Ltd", "pdb": null, "pfx": 106, "reg": "2025-07-02", "rir": "ripencc", "s24": 106, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 27136, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00083049157576}, {"a": 215224, "h": "NOVOSERVE-CUSTOMERS-AS", "n": "NovoServe BYOIP Customers", "t": "Other", "w": 3, "cc": "NL", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1885, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 2, "p": 0.4075, "hi": 6.15, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}}, "h2": [["2026-10-05", 0.870, 0.011, 0, false], ["2026-10-12", 1.606, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.043, "ts": null, "map": 0.190, "obs": 0, "own": 0.641, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.606, "se": 0.786, "ts": 0.667, "map": 5.013, "obs": 3, "own": 2.978, "comp": {"cins": -0.3281, "dshield": 3.518, "crowdsec": -2.7522, "vulncheck": 4.2564, "blocklist_de": -1.6884}, "mass": 1.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-NB80-RIPE", "org": "NovoServe B.V.", "pdb": null, "pfx": 43, "reg": "2024-03-26", "rir": "ripencc", "s24": 45, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00145233831172}, {"a": 215286, "h": "IXROOT", "n": "IXROOT LTD", "t": "Other", "w": 5, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 1, "bad_crawling": 2, "web_bruteforce": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6365, "hi": 7.63, "lo": 1.34, "ips": 3, "mean": 3.94, "above": false}, "threatfox": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 28.285, 0.756, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.756, "se": 1.699, "ts": 1.000, "map": 10.084, "obs": 1, "own": 13.698, "comp": {"urlhaus": -0.0415, "threatfox": 4.084, "phishing_db": -0.1054}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 28.285, "se": 0.698, "ts": 0.750, "map": 77.281, "obs": 4, "own": 43.820, "comp": {"cins": -0.5616, "dshield": -1.0927, "crowdsec": 6.5188, "vulncheck": -0.6925, "blocklist_de": 1.569}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.698, "det": {"threatfox": {"family:Nanocore RAT": 1}, "blocklist_de": {"bots": 1}}, "oid": "ORG-IL926-RIPE", "org": "IXROOT LTD", "pdb": null, "pfx": 6, "reg": "2025-11-10", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215305, "h": "retzor-as", "n": "Mastersoft S.R.L.", "t": "Other", "w": 1, "cc": "MD", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 3, "p": 0.6142, "hi": 7.39, "lo": 1.30, "ips": 3, "mean": 3.81, "above": false}}, "h2": [["2026-10-05", 0.377, 0.011, 0, false], ["2026-10-12", 0.409, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 0.751, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.409, "se": 1.348, "ts": 1.000, "map": 3.784, "obs": 1, "own": 2.544, "comp": {"cins": 4.9789, "dshield": -0.2725, "crowdsec": -1.0789, "vulncheck": -0.291, "blocklist_de": -0.6121}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.592, "det": {"shodan": {"c2": 1, "compromised": 2}}, "oid": "ORG-MS844-RIPE", "org": "Mastersoft S.R.L.", "pdb": null, "pfx": 19, "reg": "2025-12-23", "rir": "ripencc", "s24": 23, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008406532806}, {"a": 215311, "h": "REGXA-CLOUD", "n": "REGXA-CLOUD", "t": "Hosting & VPS", "w": 3, "cc": "IQ", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6157, "hi": 7.41, "lo": 1.30, "ips": 3, "mean": 3.82, "above": false}, "threatfox": {"n": 1, "p": 0.1976, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1940, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 3.504, 0, false], ["2026-10-12", 0.324, 3.535, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 3.535, "se": 1.182, "ts": 0.500, "map": 18.159, "obs": 2, "own": 6.790, "comp": {"urlhaus": -0.2557, "threatfox": 2.4098, "phishing_db": 2.3712}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.324, "se": 1.319, "ts": 1.000, "map": 2.743, "obs": 1, "own": 0.655, "comp": {"cins": -0.0821, "dshield": -0.1935, "crowdsec": -0.7665, "vulncheck": 3.8738, "blocklist_de": -0.4289}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.607, "det": {"shodan": {"c2": 1, "compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}, "vulncheck": {"attack_tooling": 1}}, "oid": "ORG-RCFI1-RIPE", "org": "Regxa Company for Information Technology Ltd", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "https://regxa.iq"}, "pfx": 9, "reg": "2024-03-14", "rir": "ripencc", "s24": 22, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002627235754}, {"a": 215365, "h": "Threatoff", "n": "Tom Gewiese", "t": "Hosting & VPS", "w": 7, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 3, "web_exploit": 4, "bad_crawling": 4, "first_seen_30d": 2, "ssh_bruteforce": 1}, "n": 5}, "ev": {"crowdsec": {"n": 5, "p": 0.8983, "hi": 9.96, "lo": 2.47, "ips": 5, "mean": 5.68, "above": true}, "vulncheck": {"n": 2, "p": 0.4158, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 18.555, 0.011, 1, false], ["2026-10-12", 16.133, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 2, "blocklist_de": 0}, "lo": 16.133, "se": 0.562, "ts": 0.714, "map": 34.410, "obs": 7, "own": 6.792, "comp": {"cins": -0.8178, "dshield": -1.4553, "crowdsec": 9.652, "vulncheck": 1.6359, "blocklist_de": -4.0828}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.475, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1, "botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-TG274-RIPE", "org": "Tom Gewiese", "pdb": null, "pfx": 21, "reg": "2024-03-06", "rir": "ripencc", "s24": 21, "sib": 0, "tor": 0, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00102029384332}, {"a": 215376, "h": "mlcloud", "n": "ML Cloud Ltd", "t": "Hosting & VPS", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.824, "det": null, "oid": "ORG-MA2135-RIPE", "org": "ML Cloud Ltd", "pdb": null, "pfx": 1, "reg": "2024-03-04", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215381, "h": "RockHoster", "n": "ROCKHOSTER PRIVATE LIMITED", "t": "Hosting & VPS", "w": 4, "cc": "IN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2025-54236": 1, "cve:CVE-2026-63030": 1, "cve:CVE-2026-75650": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "shodan": {"n": 2, "p": 0.4104, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 2, "p": 0.4200, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 3.316, 0.011, 0, false], ["2026-10-12", 13.870, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.331, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 13.870, "se": 0.723, "ts": 0.500, "map": 38.441, "obs": 4, "own": 7.831, "comp": {"cins": 4.2942, "dshield": -0.8836, "crowdsec": 0.4344, "vulncheck": 3.4104, "blocklist_de": -2.2127}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.955, "det": {"shodan": {"compromised": 2}, "vulncheck": {"c2_server": 1, "other_infrastructure": 1}}, "oid": "ORG-RPL16-RIPE", "org": "ROCKHOSTER PRIVATE LIMITED", "pdb": null, "pfx": 9, "reg": "2024-03-04", "rir": "ripencc", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00017445653537}, {"a": 215391, "h": "HOSTABIL", "n": "CAFER ESER", "t": "Hosting & VPS", "w": 2, "cc": "TR", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 4.075, 0.012, 0, false]], "sh": false, "uc": 2343.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.075, "se": 1.003, "ts": 0.500, "map": 19.743, "obs": 2, "own": 4.076, "comp": {"cins": -0.2577, "dshield": -0.5638, "crowdsec": 2.1624, "vulncheck": -0.4843, "blocklist_de": 3.5198}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.668, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CE114-RIPE", "org": "CAFER ESER", "pdb": null, "pfx": 10, "reg": "2024-03-01", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016482909755}, {"a": 215402, "h": "ASAD-AS", "n": "Asadov Ruslan Rafaelevich", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ARR1-RIPE", "org": "Asadov Ruslan Rafaelevich", "pdb": null, "pfx": 1, "reg": "2024-02-29", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215411, "h": "VeruniX", "n": "danis danisman", "t": "Other", "w": 13, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 4, "p": 0.8136, "hi": 9.12, "lo": 1.96, "ips": 13, "mean": 4.98, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 26.668, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 26.668, "se": 0.696, "ts": 1.000, "map": 73.113, "obs": 4, "own": 41.403, "comp": {"cins": -0.5349, "dshield": 13.7507, "crowdsec": -4.1326, "vulncheck": -0.6801, "blocklist_de": -2.7174}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.750, "det": null, "oid": "ORG-DD281-RIPE", "org": "danis danisman", "pdb": null, "pfx": 6, "reg": "2024-02-28", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": null}, {"a": 215421, "h": "LikeNet", "n": "LIKENET LLC", "t": "Broadband & mobile", "w": 8, "cc": "AM", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 4, "web_bruteforce": 4, "home_connection": 6, "router_or_botnet": 5, "cve:CVE-2026-8181": 1}, "n": 6}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 6, "mean": 1.97, "above": false}, "vulncheck": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 12.751, 0.011, 1, false], ["2026-10-12", 4.406, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 4.406, "se": 1.027, "ts": 0.500, "map": 21.861, "obs": 2, "own": 36.634, "comp": {"cins": -0.1746, "dshield": -0.3955, "crowdsec": 3.0763, "vulncheck": 2.8792, "blocklist_de": -0.9071}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.486, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "ORG-LL495-RIPE", "org": "LikeNet LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Europe", "tr": "10-20Gbps", "pol": "Open", "web": "https://likenet.am"}, "pfx": 5, "reg": "2024-02-26", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00054102734299}, {"a": 215428, "h": "shinomiya", "n": "Mykyta Skorobohatko", "t": "Other", "w": 2, "cc": "UA", "cf": null, "cs": null, "ev": {"threatfox": {"n": 2, "p": 0.4226, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.012, 59.898, 1, false], ["2026-10-12", 0.012, 7.651, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 7.651, "se": 1.232, "ts": 1.000, "map": 44.932, "obs": 2, "own": 42.700, "comp": {"urlhaus": -0.1771, "threatfox": 5.9706, "phishing_db": -0.3621}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:Unknown malware": 2}}, "oid": "ORG-MS845-RIPE", "org": "Mykyta Skorobohatko", "pdb": null, "pfx": 6, "reg": "2024-02-23", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00111401894953}, {"a": 215439, "h": "PLAY2GO-NET", "n": "PLAY2GO", "t": "Enterprise, edu & gov", "w": 30, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 8, "data_centre": 1, "web_exploit": 8, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 4, "ssh_bruteforce": 10, "web_bruteforce": 7, "mail_bruteforce": 1, "cve:CVE-2017-9841": 6, "cve:CVE-2019-9082": 5, "cve:CVE-2018-20062": 5, "cve:CVE-2023-28121": 1, "cve:CVE-2023-50164": 1}, "n": 14}, "ev": {"cins": {"n": 1, "p": 0.1733, "hi": 4.47, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "shodan": {"n": 7, "p": 0.9530, "hi": 10.04, "lo": 3.04, "ips": 7, "mean": 6.11, "above": true}, "dshield": {"n": 1, "p": 0.1667, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "urlhaus": {"n": 3, "p": 0.6382, "hi": 7.65, "lo": 1.35, "ips": 3, "mean": 3.95, "above": false}, "crowdsec": {"n": 14, "p": 1.0000, "hi": 15.80, "lo": 6.67, "ips": 14, "mean": 10.83, "above": true}, "threatfox": {"n": 3, "p": 0.6323, "hi": 7.58, "lo": 1.34, "ips": 3, "mean": 3.91, "above": false}, "vulncheck": {"n": 4, "p": 0.7756, "hi": 8.51, "lo": 1.83, "ips": 4, "mean": 4.65, "above": false}, "blocklist_de": {"n": 6, "p": 0.9373, "hi": 10.25, "lo": 2.84, "ips": 6, "mean": 6.06, "above": true}}, "h2": [["2026-10-05", 17.843, 9.510, 1, false], ["2026-10-12", 15.934, 11.602, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 3, "threatfox": 3, "phishing_db": 0}, "lo": 11.602, "se": 0.866, "ts": 0.500, "map": 32.166, "obs": 6, "own": 121.150, "comp": {"urlhaus": 5.2579, "threatfox": 0.9186, "phishing_db": -1.0794}, "mass": 5.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 14, "vulncheck": 4, "blocklist_de": 6}, "lo": 15.934, "se": 0.409, "ts": 0.538, "map": 26.233, "obs": 26, "own": 145.865, "comp": {"cins": -0.016, "dshield": -1.667, "crowdsec": 4.6976, "vulncheck": 0.1682, "blocklist_de": 1.4778}, "mass": 21.0, "listed": false}}, "abq": false, "bot": 0.671, "det": {"shodan": {"compromised": 7}, "threatfox": {"family:Chaos": 1, "family:PureRAT": 1, "family:AdaptixC2": 1}, "vulncheck": {"c2_server": 3, "attack_tooling": 1}, "blocklist_de": {"ssh": 4, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-PIL38-RIPE", "org": "PLAY2GO INTERNATIONAL LIMITED", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "500-1000Gbps", "pol": "Open", "web": "https://play2go.cloud"}, "pfx": 139, "reg": "2024-02-22", "rir": "ripencc", "s24": 145, "sib": 0, "tor": 1, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.8106], ["2026-10-12", 0.8212]], "ipv4": 37120, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00736243145295}, {"a": 215460, "h": "FELCLOUD", "n": "Daniel Mishayev", "t": "Hosting & VPS", "w": 0, "cc": "IL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-DM262-RIPE", "org": "Daniel Mishayev", "pdb": null, "pfx": 1, "reg": "2024-02-19", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215540, "h": "GCS-AS", "n": "GLOBAL CONNECTIVITY SOLUTIONS LLP", "t": "Hosting & VPS", "w": 57, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 17, "web_exploit": 15, "bad_crawling": 6, "proxy_or_vpn": 5, "first_seen_30d": 1, "ssh_bruteforce": 8, "web_bruteforce": 15, "mail_bruteforce": 3, "cve:CVE-2017-9841": 7, "cve:CVE-2019-9082": 6, "cve:CVE-2018-20062": 7, "cve:CVE-2021-41773": 3, "cve:CVE-2026-85706": 1}, "n": 22}, "ev": {"cins": {"n": 4, "p": 0.7600, "hi": 8.29, "lo": 1.78, "ips": 5, "mean": 4.53, "above": false}, "shodan": {"n": 5, "p": 0.6876, "hi": 6.87, "lo": 1.71, "ips": 5, "mean": 3.92, "above": false}, "dshield": {"n": 2, "p": 0.3395, "hi": 5.55, "lo": 0.72, "ips": 2, "mean": 2.65, "above": false}, "urlhaus": {"n": 1, "p": 0.1891, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 22, "p": 1.0000, "hi": 18.93, "lo": 9.47, "ips": 22, "mean": 13.86, "above": true}, "threatfox": {"n": 5, "p": 0.9041, "hi": 10.13, "lo": 2.52, "ips": 5, "mean": 5.78, "above": true}, "vulncheck": {"n": 6, "p": 0.9428, "hi": 10.48, "lo": 2.91, "ips": 6, "mean": 6.19, "above": true}, "phishing_db": {"n": 9, "p": 0.9975, "hi": 14.01, "lo": 4.84, "ips": 12, "mean": 8.92, "above": true}, "blocklist_de": {"n": 7, "p": 0.9600, "hi": 10.39, "lo": 3.15, "ips": 7, "mean": 6.32, "above": true}}, "h2": [["2026-10-05", 14.138, 10.553, 1, false], ["2026-10-12", 15.840, 10.630, 1, false]], "sh": true, "uc": 140.2, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 5, "phishing_db": 9}, "lo": 10.630, "se": 0.770, "ts": 0.600, "map": 23.263, "obs": 15, "own": 8.172, "comp": {"urlhaus": 0.2622, "threatfox": 1.4518, "phishing_db": 3.059}, "mass": 7.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 2, "crowdsec": 22, "vulncheck": 6, "blocklist_de": 7}, "lo": 15.840, "se": 0.387, "ts": 0.537, "map": 25.153, "obs": 41, "own": 4.903, "comp": {"cins": 4.1929, "dshield": -1.5483, "crowdsec": 4.4137, "vulncheck": 0.0734, "blocklist_de": -2.513}, "mass": 34.3, "listed": false}}, "abq": false, "bot": 0.550, "det": {"shodan": {"c2": 2, "compromised": 3}, "threatfox": {"family:pupy": 1, "family:Hermes": 1, "family:Remcos": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 1}, "vulncheck": {"c2_server": 2, "botnet_node": 4}, "blocklist_de": {"ssh": 4, "bots": 1, "mail": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-GCSL7-RIPE", "org": "GLOBAL CONNECTIVITY SOLUTIONS LLP", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://globconnex.com"}, "pfx": 237, "reg": "2024-02-09", "rir": "ripencc", "s24": 248, "sib": 0, "tor": 4, "w24": 45, "drop": 0, "hist": [["2026-10-05", 0.8809], ["2026-10-12", 1.0000]], "ipv4": 63488, "abuse": null, "score": 1.0000, "groups": ["sensors", "vulncheck", "abusech", "phishing"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00977653922822}, {"a": 215590, "h": "XORA-AS", "n": "DpkgSoft International Limited", "t": "Enterprise, edu & gov", "w": 18, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 9, "bad_crawling": 2, "proxy_or_vpn": 5, "first_seen_30d": 2, "ssh_bruteforce": 4, "web_bruteforce": 9, "cve:CVE-2012-3153": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2022-39290": 1}, "n": 11}, "ev": {"shodan": {"n": 6, "p": 0.9131, "hi": 9.46, "lo": 2.62, "ips": 6, "mean": 5.59, "above": true}, "dshield": {"n": 2, "p": 0.3818, "hi": 5.92, "lo": 0.77, "ips": 2, "mean": 2.82, "above": false}, "crowdsec": {"n": 11, "p": 0.9992, "hi": 13.86, "lo": 5.27, "ips": 11, "mean": 9.13, "above": true}, "vulncheck": {"n": 2, "p": 0.3829, "hi": 5.93, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "phishing_db": {"n": 2, "p": 0.3856, "hi": 5.95, "lo": 0.77, "ips": 2, "mean": 2.84, "above": false}, "blocklist_de": {"n": 7, "p": 0.9776, "hi": 11.67, "lo": 3.53, "ips": 7, "mean": 7.10, "above": true}}, "h2": [["2026-10-05", 10.831, 1.181, 1, false], ["2026-10-12", 17.768, 1.200, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 1.200, "se": 1.144, "ts": 1.000, "map": 5.395, "obs": 2, "own": 23.240, "comp": {"urlhaus": -0.3891, "threatfox": -0.3197, "phishing_db": 4.0205}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 11, "vulncheck": 2, "blocklist_de": 7}, "lo": 17.768, "se": 0.417, "ts": 0.500, "map": 28.969, "obs": 22, "own": 161.026, "comp": {"cins": -2.2995, "dshield": -0.2639, "crowdsec": 2.6776, "vulncheck": -0.331, "blocklist_de": 4.9767}, "mass": 18.8, "listed": false}}, "abq": false, "bot": 0.611, "det": {"shodan": {"c2": 3, "compromised": 3}, "vulncheck": {"c2_server": 1, "attack_tooling": 1}, "blocklist_de": {"ssh": 2, "bots": 4, "imap": 1, "mail": 1}}, "oid": "ORG-DPKG2-RIPE", "org": "DpkgSoft International Limited", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": null, "pol": "Restrictive", "web": "https://xorek.cloud/"}, "pfx": 118, "reg": "2024-02-02", "rir": "ripencc", "s24": 118, "sib": 1, "tor": 0, "w24": 16, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.8212]], "ipv4": 30208, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00256324575761}, {"a": 215599, "h": "ZKILLU", "n": "★ ZKILLU", "t": "Hosting & VPS", "w": 31, "cc": "FR", "cf": null, "cs": {"c": {"http_flood": 31, "web_exploit": 31, "bad_crawling": 31, "first_seen_30d": 15, "ssh_bruteforce": 6, "web_bruteforce": 31, "home_connection": 3, "mail_bruteforce": 1, "cve:CVE-2026-4020": 20, "cve:CVE-2025-55182": 17, "cve:CVE-2026-60137": 28, "cve:CVE-2026-63030": 16, "cve:CVE-2026-72898": 6}, "n": 31}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 31, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 25.631, 0.011, 1, false], ["2026-10-12", 28.273, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 28.273, "se": 0.833, "ts": 0.667, "map": 99.320, "obs": 3, "own": 19.868, "comp": {"cins": -0.3778, "dshield": -0.7879, "crowdsec": 5.0062, "vulncheck": -0.5882, "blocklist_de": 2.7397}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.992, "det": {"blocklist_de": {"bots": 3}}, "oid": "ORG-ZS84-RIPE", "org": "Zkillu SAS", "pdb": {"t": "Content", "sc": "Europe", "tr": "1-5Gbps", "pol": "Open", "web": "https://zkillu.fr"}, "pfx": 3, "reg": "2024-01-31", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00132128787037}, {"a": 215607, "h": "DF-Transit", "n": "dataforest GmbH", "t": "Other", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {"data_centre": 1, "proxy_or_vpn": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.251, 0.011, 0, false], ["2026-10-12", 0.256, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.256, "se": 1.264, "ts": 1.000, "map": 2.026, "obs": 1, "own": 1.305, "comp": {"cins": -0.1334, "dshield": -0.3075, "crowdsec": 3.5546, "vulncheck": -0.3191, "blocklist_de": -0.695}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.444, "det": null, "oid": "ORG-HSG23-RIPE", "org": "dataforest GmbH", "pdb": null, "pfx": 49, "reg": "2025-09-08", "rir": "ripencc", "s24": 49, "sib": 1, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215633, "h": "AbrBaranIDC", "n": "Abr Baran Information Technologists LLC", "t": "Other", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.407, "det": null, "oid": "ORG-ABIT7-RIPE", "org": "Abr Baran Information Technologists LLC", "pdb": null, "pfx": 7, "reg": "2024-01-29", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000327861372}, {"a": 215659, "h": "MOEMOEKYUN", "n": "Kyun", "t": "Other", "w": 4, "cc": "RO", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 3, "web_exploit": 4, "bad_crawling": 2, "proxy_or_vpn": 4, "ssh_bruteforce": 2, "web_bruteforce": 4, "cve:CVE-2017-9841": 1, "cve:CVE-2021-0027": 1, "cve:CVE-2018-20062": 3, "cve:CVE-2021-26086": 1, "cve:CVE-2021-41773": 3}, "n": 4}, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 4, "p": 0.8044, "hi": 8.96, "lo": 1.93, "ips": 4, "mean": 4.90, "above": true}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 25.415, 6.483, 1, false], ["2026-10-12", 31.877, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 31.877, "se": 0.626, "ts": 0.800, "map": 76.903, "obs": 5, "own": 43.385, "comp": {"cins": -0.7157, "dshield": -1.3185, "crowdsec": 7.9147, "vulncheck": -0.7515, "blocklist_de": 0.6073}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.732, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Sliver": 2}, "blocklist_de": {"bots": 1}}, "oid": "ORG-KA1059-RIPE", "org": "Aokigahara SRL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://kyun.sh"}, "pfx": 8, "reg": "2024-01-23", "rir": "ripencc", "s24": 8, "sib": 0, "tor": 4, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00001651712067}, {"a": 215674, "h": "BROOKPLUS-LIMITED", "n": "Brookplus Limited", "t": "Other", "w": 5, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2024-4577": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4143, "hi": 6.21, "lo": 0.81, "ips": 3, "mean": 2.96, "above": false}, "threatfox": {"n": 2, "p": 0.4227, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 5.824, 8.587, 0, false], ["2026-10-12", 6.346, 8.563, 0, false]], "sh": false, "uc": 5546.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 8.563, "se": 1.240, "ts": 1.000, "map": 51.229, "obs": 2, "own": 48.533, "comp": {"urlhaus": -0.1688, "threatfox": 6.0804, "phishing_db": -0.3492}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.346, "se": 1.035, "ts": 1.000, "map": 32.708, "obs": 2, "own": 19.460, "comp": {"cins": -0.2156, "dshield": -0.48, "crowdsec": 7.1311, "vulncheck": -0.4369, "blocklist_de": -1.1174}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.977, "det": {"threatfox": {"family:PureRAT": 1, "family:Unknown malware": 1}}, "oid": "ORG-BL611-RIPE", "org": "Brookplus Limited", "pdb": null, "pfx": 5, "reg": "2025-10-20", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215680, "h": "FEROXHOSTING-NET", "n": "Ferox Hosting", "t": "Hosting & VPS", "w": 0, "cc": "NL", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-FA1310-RIPE", "org": "Luc Haaijer trading as Ferox Hosting", "pdb": {"t": "Content", "sc": "Europe", "tr": "100-1000Mbps", "pol": "Open", "web": "https://feroxhosting.nl"}, "pfx": 1, "reg": "2024-01-22", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215691, "h": "HOSTEALO", "n": "HOSTEALO", "t": "Hosting & VPS", "w": 1, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4062, "hi": 6.14, "lo": 0.80, "ips": 2, "mean": 2.93, "above": false}, "phishing_db": {"n": 1, "p": 0.1965, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.626, 0, false], ["2026-10-12", 0.012, 0.651, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.651, "se": 1.639, "ts": 1.000, "map": 7.937, "obs": 1, "own": 3.857, "comp": {"urlhaus": -0.0649, "threatfox": -0.0881, "phishing_db": 3.8507}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.440, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-HA1080-RIPE", "org": "AP INTERACTIVE SOLUTIONS SL", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "https://apinteractive.es"}, "pfx": 12, "reg": "2024-01-19", "rir": "ripencc", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215703, "h": "FREAKHOSTING", "n": "FREAKHOSTING", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"shodan": {"n": 10, "p": 0.9994, "hi": 15.54, "lo": 5.65, "ips": 10, "mean": 10.07, "above": true}, "crowdsec": {"n": 2, "p": 0.3509, "hi": 5.65, "lo": 0.73, "ips": 2, "mean": 2.69, "above": false}, "threatfox": {"n": 1, "p": 0.1962, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 5.617, 3.222, 0, false], ["2026-10-12", 1.256, 0.413, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.413, "se": 1.519, "ts": 1.000, "map": 3.952, "obs": 1, "own": 1.802, "comp": {"urlhaus": -0.114, "threatfox": 3.3706, "phishing_db": -0.2562}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.256, "se": 0.931, "ts": 1.000, "map": 5.318, "obs": 2, "own": 1.085, "comp": {"cins": -0.2958, "dshield": -0.6372, "crowdsec": 6.0446, "vulncheck": -0.5216, "blocklist_de": -1.5252}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.860, "det": {"shodan": {"c2": 1, "compromised": 9}, "threatfox": {"family:Remcos": 1}}, "oid": "ORG-FL435-RIPE", "org": "FREAKHOSTING LTD", "pdb": {"t": "Content", "sc": "Global", "tr": "20-50Gbps", "pol": "No", "web": "https://freakhosting.com"}, "pfx": 43, "reg": "2024-01-16", "rir": "ripencc", "s24": 43, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 11008, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00091267232016}, {"a": 215708, "h": "mobinidc", "n": "Mobin Arvand Infrastructure Company LTD", "t": "Other", "w": 3, "cc": "IR", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1941, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 4, "p": 0.7854, "hi": 8.65, "lo": 1.86, "ips": 4, "mean": 4.73, "above": false}, "crowdsec": {"n": 2, "p": 0.3767, "hi": 5.87, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}, "blocklist_de": {"n": 2, "p": 0.4040, "hi": 6.12, "lo": 0.79, "ips": 2, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 7.041, 0.011, 0, false], ["2026-10-12", 12.057, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.729, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 12.057, "se": 0.620, "ts": 0.400, "map": 28.717, "obs": 5, "own": 16.245, "comp": {"cins": 3.3541, "dshield": -1.5167, "crowdsec": 0.0226, "vulncheck": -0.7943, "blocklist_de": 3.6853}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.742, "det": {"shodan": {"compromised": 4}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-MICL4-RIPE", "org": "Mobin Arvand Infrastructure Company LTD", "pdb": null, "pfx": 27, "reg": "2024-01-16", "rir": "ripencc", "s24": 27, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000666562143}, {"a": 215710, "h": "hdmdigital", "n": "HDM Dijital Hizmetleri Ticaret Limited Sirketi", "t": "Other", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.474, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HDST1-RIPE", "org": "HDM Dijital Hizmetleri Ticaret Limited Sirketi", "pdb": null, "pfx": 2, "reg": "2024-01-16", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215714, "h": "codipro", "n": "CONTROL DIGITAL DE PROCESOS SL", "t": "Other", "w": 0, "cc": "ES", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.355, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CDDP4-RIPE", "org": "CONTROL DIGITAL DE PROCESOS SL", "pdb": null, "pfx": 7, "reg": "2025-10-28", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215730, "h": "H2NEXUS-AS", "n": "H2NEXUS CLOUD SERVICES FZCO", "t": "Hosting & VPS", "w": 40, "cc": "AE", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 5, "web_exploit": 6, "bad_crawling": 4, "proxy_or_vpn": 2, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 4, "home_connection": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2025-4396": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2026-60137": 1}, "n": 6}, "ev": {"shodan": {"n": 4, "p": 0.7315, "hi": 7.92, "lo": 1.70, "ips": 4, "mean": 4.33, "above": false}, "urlhaus": {"n": 1, "p": 0.1961, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 6, "p": 0.9282, "hi": 9.92, "lo": 2.75, "ips": 6, "mean": 5.86, "above": true}, "threatfox": {"n": 2, "p": 0.4157, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "vulncheck": {"n": 4, "p": 0.7956, "hi": 8.82, "lo": 1.90, "ips": 4, "mean": 4.82, "above": true}, "phishing_db": {"n": 10, "p": 0.9996, "hi": 16.38, "lo": 5.96, "ips": 26, "mean": 10.62, "above": true}, "blocklist_de": {"n": 2, "p": 0.3727, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}}, "h2": [["2026-10-05", 9.504, 34.701, 1, false], ["2026-10-12", 10.207, 28.580, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 10}, "lo": 28.580, "se": 0.751, "ts": 0.769, "map": 62.747, "obs": 13, "own": 21.159, "comp": {"urlhaus": 0.7114, "threatfox": 0.4517, "phishing_db": 4.6022}, "mass": 5.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 4, "blocklist_de": 2}, "lo": 10.207, "se": 0.486, "ts": 0.500, "map": 18.916, "obs": 12, "own": 3.718, "comp": {"cins": -1.3395, "dshield": -2.0307, "crowdsec": 5.4695, "vulncheck": 1.9649, "blocklist_de": 0.2694}, "mass": 7.7, "listed": false}}, "abq": false, "bot": 0.789, "det": {"shodan": {"c2": 1, "compromised": 3}, "threatfox": {"family:PureRAT": 2}, "vulncheck": {"c2_server": 2, "attack_tooling": 2}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-HCSF1-RIPE", "org": "H2NEXUS CLOUD SERVICES - FZCO", "pdb": {"t": "NSP", "sc": "Europe", "tr": "200-300Gbps", "pol": "Selective", "web": "https://h2.nexus/"}, "pfx": 48, "reg": "2024-01-11", "rir": "ripencc", "s24": 73, "sib": 0, "tor": 0, "w24": 20, "drop": 0, "hist": [["2026-10-05", 0.0806], ["2026-10-12", 0.8651]], "ipv4": 18688, "abuse": null, "score": 0.8651, "groups": ["vulncheck", "phishing"], "sensors": ["crowdsec"], "traffic": 0.00634872063026}, {"a": 215731, "h": "NovusLabs", "n": "Novus Labs Limited", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.775, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 0.412, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.471, "det": null, "oid": "ORG-NLL9-RIPE", "org": "Novus Labs Limited", "pdb": null, "pfx": 19, "reg": "2025-11-19", "rir": "ripencc", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215765, "h": "RADIO-LINK-SMART", "n": "\"RADIO-LINK SMART\" LLC", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.261, "det": null, "oid": "ORG-SL1340-RIPE", "org": "\"RADIO-LINK SMART\" LLC", "pdb": null, "pfx": 1, "reg": "2025-06-03", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215859, "h": "HETZNER-CLOUD4-AS", "n": "Hetzner Online Cloud 4", "t": "Hosting & VPS", "w": 2, "cc": "DE", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.8126, "hi": 7.66, "lo": 2.12, "ips": 6, "mean": 4.53, "above": true}, "vulncheck": {"n": 2, "p": 0.3392, "hi": 5.55, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}}, "h2": [["2026-10-05", 0.810, 0.010, 0, false], ["2026-10-12", 0.197, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.942, "ts": null, "map": 0.169, "obs": 0, "own": 0.160, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.197, "se": 0.885, "ts": 1.000, "map": 0.720, "obs": 2, "own": 0.154, "comp": {"cins": -0.2416, "dshield": -0.5322, "crowdsec": -2.1022, "vulncheck": 5.1919, "blocklist_de": -1.2502}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.920, "det": {"shodan": {"compromised": 4, "doublepulsar": 2}, "vulncheck": {"c2_server": 1, "botnet_node": 1}}, "oid": "ORG-HOA1-RIPE", "org": "Hetzner Online GmbH", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.hetzner.com"}, "pfx": 83, "reg": "2023-12-11", "rir": "ripencc", "s24": 256, "sib": 3, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 153344, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00329188689687}, {"a": 215895, "h": "RU_ZIBEN", "n": "Ziben Group LLC", "t": "Other", "w": 7, "cc": "RU", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 7, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 10.424, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.999, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "ORG-ZGL1-RIPE", "org": "Ziben Group LLC", "pdb": null, "pfx": 2, "reg": "2023-12-05", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 215925, "h": "VPSVAULTHOST", "n": "VPSVAULTHOST", "t": "Hosting & VPS", "w": 49, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 18, "web_exploit": 18, "bad_crawling": 10, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 24, "web_bruteforce": 4, "mail_bruteforce": 3, "cve:CVE-2023-1389": 4, "cve:CVE-2024-3721": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-32355": 4, "cve:CVE-2026-41940": 1}, "n": 31}, "ev": {"cins": {"n": 1, "p": 0.1986, "hi": 4.74, "lo": 0.35, "ips": 8, "mean": 2.00, "above": false}, "dshield": {"n": 3, "p": 0.6461, "hi": 7.74, "lo": 1.36, "ips": 12, "mean": 3.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 3, "p": 0.6419, "hi": 7.69, "lo": 1.36, "ips": 31, "mean": 3.97, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 6, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 76.850, 15.370, 1, false], ["2026-10-12", 184.371, 15.610, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 1, "phishing_db": 0}, "lo": 15.610, "se": 1.330, "ts": 0.500, "map": 109.458, "obs": 2, "own": 41.999, "comp": {"urlhaus": 4.0825, "threatfox": 2.6536, "phishing_db": -0.4145}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 3, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 184.371, "se": 0.513, "ts": 0.333, "map": 364.316, "obs": 9, "own": 71.085, "comp": {"cins": 2.779, "dshield": 5.9034, "crowdsec": 0.4853, "vulncheck": 0.0189, "blocklist_de": -1.8949}, "mass": 6.0, "listed": false}}, "abq": false, "bot": 0.937, "det": {"threatfox": {"family:MooBot": 1}, "vulncheck": {"other_infrastructure": 2}, "blocklist_de": {"sip": 1, "ssh": 4, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-VL450-RIPE", "org": "VPSVAULT.HOST LTD", "pdb": {"t": "Content", "sc": "Global", "tr": "200-300Gbps", "pol": "Open", "web": "http://vpsvault.host"}, "pfx": 3, "reg": "2024-12-31", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00013216216825}, {"a": 215929, "h": "datacampus", "n": "Data Campus Limited", "t": "Hosting & VPS", "w": 18, "cc": "HK", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 2, "ssh_bruteforce": 8, "web_bruteforce": 2, "home_connection": 6, "cve:CVE-2023-5074": 1, "cve:CVE-2024-2473": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2025-22457": 1}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "dshield": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6383, "hi": 7.65, "lo": 1.35, "ips": 15, "mean": 3.95, "above": false}, "threatfox": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 86.731, 0.763, 1, false], ["2026-10-12", 93.695, 0.788, 1, false]], "sh": false, "uc": 4375, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.788, "se": 1.717, "ts": 1.000, "map": 10.777, "obs": 1, "own": 5.750, "comp": {"urlhaus": -0.037, "threatfox": 4.1354, "phishing_db": -0.0947}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 93.695, "se": 0.551, "ts": 0.429, "map": 197.622, "obs": 7, "own": 38.616, "comp": {"cins": 2.9593, "dshield": 0.9752, "crowdsec": 1.2288, "vulncheck": -0.8335, "blocklist_de": 2.3503}, "mass": 5.5, "listed": false}}, "abq": false, "bot": 0.979, "det": {"threatfox": {"family:Cobalt Strike": 1}, "blocklist_de": {"ssh": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-DCL55-RIPE", "org": "Data Campus Limited", "pdb": null, "pfx": 5, "reg": "2023-11-29", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049631724426}, {"a": 215930, "h": "COD", "n": "CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRAD", "t": "Other", "w": 44, "cc": "RS", "cf": null, "cs": {"c": {"http_flood": 32, "web_exploit": 34, "bad_crawling": 24, "proxy_or_vpn": 11, "first_seen_30d": 3, "ssh_bruteforce": 7, "web_bruteforce": 34, "mail_bruteforce": 6, "cve:CVE-2021-41773": 3, "cve:CVE-2022-39290": 4, "cve:CVE-2024-28000": 22, "cve:CVE-2026-60137": 5, "cve:CVE-2026-63030": 14}, "n": 42}, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 42, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 13, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 69.325, 0.013, 1, false]], "sh": true, "uc": 78906.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 69.325, "se": 0.867, "ts": 0.333, "map": 262.148, "obs": 3, "own": 150.881, "comp": {"cins": -0.3358, "dshield": 3.4829, "crowdsec": 1.3605, "vulncheck": -0.5562, "blocklist_de": 3.0111}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.991, "det": {"blocklist_de": {"ssh": 4, "imap": 2, "mail": 2, "apache": 7, "bruteforcelogin": 7}}, "oid": "ORG-COD1-RIPE", "org": "CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRAD", "pdb": null, "pfx": 1, "reg": "2023-11-28", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00426636755935}, {"a": 216014, "h": "BestDC-Limited", "n": "BestDC Limited", "t": "Other", "w": 26, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 3, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "cve:CVE-2017-9841": 2, "cve:CVE-2021-41773": 2, "cve:CVE-2022-22947": 1, "cve:CVE-2023-22515": 1, "cve:CVE-2023-35078": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 21, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 115.763, 0.012, 1, false], ["2026-10-12", 55.306, 0.013, 1, false]], "sh": false, "uc": 23828.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 55.306, "se": 0.880, "ts": 0.333, "map": 209.220, "obs": 3, "own": 123.651, "comp": {"cins": -0.2721, "dshield": -0.592, "crowdsec": 2.01, "vulncheck": 2.1658, "blocklist_de": 3.4253}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.883, "det": {"vulncheck": {"botnet_node": 21}, "blocklist_de": {"ssh": 2}}, "oid": "ORG-BA1599-RIPE", "org": "BestDC Limited", "pdb": null, "pfx": 1, "reg": "2023-11-09", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004474122325}, {"a": 216024, "h": "KVMKA-COM", "n": "ALEKSEI FEDOROV PR KRUSEVAC", "t": "Other", "w": 0, "cc": "RS", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7877, "hi": 8.69, "lo": 1.87, "ips": 4, "mean": 4.75, "above": false}}, "h2": [["2026-10-05", 0.305, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 0.740, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.212, "obs": 0, "own": 0.364, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.471, "det": {"shodan": {"compromised": 4}}, "oid": "ORG-AFPK3-RIPE", "org": "ALEKSEI FEDOROV PR KRUSEVAC", "pdb": null, "pfx": 25, "reg": "2023-11-08", "rir": "ripencc", "s24": 25, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011165075586}, {"a": 216047, "h": "INTECLOU-CDNK-NET", "n": "XDPCLOUD", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 0.257, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.918, "ts": null, "map": 0.195, "obs": 0, "own": 0.100, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.901, "det": null, "oid": "ORG-XL116-RIPE", "org": "INTECLOUD CDNK LTD", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "5-10Tbps", "pol": "Open", "web": "https://intecloud.com"}, "pfx": 36, "reg": "2023-11-01", "rir": "ripencc", "s24": 41, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 216071, "h": "VDSINA", "n": "VDSINA", "t": "Hosting & VPS", "w": 89, "cc": "AE", "cf": null, "cs": {"c": {"http_flood": 42, "data_centre": 67, "web_exploit": 59, "bad_crawling": 20, "proxy_or_vpn": 38, "first_seen_30d": 5, "ssh_bruteforce": 5, "web_bruteforce": 68, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2012-3153": 4, "cve:CVE-2017-9841": 7, "cve:CVE-2024-4577": 6, "cve:CVE-2018-20062": 5, "cve:CVE-2022-39290": 7}, "n": 76}, "ev": {"cins": {"n": 1, "p": 0.1096, "hi": 3.77, "lo": 0.28, "ips": 1, "mean": 1.59, "above": false}, "shodan": {"n": 19, "p": 1.0000, "hi": 12.09, "lo": 5.75, "ips": 19, "mean": 8.68, "above": true}, "crowdsec": {"n": 63, "p": 1.0000, "hi": 29.61, "lo": 19.60, "ips": 76, "mean": 24.39, "above": true}, "threatfox": {"n": 4, "p": 0.7660, "hi": 8.37, "lo": 1.80, "ips": 4, "mean": 4.57, "above": false}, "vulncheck": {"n": 4, "p": 0.6364, "hi": 6.93, "lo": 1.49, "ips": 4, "mean": 3.79, "above": false}, "phishing_db": {"n": 1, "p": 0.0995, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "blocklist_de": {"n": 7, "p": 0.8703, "hi": 7.95, "lo": 2.41, "ips": 7, "mean": 4.83, "above": true}}, "h2": [["2026-10-05", 14.325, 0.900, 2, false], ["2026-10-12", 11.066, 1.171, 2, false]], "sh": false, "uc": null, "v2": {"band": 2, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 1}, "lo": 1.171, "se": 0.927, "ts": 0.800, "map": 3.219, "obs": 5, "own": 1.282, "comp": {"urlhaus": -0.9596, "threatfox": 3.544, "phishing_db": 0.211}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 63, "vulncheck": 4, "blocklist_de": 7}, "lo": 11.066, "se": 0.367, "ts": 0.840, "map": 16.702, "obs": 75, "own": 3.257, "comp": {"cins": -2.1389, "dshield": -3.2504, "crowdsec": 17.5835, "vulncheck": -0.5595, "blocklist_de": -7.4254}, "mass": 56.2, "listed": true}}, "abq": false, "bot": 0.841, "det": {"shodan": {"c2": 5, "compromised": 14}, "threatfox": {"family:DeimosC2": 1, "family:AdaptixC2": 2, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1, "attack_tooling": 3}, "blocklist_de": {"ftp": 1, "ssh": 1, "bots": 5}}, "oid": "ORG-STF2-RIPE", "org": "SERVERS TECH FZCO", "pdb": {"t": "Content", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.vdsina.com"}, "pfx": 611, "reg": "2023-10-30", "rir": "ripencc", "s24": 611, "sib": 0, "tor": 0, "w24": 72, "drop": 0, "hist": [["2026-10-05", 0.9962], ["2026-10-12", 0.8212]], "ipv4": 156416, "abuse": null, "score": 0.8212, "groups": ["sensors", "shodan"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0173751262775}, {"a": 216074, "h": "ArvinCloud", "n": "Arvin Data Transfer Co. Ltd.", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.620, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-ADTC1-RIPE", "org": "Arvin Data Transfer Co. Ltd.", "pdb": null, "pfx": 2, "reg": "2023-10-30", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000028620885}, {"a": 216078, "h": "KREMER-AS", "n": "Trivox", "t": "Hosting & VPS", "w": 1, "cc": "DE", "cf": null, "cs": {"c": {"web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 2.459, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.317, "det": null, "oid": "ORG-LK155-RIPE", "org": "Liam Kremer", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "100-200Gbps", "pol": "Open", "web": "https://trivox.sh"}, "pfx": 5, "reg": "2023-10-30", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000901534946}, {"a": 216084, "h": "KEREM-ULUBOY", "n": "Kerem Uluboy", "t": "Enterprise, edu & gov", "w": 0, "cc": "TR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 4.045, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 8.137, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.767, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-KU27-RIPE", "org": "Kerem Uluboy", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "100-200Gbps", "pol": "No", "web": "https://whitebilisim.com"}, "pfx": 3, "reg": "2025-12-22", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000867638769}, {"a": 216127, "h": "NUXT-AS", "n": "NUXTCLOUD", "t": "Hosting & VPS", "w": 8, "cc": "GB", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 5, "p": 0.8508, "hi": 8.88, "lo": 2.21, "ips": 5, "mean": 5.07, "above": true}, "crowdsec": {"n": 3, "p": 0.4971, "hi": 6.31, "lo": 1.11, "ips": 3, "mean": 3.26, "above": false}, "vulncheck": {"n": 3, "p": 0.6169, "hi": 7.42, "lo": 1.31, "ips": 3, "mean": 3.83, "above": false}, "phishing_db": {"n": 1, "p": 0.1811, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1615, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 5.491, 0.311, 0, false], ["2026-10-12", 4.074, 0.326, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.326, "se": 1.473, "ts": 1.000, "map": 2.823, "obs": 1, "own": 1.269, "comp": {"urlhaus": -0.1604, "threatfox": -0.1826, "phishing_db": 3.0068}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 1}, "lo": 4.074, "se": 0.570, "ts": 0.429, "map": 8.677, "obs": 7, "own": 1.728, "comp": {"cins": -0.8395, "dshield": -1.4833, "crowdsec": 3.2794, "vulncheck": 2.75, "blocklist_de": -0.1522}, "mass": 4.2, "listed": false}}, "abq": false, "bot": 0.785, "det": {"shodan": {"compromised": 5}, "vulncheck": {"c2_server": 3}, "blocklist_de": {"ftp": 1}}, "oid": "ORG-IHCL1-RIPE", "org": "INTERNATIONAL HOSTING COMPANY LIMITED", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://nuxt.cloud/"}, "pfx": 86, "reg": "2023-10-18", "rir": "ripencc", "s24": 86, "sib": 0, "tor": 0, "w24": 7, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 22016, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00139361100484}, {"a": 216129, "h": "GuardNetwork-AS", "n": "SEBEK sp. z o.o", "t": "Other", "w": 2, "cc": "PL", "cf": null, "cs": {"c": {"data_centre": 1, "first_seen_30d": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 2, "p": 0.3937, "hi": 6.03, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "crowdsec": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 5.418, 0.011, 0, false], ["2026-10-12", 2.376, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 0.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.376, "se": 0.969, "ts": 0.500, "map": 10.711, "obs": 2, "own": 6.325, "comp": {"cins": 4.6015, "dshield": -0.6286, "crowdsec": 1.8116, "vulncheck": -0.5174, "blocklist_de": -1.5022}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.671, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-SSZO131-RIPE", "org": "SEBEK sp. z o.o", "pdb": null, "pfx": 21, "reg": "2023-10-18", "rir": "ripencc", "s24": 21, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006618944226}, {"a": 216139, "h": "IRONHOST", "n": "IRONHOST", "t": "Hosting & VPS", "w": 3, "cc": "GB", "cf": null, "cs": {"c": {"data_centre": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 2}, "ev": {"shodan": {"n": 5, "p": 0.8725, "hi": 9.32, "lo": 2.32, "ips": 5, "mean": 5.32, "above": true}, "crowdsec": {"n": 2, "p": 0.3249, "hi": 5.43, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "phishing_db": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.215, 0.360, 0, false], ["2026-10-12", 0.968, 0.376, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.376, "se": 1.499, "ts": 1.000, "map": 3.478, "obs": 1, "own": 1.568, "comp": {"urlhaus": -0.1388, "threatfox": -0.1641, "phishing_db": 3.1757}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.968, "se": 0.918, "ts": 1.000, "map": 3.993, "obs": 2, "own": 0.814, "comp": {"cins": -0.3089, "dshield": -0.662, "crowdsec": 5.8739, "vulncheck": -0.5334, "blocklist_de": -1.5915}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.522, "det": {"shodan": {"compromised": 5}}, "oid": "ORG-IHCL4-RIPE", "org": "Iron Hosting Centre LTD", "pdb": {"t": "Content", "sc": "Europe", "tr": "20-50Gbps", "pol": "Open", "web": "https://ihc.host"}, "pfx": 60, "reg": "2023-10-17", "rir": "ripencc", "s24": 60, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 15360, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00073212649635}, {"a": 216154, "h": "CLODO", "n": "CLODO CLOUD SERVICE CO. L.L.C", "t": "Hosting & VPS", "w": 4, "cc": "AE", "cf": null, "cs": {"c": {"http_flood": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 20, "p": 1.0000, "hi": 24.29, "lo": 11.76, "ips": 20, "mean": 17.55, "above": true}, "dshield": {"n": 1, "p": 0.1780, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "crowdsec": {"n": 1, "p": 0.1132, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "blocklist_de": {"n": 2, "p": 0.3603, "hi": 5.73, "lo": 0.74, "ips": 2, "mean": 2.73, "above": false}}, "h2": [["2026-10-05", 3.145, 0.011, 0, false], ["2026-10-12", 2.620, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 0.214, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.620, "se": 0.666, "ts": 0.500, "map": 6.760, "obs": 4, "own": 1.340, "comp": {"cins": -0.7223, "dshield": 1.9693, "crowdsec": -1.9492, "vulncheck": -0.7536, "blocklist_de": 4.7606}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.575, "det": {"shodan": {"compromised": 20}, "blocklist_de": {"ftp": 1, "ssh": 1}}, "oid": "ORG-CCSC6-RIPE", "org": "CLODO CLOUD SERVICE CO. L.L.C", "pdb": null, "pfx": 25, "reg": "2023-10-13", "rir": "ripencc", "s24": 92, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 23552, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0024090490025}, {"a": 216155, "h": "MiridiaGame", "n": "MiridiaGame", "t": "Other", "w": 1, "cc": "FR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 1.099, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.099, "se": 1.615, "ts": 1.000, "map": 15.896, "obs": 1, "own": 13.183, "comp": {"cins": -0.0436, "dshield": 4.9765, "crowdsec": -0.4147, "vulncheck": -0.1299, "blocklist_de": -0.2285}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-MS903-RIPE", "org": "MIRIDIA SASU", "pdb": null, "pfx": 2, "reg": "2023-10-13", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 216190, "h": "OCASDEV", "n": "OCASDEV", "t": "Hosting & VPS", "w": 0, "cc": "FR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.718, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-FNS23-RIPE", "org": "FBW NETWORKS SAS", "pdb": {"t": "Network Services", "sc": "Europe", "tr": "5-10Gbps", "pol": "Open", "web": "https://as216190.net"}, "pfx": 1, "reg": "2023-10-10", "rir": "ripencc", "s24": 1, "sib": 4, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 216246, "h": "RU-AEZA-AS", "n": "Aéza (RU)", "t": "Hosting & VPS", "w": 9, "cc": "RU", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 3, "web_bruteforce": 3, "cve:CVE-2017-9841": 3, "cve:CVE-2018-13379": 3, "cve:CVE-2018-20062": 3}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1508, "hi": 4.23, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}, "crowdsec": {"n": 3, "p": 0.5465, "hi": 6.73, "lo": 1.19, "ips": 3, "mean": 3.47, "above": false}, "threatfox": {"n": 3, "p": 0.6414, "hi": 7.69, "lo": 1.35, "ips": 3, "mean": 3.97, "above": false}, "vulncheck": {"n": 3, "p": 0.6271, "hi": 7.53, "lo": 1.33, "ips": 3, "mean": 3.88, "above": false}}, "h2": [["2026-10-05", 3.145, 4.107, 0, false], ["2026-10-12", 4.350, 3.934, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 3.934, "se": 1.005, "ts": 1.000, "map": 13.595, "obs": 3, "own": 5.047, "comp": {"urlhaus": -0.4615, "threatfox": 5.3679, "phishing_db": -0.6705}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 3, "blocklist_de": 0}, "lo": 4.350, "se": 0.601, "ts": 0.500, "map": 9.841, "obs": 6, "own": 1.970, "comp": {"cins": -0.6619, "dshield": -1.2425, "crowdsec": 5.2737, "vulncheck": 3.6472, "blocklist_de": -3.3363}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.540, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:Mirai": 1, "family:Evilginx": 1, "family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 3}}, "oid": "ORG-AGL40-RIPE", "org": "Aeza Group LLC", "pdb": {"t": "NSP", "sc": "Europe", "tr": "0-20Mbps", "pol": "Selective", "web": "https://aeza.ru"}, "pfx": 57, "reg": "2023-09-27", "rir": "ripencc", "s24": 57, "sib": 0, "tor": 0, "w24": 8, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14592, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00167805959475}, {"a": 216471, "h": "DEVOUT", "n": "Devout BV", "t": "Other", "w": 0, "cc": "BE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.820, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-DB234-RIPE", "org": "Devout BV", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://example.com"}, "pfx": 3, "reg": "2023-08-14", "rir": "ripencc", "s24": 3, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000708523825}, {"a": 216472, "h": "HS-SYR", "n": "High Speed For Internet Services L.L.C", "t": "Broadband & mobile", "w": 38, "cc": "SY", "cf": {"rb": "lo", "wb": "lo", "rep": 9.42, "waf": 2.15}, "cs": {"c": {"http_flood": 27, "web_exploit": 25, "bad_crawling": 10, "proxy_or_vpn": 24, "ssh_bruteforce": 14, "web_bruteforce": 29, "home_connection": 2, "mail_bruteforce": 9, "router_or_botnet": 32, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4396": 4, "cve:CVE-2026-8181": 1, "cve:CVE-2018-10562": 1, "cve:CVE-2024-28000": 5}, "n": 35}, "ev": {"dshield": {"n": 2, "p": 0.4085, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "crowdsec": {"n": 14, "p": 1.0000, "hi": 19.74, "lo": 8.34, "ips": 35, "mean": 13.53, "above": true}, "blocklist_de": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 26.477, 0.011, 1, false], ["2026-10-12", 32.550, 0.012, 1, false]], "sh": false, "uc": 6259.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 1.667, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 14, "vulncheck": 0, "blocklist_de": 1}, "lo": 32.550, "se": 0.428, "ts": 0.824, "map": 55.517, "obs": 17, "own": 84.842, "comp": {"cins": -1.8489, "dshield": 0.8744, "crowdsec": 13.254, "vulncheck": -0.9281, "blocklist_de": -5.9411}, "mass": 12.5, "listed": false}}, "abq": false, "bot": 0.344, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-HSFI2-RIPE", "org": "High Speed For Internet Services L.L.C", "pdb": null, "pfx": 41, "reg": "2025-09-09", "rir": "ripencc", "s24": 41, "sib": 0, "tor": 0, "w24": 14, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.02310174797693}, {"a": 216473, "h": "net-host", "n": "Bashinskii Vadim Ruslanovich", "t": "Hosting & VPS", "w": 4, "cc": "KZ", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "ssh_bruteforce": 3, "cve:CVE-2023-1389": 1, "cve:CVE-2024-4577": 1, "cve:CVE-2021-41773": 1}, "n": 4}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 66.039, 0.012, 1, false], ["2026-10-12", 20.116, 0.013, 1, false]], "sh": false, "uc": 34375, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 20.116, "se": 1.145, "ts": 0.500, "map": 128.967, "obs": 2, "own": 27.480, "comp": {"cins": -0.1718, "dshield": -0.3896, "crowdsec": 3.1085, "vulncheck": -0.3789, "blocklist_de": 4.085}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.573, "det": {"blocklist_de": {"ssh": 1}}, "oid": "ORG-BVR4-RIPE", "org": "Bashinskii Vadim Ruslanovich", "pdb": null, "pfx": 1, "reg": "2025-07-10", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 216475, "h": "nktelecom", "n": "NKtelecom INC", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3802, "hi": 5.90, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.067, "ts": null, "map": 0.192, "obs": 0, "own": 1.763, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.897, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.433, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-NI123-RIPE", "org": "NKtelecom INC", "pdb": null, "pfx": 26, "reg": "2023-08-14", "rir": "ripencc", "s24": 31, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218391, "h": null, "n": "MRS BILISIM VE TELEKOMUNIKASYON HIZMETLERI LIMITED SIRKETI", "t": "Broadband & mobile", "w": 3, "cc": "TR", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "vulncheck": {"n": 2, "p": 0.4207, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-12", 8.687, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 2, "blocklist_de": 0}, "lo": 8.687, "se": 0.826, "ts": 0.667, "map": 29.129, "obs": 3, "own": 47.441, "comp": {"cins": -0.2656, "dshield": -0.5794, "crowdsec": 2.0783, "vulncheck": 4.9045, "blocklist_de": -1.3724}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.799, "det": {"vulncheck": {"botnet_node": 1, "attack_tooling": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 7, "reg": "2026-10-15", "rir": "ripencc", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218568, "h": "SGP22-AS", "n": "Shabalov Grigoriy Pavlovich", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.597, "det": null, "oid": "ORG-SGP22-RIPE", "org": "Shabalov Grigoriy Pavlovich", "pdb": null, "pfx": 4, "reg": "2026-09-28", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218688, "h": "WL661-AS", "n": "WULDI LLC", "t": "Other", "w": 8, "cc": "GE", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 6, "bad_crawling": 5, "ssh_bruteforce": 1, "web_bruteforce": 6, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 1, "cve:CVE-2018-13379": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2026-63030": 3}, "n": 6}, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "urlhaus": {"n": 2, "p": 0.4229, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 3.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4143, "hi": 6.21, "lo": 0.81, "ips": 6, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 32.308, 17.784, 1, false], ["2026-10-12", 6.346, 18.780, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 2, "threatfox": 0, "phishing_db": 0}, "lo": 18.780, "se": 1.337, "ts": 1.000, "map": 141.388, "obs": 2, "own": 133.075, "comp": {"urlhaus": 7.5552, "threatfox": -0.3351, "phishing_db": -0.6424}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.346, "se": 1.035, "ts": 1.000, "map": 32.708, "obs": 2, "own": 19.460, "comp": {"cins": -0.2156, "dshield": -0.48, "crowdsec": 7.1311, "vulncheck": -0.4369, "blocklist_de": -1.1174}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.839, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-WL661-RIPE", "org": "WULDI LLC", "pdb": null, "pfx": 5, "reg": "2026-09-11", "rir": "ripencc", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218731, "h": "Andris-Jakovlevs", "n": "Andris Jakovlevs", "t": "Other", "w": 8, "cc": "LV", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1895, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "threatfox": {"n": 7, "p": 0.9877, "hi": 13.07, "lo": 3.96, "ips": 7, "mean": 7.95, "above": true}}, "h2": [["2026-10-05", 0.263, 14.678, 1, false], ["2026-10-12", 0.282, 17.777, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 7, "phishing_db": 0}, "lo": 17.777, "se": 0.809, "ts": 1.000, "map": 43.038, "obs": 7, "own": 38.693, "comp": {"urlhaus": -0.8881, "threatfox": 7.1761, "phishing_db": -0.8997}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.282, "se": 1.280, "ts": 1.000, "map": 2.317, "obs": 1, "own": 1.502, "comp": {"cins": -0.1278, "dshield": 4.5072, "crowdsec": -1.1695, "vulncheck": -0.3095, "blocklist_de": -0.6662}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.596, "det": {"threatfox": {"family:Remcos": 1, "family:PureRAT": 4, "family:AsyncRAT": 1, "family:Unknown malware": 1}}, "oid": "ORG-AJ160-RIPE", "org": "Andris Jakovlevs", "pdb": null, "pfx": 41, "reg": "2026-09-09", "rir": "ripencc", "s24": 41, "sib": 0, "tor": 1, "w24": 7, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 10496, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00020462878072}, {"a": 218732, "h": "rapidoserver", "n": "Sajjad Khazaei", "t": "Hosting & VPS", "w": 0, "cc": "IR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.767, "det": null, "oid": "ORG-SK390-RIPE", "org": "Sajjad Khazaei", "pdb": null, "pfx": 6, "reg": "2026-09-09", "rir": "ripencc", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007197239145}, {"a": 218736, "h": "H1CLOUD", "n": "H1CLOUD LTD", "t": "Hosting & VPS", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.498, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-HL420-RIPE", "org": "H1CLOUD LTD", "pdb": null, "pfx": 4, "reg": "2026-09-08", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218785, "h": "TC-DATACENTER", "n": "TC DATACENTER LIMITED", "t": "Hosting & VPS", "w": 59, "cc": "HK", "cf": {"rb": null, "wb": "lo", "rep": null, "waf": 3.85}, "cs": {"c": {"http_flood": 55, "web_exploit": 55, "bad_crawling": 53, "first_seen_30d": 11, "ssh_bruteforce": 15, "web_bruteforce": 51, "cve:CVE-2021-3129": 14, "cve:CVE-2024-0012": 20, "cve:CVE-2021-26086": 9, "cve:CVE-2021-41773": 11, "cve:CVE-2022-22947": 10}, "n": 55}, "ev": {"dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 55, "mean": 2.98, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 25, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 97.665, 0.011, 1, false], ["2026-10-12", 141.870, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 141.870, "se": 0.603, "ts": 0.333, "map": 327.375, "obs": 6, "own": 64.384, "comp": {"cins": -0.7539, "dshield": 1.8629, "crowdsec": 1.0144, "vulncheck": 0.5394, "blocklist_de": 4.5219}, "mass": 3.6, "listed": false}}, "abq": false, "bot": 0.982, "det": {"vulncheck": {"botnet_node": 1, "other_infrastructure": 1}, "blocklist_de": {"bots": 3, "apache": 22, "bruteforcelogin": 17}}, "oid": "ORG-TDL21-RIPE", "org": "TC DATACENTER LIMITED", "pdb": null, "pfx": 2, "reg": "2026-09-02", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02339109447648}, {"a": 218850, "h": "SETURA-YAZILIM", "n": "SETURA YAZILIM VE TICARET LIMITED SIRKETI", "t": "Other", "w": 3, "cc": "TR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.351, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.351, "se": 1.705, "ts": 1.000, "map": 21.964, "obs": 1, "own": 20.517, "comp": {"cins": -0.0302, "dshield": 5.0543, "crowdsec": -0.2892, "vulncheck": -0.0934, "blocklist_de": -0.1585}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-SA5625-RIPE", "org": "SETURA YAZILIM VE TICARET LIMITED SIRKETI", "pdb": null, "pfx": 1, "reg": "2026-08-27", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218931, "h": "HOSTSTACK-PRO", "n": "HOSTSTACK-PRO", "t": "Hosting & VPS", "w": 6, "cc": "IN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 6, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.385, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.385, "se": 1.717, "ts": 1.000, "map": 22.773, "obs": 1, "own": 7.569, "comp": {"cins": -0.0313, "dshield": -0.0755, "crowdsec": -0.2996, "vulncheck": -0.0965, "blocklist_de": 5.0223}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.978, "det": {"blocklist_de": {"ssh": 6}}, "oid": "ORG-HOPL1-RIPE", "org": "HOSTSTACK (OPC) PRIVATE LIMITED", "pdb": {"t": "Network Services", "sc": "Asia Pacific", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.hoststack.pro/"}, "pfx": 1, "reg": "2026-08-18", "rir": "ripencc", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 218986, "h": "SnowcoreInc", "n": "Snowcore Inc", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.908, "det": null, "oid": "ORG-SI347-RIPE", "org": "Snowcore Inc", "pdb": null, "pfx": 2, "reg": "2026-08-11", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219067, "h": "CHIARA-AS", "n": "Chiara Conti", "t": "Other", "w": 7, "cc": "IT", "cf": null, "cs": null, "ev": {"threatfox": {"n": 2, "p": 0.4230, "hi": 6.29, "lo": 0.82, "ips": 7, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.999, 0, false], ["2026-10-12", 0.013, 14.381, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 14.381, "se": 1.292, "ts": 1.000, "map": 97.757, "obs": 2, "own": 91.671, "comp": {"urlhaus": -0.1304, "threatfox": 6.6249, "phishing_db": -0.2858}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.901, "det": {"threatfox": {"family:DCRat": 2, "family:PureRAT": 5}}, "oid": "ORG-CC1023-RIPE", "org": "Chiara Conti", "pdb": null, "pfx": 2, "reg": "2026-08-04", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219200, "h": "CRYPHORA-AS", "n": "Cryphora Limited", "t": "Other", "w": 4, "cc": "GB", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}, "threatfox": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "phishing_db": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.860, 11.849, 1, false], ["2026-10-12", 0.951, 11.864, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 11.864, "se": 1.270, "ts": 0.500, "map": 77.009, "obs": 2, "own": 72.246, "comp": {"urlhaus": -0.153, "threatfox": 3.0596, "phishing_db": 3.0635}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.871, "det": {"threatfox": {"family:AdaptixC2": 1}}, "oid": "ORG-CL851-RIPE", "org": "Cryphora Limited", "pdb": null, "pfx": 3, "reg": "2026-07-15", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000025874244}, {"a": 219202, "h": "NEUROSIGNAL-AS", "n": "NEUROSIGNAL LLC", "t": "Other", "w": 0, "cc": "RU", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.540, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.609, "det": null, "oid": "ORG-NL713-RIPE", "org": "NEUROSIGNAL LLC", "pdb": null, "pfx": 10, "reg": "2026-07-15", "rir": "ripencc", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000010591776}, {"a": 219307, "h": "TV-Plus", "n": "TV Plus", "t": "Other", "w": 0, "cc": "LB", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.085, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-MTAS4-RIPE", "org": "Multi Technology Access S.A.L", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://wavesandrights.com/"}, "pfx": 2, "reg": "2026-06-30", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219326, "h": "SULAVIL", "n": "SULAVI LTD", "t": "Other", "w": 2, "cc": "GB", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.007, 0.911, 0, false], ["2026-10-12", 31.856, 0.013, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 31.856, "se": 0.860, "ts": 0.333, "map": 115.971, "obs": 3, "own": 68.477, "comp": {"cins": 4.5831, "dshield": 3.6484, "crowdsec": -2.5441, "vulncheck": 2.0048, "blocklist_de": -1.5451}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.788, "det": {"shodan": {"c2": 1}, "vulncheck": {"c2_server": 1}}, "oid": "ORG-SL1438-RIPE", "org": "SULAVI LTD", "pdb": null, "pfx": 2, "reg": "2026-06-29", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219329, "h": "ASN-FEIT", "n": "FLASH EDGE INFORMATION TECHNOLOGY LLC", "t": "Other", "w": 1, "cc": "AE", "cf": {"rb": "lo", "wb": null, "rep": 1.62, "waf": null}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-12", 0.231, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 0.623, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.231, "se": 1.250, "ts": 1.000, "map": 1.794, "obs": 1, "own": 1.149, "comp": {"cins": -0.1396, "dshield": 4.4444, "crowdsec": -1.2704, "vulncheck": -0.3294, "blocklist_de": -0.727}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.504, "det": {"blocklist_de": {"bots": 2}}, "oid": "ORG-FEIT1-RIPE", "org": "FLASH EDGE INFORMATION TECHNOLOGY LLC", "pdb": null, "pfx": 58, "reg": "2026-06-29", "rir": "ripencc", "s24": 58, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00464140496864}, {"a": 219337, "h": "PLAY2GO", "n": "PLAY2GO - FZCO", "t": "Enterprise, edu & gov", "w": 6, "cc": "AE", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1901, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 2, "p": 0.3566, "hi": 5.70, "lo": 0.74, "ips": 2, "mean": 2.72, "above": false}, "urlhaus": {"n": 1, "p": 0.1971, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1479, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "threatfox": {"n": 3, "p": 0.6422, "hi": 7.70, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}, "blocklist_de": {"n": 3, "p": 0.6120, "hi": 7.37, "lo": 1.30, "ips": 3, "mean": 3.80, "above": false}}, "h2": [["2026-10-05", 1.280, 19.747, 1, false], ["2026-10-12", 7.478, 9.715, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 0}, "lo": 9.715, "se": 0.949, "ts": 0.750, "map": 30.816, "obs": 4, "own": 121.653, "comp": {"urlhaus": 2.677, "threatfox": 3.2381, "phishing_db": -0.8609}, "mass": 2.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 7.478, "se": 0.616, "ts": 0.600, "map": 17.670, "obs": 5, "own": 99.220, "comp": {"cins": 3.1812, "dshield": -1.614, "crowdsec": -3.4766, "vulncheck": -0.8129, "blocklist_de": 6.9878}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.586, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Hook": 1, "family:Mirai": 2}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-PF140-RIPE", "org": "PLAY2GO - FZCO", "pdb": {"t": "Enterprise", "sc": "Europe", "tr": "300-500Gbps", "pol": "Open", "web": "https://play2go.cloud"}, "pfx": 49, "reg": "2026-06-26", "rir": "ripencc", "s24": 49, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00078626788256}, {"a": 219399, "h": "US-SERVINGA", "n": "servinga GmbH", "t": "Other", "w": 3, "cc": "DE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "threatfox": {"n": 2, "p": 0.4219, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.492, 0.610, 0, false], ["2026-10-12", 0.513, 4.764, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 4.764, "se": 1.199, "ts": 1.000, "map": 25.577, "obs": 2, "own": 24.720, "comp": {"urlhaus": -0.2157, "threatfox": 5.5015, "phishing_db": -0.4179}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.513, "se": 1.394, "ts": 1.000, "map": 5.178, "obs": 1, "own": 3.557, "comp": {"cins": -0.0913, "dshield": -0.2145, "crowdsec": 4.0618, "vulncheck": -0.2407, "blocklist_de": -0.4771}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.631, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1, "family:Evilginx": 1}}, "oid": "ORG-SG288-RIPE", "org": "servinga GmbH", "pdb": null, "pfx": 10, "reg": "2026-06-19", "rir": "ripencc", "s24": 13, "sib": 5, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219469, "h": "PRIVATEBYTE-MNT", "n": "PrivateByte Ltd", "t": "Other", "w": 0, "cc": "GB", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 15136.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.788, "det": null, "oid": "ORG-PL620-RIPE", "org": "PrivateByte Ltd", "pdb": null, "pfx": 4, "reg": "2026-06-11", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219499, "h": "ZUNGWAICLOUD", "n": "HK ZUNGWAI CLOUD LIMITED", "t": "Hosting & VPS", "w": 0, "cc": "HK", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-ZWCL1-RIPE", "org": "HK ZUNGWAI CLOUD LIMITED", "pdb": null, "pfx": 3, "reg": "2026-06-09", "rir": "ripencc", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219501, "h": "XYTOR-AS", "n": "Illia Kravtsov", "t": "Other", "w": 0, "cc": "UA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.592, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-IK79-RIPE", "org": "Illia Kravtsov", "pdb": null, "pfx": 2, "reg": "2026-06-09", "rir": "ripencc", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 219502, "h": "STORMCLOUD-AS", "n": "Storm Industries LLC", "t": "Hosting & VPS", "w": 81, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 30, "data_centre": 18, "web_exploit": 38, "bad_crawling": 17, "first_seen_30d": 1, "ssh_bruteforce": 44, "web_bruteforce": 15, "cve:CVE-2017-9841": 5, "cve:CVE-2023-1389": 4, "cve:CVE-2024-3721": 4, "cve:CVE-2024-6387": 8, "cve:CVE-2025-55182": 4}, "n": 49}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "dshield": {"n": 2, "p": 0.4217, "hi": 6.28, "lo": 0.82, "ips": 14, "mean": 2.99, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 27, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 49, "mean": 2.97, "above": false}, "threatfox": {"n": 2, "p": 0.4228, "hi": 6.29, "lo": 0.82, "ips": 4, "mean": 3.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 5, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 26.869, 34.842, 1, false], ["2026-10-12", 96.436, 41.191, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 2, "phishing_db": 0}, "lo": 41.191, "se": 1.058, "ts": 0.667, "map": 169.355, "obs": 3, "own": 59.275, "comp": {"urlhaus": 3.6022, "threatfox": 3.7854, "phishing_db": -0.6294}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 2}, "lo": 96.436, "se": 0.562, "ts": 0.286, "map": 205.955, "obs": 7, "own": 40.373, "comp": {"cins": -0.909, "dshield": 4.3168, "crowdsec": -0.3394, "vulncheck": 0.2867, "blocklist_de": 3.3663}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.939, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Mirai": 1, "family:Aisuru": 1, "family:CECbot": 1, "family:AdaptixC2": 1}, "vulncheck": {"other_infrastructure": 4}, "blocklist_de": {"ssh": 3, "bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-SI335-RIPE", "org": "Storm Industries LLC", "pdb": null, "pfx": 4, "reg": "2026-06-09", "rir": "ripencc", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00127274156755}, {"a": 262186, "h": "", "n": "TV AZTECA SUCURSAL COLOMBIA", "t": "Hosting & VPS", "w": 9, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 3, "mail_bruteforce": 3, "router_or_botnet": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 6}, "ev": {"crowdsec": {"n": 6, "p": 0.7004, "hi": 6.57, "lo": 1.82, "ips": 6, "mean": 3.88, "above": false}, "blocklist_de": {"n": 6, "p": 0.8923, "hi": 8.95, "lo": 2.48, "ips": 7, "mean": 5.29, "above": true}}, "h2": [["2026-10-05", 2.499, 0.010, 0, false], ["2026-10-12", 4.100, 0.011, 0, false]], "sh": false, "uc": 525.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.929, "ts": null, "map": 0.166, "obs": 0, "own": 0.152, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 6}, "lo": 4.100, "se": 0.467, "ts": 0.500, "map": 7.354, "obs": 12, "own": 1.441, "comp": {"cins": -1.8223, "dshield": -2.4295, "crowdsec": 0.4844, "vulncheck": -0.9261, "blocklist_de": 8.0825}, "mass": 12.3, "listed": false}}, "abq": false, "bot": 0.326, "det": {"blocklist_de": {"ssh": 2, "bots": 2, "imap": 3, "mail": 3}}, "oid": "@aut-262186-LACNIC", "org": "TV AZTECA SUCURSAL COLOMBIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "http://aztecacomunicaciones.com/"}, "pfx": 277, "reg": "2012-07-16", "rir": "lacnic", "s24": 302, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 144896, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00578929387482}, {"a": 262191, "h": "", "n": "COLUMBUS NETWORKS COLOMBIA", "t": "Hosting & VPS", "w": 11, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 1, "web_exploit": 5, "proxy_or_vpn": 5, "ssh_bruteforce": 2, "web_bruteforce": 6, "router_or_botnet": 7, "cve:CVE-2025-4396": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 9}, "ev": {"crowdsec": {"n": 9, "p": 0.9554, "hi": 8.87, "lo": 3.06, "ips": 9, "mean": 5.65, "above": true}, "vulncheck": {"n": 1, "p": 0.1406, "hi": 4.12, "lo": 0.31, "ips": 1, "mean": 1.74, "above": false}, "blocklist_de": {"n": 2, "p": 0.2482, "hi": 4.80, "lo": 0.62, "ips": 2, "mean": 2.29, "above": false}}, "h2": [["2026-10-05", 1.413, 0.010, 0, false], ["2026-10-12", 3.326, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.932, "ts": null, "map": 0.166, "obs": 0, "own": 0.154, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 9, "vulncheck": 1, "blocklist_de": 2}, "lo": 3.326, "se": 0.471, "ts": 0.750, "map": 6.046, "obs": 12, "own": 1.187, "comp": {"cins": -1.5738, "dshield": -2.237, "crowdsec": 8.6823, "vulncheck": -0.3282, "blocklist_de": -1.3502}, "mass": 9.7, "listed": false}}, "abq": false, "bot": 0.224, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-262191-LACNIC", "org": "LIBERTY NETWORKS DE COLOMBIA S.A.S", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.cwnetworks.com"}, "pfx": 236, "reg": "2011-10-03", "rir": "lacnic", "s24": 290, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 78080, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0103588519851}, {"a": 262210, "h": "", "n": "VIETTEL PERU", "t": "Broadband & mobile", "w": 4, "cc": "PE", "cf": null, "cs": {"c": {"http_flood": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.1186, "hi": 3.72, "lo": 0.48, "ips": 2, "mean": 1.77, "above": false}, "vulncheck": {"n": 2, "p": 0.3380, "hi": 5.54, "lo": 0.72, "ips": 2, "mean": 2.64, "above": false}}, "h2": [["2026-10-12", 0.640, 0.011, 0, false]], "sh": false, "uc": 312.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 1.030, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 2, "blocklist_de": 0}, "lo": 0.640, "se": 0.680, "ts": 0.500, "map": 1.655, "obs": 4, "own": 2.634, "comp": {"cins": -0.5258, "dshield": -1.0366, "crowdsec": 3.2983, "vulncheck": 2.8341, "blocklist_de": -2.6727}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.074, "det": {"vulncheck": {"c2_server": 2}}, "oid": "@aut-262210-LACNIC", "org": "VIETTEL PERÚ S.A.C.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": null, "pol": "Open", "web": "https://www.bitel.com.pe"}, "pfx": 148, "reg": "2012-01-11", "rir": "lacnic", "s24": 260, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 148736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.02301615468756}, {"a": 262215, "h": "", "n": "ITELKOM", "t": "Broadband & mobile", "w": 0, "cc": "CO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 483.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 1.658, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.194, "obs": 0, "own": 0.771, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.236, "det": null, "oid": "@aut-262215-LACNIC", "org": "ITELKOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.itelkom.co"}, "pfx": 39, "reg": "2012-02-01", "rir": "lacnic", "s24": 42, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046134001335}, {"a": 262220, "h": "", "n": "HV TELEVISION S.A.S", "t": "Other", "w": 0, "cc": "CO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 915.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.720, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.960, "ts": null, "map": 0.207, "obs": 0, "own": 0.339, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "@aut-263210-LACNIC", "org": "HV TELEVISION S.A.S", "pdb": null, "pfx": 14, "reg": "2012-09-27", "rir": "lacnic", "s24": 29, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0005834579833}, {"a": 262287, "h": "", "n": "Latitude.sh AS262287", "t": "Hosting & VPS", "w": 227, "cc": "BR", "cf": {"rb": "hi", "wb": "hi", "rep": 1.08, "waf": 0.94}, "cs": {"c": {"http_flood": 203, "data_centre": 65, "web_exploit": 209, "bad_crawling": 50, "proxy_or_vpn": 25, "ssh_bruteforce": 9, "web_bruteforce": 227, "home_connection": 7, "mail_bruteforce": 25, "cve:CVE-2017-9841": 89, "cve:CVE-2017-16894": 74, "cve:CVE-2019-17050": 74, "cve:CVE-2023-49103": 91, "cve:CVE-2026-63030": 39}, "n": 227}, "ev": {"shodan": {"n": 1, "p": 0.0125, "hi": 2.23, "lo": 0.17, "ips": 1, "mean": 0.94, "above": false}, "crowdsec": {"n": 5, "p": 0.2747, "hi": 4.37, "lo": 1.09, "ips": 227, "mean": 2.50, "above": false}}, "h2": [["2026-10-05", 1.026, 0.009, 0, false], ["2026-10-12", 0.637, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.887, "ts": null, "map": 0.151, "obs": 0, "own": 0.126, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.637, "se": 0.597, "ts": 1.000, "map": 1.441, "obs": 5, "own": 0.285, "comp": {"cins": -0.8527, "dshield": -1.5001, "crowdsec": 9.151, "vulncheck": -0.791, "blocklist_de": -4.2483}, "mass": 4.3, "listed": false}}, "abq": false, "bot": 0.523, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-262287-LACNIC", "org": "Latitude.sh LTDA", "pdb": {"t": "Content", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://latitude.sh"}, "pfx": 300, "reg": "2012-07-04", "rir": "lacnic", "s24": 528, "sib": 0, "tor": 0, "w24": 5, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 137216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.067994}, {"a": 262298, "h": "", "n": "Maikol Campanini Informatica Me", "t": "Other", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 2, "p": 0.4146, "hi": 6.22, "lo": 0.81, "ips": 4, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 3.259, 0.011, 0, false], ["2026-10-12", 9.429, 0.012, 0, false]], "sh": false, "uc": 2050.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 9.429, "se": 0.799, "ts": 0.667, "map": 31.210, "obs": 3, "own": 17.911, "comp": {"cins": -0.4648, "dshield": -0.9375, "crowdsec": 0.1443, "vulncheck": -0.6436, "blocklist_de": 6.736}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.182, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-262298-LACNIC", "org": "Maikol Campanini Informatica Me", "pdb": null, "pfx": 12, "reg": "2012-07-16", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262321, "h": "", "n": "Conectwave Serviços e Internet Ltda", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 7812.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.238, "det": null, "oid": "@aut-262321-LACNIC", "org": "Conectwave Serviços e Internet Ltda", "pdb": null, "pfx": 5, "reg": "2011-12-20", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262328, "h": "", "n": "Constel Tecnologia", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.506, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262328-LACNIC", "org": "CONSTEL TECNOLOGIA LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": null, "pol": "Open", "web": "https://www.constel.com.br"}, "pfx": 2, "reg": "2011-12-22", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262391, "h": "", "n": "Brasil TecPar (ALT/Acessoline)", "t": "Transit & backbone", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 3, "router_or_botnet": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 3, "p": 0.5639, "hi": 6.89, "lo": 1.21, "ips": 3, "mean": 3.56, "above": false}}, "h2": [["2026-10-05", 1.118, 0.011, 0, false], ["2026-10-12", 4.208, 0.012, 0, false]], "sh": false, "uc": 4105.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.047, "ts": null, "map": 0.190, "obs": 0, "own": 2.302, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.208, "se": 0.670, "ts": 0.750, "map": 10.925, "obs": 4, "own": 34.454, "comp": {"cins": -0.6136, "dshield": 2.3528, "crowdsec": 5.8619, "vulncheck": -0.7146, "blocklist_de": -3.1019}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.166, "det": null, "oid": "@family-8478", "org": "ACESSOLINE TELECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.acessoline.net.br"}, "pfx": 41, "reg": "2012-02-23", "rir": "lacnic", "s24": 47, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0017965560522}, {"a": 262399, "h": "", "n": "GLP Telecomunicações", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6242, "hi": 7.50, "lo": 1.32, "ips": 4, "mean": 3.87, "above": false}}, "h2": [["2026-10-05", 1.645, 0.011, 0, false], ["2026-10-12", 4.414, 0.012, 0, false]], "sh": false, "uc": 1086.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 4.414, "se": 0.778, "ts": 1.000, "map": 14.047, "obs": 3, "own": 22.006, "comp": {"cins": -0.5465, "dshield": -1.0692, "crowdsec": -4.2035, "vulncheck": -0.6856, "blocklist_de": 10.5408}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.219, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-262399-LACNIC", "org": "GLP Telecomunicações Ltda.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.glpnet.com.br"}, "pfx": 31, "reg": "2012-02-28", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23552, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262403, "h": "", "n": "NetWay Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 2.864, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.864, "se": 0.980, "ts": 0.500, "map": 13.299, "obs": 2, "own": 21.464, "comp": {"cins": -0.2765, "dshield": -0.6004, "crowdsec": 1.9646, "vulncheck": -0.5033, "blocklist_de": 3.3969}, "mass": 1.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-262403-LACNIC", "org": "Net Way Telecom LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.netwt.com.br"}, "pfx": 3, "reg": "2011-02-21", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262415, "h": "", "n": "OPEN PROCESSAMENTO DE DADOS", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.431, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.706, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262415-LACNIC", "org": "OPEN PROCESSAMENTO DE DADOS LTDA", "pdb": {"t": "Content", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.opendatacenter.com.br"}, "pfx": 16, "reg": "2011-03-14", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262426, "h": "", "n": "TELECOMUNICAÇÕES RONDONOPOLIS", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 5175.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.149, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-262426-LACNIC", "org": "TELECOMUNICAÇÕES RONDONOPOLIS LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "https://bravainternet.com.br"}, "pfx": 4, "reg": "2011-03-28", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262470, "h": "", "n": "Pontenet Teleinformática", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 1150.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.833, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.224, "det": null, "oid": "@aut-262470-LACNIC", "org": "Pontenet Teleinformática Ltda.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.pontenet.com.br"}, "pfx": 21, "reg": "2011-05-13", "rir": "lacnic", "s24": 36, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 17664, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262486, "h": "", "n": "PRODAM Processamento de Dados Amazonas", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.379, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-262486-LACNIC", "org": "PRODAM Processamento de Dados Amazonas S.A", "pdb": null, "pfx": 4, "reg": "2011-06-06", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262494, "h": "", "n": "VIRTEX TELECOM", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "blocklist_de": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.247, 0.011, 0, false], ["2026-10-12", 0.261, 0.012, 0, false]], "sh": false, "uc": 1201.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 1.584, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.261, "se": 1.269, "ts": 1.000, "map": 2.083, "obs": 1, "own": 3.682, "comp": {"cins": -0.1451, "dshield": -0.3329, "crowdsec": -1.3175, "vulncheck": -0.3384, "blocklist_de": 4.2614}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.120, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-262494-LACNIC", "org": "Virtex Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.virtex.com.br"}, "pfx": 49, "reg": "2011-06-08", "rir": "lacnic", "s24": 52, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 23552, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00323888030613}, {"a": 262520, "h": "", "n": "Prefeitura Municipal de Alfenas", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 5322.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.569, "det": null, "oid": "@aut-262520-LACNIC", "org": "Prefeitura Municipal de Alfenas", "pdb": null, "pfx": 5, "reg": "2011-07-05", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262543, "h": "", "n": "New Life Net", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 6640.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 38.610, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.204, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-262543-LACNIC", "org": "BRMOM CONSTRUINDO CONEXOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.minhanewlife.com.br"}, "pfx": 8, "reg": "2011-07-22", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262606, "h": "", "n": "MICROTELL (MELL)", "t": "Broadband & mobile", "w": 8, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4061, "hi": 6.14, "lo": 0.80, "ips": 8, "mean": 2.92, "above": false}}, "h2": [["2026-10-05", 0.365, 0.011, 0, false], ["2026-10-12", 2.264, 0.012, 0, false]], "sh": false, "uc": 3320.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.264, "se": 0.966, "ts": 1.000, "map": 10.218, "obs": 2, "own": 16.469, "comp": {"cins": -0.3157, "dshield": -0.6747, "crowdsec": -2.6618, "vulncheck": -0.5393, "blocklist_de": 7.9093}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.161, "det": {"blocklist_de": {"imap": 8, "mail": 8}}, "oid": "@aut-265157-LACNIC", "org": "MICROTELL SCM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.microtell.com.br"}, "pfx": 23, "reg": "2011-10-10", "rir": "lacnic", "s24": 24, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20992, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00143783972787}, {"a": 262609, "h": "", "n": "CL9 Tecnologias", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.738, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262609-LACNIC", "org": "CL9 Tecnologias Ltda.", "pdb": null, "pfx": 8, "reg": "2011-10-10", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262663, "h": "", "n": "METROFLEX", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1267, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 1, "p": 0.1132, "hi": 3.81, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "vulncheck": {"n": 1, "p": 0.1785, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "blocklist_de": {"n": 1, "p": 0.1591, "hi": 4.32, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 4.331, 0.011, 0, false], ["2026-10-12", 1.246, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.010, "ts": null, "map": 0.185, "obs": 0, "own": 1.382, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 1.246, "se": 0.770, "ts": 0.333, "map": 3.831, "obs": 3, "own": 6.122, "comp": {"cins": -0.4401, "dshield": -0.896, "crowdsec": 0.3675, "vulncheck": 1.3654, "blocklist_de": 2.3399}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.148, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-262663-LACNIC", "org": "METROFLEX TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Tbps", "pol": "Open", "web": "http://www.metroflex.com.br"}, "pfx": 96, "reg": "2009-06-04", "rir": "lacnic", "s24": 92, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00507236505762}, {"a": 262674, "h": "", "n": "Conquest Telecomunicações", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-12", 8.004, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 8.004, "se": 0.794, "ts": 1.000, "map": 26.133, "obs": 3, "own": 40.952, "comp": {"cins": -0.5127, "dshield": -1.0157, "crowdsec": -3.995, "vulncheck": -0.6692, "blocklist_de": 10.8495}, "mass": 2.4, "listed": false}}, "abq": false, "bot": 0.212, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-262674-LACNIC", "org": "Conquest Telecomunicações Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.conquesttelecom.com.br/"}, "pfx": 16, "reg": "2009-12-09", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 16640, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262761, "h": "", "n": "Sinal BR Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1768, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.269, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 1.604, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.269, "se": 1.274, "ts": 1.000, "map": 2.176, "obs": 1, "own": 3.855, "comp": {"cins": -0.1429, "dshield": -0.3282, "crowdsec": -1.2989, "vulncheck": -0.3349, "blocklist_de": 4.276}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-262761-LACNIC", "org": "Sinal Br Telecom Ltda", "pdb": {"t": "NSP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.sinalbr.com.br"}, "pfx": 49, "reg": "2010-07-30", "rir": "lacnic", "s24": 49, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262773, "h": "", "n": "PROXXIMA TELECOMUNICAÇÕES", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.0363, "hi": 2.78, "lo": 0.21, "ips": 1, "mean": 1.17, "above": false}, "crowdsec": {"n": 2, "p": 0.0797, "hi": 3.34, "lo": 0.43, "ips": 2, "mean": 1.59, "above": false}}, "h2": [["2026-10-05", 0.472, 0.010, 0, false], ["2026-10-12", 0.247, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.922, "ts": null, "map": 0.163, "obs": 0, "own": 0.953, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.247, "se": 0.858, "ts": 1.000, "map": 0.901, "obs": 2, "own": 1.434, "comp": {"cins": -0.379, "dshield": -0.7901, "crowdsec": 4.9914, "vulncheck": -0.5891, "blocklist_de": -1.9443}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.131, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-262773-LACNIC", "org": "PROXXIMA TELECOMUNICACOES SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.proxxima.net"}, "pfx": 341, "reg": "2010-08-30", "rir": "lacnic", "s24": 332, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 204032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0092340052413}, {"a": 262781, "h": "", "n": "RADIOBR INTERNET LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.179, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-262781-LACNIC", "org": "RADIOBR INTERNET LTDA", "pdb": null, "pfx": 4, "reg": "2010-09-03", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262787, "h": "", "n": "IPHOTEL Hospedagem de Sites", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.896, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262787-LACNIC", "org": "IPHOTEL Hospedagem de Sites Ltda", "pdb": {"t": "Content", "sc": "South America", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.iphotel.com.br"}, "pfx": 14, "reg": "2010-09-16", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262790, "h": "", "n": "Central Server Informática Ltda", "t": "Hosting & VPS", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "phishing_db": {"n": 1, "p": 0.1931, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.011, 0.479, 0, false], ["2026-10-12", 0.011, 0.499, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.499, "se": 1.561, "ts": 1.000, "map": 5.274, "obs": 1, "own": 2.426, "comp": {"urlhaus": -0.0995, "threatfox": -0.1263, "phishing_db": 3.5148}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.120, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.992, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262790-LACNIC", "org": "Central Server Informática Ltda", "pdb": {"t": "Content", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.centralserver.com.br"}, "pfx": 12, "reg": "2010-09-17", "rir": "lacnic", "s24": 28, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262797, "h": "", "n": "PROVALE SCM", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3751, "hi": 5.86, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 1.648, 0.011, 0, false], ["2026-10-12", 4.282, 0.012, 0, false]], "sh": false, "uc": 1464.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.282, "se": 0.776, "ts": 0.667, "map": 13.551, "obs": 3, "own": 21.238, "comp": {"cins": -0.4702, "dshield": -0.9465, "crowdsec": 3.9162, "vulncheck": -0.6467, "blocklist_de": 2.1474}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.165, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-262797-LACNIC", "org": "PROVALE SCM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.provale.com.br"}, "pfx": 53, "reg": "2010-10-04", "rir": "lacnic", "s24": 28, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31744, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00212118082638}, {"a": 262805, "h": "", "n": "Rede Minas Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2179.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.008, "ts": null, "map": 0.219, "obs": 0, "own": 1.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.216, "det": null, "oid": "@aut-262805-LACNIC", "org": "REDE MINAS TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.redeminastelecom.com.br"}, "pfx": 20, "reg": "2010-10-14", "rir": "lacnic", "s24": 19, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262808, "h": "", "n": "Brasilnet Telecom - Sudeste", "t": "Broadband & mobile", "w": 5, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1864, "hi": 4.61, "lo": 0.35, "ips": 4, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 0.197, 0.011, 0, false], ["2026-10-12", 0.863, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 1}, "lo": 0.863, "se": 0.938, "ts": 0.500, "map": 3.565, "obs": 2, "own": 5.905, "comp": {"cins": -0.2604, "dshield": -0.5691, "crowdsec": -2.2473, "vulncheck": 2.2392, "blocklist_de": 3.5022}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.196, "det": {"vulncheck": {"botnet_node": 4}, "blocklist_de": {"bots": 1}}, "oid": "@aut-262808-LACNIC", "org": "Brasilnet Telecomunicações Ltda ME", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Open", "web": "http://www.brasilnet.net.br"}, "pfx": 25, "reg": "2010-10-15", "rir": "lacnic", "s24": 56, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262831, "h": "", "n": "N G B Pires & CIA LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.146, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262831-LACNIC", "org": "N G B Pires & CIA LTDA", "pdb": null, "pfx": 6, "reg": "2010-11-22", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262851, "h": "", "n": "Plim Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.300, 0.012, 0, false]], "sh": false, "uc": 505, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 1.667, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.300, "se": 1.293, "ts": 1.000, "map": 2.508, "obs": 1, "own": 4.487, "comp": {"cins": 4.934, "dshield": -0.3176, "crowdsec": -1.2571, "vulncheck": -0.3269, "blocklist_de": -0.719}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.158, "det": null, "oid": "@aut-262851-LACNIC", "org": "PLIM TELECOMUNICACOES LTDA-ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.plimtelecom.com.br"}, "pfx": 9, "reg": "2010-12-10", "rir": "lacnic", "s24": 41, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 13056, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262873, "h": "", "n": "VETT - VIA EXPRESS TECNOLOGIA E TELECOMUNICACOES", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.443, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.252, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262873-LACNIC", "org": "VETT - VIA EXPRESS TECNOLOGIA E TELECOMUNICACOES", "pdb": null, "pfx": 7, "reg": "2017-10-11", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262888, "h": "", "n": "Lprint Telecomunicação e Engenharia", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}}, "h2": [["2026-10-12", 4.486, 0.012, 0, false]], "sh": false, "uc": 2490.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.486, "se": 1.009, "ts": 1.000, "map": 22.127, "obs": 2, "own": 35.813, "comp": {"cins": -0.2324, "dshield": -0.5139, "crowdsec": 6.8968, "vulncheck": -0.4567, "blocklist_de": -1.2033}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.200, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-262888-LACNIC", "org": "LPRINT TELECOMUNICAÇÕES E ENGENHARIA LTDA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.print.com.br"}, "pfx": 9, "reg": "2011-01-17", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262895, "h": "", "n": "Norte Line Telecomunicacoes", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.606, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4345.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.202, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-262895-LACNIC", "org": "Norte Line Telecomunicacoes Ltda.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.norteline.com.br"}, "pfx": 2, "reg": "2011-01-26", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262903, "h": "", "n": "Tubaron Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 865, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.942, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.211, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-262903-LACNIC", "org": "Tubaron Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Selective", "web": "http://www.tubaron.com.br"}, "pfx": 51, "reg": "2011-02-03", "rir": "lacnic", "s24": 28, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 25600, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262907, "h": "", "n": "Brasil TecPar (Avato)", "t": "Broadband & mobile", "w": 12, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.0198, "hi": 2.56, "lo": 0.45, "ips": 3, "mean": 1.32, "above": false}, "vulncheck": {"n": 1, "p": 0.0777, "hi": 3.39, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "blocklist_de": {"n": 9, "p": 0.9483, "hi": 8.63, "lo": 2.98, "ips": 9, "mean": 5.50, "above": true}}, "h2": [["2026-10-05", 0.687, 0.009, 0, false], ["2026-10-12", 1.958, 0.010, 0, false]], "sh": false, "uc": 59.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.858, "ts": null, "map": 0.139, "obs": 0, "own": 0.716, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 9}, "lo": 1.958, "se": 0.463, "ts": 0.692, "map": 3.492, "obs": 13, "own": 5.375, "comp": {"cins": -2.0245, "dshield": -2.5693, "crowdsec": -5.612, "vulncheck": -0.547, "blocklist_de": 13.3968}, "mass": 14.8, "listed": false}}, "abq": false, "bot": 0.185, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1, "bots": 7, "imap": 1, "mail": 1}}, "oid": "@aut-52674-LACNIC", "org": "BRASIL TECPAR / AMIGO / AVATO", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.brasiltecpar.com.br"}, "pfx": 531, "reg": "2011-02-14", "rir": "lacnic", "s24": 765, "sib": 1, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 540672, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.01028576388378}, {"a": 262916, "h": "", "n": "Mega Cable, S.A. de C.V.", "t": "Broadband & mobile", "w": 4, "cc": "MX", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 2, "home_connection": 3}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1255, "hi": 3.95, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "crowdsec": {"n": 3, "p": 0.1542, "hi": 3.90, "lo": 0.69, "ips": 3, "mean": 2.01, "above": false}}, "h2": [["2026-10-05", 0.665, 0.010, 0, false], ["2026-10-12", 0.651, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.914, "ts": null, "map": 0.160, "obs": 0, "own": 0.918, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.651, "se": 0.649, "ts": 0.750, "map": 1.615, "obs": 4, "own": 2.516, "comp": {"cins": -0.7014, "dshield": 2.0405, "crowdsec": 4.8077, "vulncheck": -0.7468, "blocklist_de": -3.527}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.561, "det": null, "oid": "@aut-262916-LACNIC", "org": "Mega Cable, S.A. de C.V.", "pdb": null, "pfx": 363, "reg": "2010-03-17", "rir": "lacnic", "s24": 372, "sib": 2, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 95232, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0058578619904}, {"a": 262954, "h": "", "n": "VirtuaServer Informatica", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.883, "det": {"shodan": {"compromised": 3}}, "oid": "@aut-262954-LACNIC", "org": "VirtuaServer Informatica Ltda", "pdb": {"t": "Content", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.VirtuaServer.com.br"}, "pfx": 8, "reg": "2013-06-25", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262968, "h": "", "n": "4B Digital Ltda", "t": "Enterprise, edu & gov", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 7.446, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.743, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-262968-LACNIC", "org": "4B Digital Ltda", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://4bdigital.com"}, "pfx": 4, "reg": "2013-07-10", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 262996, "h": "", "n": "MINAS TELECOMUNICACOES E INFORMATICA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": 2256.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 12.706, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.289, "det": null, "oid": "@aut-262996-LACNIC", "org": "MEGAMINAS TELECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.megaminastelecom.com.br/"}, "pfx": 9, "reg": "2012-05-15", "rir": "lacnic", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263016, "h": "", "n": "NDX Telecomunicacoes Ltda", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263016-LACNIC", "org": "NDX Net Servicos de Informatica Ltda.", "pdb": {"t": "NSP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.ndxtelecom.com"}, "pfx": 2, "reg": "2012-05-31", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263055, "h": "", "n": "Pinhais Net Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.183, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-265965-LACNIC", "org": "Pinhais Net Telecom Comercio e Serviços Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.pinhaistelecom.com.br"}, "pfx": 4, "reg": "2012-03-15", "rir": "lacnic", "s24": 16, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263062, "h": "", "n": "CDZNet Networks Ltda.", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263062-LACNIC", "org": "CDZNET DATACENTER LTDA", "pdb": {"t": "Content", "sc": "Global", "tr": "100-1000Mbps", "pol": "Selective", "web": "http://cdznet.com.br"}, "pfx": 2, "reg": "2012-03-19", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263108, "h": "", "n": "OPANET TELECOMUNICACOES LTDA - ME", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 3, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 4.579, 0.011, 0, false], ["2026-10-12", 5.141, 0.012, 0, false]], "sh": false, "uc": 5566.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 5.141, "se": 1.021, "ts": 1.000, "map": 25.709, "obs": 2, "own": 41.809, "comp": {"cins": -0.2678, "dshield": -0.5836, "crowdsec": -2.3041, "vulncheck": -0.4946, "blocklist_de": 8.2907}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.152, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-263108-LACNIC", "org": "OPANET TELECOMUNICACOES LTDA - ME", "pdb": null, "pfx": 7, "reg": "2014-05-06", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263114, "h": "", "n": "Kiwi Networks", "t": "Other", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1681, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.061, "ts": null, "map": 0.192, "obs": 0, "own": 0.694, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.937, "ts": null, "map": 0.201, "obs": 0, "own": 0.309, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.440, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263114-LACNIC", "org": "Kiwi Networks", "pdb": null, "pfx": 31, "reg": "2013-08-28", "rir": "lacnic", "s24": 35, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001206203648}, {"a": 263116, "h": "", "n": "HELP NET TELECOM E INFORMÁTICA LTDA - ME", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 1725.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 1.372, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.165, "det": null, "oid": "@aut-263116-LACNIC", "org": "HELP NET TELECOM E INFORMÁTICA LTDA - ME", "pdb": null, "pfx": 6, "reg": "2014-05-07", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263119, "h": "", "n": "BKup Ti e Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 5566.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.195, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-268410-LACNIC", "org": "BKup Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.bkup.com.br/"}, "pfx": 3, "reg": "2014-05-08", "rir": "lacnic", "s24": 4, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263133, "h": "", "n": "IPLink Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.176, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263133-LACNIC", "org": "LOL Conectividade Ltda", "pdb": null, "pfx": 5, "reg": "2014-05-14", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263137, "h": "", "n": "YUNE INFORMATICA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 1790.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 1.372, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.120, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-263137-LACNIC", "org": "YUNE NET TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.yunenet.com.br"}, "pfx": 8, "reg": "2014-05-14", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263150, "h": "", "n": "ANTONIO FRIAS SALAZAR", "t": "Other", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.171, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263150-LACNIC", "org": "ANTONIO FRIAS SALAZAR", "pdb": null, "pfx": 9, "reg": "2011-08-02", "rir": "lacnic", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001574334848}, {"a": 263237, "h": "", "n": "PowerHost Chile", "t": "Hosting & VPS", "w": 0, "cc": "CL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 0.315, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 0.169, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.912, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263237-LACNIC", "org": "PowerHost Telecom SPA", "pdb": {"t": null, "sc": "Global", "tr": "5-10Tbps", "pol": "Open", "web": "https://www.powerhost.cl"}, "pfx": 15, "reg": "2014-05-22", "rir": "lacnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6400, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002017730214}, {"a": 263238, "h": "", "n": "Fibramax", "t": "Broadband & mobile", "w": 4, "cc": "EC", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "mail_bruteforce": 2, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.5482, "hi": 6.75, "lo": 1.19, "ips": 3, "mean": 3.48, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 4.322, 0.011, 0, false], ["2026-10-12", 3.850, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 1.557, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.850, "se": 0.670, "ts": 0.750, "map": 9.923, "obs": 4, "own": 15.421, "comp": {"cins": -0.6566, "dshield": -1.2348, "crowdsec": 5.3372, "vulncheck": -0.7311, "blocklist_de": 0.9739}, "mass": 3.1, "listed": false}}, "abq": false, "bot": 0.276, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-263238-LACNIC", "org": "Eliana Vanessa Morocho Oña", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "300-500Gbps", "pol": "Selective", "web": "http://www.fibramax.ec"}, "pfx": 83, "reg": "2014-05-23", "rir": "lacnic", "s24": 56, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 32768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00809620190431}, {"a": 263242, "h": "", "n": "DIGITAL WORK", "t": "Broadband & mobile", "w": 1, "cc": "BO", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1960, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.514, 0.012, 0, false]], "sh": false, "uc": 1562.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.514, "se": 1.394, "ts": 1.000, "map": 5.194, "obs": 1, "own": 9.752, "comp": {"cins": -0.0916, "dshield": 4.7047, "crowdsec": -0.8521, "vulncheck": -0.2412, "blocklist_de": -0.4786}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.332, "det": null, "oid": "@aut-263242-LACNIC", "org": "DIGITAL WORK", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://vuela.bo"}, "pfx": 13, "reg": "2014-05-30", "rir": "lacnic", "s24": 13, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003668177352}, {"a": 263250, "h": "", "n": "Barbosa & Costa", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6213, "hi": 7.47, "lo": 1.32, "ips": 3, "mean": 3.85, "above": false}}, "h2": [["2026-10-05", 0.296, 0.011, 0, false], ["2026-10-12", 4.025, 0.012, 0, false]], "sh": false, "uc": 1161, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 4.025, "se": 0.776, "ts": 1.000, "map": 12.637, "obs": 3, "own": 19.797, "comp": {"cins": -0.5523, "dshield": -1.0783, "crowdsec": -4.2388, "vulncheck": -0.6883, "blocklist_de": 10.4879}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.136, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "@aut-263250-LACNIC", "org": "Barbosa & Costa Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://telecomprovider.com.br/site/"}, "pfx": 36, "reg": "2014-05-22", "rir": "lacnic", "s24": 36, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00237606664428}, {"a": 263256, "h": "", "n": "PROVEDOR DE INTERNET EXTREMA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4443.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.194, "det": null, "oid": "@aut-263256-LACNIC", "org": "PIX PROVEDOR DE INTERNET LTDA - ME", "pdb": {"t": null, "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://pixwifi.com.br/"}, "pfx": 14, "reg": "2014-05-22", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263284, "h": "", "n": "Topmega Internet e Informática LTDA -ME", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 12304.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.236, "det": null, "oid": "@aut-263284-LACNIC", "org": "MAXXIMO INFORMATICA E TELECOMUNICACAO LTDA", "pdb": null, "pfx": 4, "reg": "2014-04-16", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263292, "h": "", "n": "L E M TELECOMUNICAÇÕES", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "crowdsec": {"n": 1, "p": 0.1525, "hi": 4.25, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 1.172, 0.011, 0, false], ["2026-10-12", 1.238, 0.012, 0, false]], "sh": false, "uc": 541.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 1.642, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.238, "se": 0.930, "ts": 0.500, "map": 5.232, "obs": 2, "own": 8.377, "comp": {"cins": -0.2976, "dshield": 3.6581, "crowdsec": 1.7458, "vulncheck": -0.5233, "blocklist_de": -1.5346}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.119, "det": null, "oid": "@aut-263292-LACNIC", "org": "L E M TELECOMUNICAÇÕES LTDA -ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "200-300Gbps", "pol": "Open", "web": "https://jrtelecom.com.br/"}, "pfx": 11, "reg": "2014-04-25", "rir": "lacnic", "s24": 44, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0050569895397}, {"a": 263308, "h": "", "n": "Ntweb Internet", "t": "Enterprise, edu & gov", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.948, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 250.703, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.218, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-263308-LACNIC", "org": "NTWEB SOLUCOES EM INTERNET LTDA ME", "pdb": {"t": "Enterprise", "sc": "Regional", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.ntweb.com.br"}, "pfx": 7, "reg": "2014-02-18", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263331, "h": "", "n": "Netvox Telecomunicacoes LTDA", "t": "Broadband & mobile", "w": 5, "cc": "BR", "cf": null, "cs": null, "ev": {"threatfox": {"n": 3, "p": 0.6460, "hi": 7.74, "lo": 1.36, "ips": 4, "mean": 3.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.510, 13.218, 1, false], ["2026-10-12", 0.557, 13.039, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 3, "phishing_db": 0}, "lo": 13.039, "se": 1.007, "ts": 1.000, "map": 47.911, "obs": 3, "own": 108.696, "comp": {"urlhaus": -0.3556, "threatfox": 6.4301, "phishing_db": -0.579}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.557, "se": 1.414, "ts": 1.000, "map": 5.818, "obs": 1, "own": 11.088, "comp": {"cins": -0.0946, "dshield": -0.2219, "crowdsec": -0.8791, "vulncheck": -0.2474, "blocklist_de": 4.5976}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.207, "det": {"threatfox": {"family:DanaBot": 4}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-263331-LACNIC", "org": "Netvox Telecomunicacoes LTDA", "pdb": null, "pfx": 2, "reg": "2014-03-12", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263333, "h": "", "n": "VIPTURBO COMÉRCIO & SERVIÇOS DE INFORMÁTICA LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 20898.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.445, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.268, "det": null, "oid": "@aut-263333-LACNIC", "org": "VIPTURBO COMÉRCIO & SERVIÇOS DE INFORMÁTICA LTDA", "pdb": null, "pfx": 16, "reg": "2014-03-12", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263345, "h": "", "n": "Power Tech", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.201, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263345-LACNIC", "org": "Power Tech Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Tbps", "pol": "Open", "web": "https://www.powertech.psi.br"}, "pfx": 31, "reg": "2014-03-14", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263422, "h": "", "n": "AXXESS TELECOMUNICAÇÕES", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 5566.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.129, "det": null, "oid": "@aut-263422-LACNIC", "org": "AXES SERVICOS DE COMUNICACAO LTDA.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": null, "pol": "Open", "web": "http://www.axes.com.br"}, "pfx": 4, "reg": "2014-04-09", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263456, "h": "", "n": "MKNETWORK TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 18554.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.194, "det": null, "oid": "@aut-263456-LACNIC", "org": "MKNETWORK TELECOM LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.mknetwork.com.br"}, "pfx": 4, "reg": "2013-12-16", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263501, "h": "", "n": "INFORTECLINE TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 1318.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.181, "det": null, "oid": "@aut-263501-LACNIC", "org": "INFORTECLINE TELECOM", "pdb": null, "pfx": 28, "reg": "2013-12-26", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263522, "h": "", "n": "LGNET", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1870, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.491, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 1.327, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.155, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263522-LACNIC", "org": "LGNET SERVICOS DE TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://lgnetpb.com.br"}, "pfx": 13, "reg": "2014-01-13", "rir": "lacnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263530, "h": "", "n": "MICROSOL INFORMATICA LTDA - ME", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 7031.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.174, "det": null, "oid": "@aut-263530-LACNIC", "org": "MICROSOL INFORMATICA LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Open", "web": "http://msolnet.com.br/"}, "pfx": 6, "reg": "2014-01-16", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263541, "h": "", "n": "IMF Network", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263541-LACNIC", "org": "IMF NETWORK DATA LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": "20-50Gbps", "pol": "Selective", "web": "http://www.imfnetwork.com.br"}, "pfx": 5, "reg": "2014-01-27", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263548, "h": "", "n": "portal provedor de comunicações", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.484, 0.012, 0, false]], "sh": false, "uc": 1220.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.484, "se": 1.383, "ts": 1.000, "map": 4.801, "obs": 1, "own": 3.286, "comp": {"cins": -0.1039, "dshield": -0.2427, "crowdsec": -0.961, "vulncheck": -0.2657, "blocklist_de": 4.5357}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.216, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-263548-LACNIC", "org": "portal provedor de comunicações ltda", "pdb": {"t": null, "sc": "South America", "tr": null, "pol": "Open", "web": "http://www.portalcom.net.br"}, "pfx": 9, "reg": "2014-01-31", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263579, "h": "", "n": "iSUPER Telecom", "t": "Broadband & mobile", "w": 9, "cc": "BR", "cf": null, "cs": {"c": {"home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1190, "hi": 3.88, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "blocklist_de": {"n": 8, "p": 0.9935, "hi": 13.24, "lo": 4.31, "ips": 8, "mean": 8.26, "above": true}}, "h2": [["2026-10-05", 15.348, 0.011, 1, false], ["2026-10-12", 11.480, 0.012, 1, false]], "sh": false, "uc": 1711.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.016, "ts": null, "map": 0.186, "obs": 0, "own": 1.414, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 8}, "lo": 11.480, "se": 0.500, "ts": 0.889, "map": 22.058, "obs": 9, "own": 33.805, "comp": {"cins": -1.6304, "dshield": -2.2831, "crowdsec": -7.0153, "vulncheck": -0.91, "blocklist_de": 16.3261}, "mass": 10.2, "listed": false}}, "abq": false, "bot": 0.236, "det": {"blocklist_de": {"imap": 7, "mail": 8}}, "oid": "@aut-263579-LACNIC", "org": "ISUPER TELECOMUNICACOES INFO LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.isuper.com.br"}, "pfx": 20, "reg": "2013-08-14", "rir": "lacnic", "s24": 84, "sib": 0, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39936, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 263616, "h": "", "n": "Dez Solucoes em Telecomunicacoes", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1705, "hi": 4.44, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.883, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.165, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-263616-LACNIC", "org": "Dez Solucoes em Telecomunicacoes LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Selective", "web": "https://deztelecom.net.br"}, "pfx": 2, "reg": "2013-09-11", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263620, "h": "", "n": "Sertãonet Internet", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": 2929.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.164, "det": null, "oid": "@aut-263620-LACNIC", "org": "Sertaonet Internet Provider LTDA-ME", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.sertaonet.net.br"}, "pfx": 7, "reg": "2013-09-18", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263627, "h": "", "n": "Wnetsistem Comercio e Servicos de Informatica Ltda", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 1627.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.226, "det": null, "oid": "@aut-263627-LACNIC", "org": "Wnetsistem Comercio e Servicos de Informatica Ltda", "pdb": {"t": null, "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.wnetsystem.com.br"}, "pfx": 14, "reg": "2013-09-24", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263650, "h": "", "n": "Clicfacil Telecom", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 2, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6205, "hi": 7.46, "lo": 1.31, "ips": 3, "mean": 3.85, "above": false}, "blocklist_de": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 11.523, 0.011, 1, false], ["2026-10-12", 12.417, 0.012, 1, false]], "sh": false, "uc": 2734.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.417, "se": 0.686, "ts": 0.750, "map": 33.348, "obs": 4, "own": 51.730, "comp": {"cins": -0.5999, "dshield": -1.1512, "crowdsec": 6.0324, "vulncheck": -0.709, "blocklist_de": 1.3283}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.149, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-263650-LACNIC", "org": "Clicfacil Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "http://clicfacilitb.com.br/"}, "pfx": 16, "reg": "2013-10-23", "rir": "lacnic", "s24": 15, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263652, "h": "", "n": "MAP Tecnologia Ltda", "t": "Transit & backbone", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3950, "hi": 6.04, "lo": 0.78, "ips": 3, "mean": 2.88, "above": false}}, "h2": [["2026-10-12", 1.531, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 2.382, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.531, "se": 0.944, "ts": 1.000, "map": 6.615, "obs": 2, "own": 21.594, "comp": {"cins": -0.3387, "dshield": -0.7173, "crowdsec": -2.8289, "vulncheck": -0.5585, "blocklist_de": 7.7265}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"ssh": 1, "bots": 2}}, "oid": "@family-45382", "org": "BIZZ INTERNET LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.bizzinternet.com.br/"}, "pfx": 13, "reg": "2013-10-31", "rir": "lacnic", "s24": 40, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 18432, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00259471016994}, {"a": 263686, "h": "", "n": "INET Communication", "t": "Other", "w": 3, "cc": "HN", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "crowdsec": {"n": 1, "p": 0.1723, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "blocklist_de": {"n": 3, "p": 0.6300, "hi": 7.56, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 0.365, 0.011, 0, false], ["2026-10-12", 9.354, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 0.745, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 9.354, "se": 0.683, "ts": 0.750, "map": 25.000, "obs": 4, "own": 14.194, "comp": {"cins": -0.7008, "dshield": -1.2977, "crowdsec": -1.7891, "vulncheck": -0.7466, "blocklist_de": 9.1467}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"c2": 1}, "blocklist_de": {"ssh": 1, "imap": 2, "mail": 2}}, "oid": "@aut-263686-LACNIC", "org": "INET Communication", "pdb": {"t": null, "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.inethn.com"}, "pfx": 26, "reg": "2014-09-24", "rir": "lacnic", "s24": 24, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025188785292}, {"a": 263702, "h": "", "n": "Grupo ZGH", "t": "Hosting & VPS", "w": 6, "cc": "CL", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 2, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "shodan": {"n": 1, "p": 0.1486, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "crowdsec": {"n": 2, "p": 0.3249, "hi": 5.43, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "vulncheck": {"n": 3, "p": 0.6261, "hi": 7.52, "lo": 1.32, "ips": 3, "mean": 3.88, "above": false}}, "h2": [["2026-10-05", 2.268, 0.011, 0, false], ["2026-10-12", 4.424, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 0.237, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 3, "blocklist_de": 0}, "lo": 4.424, "se": 0.607, "ts": 0.500, "map": 10.089, "obs": 6, "own": 2.025, "comp": {"cins": 3.7011, "dshield": -1.3051, "crowdsec": 1.4629, "vulncheck": 3.3953, "blocklist_de": -3.5491}, "mass": 3.4, "listed": false}}, "abq": false, "bot": 0.313, "det": {"shodan": {"compromised": 1}, "vulncheck": {"botnet_node": 3}}, "oid": "@aut-64161-LACNIC", "org": "GRUPO ZGH SPA", "pdb": {"t": "Content", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.zgh.cl"}, "pfx": 64, "reg": "2014-11-13", "rir": "lacnic", "s24": 60, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 29952, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00083783624382}, {"a": 263703, "h": "", "n": "CORPORACION VNET, C.A.", "t": "Broadband & mobile", "w": 6, "cc": "VE", "cf": {"rb": "lo", "wb": null, "rep": 1.76, "waf": null}, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2021-41773": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1803, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 2, "p": 0.2642, "hi": 4.93, "lo": 0.64, "ips": 2, "mean": 2.35, "above": false}, "vulncheck": {"n": 1, "p": 0.1760, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1545, "hi": 4.27, "lo": 0.32, "ips": 2, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 1.867, 0.011, 0, false], ["2026-10-12", 2.824, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.003, "ts": null, "map": 0.184, "obs": 0, "own": 1.339, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.824, "se": 0.626, "ts": 0.400, "map": 6.718, "obs": 5, "own": 10.496, "comp": {"cins": 3.5069, "dshield": -1.4263, "crowdsec": 0.6369, "vulncheck": 0.4647, "blocklist_de": 0.1163}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.278, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-263703-LACNIC", "org": "VIGINET C.A", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "http://www.vnet.com.ve"}, "pfx": 104, "reg": "2014-11-13", "rir": "lacnic", "s24": 104, "sib": 1, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 42752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01442328300091}, {"a": 263715, "h": "", "n": "EMPRESA DE SERVICIOS Y APLICACIONES TECNOLOGICAS SRL", "t": "Broadband & mobile", "w": 18, "cc": "AR", "cf": null, "cs": {"c": {"home_connection": 14, "mail_bruteforce": 15}, "n": 15}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 15, "mean": 2.94, "above": false}, "blocklist_de": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 12, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 21.086, 0.011, 1, false], ["2026-10-12", 23.400, 0.012, 1, false]], "sh": false, "uc": 12646.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 23.400, "se": 0.696, "ts": 0.500, "map": 63.678, "obs": 4, "own": 98.731, "comp": {"cins": -0.6094, "dshield": -1.1654, "crowdsec": 2.4164, "vulncheck": -0.7129, "blocklist_de": 5.6188}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.308, "det": {"blocklist_de": {"imap": 12, "mail": 12}}, "oid": "@aut-263715-LACNIC", "org": "EMPRESA DE SERVICIOS Y APLICACIONES TECNOLOGICAS SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.grupoesat.com.ar"}, "pfx": 10, "reg": "2014-12-11", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263735, "h": "", "n": "SOCIEDAD BUENA HOSTING, S.A.", "t": "Hosting & VPS", "w": 5, "cc": "HN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 5, "web_bruteforce": 2}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.6992, "hi": 7.55, "lo": 1.62, "ips": 5, "mean": 4.12, "above": false}}, "h2": [["2026-10-05", 2.484, 0.011, 0, false], ["2026-10-12", 2.596, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.221, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.596, "se": 0.664, "ts": 1.000, "map": 6.669, "obs": 4, "own": 1.321, "comp": {"cins": -0.6341, "dshield": -1.2021, "crowdsec": 9.052, "vulncheck": -0.7227, "blocklist_de": -3.2019}, "mass": 3.0, "listed": false}}, "abq": false, "bot": 0.912, "det": null, "oid": "@aut-263735-LACNIC", "org": "SOCIEDAD BUENA HOSTING, S.A.", "pdb": null, "pfx": 5, "reg": "2015-03-11", "rir": "lacnic", "s24": 80, "sib": 0, "tor": 0, "w24": 4, "drop": 5, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20480, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002457270865}, {"a": 263740, "h": "", "n": "Corporacion Laceibanetsociety", "t": "Other", "w": 3, "cc": "HN", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "cve:CVE-2022-22965": 1, "cve:CVE-2022-42889": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1348, "hi": 4.05, "lo": 0.30, "ips": 2, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.882, 0.011, 0, false], ["2026-10-12", 0.926, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.926, "se": 0.915, "ts": 0.500, "map": 3.790, "obs": 2, "own": 2.217, "comp": {"cins": -0.3124, "dshield": 3.5895, "crowdsec": 1.5949, "vulncheck": -0.5365, "blocklist_de": -1.6095}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.888, "det": null, "oid": "@aut-263740-LACNIC", "org": "Corporacion Laceibanetsociety", "pdb": null, "pfx": 7, "reg": "2015-03-16", "rir": "lacnic", "s24": 64, "sib": 0, "tor": 0, "w24": 2, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263744, "h": "", "n": "Udasha S.A.", "t": "Other", "w": 8, "cc": "HN", "cf": null, "cs": {"c": {"web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 3, "cve:CVE-2011-3600": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2021-44228": 1, "cve:CVE-2022-26134": 1, "cve:CVE-2025-55182": 1}, "n": 8}, "ev": {"crowdsec": {"n": 4, "p": 0.7850, "hi": 8.65, "lo": 1.86, "ips": 8, "mean": 4.72, "above": false}}, "h2": [["2026-10-05", 7.843, 0.011, 0, false], ["2026-10-12", 8.381, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.080, "ts": null, "map": 0.194, "obs": 0, "own": 0.756, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.381, "se": 0.679, "ts": 1.000, "map": 21.919, "obs": 4, "own": 12.438, "comp": {"cins": -0.5811, "dshield": -1.1227, "crowdsec": 9.8294, "vulncheck": -0.7011, "blocklist_de": -2.9436}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.944, "det": null, "oid": "@aut-263744-LACNIC", "org": "Udasha S.A.", "pdb": null, "pfx": 8, "reg": "2015-03-20", "rir": "lacnic", "s24": 22, "sib": 0, "tor": 0, "w24": 4, "drop": 3, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263765, "h": "", "n": "XINWEI INTELCOM.NIC, S.A.", "t": "Broadband & mobile", "w": 5, "cc": "NI", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 3, "router_or_botnet": 4, "cve:CVE-2019-8318": 2, "cve:CVE-2018-10562": 2, "cve:CVE-2024-12847": 4}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.6276, "hi": 7.53, "lo": 1.33, "ips": 5, "mean": 3.89, "above": false}}, "h2": [["2026-10-05", 8.406, 0.011, 0, false], ["2026-10-12", 8.888, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 8.888, "se": 0.795, "ts": 1.000, "map": 29.142, "obs": 3, "own": 45.621, "comp": {"cins": -0.4039, "dshield": -0.8338, "crowdsec": 8.6783, "vulncheck": -0.6062, "blocklist_de": -2.0686}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.162, "det": null, "oid": "@aut-263765-LACNIC", "org": "CONSUL TIC, S.A.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://itel.com.ni"}, "pfx": 11, "reg": "2015-05-12", "rir": "lacnic", "s24": 11, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010683833186}, {"a": 263793, "h": "", "n": "BACKBONE NETWORKS", "t": "Broadband & mobile", "w": 1, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.273, 0.011, 0, false], ["2026-10-12", 0.293, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 1.658, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.293, "se": 1.288, "ts": 1.000, "map": 2.435, "obs": 1, "own": 4.340, "comp": {"cins": -0.1373, "dshield": -0.316, "crowdsec": -1.2508, "vulncheck": -0.3256, "blocklist_de": 4.3134}, "mass": 0.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-263793-LACNIC", "org": "TECNET ARGENTINA S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.wiber.com.ar"}, "pfx": 13, "reg": "2015-07-03", "rir": "lacnic", "s24": 42, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00087816106476}, {"a": 263812, "h": "", "n": "IPXON Networks", "t": "Broadband & mobile", "w": 7, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 6, "bad_crawling": 2, "proxy_or_vpn": 5, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 6, "home_connection": 6, "cve:CVE-2017-9841": 1, "cve:CVE-2022-1388": 1, "cve:CVE-2018-20062": 3, "cve:CVE-2019-19781": 1}, "n": 7}, "ev": {"crowdsec": {"n": 5, "p": 0.8466, "hi": 8.80, "lo": 2.19, "ips": 7, "mean": 5.03, "above": true}}, "h2": [["2026-10-05", 2.677, 0.011, 0, false], ["2026-10-12", 3.995, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 1.464, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 3.995, "se": 0.608, "ts": 1.000, "map": 9.174, "obs": 5, "own": 14.195, "comp": {"cins": -0.7682, "dshield": -1.3901, "crowdsec": 10.3832, "vulncheck": -0.7678, "blocklist_de": -3.847}, "mass": 3.7, "listed": false}}, "abq": false, "bot": 0.468, "det": null, "oid": "@aut-263812-LACNIC", "org": "SONDATECH S.A.S.", "pdb": {"t": null, "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.ipxon.com/"}, "pfx": 59, "reg": "2015-08-03", "rir": "lacnic", "s24": 73, "sib": 0, "tor": 4, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18688, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0015191111815}, {"a": 263821, "h": "", "n": "Soluciones Favorables", "t": "Other", "w": 2, "cc": "HN", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3964, "hi": 6.05, "lo": 0.79, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 2.927, 0.011, 0, false], ["2026-10-12", 1.589, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.058, "ts": null, "map": 0.192, "obs": 0, "own": 0.682, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.589, "se": 0.946, "ts": 1.000, "map": 6.911, "obs": 2, "own": 4.065, "comp": {"cins": -0.3364, "dshield": -0.7131, "crowdsec": -2.8122, "vulncheck": -0.5566, "blocklist_de": 7.745}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.883, "det": {"blocklist_de": {"bots": 2}}, "oid": "@aut-263821-LACNIC", "org": "Soluciones Favorables", "pdb": null, "pfx": 9, "reg": "2015-08-14", "rir": "lacnic", "s24": 38, "sib": 0, "tor": 0, "w24": 2, "drop": 7, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9728, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263824, "h": "", "n": "Central TV and Internet Limited", "t": "Broadband & mobile", "w": 7, "cc": "BZ", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1945, "hi": 4.69, "lo": 0.35, "ips": 7, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 1.849, 0.011, 0, false], ["2026-10-12", 0.340, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.340, "se": 1.327, "ts": 1.000, "map": 2.935, "obs": 1, "own": 5.522, "comp": {"cins": -0.0799, "dshield": -0.1885, "crowdsec": -0.7468, "vulncheck": 3.903, "blocklist_de": -0.4175}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.142, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "@aut-263824-LACNIC", "org": "Central TV and Internet Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.centraltv.bz"}, "pfx": 27, "reg": "2015-08-17", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0004228027848}, {"a": 263829, "h": "", "n": "HOST PARA TU VIDA S.A.", "t": "Hosting & VPS", "w": 0, "cc": "HN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.309, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 0.159, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.785, "det": null, "oid": "@aut-263829-LACNIC", "org": "HOST PARA TU VIDA S.A.", "pdb": null, "pfx": 4, "reg": "2015-08-27", "rir": "lacnic", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263840, "h": "", "n": "J M Souza Oliveira", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.179, "det": null, "oid": "@aut-263840-LACNIC", "org": "JSOUZANET TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.jsouzanet.com.br/"}, "pfx": 2, "reg": "2015-07-07", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263869, "h": "", "n": "NAVG TELECOMUNICACOES", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.194, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-263869-LACNIC", "org": "NAVG TELECOMUNICACOES EIRELI - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.navg.com.br/"}, "pfx": 3, "reg": "2015-07-24", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263908, "h": "", "n": "VICONTEC TECNOLOGIA INTERNET E REDES LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8789.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.132, "det": null, "oid": "@aut-263908-LACNIC", "org": "VICONTEC TECNOLOGIA INTERNET E REDES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://vicontec.com.br"}, "pfx": 3, "reg": "2015-08-06", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263913, "h": "", "n": "CIDADE ONLINE", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.156, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-263913-LACNIC", "org": "CIDADE ONLINE LTDA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.coltelecom.net.br"}, "pfx": 13, "reg": "2015-08-07", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263922, "h": "", "n": "SPEED TURBO TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 6347.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.140, "det": null, "oid": "@aut-263922-LACNIC", "org": "SPEED TURBO TELECOM", "pdb": {"t": null, "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.speedturbo.com.br"}, "pfx": 11, "reg": "2015-08-12", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263944, "h": "", "n": "FiberNet Telecomunicacoes", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 17871.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.222, "det": null, "oid": "@aut-263944-LACNIC", "org": "FiberNet Telecomunicacoes", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.fibernet.net.br"}, "pfx": 3, "reg": "2015-08-19", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263966, "h": "", "n": "WORLD WIFI TELECOMUNICAÇÕES", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "home_connection": 3, "mail_bruteforce": 1, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.3901, "hi": 5.99, "lo": 0.78, "ips": 3, "mean": 2.86, "above": false}}, "h2": [["2026-10-12", 2.373, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.373, "se": 0.967, "ts": 1.000, "map": 10.679, "obs": 2, "own": 17.174, "comp": {"cins": -0.2644, "dshield": -0.577, "crowdsec": 6.4607, "vulncheck": -0.4912, "blocklist_de": -1.3662}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.172, "det": null, "oid": "@aut-263966-LACNIC", "org": "WORLD WIFI TELECOMUNICAÇÕES LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.worldwifi.com.br"}, "pfx": 28, "reg": "2015-08-26", "rir": "lacnic", "s24": 19, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00169693550901}, {"a": 263987, "h": "", "n": "E. DA SILVA PROVEDORES DE TELECOMUNICAÇÕES EIRELI", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.119, "det": {"shodan": {"malware": 1}}, "oid": "@aut-263987-LACNIC", "org": "E. DA SILVA PROVEDORES DE TELECOMUNICAÇÕES EIRELI", "pdb": null, "pfx": 5, "reg": "2015-09-08", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 263997, "h": "", "n": "BITMAIL SERVICOS DE INFORMATICA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 7942.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 2.240, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.132, "det": null, "oid": "@aut-263997-LACNIC", "org": "BITMAIL SERVICOS DE INFORMATICA LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "https://bitmail.com.br/"}, "pfx": 4, "reg": "2015-09-10", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264056, "h": "", "n": "Uli Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.242, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-264056-LACNIC", "org": "ULI TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Selective", "web": "http://uli.net.br"}, "pfx": 5, "reg": "2015-09-30", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264096, "h": "", "n": "RG PROVIDER", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.312, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.077, "ts": null, "map": 0.193, "obs": 0, "own": 1.848, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.213, "obs": 0, "own": 1.013, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-264096-LACNIC", "org": "RG PROVIDER LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.rgprovider.com.br"}, "pfx": 22, "reg": "2015-02-20", "rir": "lacnic", "s24": 24, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264206, "h": "", "n": "Mixconect Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 7128.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.182, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-264206-LACNIC", "org": "Mixconect Telecom Ltda Eireli", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://www.mixconect.com.br"}, "pfx": 3, "reg": "2015-04-09", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264278, "h": "", "n": "MICROTELL (MELL).", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 9082, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.311, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-264278-LACNIC", "org": "MICROTELL INFORMATICA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Selective", "web": "https://www.microtell.com.br/"}, "pfx": 3, "reg": "2015-06-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264294, "h": "", "n": "Ora Servicos de Telecomunicacoes Ltda", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 3091, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.079, "ts": null, "map": 0.193, "obs": 0, "own": 1.862, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.214, "obs": 0, "own": 1.033, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.176, "det": null, "oid": "@aut-264294-LACNIC", "org": "Ora Servicos de Telecomunicacoes Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Selective", "web": "https://oratelecom.com.br/"}, "pfx": 14, "reg": "2015-06-11", "rir": "lacnic", "s24": 23, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264369, "h": "", "n": "INHAMBUPE ON-LINE COM COM. E SERV. DE INFORMÁTICA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 13574.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.140, "det": null, "oid": "@aut-264369-LACNIC", "org": "IOL REDE DE PROVEDORES LTDA", "pdb": {"t": null, "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://redeiol.com.br/"}, "pfx": 3, "reg": "2014-09-17", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264434, "h": "", "n": "Rech e Bernardi LTDA ME", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 6835.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.181, "det": null, "oid": "@aut-264434-LACNIC", "org": "Rech e Bernardi LTDA ME", "pdb": null, "pfx": 3, "reg": "2014-10-23", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264528, "h": "", "n": "KASATECH PROVEDOR DE INTERNET", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.120, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-264528-LACNIC", "org": "KASATECH PROVEDOR DE INTERNET LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.kasatech.net/"}, "pfx": 13, "reg": "2014-12-18", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264562, "h": "", "n": "Texnet Internet Fibra Óptica", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"urlhaus": {"n": 1, "p": 0.1978, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-12", 0.324, 0.644, 0, false]], "sh": false, "uc": 830.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 0}, "lo": 0.644, "se": 1.648, "ts": 1.000, "map": 7.761, "obs": 1, "own": 25.273, "comp": {"urlhaus": 4.2024, "threatfox": -0.1855, "phishing_db": -0.3415}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.178, "det": null, "oid": "@aut-264562-LACNIC", "org": "PBR SERVICOS DE TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.texnet.com.br"}, "pfx": 43, "reg": "2015-01-13", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00182593427394}, {"a": 264580, "h": "", "n": "NETLI TELECOMUNICAÇÕES LTDA - ME", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5371.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.228, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-264580-LACNIC", "org": "NETLI TELECOMUNICAÇÕES LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.netli.com.br"}, "pfx": 7, "reg": "2015-01-23", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264604, "h": "", "n": "Unixsis Servicos de Unix e Cloud - ME", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.709, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-264604-LACNIC", "org": "Unixsis Servicos de Unix e Cloud - ME", "pdb": null, "pfx": 1, "reg": "2015-02-20", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264617, "h": "", "n": "Grupo Panaglobal 15 S.A", "t": "Other", "w": 4, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 4, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 4, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2017-9841": 1}, "n": 4}, "ev": {"crowdsec": {"n": 4, "p": 0.7459, "hi": 8.10, "lo": 1.74, "ips": 4, "mean": 4.42, "above": false}, "blocklist_de": {"n": 3, "p": 0.6120, "hi": 7.37, "lo": 1.30, "ips": 3, "mean": 3.80, "above": false}}, "h2": [["2026-10-05", 9.812, 0.011, 0, false], ["2026-10-12", 10.945, 0.012, 1, false]], "sh": false, "uc": 932.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 10.945, "se": 0.544, "ts": 0.571, "map": 22.443, "obs": 7, "own": 12.643, "comp": {"cins": -1.1361, "dshield": -1.8279, "crowdsec": 2.966, "vulncheck": -0.8491, "blocklist_de": 5.3516}, "mass": 6.1, "listed": false}}, "abq": false, "bot": 0.832, "det": {"blocklist_de": {"ssh": 3}}, "oid": "@aut-264617-LACNIC", "org": "GRUPO PANAGLOBAL 15 S.A", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.rackend.com"}, "pfx": 44, "reg": "2015-10-14", "rir": "lacnic", "s24": 49, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00203695007436}, {"a": 264619, "h": "", "n": "Wireless Provider", "t": "Broadband & mobile", "w": 13, "cc": "AR", "cf": null, "cs": {"c": {"web_exploit": 2, "web_bruteforce": 1, "mail_bruteforce": 4, "router_or_botnet": 2, "cve:CVE-2020-5902": 1, "cve:CVE-2024-3272": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4073, "hi": 6.15, "lo": 0.80, "ips": 5, "mean": 2.93, "above": false}, "blocklist_de": {"n": 4, "p": 0.8104, "hi": 9.07, "lo": 1.95, "ips": 10, "mean": 4.95, "above": true}}, "h2": [["2026-10-05", 10.390, 0.011, 1, false], ["2026-10-12", 45.862, 0.012, 1, false]], "sh": false, "uc": 8897.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 45.862, "se": 0.582, "ts": 0.667, "map": 101.671, "obs": 6, "own": 156.174, "comp": {"cins": -0.9874, "dshield": -1.6632, "crowdsec": -0.9719, "vulncheck": -0.8217, "blocklist_de": 10.4597}, "mass": 5.1, "listed": false}}, "abq": false, "bot": 0.411, "det": {"blocklist_de": {"bots": 1, "imap": 9, "mail": 9}}, "oid": "@aut-264619-LACNIC", "org": "Wireless Provider", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.wirelessprovider.com.ar"}, "pfx": 6, "reg": "2015-10-16", "rir": "lacnic", "s24": 9, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.0005602198539}, {"a": 264628, "h": "", "n": "FIBEX TELECOM", "t": "Broadband & mobile", "w": 1, "cc": "VE", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1895, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.282, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.054, "ts": null, "map": 0.191, "obs": 0, "own": 1.667, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.282, "se": 1.280, "ts": 1.000, "map": 2.317, "obs": 1, "own": 4.106, "comp": {"cins": -0.1278, "dshield": 4.5072, "crowdsec": -1.1695, "vulncheck": -0.3095, "blocklist_de": -0.6662}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-264628-LACNIC", "org": "CORPORACION FIBEX TELECOM, C.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://fibextelecom.net/"}, "pfx": 39, "reg": "2015-11-25", "rir": "lacnic", "s24": 41, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01562767072993}, {"a": 264631, "h": "", "n": "RED PARAGUAYA DE TELECOMUNICACIONES SA", "t": "Broadband & mobile", "w": 2, "cc": "PY", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4091, "hi": 6.16, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 31.137, 0.011, 1, false], ["2026-10-12", 12.387, 0.012, 1, false]], "sh": false, "uc": 4687.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.387, "se": 0.806, "ts": 0.667, "map": 41.570, "obs": 3, "own": 65.176, "comp": {"cins": -0.4176, "dshield": -0.8575, "crowdsec": 4.5273, "vulncheck": -0.6152, "blocklist_de": 2.484}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.414, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-264631-LACNIC", "org": "RED PARAGUAYA DE TELECOMUNICACIONES SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.neo.com.py"}, "pfx": 8, "reg": "2015-10-28", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0007584125663}, {"a": 264649, "h": "", "n": "NUT HOST SRL", "t": "Hosting & VPS", "w": 1, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 2.871, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-264649-LACNIC", "org": "NUT HOST SRL", "pdb": null, "pfx": 4, "reg": "2015-12-15", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264667, "h": "", "n": "Coop. LTDA. de Cons. Pop. de Electricidad y Serv.Anexos de Bustinza", "t": "Other", "w": 4, "cc": "AR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 4}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4179, "hi": 6.25, "lo": 0.81, "ips": 4, "mean": 2.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4210, "hi": 6.28, "lo": 0.82, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 50.138, 0.011, 1, false], ["2026-10-12", 55.351, 0.013, 1, false]], "sh": false, "uc": 58333.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 55.351, "se": 0.711, "ts": 0.500, "map": 156.178, "obs": 4, "own": 88.535, "comp": {"cins": -0.5667, "dshield": -1.1006, "crowdsec": 2.86, "vulncheck": -0.6948, "blocklist_de": 5.9467}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.318, "det": {"blocklist_de": {"imap": 2, "mail": 3}}, "oid": "@aut-264667-LACNIC", "org": "Coop. LTDA. de Cons. Pop. de Electricidad y Serv.Anexos de Bustinza", "pdb": null, "pfx": 3, "reg": "2016-01-15", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264727, "h": "", "n": "UNIVERSIDAD CATOLICA DE SALTA", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.100, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-264727-LACNIC", "org": "UNIVERSIDAD CATOLICA DE SALTA", "pdb": null, "pfx": 1, "reg": "2016-07-05", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 264738, "h": "", "n": "Sebastian Souto", "t": "Broadband & mobile", "w": 5, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 4, "web_bruteforce": 2, "home_connection": 4, "mail_bruteforce": 4}, "n": 4}, "ev": {"cins": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.6151, "hi": 7.40, "lo": 1.30, "ips": 4, "mean": 3.82, "above": false}, "blocklist_de": {"n": 2, "p": 0.4104, "hi": 6.18, "lo": 0.80, "ips": 3, "mean": 2.94, "above": false}}, "h2": [["2026-10-05", 20.497, 0.011, 1, false], ["2026-10-12", 23.063, 0.012, 1, false]], "sh": false, "uc": 8593.8, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 23.063, "se": 0.579, "ts": 0.500, "map": 50.434, "obs": 6, "own": 77.681, "comp": {"cins": 3.1035, "dshield": -1.6561, "crowdsec": 1.8527, "vulncheck": -0.8205, "blocklist_de": 2.8347}, "mass": 5.0, "listed": false}}, "abq": false, "bot": 0.191, "det": {"blocklist_de": {"imap": 2, "mail": 3}}, "oid": "@aut-264738-LACNIC", "org": "Sebastian Souto (SSSERVICIOS)", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Restrictive", "web": "http://www.ssservicios.com.ar"}, "pfx": 24, "reg": "2016-07-21", "rir": "lacnic", "s24": 18, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00176985906678}, {"a": 264758, "h": "", "n": "ISP GROUP SRL", "t": "Broadband & mobile", "w": 9, "cc": "AR", "cf": null, "cs": {"c": {"mail_bruteforce": 7}, "n": 7}, "ev": {"crowdsec": {"n": 2, "p": 0.3620, "hi": 5.75, "lo": 0.75, "ips": 7, "mean": 2.74, "above": false}, "blocklist_de": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 8.320, 0.011, 0, false], ["2026-10-12", 6.087, 0.012, 0, false]], "sh": false, "uc": 2973.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 1.711, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 6.087, "se": 0.677, "ts": 0.500, "map": 16.000, "obs": 4, "own": 24.853, "comp": {"cins": -0.677, "dshield": -1.2641, "crowdsec": 1.7424, "vulncheck": -0.7384, "blocklist_de": 5.1034}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.216, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-264758-LACNIC", "org": "ISP GROUP SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.ispgroup.com.ar"}, "pfx": 29, "reg": "2016-08-23", "rir": "lacnic", "s24": 36, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00122234158452}, {"a": 264764, "h": "", "n": "Innova Network", "t": "Transit & backbone", "w": 3, "cc": "GT", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6027, "hi": 7.27, "lo": 1.28, "ips": 3, "mean": 3.75, "above": false}}, "h2": [["2026-10-05", 4.173, 0.011, 0, false], ["2026-10-12", 4.407, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.075, "ts": null, "map": 0.193, "obs": 0, "own": 2.609, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.407, "se": 0.776, "ts": 1.000, "map": 13.962, "obs": 3, "own": 44.401, "comp": {"cins": -0.4363, "dshield": -0.8895, "crowdsec": 8.2126, "vulncheck": -0.6269, "blocklist_de": -2.23}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.182, "det": null, "oid": "@aut-264764-LACNIC", "org": "Innova Outsourcing S.A", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.innovatelco.net"}, "pfx": 26, "reg": "2016-09-01", "rir": "lacnic", "s24": 25, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00041765863365}, {"a": 264921, "h": "", "n": "LASER PROVEDOR DE INTERNET LTDA - ME", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8007.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-264921-LACNIC", "org": "LASER PROVEDOR DE INTERNET LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://laserinternet.com.br/"}, "pfx": 5, "reg": "2016-04-13", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265059, "h": "", "n": "TV CABO SÃO PAULO LTDA", "t": "Other", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 5.238, 0.011, 0, false], ["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 6.496, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "@aut-265059-LACNIC", "org": "TV CABO SÃO PAULO LTDA", "pdb": null, "pfx": 5, "reg": "2016-06-23", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265077, "h": "", "n": "J P DOS SANTOS", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 11523.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.157, "det": null, "oid": "@aut-265077-LACNIC", "org": "J P DOS SANTOS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.dginet.com.br"}, "pfx": 4, "reg": "2016-07-07", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265141, "h": "", "n": "RBT Internet", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 0.406, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.193, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-265141-LACNIC", "org": "RBT Internet", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://rbt.psi.br"}, "pfx": 10, "reg": "2015-11-12", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00158134456179}, {"a": 265204, "h": "", "n": "YSABELLA KRISTINA CALCAGNO RODRIGUESD", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.858, 0.013, 0, false]], "sh": false, "uc": 8154.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.858, "se": 1.529, "ts": 1.000, "map": 10.892, "obs": 1, "own": 8.268, "comp": {"cins": -0.0595, "dshield": 4.885, "crowdsec": -0.5621, "vulncheck": -0.17, "blocklist_de": -0.3117}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.130, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-265204-LACNIC", "org": "LINKFIRE TELECOM LTDA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.linkfire.com.br"}, "pfx": 7, "reg": "2015-12-17", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265240, "h": "", "n": "ULTRA NET SERVICOS EM INTERNET LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 6510.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.142, "det": null, "oid": "@aut-265240-LACNIC", "org": "NET GUIBOR", "pdb": null, "pfx": 3, "reg": "2015-12-29", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265260, "h": "", "n": "JOSÉ APARECIDO PEREIRA DA SILVA TELNET - ME", "t": "Broadband & mobile", "w": 5, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 5, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 22.585, 0.011, 1, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": 16113.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 74.650, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.250, "det": {"blocklist_de": {"imap": 5, "mail": 5}}, "oid": "@aut-265260-LACNIC", "org": "JOSE APARECIDO PEREIRA DA SILVA TELNET - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.telnettelecom.net.br"}, "pfx": 3, "reg": "2016-01-11", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265293, "h": "", "n": "SPEEDMAX INTERNET FIBRA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.139, "det": null, "oid": "@aut-265293-LACNIC", "org": "SPEEDMAX INTERNET FIBRA", "pdb": null, "pfx": 5, "reg": "2016-01-26", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265405, "h": "", "n": "Imax Wireless Provedor de Internet", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 5371.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.211, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-265405-LACNIC", "org": "Imax Wireless Provedor de Internet Ltda", "pdb": null, "pfx": 7, "reg": "2016-08-09", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265451, "h": "", "n": "INFOLINK TELECOM", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.510, 0.011, 0, false], ["2026-10-12", 0.442, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.442, "se": 1.377, "ts": 1.000, "map": 4.186, "obs": 1, "own": 8.075, "comp": {"cins": -0.0685, "dshield": -0.1625, "crowdsec": -0.644, "vulncheck": 4.0589, "blocklist_de": -0.3584}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.119, "det": {"shodan": {"malware": 1}, "vulncheck": {"c2_server": 1}}, "oid": "@aut-265451-LACNIC", "org": "INFOLINK TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.infolinktelecom.com/"}, "pfx": 3, "reg": "2016-08-29", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00213435984174}, {"a": 265491, "h": "", "n": "Arp Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"bots": 1}}, "oid": "@aut-265491-LACNIC", "org": "ARP TELECOM COMUNICAÇOES LTDA ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.arpinternet.com.br"}, "pfx": 7, "reg": "2016-09-19", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265540, "h": "", "n": "ALTAN REDES", "t": "Transit & backbone", "w": 3, "cc": "MX", "cf": null, "cs": null, "ev": {"dshield": {"n": 3, "p": 0.6255, "hi": 7.51, "lo": 1.32, "ips": 3, "mean": 3.87, "above": false}}, "h2": [["2026-10-12", 2.095, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 2.180, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 3, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.095, "se": 0.758, "ts": 1.000, "map": 6.407, "obs": 3, "own": 20.375, "comp": {"cins": -0.4758, "dshield": 10.5631, "crowdsec": -3.7607, "vulncheck": -0.6498, "blocklist_de": -2.4259}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.044, "det": null, "oid": "@aut-265540-LACNIC", "org": "ALTAN REDES, S.A.P.I. de C. V.", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.altanredes.com"}, "pfx": 64, "reg": "2017-09-08", "rir": "lacnic", "s24": 60, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 26624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0285851580928}, {"a": 265545, "h": "", "n": "OPSICOME SA DE CV", "t": "Other", "w": 4, "cc": "MX", "cf": null, "cs": {"c": {"proxy_or_vpn": 2, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 2, "router_or_botnet": 4}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 4, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": 27832, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.268, "det": null, "oid": "@aut-265545-LACNIC", "org": "OPSICOME SA DE CV", "pdb": null, "pfx": 4, "reg": "2018-02-01", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265552, "h": "", "n": "Baja Datacenter, SA de CV", "t": "Hosting & VPS", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 264, "p": 1.0000, "hi": 289.86, "lo": 236.78, "ips": 264, "mean": 262.75, "above": true}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.999, "det": {"shodan": {"compromised": 264}}, "oid": "@aut-265552-LACNIC", "org": "Baja Datacenter, SA de CV", "pdb": null, "pfx": 1, "reg": "2018-07-10", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 1024, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 265594, "h": "", "n": "Television Internacional, S.A. de C.V.", "t": "Other", "w": 7, "cc": "MX", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"dshield": {"n": 5, "p": 0.8923, "hi": 9.79, "lo": 2.43, "ips": 6, "mean": 5.59, "above": true}, "crowdsec": {"n": 1, "p": 0.0856, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "blocklist_de": {"n": 1, "p": 0.1427, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-12", 3.761, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 5, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.761, "se": 0.540, "ts": 0.714, "map": 7.674, "obs": 7, "own": 4.333, "comp": {"cins": -1.0923, "dshield": 11.397, "crowdsec": -4.3635, "vulncheck": -0.8416, "blocklist_de": -1.668}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.098, "det": {"blocklist_de": {"ssh": 1}}, "oid": "@aut-265594-LACNIC", "org": "Television Internacional, S.A. de C.V.", "pdb": null, "pfx": 97, "reg": "2019-08-09", "rir": "lacnic", "s24": 136, "sib": 6, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 35328, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["dshield"], "traffic": 0.0198513601664}, {"a": 265645, "h": "", "n": "HOSTINGFOREX S.A.", "t": "Hosting & VPS", "w": 0, "cc": "HN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.880, "det": null, "oid": "@aut-265645-LACNIC", "org": "HOSTINGFOREX S.A.", "pdb": null, "pfx": 1, "reg": "2017-02-06", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265676, "h": "", "n": "INTERSAT", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 6.802, 0.013, 0, false]], "sh": false, "uc": 7031.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 6.802, "se": 1.043, "ts": 0.500, "map": 35.577, "obs": 2, "own": 58.127, "comp": {"cins": 4.7268, "dshield": -0.5161, "crowdsec": 2.4215, "vulncheck": -0.4579, "blocklist_de": -1.2089}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.226, "det": null, "oid": "@aut-265676-LACNIC", "org": "INTERSAT S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.intersatargentina.com"}, "pfx": 5, "reg": "2017-03-17", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00021172505424}, {"a": 265688, "h": "", "n": "Sinergy", "t": "Broadband & mobile", "w": 4, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "home_connection": 2, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3987, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "blocklist_de": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 11.047, 0.011, 1, false], ["2026-10-12", 14.218, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 2.018, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 14.218, "se": 0.689, "ts": 0.500, "map": 38.117, "obs": 4, "own": 59.135, "comp": {"cins": -0.6342, "dshield": -1.2023, "crowdsec": 2.1647, "vulncheck": -0.7227, "blocklist_de": 5.4288}, "mass": 3.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-265688-LACNIC", "org": "SINERGY SOLUCIONES INTEGRALES", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "https://sinergy.com.co/"}, "pfx": 20, "reg": "2017-03-24", "rir": "lacnic", "s24": 14, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00187423809369}, {"a": 265691, "h": "", "n": "WI-NET TELECOM", "t": "Broadband & mobile", "w": 12, "cc": "PE", "cf": null, "cs": {"c": {"http_flood": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1631, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}, "dshield": {"n": 2, "p": 0.3521, "hi": 5.66, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}, "crowdsec": {"n": 1, "p": 0.0536, "hi": 3.05, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "blocklist_de": {"n": 7, "p": 0.9662, "hi": 10.75, "lo": 3.26, "ips": 9, "mean": 6.54, "above": true}}, "h2": [["2026-10-05", 0.772, 0.010, 0, false], ["2026-10-12", 5.959, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.957, "ts": null, "map": 0.173, "obs": 0, "own": 1.102, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 2, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 7}, "lo": 5.959, "se": 0.475, "ts": 0.636, "map": 10.951, "obs": 11, "own": 16.813, "comp": {"cins": 1.2188, "dshield": 0.8722, "crowdsec": -7.8879, "vulncheck": -0.9282, "blocklist_de": 10.5122}, "mass": 12.6, "listed": false}}, "abq": false, "bot": 0.146, "det": {"blocklist_de": {"ftp": 1, "bots": 8}}, "oid": "@aut-265691-LACNIC", "org": "WI-NET TELECOM S.A.C.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://win.pe"}, "pfx": 159, "reg": "2017-03-29", "rir": "lacnic", "s24": 208, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 126464, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.04840668305856}, {"a": 265823, "h": "", "n": "NETROPOLYS S.A.", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.334, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-265823-LACNIC", "org": "NETROPOLYS S.A.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.ioconexiontotal.com"}, "pfx": 10, "reg": "2017-09-18", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00031460294838}, {"a": 265839, "h": "", "n": "HOSTING.CL", "t": "Hosting & VPS", "w": 1, "cc": "CL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1981, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.012, 0.778, 0, false], ["2026-10-12", 0.012, 0.807, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.807, "se": 1.727, "ts": 1.000, "map": 11.195, "obs": 1, "own": 6.039, "comp": {"urlhaus": -0.0385, "threatfox": -0.0551, "phishing_db": 4.1352}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.596, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-274233-LACNIC", "org": "HOSTING.CL", "pdb": null, "pfx": 5, "reg": "2017-10-11", "rir": "lacnic", "s24": 5, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00012018745476}, {"a": 265843, "h": "", "n": "NUBICOM", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.654, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.196, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-265843-LACNIC", "org": "NUBICOM S.R.L.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://nubicom.com.ar/"}, "pfx": 6, "reg": "2017-10-12", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00028846265574}, {"a": 265867, "h": "", "n": "Trans Ocean Network", "t": "Broadband & mobile", "w": 1, "cc": "PA", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 1.130, 0.391, 0, false], ["2026-10-12", 0.010, 0.409, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.409, "se": 1.515, "ts": 1.000, "map": 3.900, "obs": 1, "own": 11.412, "comp": {"urlhaus": -0.1276, "threatfox": -0.1538, "phishing_db": 3.2685}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.713, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-265867-LACNIC", "org": "Trans Ocean Network", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.transoceanet.com"}, "pfx": 62, "reg": "2017-11-07", "rir": "lacnic", "s24": 49, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 22528, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055836237942}, {"a": 265907, "h": "", "n": "DAL MORA & CIA LTDA - EPP", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": 5175.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 74.650, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.128, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-265907-LACNIC", "org": "DAL MORA & CIA LTDA - EPP", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Open", "web": "https://dalmora.com.br/"}, "pfx": 3, "reg": "2017-06-29", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265919, "h": "", "n": "BB Host Datacenter", "t": "Hosting & VPS", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "shodan": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "vulncheck": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 1.916, 0.011, 0, false], ["2026-10-12", 9.048, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 0.297, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 9.048, "se": 0.705, "ts": 0.250, "map": 24.812, "obs": 4, "own": 4.982, "comp": {"cins": 3.997, "dshield": -1.1053, "crowdsec": -0.758, "vulncheck": 0.9538, "blocklist_de": 1.5176}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.645, "det": {"shodan": {"compromised": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "@aut-265919-LACNIC", "org": "BB Host LTDA", "pdb": {"t": "Content", "sc": "Global", "tr": "50-100Gbps", "pol": "Selective", "web": "https://www.bbhost.com.br"}, "pfx": 20, "reg": "2017-07-04", "rir": "lacnic", "s24": 19, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265966, "h": "", "n": "ALENCAR & ALENCAR", "t": "Transit & backbone", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 5664.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 45.760, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.130, "det": null, "oid": "@aut-265966-LACNIC", "org": "J M P M ALENCAR & A G F ALENCAR LTDA - ME", "pdb": {"t": "NSP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://speednetprovedor.com.br/"}, "pfx": 7, "reg": "2017-07-14", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 265989, "h": "", "n": "GARCIA NET TELECOM LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4052.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.194, "det": null, "oid": "@family-11509", "org": "GARCIA TELECOMUNICACOES LTDA", "pdb": null, "pfx": 7, "reg": "2017-07-21", "rir": "lacnic", "s24": 8, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266032, "h": "", "n": "Fonte Telecom", "t": "Broadband & mobile", "w": 7, "cc": "BR", "cf": null, "cs": {"c": {"home_connection": 2, "mail_bruteforce": 2, "router_or_botnet": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 6, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 38.964, 0.011, 1, false], ["2026-10-12", 42.926, 0.013, 1, false]], "sh": false, "uc": 10351.6, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 42.926, "se": 0.707, "ts": 0.500, "map": 120.082, "obs": 4, "own": 186.065, "comp": {"cins": -0.5791, "dshield": -1.1197, "crowdsec": 2.7296, "vulncheck": -0.7002, "blocklist_de": 5.8512}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.149, "det": {"blocklist_de": {"imap": 6, "mail": 6}}, "oid": "@aut-266032-LACNIC", "org": "T.A.LUIZ ELETRONICO LTDA - ME", "pdb": null, "pfx": 4, "reg": "2017-02-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266044, "h": "", "n": "NICNET S.A.", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3951, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 1.101, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.175, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-266044-LACNIC", "org": "Nicnet S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "200-300Gbps", "pol": "Selective", "web": "https://nicnet.com.br/"}, "pfx": 5, "reg": "2017-02-21", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00315500136462}, {"a": 266087, "h": "", "n": "Orbitel Telecomunicações - ASN266087", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 4062.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.572, "det": null, "oid": "@aut-266087-LACNIC", "org": "Orbitel Telecomunicações e Informática Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.orbitel.com.br"}, "pfx": 6, "reg": "2017-03-13", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266097, "h": "", "n": "OKEY NET", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 27.413, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.129, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266097-LACNIC", "org": "YUHOO NET", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.okeynet.com.br"}, "pfx": 4, "reg": "2017-03-17", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266240, "h": "", "n": "A2 TELECOM EIRELI - ME", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 10839.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.144, "det": null, "oid": "@aut-266240-LACNIC", "org": "A2 TELECOM EIRELI - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.a2telecomfibra.com.br/"}, "pfx": 3, "reg": "2017-05-02", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266242, "h": "", "n": "VIANET GUARACIAMA", "t": "Hosting & VPS", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 3, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 9.514, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.143, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-266242-LACNIC", "org": "VIANET GUARACIAMA EIRELI ME", "pdb": {"t": "Network Services", "sc": "South America", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.internetvianet.com.br/"}, "pfx": 7, "reg": "2017-05-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266245, "h": "", "n": "Burda Comercio e Serviços", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.228, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-266245-LACNIC", "org": "Burda Comercio e Serviços Ltda Me", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.clicknettelecom.com.br"}, "pfx": 1, "reg": "2017-05-04", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266346, "h": "", "n": "ATIVA INTERNET", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2343.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 1.327, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.188, "det": null, "oid": "@aut-266346-LACNIC", "org": "G2G NETWORKS SERVICOS DE COMUNICACAO", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.internetativa.com.br/"}, "pfx": 15, "reg": "2016-11-07", "rir": "lacnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266380, "h": "", "n": "InfoAssisNet", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 74.650, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-266380-LACNIC", "org": "INFO TELECOMUNICACOES LTDA - ME", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.infoassisnet.com.br"}, "pfx": 5, "reg": "2016-11-24", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266400, "h": "", "n": "Ferenz Networks", "t": "Transit & backbone", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1799, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "phishing_db": {"n": 1, "p": 0.1946, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.530, 0, false], ["2026-10-12", 0.011, 0.551, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.551, "se": 1.586, "ts": 1.000, "map": 6.103, "obs": 1, "own": 26.210, "comp": {"urlhaus": -0.0867, "threatfox": -0.1128, "phishing_db": 3.6344}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.997, "ts": null, "map": 0.217, "obs": 0, "own": 2.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266400-LACNIC", "org": "Ferenz Networks", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Selective", "web": "https://www.ferenz.com.br"}, "pfx": 31, "reg": "2016-12-06", "rir": "lacnic", "s24": 21, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11520, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266409, "h": "", "n": "SECW TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.708, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266409-LACNIC", "org": "SECW TELECOM", "pdb": {"t": "NSP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.secw.com.br"}, "pfx": 6, "reg": "2016-12-07", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266436, "h": "", "n": "NETCENTER TELECOM Porto Seguro", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 4622.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 1.788, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.176, "det": null, "oid": "@aut-266436-LACNIC", "org": "NETCENTER TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.netcentertelecom.com.br"}, "pfx": 8, "reg": "2016-12-20", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266515, "h": "", "n": "robson galassi - me", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 80078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.191, "det": null, "oid": "@aut-266515-LACNIC", "org": "robson galassi - me", "pdb": null, "pfx": 4, "reg": "2017-01-18", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266526, "h": "", "n": "Jefferson Mantovani ltda me", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-266526-LACNIC", "org": "Jefferson Mantovani ltda me", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.ubinformatica.com.br"}, "pfx": 5, "reg": "2017-05-09", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266539, "h": "", "n": "LINQ TELECOMUNICAÇOES", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 2, "mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3131, "hi": 5.33, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}, "blocklist_de": {"n": 3, "p": 0.5984, "hi": 7.23, "lo": 1.27, "ips": 3, "mean": 3.73, "above": false}}, "h2": [["2026-10-05", 4.379, 0.011, 0, false], ["2026-10-12", 5.155, 0.012, 0, false]], "sh": false, "uc": 643.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 5.155, "se": 0.613, "ts": 0.600, "map": 11.951, "obs": 5, "own": 18.491, "comp": {"cins": -0.8992, "dshield": -1.558, "crowdsec": -0.2578, "vulncheck": -0.8024, "blocklist_de": 7.3918}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"ssh": 1, "bots": 1, "mail": 1}}, "oid": "@aut-266539-LACNIC", "org": "LINQ TELECOMUNICACOES", "pdb": {"t": "Network Services", "sc": "South America", "tr": null, "pol": "Open", "web": "http://www.linq.net.br"}, "pfx": 6, "reg": "2017-05-11", "rir": "lacnic", "s24": 68, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19456, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00753221912247}, {"a": 266668, "h": "", "n": "OBERCOM S.R.L", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 4.363, 0.011, 0, false], ["2026-10-12", 12.427, 0.012, 1, false]], "sh": false, "uc": 3418, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.427, "se": 0.806, "ts": 0.333, "map": 41.707, "obs": 3, "own": 65.382, "comp": {"cins": -0.4188, "dshield": 3.1198, "crowdsec": 0.5632, "vulncheck": -0.616, "blocklist_de": 2.476}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.204, "det": {"blocklist_de": {"ssh": 1, "mail": 1}}, "oid": "@aut-266668-LACNIC", "org": "OBERCOM S.R.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "20-50Gbps", "pol": "Selective", "web": "https://www.obercom.com.ar/"}, "pfx": 7, "reg": "2017-12-11", "rir": "lacnic", "s24": 8, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00103295884209}, {"a": 266702, "h": "", "n": "MEGALINK S.R.L.", "t": "Broadband & mobile", "w": 125, "cc": "AR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 124, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 111, "router_or_botnet": 110, "cve:CVE-2019-8318": 89, "cve:CVE-2018-10562": 99, "cve:CVE-2024-12847": 124}, "n": 124}, "ev": {"dshield": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 124, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1949, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 3.849, 0.011, 0, false], ["2026-10-12", 11.291, 0.012, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 11.291, "se": 0.803, "ts": 0.333, "map": 37.550, "obs": 3, "own": 58.860, "comp": {"cins": -0.4237, "dshield": 3.0992, "crowdsec": 0.5181, "vulncheck": -0.6191, "blocklist_de": 2.4448}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.155, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-266702-LACNIC", "org": "MEGALINK S.R.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://ultrafibra.com.ar/"}, "pfx": 9, "reg": "2018-01-18", "rir": "lacnic", "s24": 9, "sib": 0, "tor": 0, "w24": 2, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00066275119113}, {"a": 266703, "h": "", "n": "ALEJO TV", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.171, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-266703-LACNIC", "org": "ALEJO TV SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.alejotv.com.ar"}, "pfx": 4, "reg": "2018-01-18", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266715, "h": "", "n": "tvncl", "t": "Hosting & VPS", "w": 0, "cc": "CL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266715-LACNIC", "org": "Televisión Nacional de Chile", "pdb": {"t": "Content", "sc": "Global", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.tvn.cl"}, "pfx": 3, "reg": "2018-01-30", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001701735714}, {"a": 266769, "h": "", "n": "ISPCOM", "t": "Broadband & mobile", "w": 2, "cc": "AR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 7.902, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.902, "se": 1.054, "ts": 0.500, "map": 42.358, "obs": 2, "own": 69.254, "comp": {"cins": -0.223, "dshield": 4.0167, "crowdsec": -1.9557, "vulncheck": -0.4457, "blocklist_de": 3.7474}, "mass": 1.0, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-266769-LACNIC", "org": "ISPCOM S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.ispcomsa.com.ar/"}, "pfx": 4, "reg": "2018-04-11", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00055028286495}, {"a": 266783, "h": "", "n": "Anibal Humberto Enriquez Moncayo", "t": "Other", "w": 0, "cc": "EC", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.274, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266783-LACNIC", "org": "Anibal Humberto Enriquez Moncayo(Comunicate)", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://comunicate.ec"}, "pfx": 8, "reg": "2018-04-20", "rir": "lacnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00023795208697}, {"a": 266831, "h": "", "n": "MONGELOS ARCE MARCIAL(DELTA NETWORKS)", "t": "Broadband & mobile", "w": 0, "cc": "PY", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.355, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266831-LACNIC", "org": "MONGELOS ARCE MARCIAL(DELTA NETWORKS)", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://super.net.py"}, "pfx": 5, "reg": "2018-06-20", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001390231151}, {"a": 266870, "h": "", "n": "SERVICIO DE TELECOMUNICACIONES VEMOS MAS", "t": "Broadband & mobile", "w": 1, "cc": "CL", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 8398.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.258, "det": null, "oid": "@aut-266870-LACNIC", "org": "SERVICIO DE TELECOMUNICACIONES VEMOS MAS LTDA.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.vemosmas.cl/"}, "pfx": 5, "reg": "2018-07-30", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025417333602}, {"a": 266921, "h": "", "n": "Mundial Station", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10253.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.181, "det": null, "oid": "@aut-266921-LACNIC", "org": "Mundial Station", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.mundialstation.com.br"}, "pfx": 3, "reg": "2017-10-16", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266965, "h": "", "n": "SAMUEL DE LUCENA MARTINS - EPP", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4980.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.128, "det": null, "oid": "@aut-266965-LACNIC", "org": "FLORIANO TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.florianotelecom.com.br/"}, "pfx": 2, "reg": "2017-11-01", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 266983, "h": "", "n": "XZoom Telecom", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.161, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-266983-LACNIC", "org": "XZoom Telecom", "pdb": null, "pfx": 3, "reg": "2017-11-06", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267121, "h": "", "n": "Atplus Telecom", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "web_bruteforce": 1, "home_connection": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-2392": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1826, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "crowdsec": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.408, 0.011, 0, false], ["2026-10-12", 0.437, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.437, "se": 1.360, "ts": 1.000, "map": 4.149, "obs": 1, "own": 7.638, "comp": {"cins": -0.1011, "dshield": -0.2364, "crowdsec": 3.9422, "vulncheck": -0.2603, "blocklist_de": -0.5278}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.333, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267121-LACNIC", "org": "ATPlus Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.atplus.com.br"}, "pfx": 24, "reg": "2018-01-04", "rir": "lacnic", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267135, "h": "", "n": "DL CENTER PROVEDOR DE INTERNET LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5273.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.113, "det": null, "oid": "@aut-267135-LACNIC", "org": "DL CENTER PROVEDOR DE INTERNET LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.dlcenter.com.br"}, "pfx": 3, "reg": "2018-01-10", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267178, "h": "", "n": "B4M Serviços de Comunicação Multimída", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.670, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.670, "se": 1.459, "ts": 1.000, "map": 7.555, "obs": 1, "own": 5.435, "comp": {"cins": -0.0822, "dshield": -0.1938, "crowdsec": -0.7676, "vulncheck": -0.2214, "blocklist_de": 4.681}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.175, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-267178-LACNIC", "org": "UNO INTERNET LTDA", "pdb": null, "pfx": 12, "reg": "2018-02-01", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5120, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267200, "h": "", "n": "Microlink Fibra", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.158, "det": null, "oid": "@aut-267200-LACNIC", "org": "MICROLINK TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://microlinkmg.com.br"}, "pfx": 3, "reg": "2018-02-15", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267212, "h": "", "n": "WEB 8 DATA CENTER LTDA", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.243, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.839, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267212-LACNIC", "org": "WEB 8 DATA CENTER LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://WEB8D.COM"}, "pfx": 6, "reg": "2018-02-19", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267355, "h": "", "n": "HOSTIDC INTERNET DATACENTER", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.937, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267355-LACNIC", "org": "HOSTIDC INTERNET DATACENTER LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.hostidc.com.br"}, "pfx": 4, "reg": "2018-04-04", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267373, "h": "", "n": "AGIL TECOMUNICACOES LTDA", "t": "Transit & backbone", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 5078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 48.982, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.158, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-267373-LACNIC", "org": "ÁGIL TECOMUNICACOES LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.agilinternet.net.br/"}, "pfx": 7, "reg": "2018-04-09", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267391, "h": "", "n": "ALL KEYS COMERCIO DE EQUIPAMENTOS DE INFORMATICA L", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 7324.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.229, "det": null, "oid": "@aut-267391-LACNIC", "org": "ALL KEYS COMERCIO DE EQUIPAMENTOS DE INFORMATICA L", "pdb": null, "pfx": 3, "reg": "2018-04-11", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267466, "h": "", "n": "MVF NETWORK", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 5664.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.159, "det": null, "oid": "@aut-267466-LACNIC", "org": "MVF NETWORK", "pdb": null, "pfx": 6, "reg": "2017-08-10", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267494, "h": "", "n": "DNL NETWORK TELECOMUNICAÇÕES LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.214, "det": null, "oid": "@aut-267494-LACNIC", "org": "DNL NETWORK TELECOMUNICAÇÕES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "No", "web": "https://alternativamais.com"}, "pfx": 5, "reg": "2017-08-18", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267513, "h": "", "n": "Seanet Telecom Carazinho", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1843, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 1.215, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267513-LACNIC", "org": "Seanet Telecom Carazinho Eireli", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.seanet.com.br"}, "pfx": 19, "reg": "2017-08-23", "rir": "lacnic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267549, "h": "", "n": "NetCOMM Fibra", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": 15234.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 1.905, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.197, "det": null, "oid": "@aut-267549-LACNIC", "org": "NetCOMM FIBRA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "https://netcomm.psi.br/"}, "pfx": 6, "reg": "2017-08-31", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267578, "h": "", "n": "WILLIAN MENDES DE OLIVEIRA", "t": "Broadband & mobile", "w": 7, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 3, "p": 0.6408, "hi": 7.68, "lo": 1.35, "ips": 7, "mean": 3.96, "above": false}}, "h2": [["2026-10-05", 0.532, 0.011, 0, false], ["2026-10-12", 12.979, 0.012, 1, false]], "sh": false, "uc": 3160.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 3}, "lo": 12.979, "se": 0.809, "ts": 1.000, "map": 43.659, "obs": 3, "own": 68.452, "comp": {"cins": -0.4852, "dshield": -0.9711, "crowdsec": -3.821, "vulncheck": -0.6549, "blocklist_de": 11.1022}, "mass": 2.2, "listed": false}}, "abq": false, "bot": 0.182, "det": {"blocklist_de": {"imap": 7, "mail": 7}}, "oid": "@aut-267578-LACNIC", "org": "W LINKS INTERNET LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.wlinks.com.br/"}, "pfx": 8, "reg": "2017-09-11", "rir": "lacnic", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00182474450172}, {"a": 267587, "h": "", "n": "CLICK SPEED SERVICOS DE TELECOMUNICACOES", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 169.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.098, "ts": null, "map": 0.195, "obs": 0, "own": 2.040, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.048, "ts": null, "map": 0.227, "obs": 0, "own": 1.327, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.129, "det": null, "oid": "@aut-267587-LACNIC", "org": "CLICK SPEED SERVICOS DE TELECOMUNICACOES LTDA - EP", "pdb": {"t": "NSP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.velfibra.com.br/"}, "pfx": 17, "reg": "2017-09-12", "rir": "lacnic", "s24": 13, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 143360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00276837115359}, {"a": 267645, "h": "", "n": "Vision On Line Telecom LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.188, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267645-LACNIC", "org": "Vision On Line Telecom LTDA", "pdb": null, "pfx": 5, "reg": "2017-10-04", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267682, "h": "", "n": "WIFAO COLOMBIA S A S", "t": "Hosting & VPS", "w": 0, "cc": "CO", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.198, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-267682-LACNIC", "org": "WAO INTERNET S.A.S.", "pdb": null, "pfx": 3, "reg": "2018-09-19", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000443027684}, {"a": 267684, "h": "", "n": "VISIONMAGICA SOCIEDAD ANONIMA", "t": "Broadband & mobile", "w": 3, "cc": "EC", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.280, "det": null, "oid": "@aut-267684-LACNIC", "org": "VISIONMAGICA SOCIEDAD ANONIMA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.visionmagicasa.com"}, "pfx": 5, "reg": "2018-09-21", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00083720773773}, {"a": 267690, "h": "", "n": "ELDA SALERNO(FULLNET)", "t": "Other", "w": 15, "cc": "AR", "cf": null, "cs": {"c": {"mail_bruteforce": 3, "router_or_botnet": 2}, "n": 3}, "ev": {"dshield": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4210, "hi": 6.28, "lo": 0.82, "ips": 13, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 55.525, 0.013, 1, false]], "sh": false, "uc": 50651, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 55.525, "se": 0.711, "ts": 0.500, "map": 156.657, "obs": 4, "own": 88.794, "comp": {"cins": -0.5682, "dshield": 2.5217, "crowdsec": -0.7454, "vulncheck": -0.6955, "blocklist_de": 5.935}, "mass": 2.6, "listed": false}}, "abq": false, "bot": 0.248, "det": {"blocklist_de": {"imap": 13, "mail": 13}}, "oid": "@aut-267690-LACNIC", "org": "ELDA SALERNO(FULLNET)", "pdb": null, "pfx": 2, "reg": "2018-09-27", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267717, "h": "", "n": "CS SPA", "t": "Other", "w": 0, "cc": "CL", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 6250, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.223, "det": null, "oid": "@aut-267717-LACNIC", "org": "CS SPA", "pdb": null, "pfx": 7, "reg": "2018-11-12", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006738688044}, {"a": 267721, "h": "", "n": "FIORANI ALEJANDRO", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.546, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267721-LACNIC", "org": "FIORANI ALEJANDRO", "pdb": null, "pfx": 4, "reg": "2018-11-15", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267784, "h": "", "n": "Flyservers S.A.", "t": "Hosting & VPS", "w": 15, "cc": "PA", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 5, "web_exploit": 6, "bad_crawling": 1, "proxy_or_vpn": 4, "ssh_bruteforce": 7, "web_bruteforce": 4, "cve:CVE-2023-1389": 1, "cve:CVE-2024-3721": 1, "cve:CVE-2021-41773": 1}, "n": 14}, "ev": {"shodan": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 14, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 26.498, 0.011, 1, false], ["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 11.171, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.834, "det": {"shodan": {"c2": 2}, "threatfox": {"family:SectopRAT": 1}, "blocklist_de": {"apache": 1}}, "oid": "@aut-267784-LACNIC", "org": "Flyservers S.A.", "pdb": null, "pfx": 3, "reg": "2019-02-28", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00002882196657}, {"a": 267797, "h": "", "n": "ENATREL", "t": "Other", "w": 3, "cc": "NI", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 2, "router_or_botnet": 1, "cve:CVE-2019-8318": 2, "cve:CVE-2018-10562": 1, "cve:CVE-2024-12847": 2}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1902, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "shodan": {"n": 1, "p": 0.1577, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}, "crowdsec": {"n": 2, "p": 0.3431, "hi": 5.58, "lo": 0.73, "ips": 2, "mean": 2.66, "above": false}}, "h2": [["2026-10-05", 1.098, 0.011, 0, false], ["2026-10-12", 2.728, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 0.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.728, "se": 0.766, "ts": 0.667, "map": 8.465, "obs": 3, "own": 4.862, "comp": {"cins": 4.1487, "dshield": -0.995, "crowdsec": 3.5835, "vulncheck": -0.6627, "blocklist_de": -2.5449}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.240, "det": {"shodan": {"malware": 1}}, "oid": "@aut-267797-LACNIC", "org": "EMPRESA NACIONAL DE TRANSMISIÓN ELÉCTRICA (ENATREL)", "pdb": null, "pfx": 43, "reg": "2019-03-13", "rir": "lacnic", "s24": 48, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 17408, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042801218434}, {"a": 267798, "h": "", "n": "GENERACION WI-FI", "t": "Broadband & mobile", "w": 6, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}, "blocklist_de": {"n": 3, "p": 0.6386, "hi": 7.66, "lo": 1.35, "ips": 4, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 8.585, 0.011, 0, false], ["2026-10-12", 32.822, 0.012, 1, false]], "sh": false, "uc": 2799.5, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 3}, "lo": 32.822, "se": 0.580, "ts": 0.500, "map": 72.955, "obs": 6, "own": 112.188, "comp": {"cins": -0.9538, "dshield": 1.241, "crowdsec": -0.7049, "vulncheck": -0.8147, "blocklist_de": 6.916}, "mass": 4.8, "listed": false}}, "abq": false, "bot": 0.271, "det": {"blocklist_de": {"ssh": 1, "imap": 3, "mail": 3}}, "oid": "@aut-267798-LACNIC", "org": "GENERACION WI-FI SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "http://www.astesano.com.ar"}, "pfx": 5, "reg": "2019-03-13", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00079454183319}, {"a": 267832, "h": "", "n": "VELONET SAS", "t": "Broadband & mobile", "w": 1, "cc": "CO", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": 5803.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 15.216, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.277, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-267832-LACNIC", "org": "VELONET SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://velonet.co/"}, "pfx": 10, "reg": "2019-04-16", "rir": "lacnic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00066664413065}, {"a": 267833, "h": "", "n": "ONPOWER Internet", "t": "Broadband & mobile", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.235, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267833-LACNIC", "org": "CASELLES COSTA FACUNDO JAVIER (ONPOWER)", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.onpower.com.ar"}, "pfx": 9, "reg": "2019-04-23", "rir": "lacnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00043364878326}, {"a": 267838, "h": "", "n": "Greenlink", "t": "Broadband & mobile", "w": 3, "cc": "DO", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 3, "home_connection": 3, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.357, "det": null, "oid": "@aut-267838-LACNIC", "org": "GREENLINK SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://greenlink.com.do/"}, "pfx": 1, "reg": "2019-04-25", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005426505516}, {"a": 267889, "h": "", "n": "PROVINSAT CAPITAL SA", "t": "Other", "w": 3, "cc": "AR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 1.385, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.385, "se": 1.717, "ts": 1.000, "map": 22.773, "obs": 1, "own": 21.732, "comp": {"cins": -0.0313, "dshield": -0.0755, "crowdsec": -0.2996, "vulncheck": -0.0965, "blocklist_de": 5.0223}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.134, "det": {"blocklist_de": {"imap": 3, "mail": 3}}, "oid": "@aut-267889-LACNIC", "org": "PROVINSAT CAPITAL SA", "pdb": null, "pfx": 1, "reg": "2019-06-07", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 267912, "h": "", "n": "VIDEO DIGITAL", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 17.753, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.165, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "@aut-267912-LACNIC", "org": "VIDEO DIGITAL SRL", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.videodigital.com.ar"}, "pfx": 5, "reg": "2019-06-21", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034617499014}, {"a": 267982, "h": "", "n": "FONETALK SERVICOS DE TELEFONIA UNIPESSOAL LIMITADA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.212, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-267982-LACNIC", "org": "FONETALK SERVICOS DE TELEFONIA UNIPESSOAL LIMITADA", "pdb": null, "pfx": 5, "reg": "2018-11-13", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268050, "h": "", "n": "SUPRINET SOLUCOES EM INTERNET LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10058.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.270, "det": null, "oid": "@aut-268050-LACNIC", "org": "SUPRINET SOLUCOES EM INTERNET LTDA", "pdb": null, "pfx": 5, "reg": "2018-12-05", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268075, "h": "", "n": "FABIANA CRISTINA MOREIRA", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.143, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268075-LACNIC", "org": "FABIANA CRISTINA MOREIRA", "pdb": null, "pfx": 4, "reg": "2018-12-13", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268117, "h": "", "n": "RAFFERDEME", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8984.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "@aut-268117-LACNIC", "org": "RAFAEL FERNANDES DE MEDEIROS", "pdb": null, "pfx": 4, "reg": "2019-01-04", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268214, "h": "", "n": "schossler e silva", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 2.240, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.220, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268214-LACNIC", "org": "schossler e silva ltda - me", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "http://cyberwebatjp.net.br/"}, "pfx": 3, "reg": "2018-05-07", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268241, "h": "", "n": "DIGITUS INFORMATICA LTDA - ME", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 32324.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 8.823, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.179, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-268241-LACNIC", "org": "DIGITUS INFORMATICA LTDA - ME", "pdb": null, "pfx": 4, "reg": "2018-05-18", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268305, "h": "", "n": "Netmais Fibra", "t": "Broadband & mobile", "w": 10, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 5, "web_bruteforce": 5, "home_connection": 8, "mail_bruteforce": 10, "cve:CVE-2026-63030": 1}, "n": 10}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 10, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 100293, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"imap": 4, "mail": 5}}, "oid": "@aut-268305-LACNIC", "org": "T & I TELECOMUNICAÇÕES LTDA ME", "pdb": null, "pfx": 1, "reg": "2018-06-13", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268323, "h": null, "n": "AZZA TELECOM SERVIÇOS EM TELECOMUNICAÇÕES LTDA", "t": "Broadband & mobile", "w": 4, "cc": null, "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1754, "hi": 4.49, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 1, "p": 0.1049, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}, "blocklist_de": {"n": 2, "p": 0.3526, "hi": 5.66, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}}, "h2": [["2026-10-12", 2.375, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.003, "ts": null, "map": 0.184, "obs": 0, "own": 1.339, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.375, "se": 0.665, "ts": 0.500, "map": 6.037, "obs": 4, "own": 9.391, "comp": {"cins": -0.728, "dshield": 1.9497, "crowdsec": -1.9917, "vulncheck": -0.7555, "blocklist_de": 4.7171}, "mass": 3.5, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1, "bots": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 97, "reg": null, "rir": "lacnic", "s24": 104, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 85760, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00673818344703}, {"a": 268339, "h": "", "n": "MOBILLE TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268339-LACNIC", "org": "MOBILLE TELECOM LTDA - ME", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.planetanet.com.br/"}, "pfx": 3, "reg": "2018-06-29", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268398, "h": "", "n": "Connecta Comercio de Informatica e Telecom", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 17.753, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.166, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "@aut-268398-LACNIC", "org": "Connecta Comercio de Informatica e Telecom", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.connectanet.com.br/"}, "pfx": 7, "reg": "2018-08-02", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268404, "h": "", "n": "DIGITAL VIRTUAL", "t": "Other", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 15429.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 25.255, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.157, "det": {"blocklist_de": {"ssh": 1, "imap": 2, "mail": 2}}, "oid": "@aut-268404-LACNIC", "org": "DIGITAL VIRTUAL LTDA - ME", "pdb": {"t": null, "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.digitalvirtual.com.br"}, "pfx": 3, "reg": "2018-08-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268429, "h": "", "n": "SISTELBRAS TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4980.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.123, "det": null, "oid": "@aut-268429-LACNIC", "org": "SISTELBRAS TELECOM", "pdb": null, "pfx": 2, "reg": "2018-08-10", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268447, "h": "", "n": "A C M DA CRUZ TECNOLOGIA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 6347.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.107, "det": null, "oid": "@aut-268447-LACNIC", "org": "A C M DA CRUZ TECNOLOGIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "https://newinfor.com.br"}, "pfx": 3, "reg": "2018-08-16", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268492, "h": "", "n": "JL Provedor", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.134, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268492-LACNIC", "org": "JL Provedor", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "http://jlprovedor.com.br"}, "pfx": 7, "reg": "2018-08-29", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000128729916}, {"a": 268580, "h": "", "n": "COELHO NETO PROVEDORES DE INTERNET  LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.142, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268580-LACNIC", "org": "COELHO NETO PROVEDORES DE INTERNET LTDA", "pdb": null, "pfx": 1, "reg": "2018-10-02", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268581, "h": "", "n": "QNAX Data Center", "t": "Hosting & VPS", "w": 13, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 4, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "cve:CVE-2017-9841": 2, "cve:CVE-2019-9082": 2, "cve:CVE-2018-20062": 2, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1934, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 6, "p": 0.9555, "hi": 11.11, "lo": 3.08, "ips": 6, "mean": 6.57, "above": true}, "crowdsec": {"n": 5, "p": 0.8891, "hi": 9.71, "lo": 2.41, "ips": 6, "mean": 5.54, "above": true}, "vulncheck": {"n": 3, "p": 0.6363, "hi": 7.63, "lo": 1.34, "ips": 4, "mean": 3.94, "above": false}, "phishing_db": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 3, "p": 0.6249, "hi": 7.50, "lo": 1.32, "ips": 5, "mean": 3.87, "above": false}}, "h2": [["2026-10-05", 20.596, 0.462, 1, false], ["2026-10-12", 27.646, 0.481, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.481, "se": 1.552, "ts": 1.000, "map": 5.001, "obs": 1, "own": 2.290, "comp": {"urlhaus": -0.1043, "threatfox": -0.1312, "phishing_db": 3.4712}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 5, "vulncheck": 3, "blocklist_de": 3}, "lo": 27.646, "se": 0.483, "ts": 0.417, "map": 51.162, "obs": 12, "own": 10.020, "comp": {"cins": 2.0364, "dshield": -2.1515, "crowdsec": 1.9004, "vulncheck": 0.9957, "blocklist_de": 2.5476}, "mass": 8.8, "listed": false}}, "abq": false, "bot": 0.636, "det": {"shodan": {"compromised": 6}, "vulncheck": {"botnet_node": 4}, "blocklist_de": {"ssh": 5}}, "oid": "@aut-268581-LACNIC", "org": "QNAX LTDA", "pdb": {"t": "Enterprise", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://qnax.sh"}, "pfx": 27, "reg": "2018-10-03", "rir": "lacnic", "s24": 31, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.7823], ["2026-10-12", 0.0690]], "ipv4": 11520, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": ["crowdsec"], "traffic": 0.00479954113548}, {"a": 268590, "h": "", "n": "ERALDO CARLOS DA SILVA LIMA SEABANT ME", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.186, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268590-LACNIC", "org": "SEABANT DIGITAL LTDA", "pdb": null, "pfx": 1, "reg": "2018-10-04", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268605, "h": "", "n": "SRG TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4150.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.217, "det": null, "oid": "@aut-268605-LACNIC", "org": "SRG TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.srgtelecom.com.br"}, "pfx": 14, "reg": "2018-10-09", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268624, "h": "", "n": "Gamers Club", "t": "Transit & backbone", "w": 5, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.6331, "hi": 7.59, "lo": 1.34, "ips": 3, "mean": 3.92, "above": false}, "phishing_db": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 2, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 1.647, 0.440, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.440, "se": 1.531, "ts": 1.000, "map": 4.362, "obs": 1, "own": 18.236, "comp": {"urlhaus": -0.1169, "threatfox": -0.1437, "phishing_db": 3.3596}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 1.647, "se": 0.793, "ts": 1.000, "map": 5.140, "obs": 3, "own": 17.185, "comp": {"cins": -0.2677, "dshield": -0.5834, "crowdsec": -2.3035, "vulncheck": 7.5683, "blocklist_de": -1.383}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.718, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "@aut-268624-LACNIC", "org": "Gamers Club Ltda", "pdb": {"t": "NSP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.gamersclub.com.br"}, "pfx": 41, "reg": "2018-10-11", "rir": "lacnic", "s24": 40, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11776, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001210218993}, {"a": 268696, "h": "", "n": "TUDDO INTERNET", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2773.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 3.008, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 3.000, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.179, "det": null, "oid": "@aut-268696-LACNIC", "org": "Tuddo Telecom Ltda.", "pdb": {"t": "NSP", "sc": "South America", "tr": "1-5Tbps", "pol": "Open", "web": "http://tuddointernet.com.br/home/"}, "pfx": 15, "reg": "2018-10-31", "rir": "lacnic", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5632, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268814, "h": "", "n": "tsunami coite internet ltda", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.137, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-268814-LACNIC", "org": "tsunami coite internet ltda", "pdb": null, "pfx": 4, "reg": "2019-03-25", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 268942, "h": "", "n": "G. PEREIRA NORONHA - ME", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 7226.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.132, "det": null, "oid": "@aut-268942-LACNIC", "org": "G. PEREIRA NORONHA - ME", "pdb": null, "pfx": 5, "reg": "2019-05-15", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269048, "h": "", "n": "MAN WEB HOSTING", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.978, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269048-LACNIC", "org": "MAN WEB HOSTING LTDA", "pdb": {"t": "Content", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://fmd.ag"}, "pfx": 4, "reg": "2019-06-14", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269054, "h": "", "n": "GIGA REDE INTERNET", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2023-1389": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-269054-LACNIC", "org": "GIGA REDE INTERNET LTDA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.gigarede.com.br"}, "pfx": 3, "reg": "2019-06-17", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269070, "h": "", "n": "Hostzone Tecnologia LTDA", "t": "Hosting & VPS", "w": 11, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 10, "first_seen_30d": 1, "ssh_bruteforce": 10, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2024-28000": 1}, "n": 11}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 3, "p": 0.6294, "hi": 7.55, "lo": 1.33, "ips": 11, "mean": 3.90, "above": false}, "blocklist_de": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 16.523, 0.011, 1, false], ["2026-10-12", 17.998, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 1}, "lo": 17.998, "se": 0.691, "ts": 0.750, "map": 48.386, "obs": 4, "own": 9.561, "comp": {"cins": -0.5828, "dshield": -1.1253, "crowdsec": 6.2474, "vulncheck": -0.7018, "blocklist_de": 1.4354}, "mass": 2.7, "listed": false}}, "abq": false, "bot": 0.819, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ftp": 1}}, "oid": "@aut-269070-LACNIC", "org": "Hostzone Tecnologia LTDA", "pdb": {"t": "NSP", "sc": "South America", "tr": null, "pol": "Open", "web": "https://hostzone.com.br"}, "pfx": 12, "reg": "2019-06-18", "rir": "lacnic", "s24": 10, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269098, "h": "", "n": "AbsamHost Internet Data Center", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.530, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-269098-LACNIC", "org": "AbsamHost Internet Data Center", "pdb": null, "pfx": 8, "reg": "2019-06-28", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269177, "h": "", "n": "NEUTRA TELECOMUNICACOES DO BRASIL LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.144, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269177-LACNIC", "org": "NEUTRA TELECOMUNICACOES DO BRASIL LTDA", "pdb": null, "pfx": 4, "reg": "2019-07-26", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269194, "h": "", "n": "ST1 INTERNET", "t": "Transit & backbone", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.425, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 2.690, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.425, "se": 1.355, "ts": 1.000, "map": 3.985, "obs": 1, "own": 14.906, "comp": {"cins": -0.113, "dshield": -0.2628, "crowdsec": -1.0405, "vulncheck": -0.2829, "blocklist_de": 4.4753}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-269194-LACNIC", "org": "ST1 INTERNET", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Open", "web": "https://st1.net.br"}, "pfx": 36, "reg": "2019-08-01", "rir": "lacnic", "s24": 21, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15616, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00386012444685}, {"a": 269195, "h": "", "n": "CALUX NET PROVEDORA DE INTERNET LTDA", "t": "Other", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": 6054.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 27.317, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.160, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-269195-LACNIC", "org": "J. CALUX & CIA LTDA", "pdb": null, "pfx": 5, "reg": "2019-08-02", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269272, "h": "", "n": "NEWNET TECNOLOGIA E PROJETOS LTDA", "t": "Other", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.453, 0.011, 0, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": 8007.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 27.317, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.312, "det": {"blocklist_de": {"imap": 4, "mail": 4}}, "oid": "@aut-269272-LACNIC", "org": "NEWNET TECNOLOGIA E PROJETOS LTDA", "pdb": null, "pfx": 6, "reg": "2019-08-27", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269302, "h": "", "n": "Fourlink Telecom Serviços de Telecomunicações Ltda", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.243, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269302-LACNIC", "org": "Fourlink Telecom Serviços de Telecomunicações Ltda", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "https://fourlinktelecom.com/"}, "pfx": 7, "reg": "2019-09-04", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269387, "h": "", "n": "COLLIS TELECOMUNICAÇÕES LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.176, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269387-LACNIC", "org": "COLLIS TELECOMUNICAÇÕES LTDA", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://collis.net.br/"}, "pfx": 7, "reg": "2019-09-27", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269559, "h": "", "n": "J J T SANTOS - SERVICOS WEB E SOLUCOES PARA INTERN", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.467, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269559-LACNIC", "org": "J J T SANTOS - SERVICOS WEB E SOLUCOES PARA INTERN", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.azureweb.com.br/"}, "pfx": 5, "reg": "2019-11-14", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269630, "h": "", "n": "José Carlos Santana Júnior-ME", "t": "Other", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 8.440, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 8.440, "se": 1.061, "ts": 1.000, "map": 45.545, "obs": 2, "own": 27.317, "comp": {"cins": -0.2388, "dshield": -0.5267, "crowdsec": -2.0806, "vulncheck": -0.4639, "blocklist_de": 8.5225}, "mass": 1.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-269630-LACNIC", "org": "José Carlos Santana Júnior-ME", "pdb": null, "pfx": 3, "reg": "2019-12-09", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269643, "h": "", "n": "CENTRAL NETWORKS E TECNLOGIA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.223, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269643-LACNIC", "org": "CENTRAL NETWORKS E TECNLOGIA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.centralnetworks.com.br"}, "pfx": 4, "reg": "2019-12-11", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269698, "h": "", "n": "INTERCLUB FIBRA TELECOM LTDA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.152, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269698-LACNIC", "org": "INTERCLUB FIBRA TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://interclubfibratelecom.com.br/"}, "pfx": 3, "reg": "2020-01-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269712, "h": "", "n": "OCTA TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.117, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-269712-LACNIC", "org": "OCTA TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Selective", "web": "http://www.octatelecom.com.br"}, "pfx": 5, "reg": "2020-01-09", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 269804, "h": "", "n": "SEPCOM COMUNICACIONES SAS", "t": "Hosting & VPS", "w": 3, "cc": "CO", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 16.981, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 16.981, "se": 0.817, "ts": 0.667, "map": 57.861, "obs": 3, "own": 11.572, "comp": {"cins": -0.4341, "dshield": -0.8859, "crowdsec": 0.422, "vulncheck": -0.6256, "blocklist_de": 6.9753}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.425, "det": {"blocklist_de": {"ftp": 1, "ssh": 2}}, "oid": "@aut-269804-LACNIC", "org": "SEPCOM COMUNICACIONES SAS", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "50-100Gbps", "pol": "Open", "web": "https://colombianet.tech/"}, "pfx": 6, "reg": "2019-10-07", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086135124407}, {"a": 269913, "h": "", "n": "Waoo", "t": "Other", "w": 1, "cc": "PE", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 7519.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.163, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-269913-LACNIC", "org": "CABLE SELVA CENTRAL S.A.C.", "pdb": {"t": null, "sc": "South America", "tr": null, "pol": "Open", "web": "https://waoo.pe"}, "pfx": 4, "reg": "2020-01-21", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006771626748}, {"a": 269931, "h": "", "n": "WIRELESS MULTI SERVICE VARGAS CABRERA", "t": "Broadband & mobile", "w": 3, "cc": "DO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 5.886, 0.013, 0, false]], "sh": false, "uc": 3906.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 5.886, "se": 1.031, "ts": 0.500, "map": 30.211, "obs": 2, "own": 49.175, "comp": {"cins": -0.2377, "dshield": -0.5244, "crowdsec": 2.3761, "vulncheck": -0.4627, "blocklist_de": 3.6506}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.295, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-269931-LACNIC", "org": "WIRELESS MULTI SERVICE VARGAS CABRERA, S. R. L", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.wmservice.com.do"}, "pfx": 6, "reg": "2020-02-06", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00086365632984}, {"a": 270013, "h": "", "n": "INFOFRACTAL", "t": "Enterprise, edu & gov", "w": 2, "cc": "CL", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.979, 0.011, 0, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 130.477, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.807, "det": null, "oid": "@aut-270013-LACNIC", "org": "J AND J SPA (INFOFRACTAL)", "pdb": {"t": "Enterprise", "sc": "South America", "tr": "100-1000Mbps", "pol": "Open", "web": "https://infofractal.io/en"}, "pfx": 2, "reg": "2020-05-29", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 2, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001010339748}, {"a": 270052, "h": "", "n": "STARTELECOM S.A.", "t": "Broadband & mobile", "w": 6, "cc": "PY", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 5, "mail_bruteforce": 1, "router_or_botnet": 3, "cve:CVE-2026-8181": 1}, "n": 5}, "ev": {"crowdsec": {"n": 2, "p": 0.4021, "hi": 6.10, "lo": 0.79, "ips": 5, "mean": 2.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 6.717, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 1, "blocklist_de": 0}, "lo": 6.717, "se": 0.807, "ts": 0.667, "map": 22.068, "obs": 3, "own": 35.254, "comp": {"cins": -0.339, "dshield": -0.7178, "crowdsec": 5.4891, "vulncheck": 1.7986, "blocklist_de": -1.7432}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.327, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-270052-LACNIC", "org": "STARTELECOM S.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Open", "web": "https://startelecom.com.py"}, "pfx": 9, "reg": "2020-07-10", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 6144, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0011148764118}, {"a": 270068, "h": "", "n": "WOW PERU", "t": "Other", "w": 4, "cc": "PE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1851, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "crowdsec": {"n": 2, "p": 0.3249, "hi": 5.43, "lo": 0.71, "ips": 2, "mean": 2.59, "above": false}, "blocklist_de": {"n": 1, "p": 0.1721, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-12", 3.599, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.035, "ts": null, "map": 0.189, "obs": 0, "own": 0.618, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.599, "se": 0.669, "ts": 0.500, "map": 9.339, "obs": 4, "own": 5.311, "comp": {"cins": -0.6613, "dshield": 2.1808, "crowdsec": 1.8962, "vulncheck": -0.7328, "blocklist_de": 0.9448}, "mass": 3.1, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-270068-LACNIC", "org": "DESARROLLO DE INFRAESTRUCTURA DE TELECOMUNICACIONES PERU S.A.C. (INFRATEL)", "pdb": {"t": null, "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "https://wowperu.pe/"}, "pfx": 63, "reg": "2020-07-27", "rir": "lacnic", "s24": 60, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 30208, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01404269936784}, {"a": 270106, "h": "", "n": "Paralelo 46 TV", "t": "Other", "w": 2, "cc": "AR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": 17187.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 32.074, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.181, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-270106-LACNIC", "org": "Paralelo 46 TV SA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.canal5picotruncado.com/"}, "pfx": 4, "reg": "2020-08-28", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270126, "h": "", "n": "Neutral Networks_MX", "t": "Other", "w": 1, "cc": "MX", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 4052.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 14.129, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.151, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-270126-LACNIC", "org": "NEUTRAL NETWORKS, S de RL de CV", "pdb": {"t": null, "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.neutralnetworks.mx/"}, "pfx": 8, "reg": "2020-08-26", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0002878231808}, {"a": 270143, "h": "", "n": "Maysnet SA de CV", "t": "Broadband & mobile", "w": 0, "cc": "MX", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 2.210, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 1.692, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.209, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-270143-LACNIC", "org": "MAYSNET SA DE CV", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.maysnet.com.mx"}, "pfx": 8, "reg": "2021-08-27", "rir": "lacnic", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008577219456}, {"a": 270161, "h": "", "n": "Television Internacional, S.A. de C.V.", "t": "Other", "w": 2, "cc": "MX", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1671, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1402, "hi": 4.11, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}}, "h2": [["2026-10-12", 0.527, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.982, "ts": null, "map": 0.180, "obs": 0, "own": 0.495, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.527, "se": 0.890, "ts": 0.500, "map": 2.040, "obs": 2, "own": 1.192, "comp": {"cins": -0.3705, "dshield": 3.3281, "crowdsec": -3.0546, "vulncheck": -0.5829, "blocklist_de": 2.7866}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-265594-LACNIC", "org": "Television Internacional, S.A. de C.V.", "pdb": null, "pfx": 55, "reg": "2022-07-22", "rir": "lacnic", "s24": 143, "sib": 6, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 47360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0106184713344}, {"a": 270207, "h": "", "n": "JOSE DE JESUS VAZQUEZ PONCE", "t": "Other", "w": 1, "cc": "MX", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-41773": 1, "cve:CVE-2022-39290": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-12", 0.449, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 0.790, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.449, "se": 1.366, "ts": 1.000, "map": 4.316, "obs": 1, "own": 2.917, "comp": {"cins": -0.0994, "dshield": -0.2325, "crowdsec": 3.9635, "vulncheck": -0.2568, "blocklist_de": -0.5188}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-270207-LACNIC", "org": "MULTICARRIER JE S. DE R.L. DE C.V.", "pdb": null, "pfx": 17, "reg": "2023-02-21", "rir": "lacnic", "s24": 17, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0014315474432}, {"a": 270268, "h": "", "n": "JULIANA PALANDRANE", "t": "Other", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 3, "router_or_botnet": 3, "cve:CVE-2019-8318": 2, "cve:CVE-2018-10562": 3, "cve:CVE-2024-12847": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.449, "det": null, "oid": "@aut-270268-LACNIC", "org": "FiberPon telecom", "pdb": null, "pfx": 2, "reg": "2020-01-23", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270360, "h": "", "n": "MAXNET PROVEDOR DE INTERNET", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.730, 0.013, 0, false]], "sh": false, "uc": 5664.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.730, "se": 1.494, "ts": 1.000, "map": 8.528, "obs": 1, "own": 6.496, "comp": {"cins": -0.0468, "dshield": -0.112, "crowdsec": -0.444, "vulncheck": 4.3847, "blocklist_de": -0.2449}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.199, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "@aut-270360-LACNIC", "org": "MAXNET PROVEDOR DE INTERNET LTDA", "pdb": null, "pfx": 3, "reg": "2020-02-13", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270368, "h": "", "n": "TR TELECOMUNICACOES", "t": "Broadband & mobile", "w": 145, "cc": "BR", "cf": null, "cs": {"c": {"mail_bruteforce": 141}, "n": 141}, "ev": {"dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.4196, "hi": 6.26, "lo": 0.81, "ips": 141, "mean": 2.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 23, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 71.124, 0.011, 1, false], ["2026-10-12", 120.526, 0.013, 1, false]], "sh": false, "uc": 265820.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 120.526, "se": 0.640, "ts": 0.400, "map": 298.590, "obs": 5, "own": 459.405, "comp": {"cins": -0.698, "dshield": 2.0524, "crowdsec": 1.5398, "vulncheck": -0.7456, "blocklist_de": 4.9442}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.189, "det": {"blocklist_de": {"imap": 23, "mail": 23}}, "oid": "@aut-270368-LACNIC", "org": "T. R. TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "No", "web": null}, "pfx": 3, "reg": "2020-02-17", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270538, "h": "", "n": "MEGA CONNECT SERVICOS ESPECIAIS", "t": "Transit & backbone", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.151, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-270538-LACNIC", "org": "MEGA CONNECT SERVICOS ESPECIAIS LTDA.", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Selective", "web": "http://megaconnect.com.br/"}, "pfx": 6, "reg": "2020-03-19", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270556, "h": "", "n": "AGILE TELECOM LTDA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 6250, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.131, "det": null, "oid": "@aut-270556-LACNIC", "org": "ÁGILE TELECOM LTDA", "pdb": null, "pfx": 3, "reg": "2020-03-24", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270564, "h": "", "n": "MASTER DA WEB", "t": "Hosting & VPS", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "phishing_db": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.556, 0, false], ["2026-10-12", 0.011, 0.577, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.577, "se": 1.601, "ts": 1.000, "map": 6.580, "obs": 1, "own": 3.100, "comp": {"urlhaus": -0.0803, "threatfox": -0.1057, "phishing_db": 3.6963}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.147, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.915, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-270564-LACNIC", "org": "MASTER DA WEB DATACENTER LTDA", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://masterdaweb.com"}, "pfx": 18, "reg": "2020-03-25", "rir": "lacnic", "s24": 18, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270587, "h": "", "n": "figueiredo provedores", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": 18164.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.189, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-270587-LACNIC", "org": "figueiredo provedores eireli", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.figueiredoprovedores.com.br"}, "pfx": 4, "reg": "2020-03-31", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270636, "h": "", "n": "GLOBALLIG TELECOMUNICACOES LTDA - ME", "t": "Broadband & mobile", "w": 2, "cc": "BR", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.795, 0.011, 0, false], ["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 24.111, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-270636-LACNIC", "org": "GLOBALLIG TELECOMUNICACOES LTDA - ME", "pdb": null, "pfx": 6, "reg": "2020-04-22", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270660, "h": "", "n": "Infinity Web Fibra Optica Ltda", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 20117.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.212, "det": null, "oid": "@aut-270660-LACNIC", "org": "Infinity Web Fibra Optica Ltda", "pdb": null, "pfx": 2, "reg": "2020-04-29", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270733, "h": "", "n": "netmax telecomunicacoes ltda", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 8.703, 0.011, 0, false], ["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": 17968.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 87.650, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.123, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-270733-LACNIC", "org": "netmax telecomunicacoes ltda", "pdb": null, "pfx": 3, "reg": "2020-05-21", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270776, "h": "", "n": "Hiperlink Telecom Brazil", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5371.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.187, "det": null, "oid": "@aut-270776-LACNIC", "org": "Hiperlink Telecom LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": null}, "pfx": 6, "reg": "2020-06-02", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270814, "h": "", "n": "ZAAZ PROVEDOR DE INTERNET E TELECOMUNICACOES S.A.", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0782, "hi": 3.39, "lo": 0.25, "ips": 1, "mean": 1.43, "above": false}, "blocklist_de": {"n": 3, "p": 0.5405, "hi": 6.68, "lo": 1.18, "ips": 3, "mean": 3.45, "above": false}}, "h2": [["2026-10-05", 1.426, 0.010, 0, false], ["2026-10-12", 1.822, 0.011, 0, false]], "sh": false, "uc": 278.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.979, "ts": null, "map": 0.179, "obs": 0, "own": 1.212, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 3}, "lo": 1.822, "se": 0.662, "ts": 0.750, "map": 4.621, "obs": 4, "own": 7.189, "comp": {"cins": -0.7904, "dshield": -1.4196, "crowdsec": -2.4403, "vulncheck": -0.7742, "blocklist_de": 8.3488}, "mass": 3.9, "listed": false}}, "abq": false, "bot": 0.166, "det": {"blocklist_de": {"bots": 2, "imap": 1, "mail": 1}}, "oid": "@family-15203", "org": "ZAAZ PROVEDOR DE INTERNET E TELECOMUNICACOES LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Selective", "web": "https://www.zaaztelecom.com.br/"}, "pfx": 45, "reg": "2020-06-15", "rir": "lacnic", "s24": 150, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50688, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00596913298821}, {"a": 270842, "h": "", "n": "PORTAL NET INTERNET LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 6738.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.133, "det": null, "oid": "@aut-270842-LACNIC", "org": "PORTAL NET INTERNET LTDA", "pdb": null, "pfx": 4, "reg": "2020-06-22", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270907, "h": "", "n": "ITTV TELECOMUNICACOES LTDA", "t": "Broadband & mobile", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.708, 0.011, 0, false], ["2026-10-12", 4.887, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.887, "se": 1.042, "ts": 1.000, "map": 24.402, "obs": 2, "own": 41.752, "comp": {"cins": -0.1312, "dshield": -0.3028, "crowdsec": -1.1987, "vulncheck": 6.9048, "blocklist_de": -0.6838}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.927, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "@aut-270907-LACNIC", "org": "PLAY SERVICO DE VALOR AGREGADO LTDA", "pdb": {"t": "Content", "sc": "South America", "tr": "5-10Gbps", "pol": "No", "web": "http://www.ittv.com.br"}, "pfx": 4, "reg": "2020-07-06", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 270930, "h": "", "n": "NIVEL 3 TELECOM LTDA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 7.877, 0.013, 0, false]], "sh": false, "uc": 15039.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 7.877, "se": 1.054, "ts": 0.500, "map": 42.208, "obs": 2, "own": 69.016, "comp": {"cins": -0.2222, "dshield": -0.4934, "crowdsec": 2.5444, "vulncheck": -0.4448, "blocklist_de": 3.7524}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.177, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-270930-LACNIC", "org": "NIVEL 3 TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.nivel3telecom.com.br/"}, "pfx": 4, "reg": "2020-07-10", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271023, "h": "", "n": "Tera Soluções", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "blocklist_de": {"n": 1, "p": 0.1897, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.435, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 1.907, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.435, "se": 1.360, "ts": 1.000, "map": 4.121, "obs": 1, "own": 7.609, "comp": {"cins": -0.1113, "dshield": -0.2591, "crowdsec": -1.0261, "vulncheck": -0.2798, "blocklist_de": 4.4863}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.160, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"bots": 1}}, "oid": "@aut-271023-LACNIC", "org": "TERA SOLUCOES", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.teracorporation.com.br"}, "pfx": 11, "reg": "2020-07-31", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271042, "h": "", "n": "BOT INTERNET E SERVICOS DE TELECOMUNICACOES", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.159, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271042-LACNIC", "org": "BOT INTERNET E SERVICOS DE TELECOMUNICACOES LTDA", "pdb": {"t": null, "sc": "South America", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.botinternet.com.br/"}, "pfx": 1, "reg": "2020-08-03", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271069, "h": "", "n": "A4 TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 8056.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.124, "det": null, "oid": "@aut-271069-LACNIC", "org": "A4 TELECOM SERVICOS DE TELECOMUNICACAO LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "https://a4telecom.com.br/"}, "pfx": 10, "reg": "2020-08-04", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271071, "h": "", "n": "NAVEGAI SERVICOS DE TELECOMUNICACOES E INFORMATICA", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.208, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271071-LACNIC", "org": "NAVEGAI SERVICOS DE TELECOMUNICACOES E INFORMATICA", "pdb": null, "pfx": 5, "reg": "2020-08-04", "rir": "lacnic", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271231, "h": "", "n": "J. S. dos Santos Junior Comunicações ME", "t": "Other", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 0.640, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.640, "se": 1.447, "ts": 1.000, "map": 7.117, "obs": 1, "own": 5.061, "comp": {"cins": -0.0775, "dshield": -0.1831, "crowdsec": 4.2331, "vulncheck": -0.2113, "blocklist_de": -0.4051}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "@aut-271231-LACNIC", "org": "J. S. dos Santos Junior Comunicações ME", "pdb": null, "pfx": 12, "reg": "2020-08-18", "rir": "lacnic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271239, "h": "", "n": "Altatech Soluções em Tecnologia EIRELI", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.810, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271239-LACNIC", "org": "Altatech Soluções em Tecnologia EIRELI", "pdb": null, "pfx": 3, "reg": "2020-08-19", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271259, "h": "", "n": "JOTTANET SERVICOS DE INTERNET E INFORMATICA EIRELI", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 8984.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.174, "det": null, "oid": "@aut-271259-LACNIC", "org": "CR INTERNET APUCARANA LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Open", "web": "http://conecttiva.com.br"}, "pfx": 1, "reg": "2020-08-20", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271438, "h": "", "n": "GOVFACILBRASIL TECNOLOGIA E GESTAO", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.660, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271438-LACNIC", "org": "GOVFACILBRASIL TECNOLOGIA E GESTAO", "pdb": null, "pfx": 1, "reg": "2020-10-13", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271482, "h": "", "n": "Mega Telecom Ltda", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.133, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271482-LACNIC", "org": "Mega Telecom Ltda", "pdb": null, "pfx": 4, "reg": "2020-10-29", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271503, "h": "", "n": "PROVEDOR SUPERCELL NET", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 9.612, 0.013, 0, false]], "sh": false, "uc": 11914.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.612, "se": 1.071, "ts": 0.500, "map": 53.408, "obs": 2, "own": 87.650, "comp": {"cins": -0.2114, "dshield": -0.4716, "crowdsec": 2.663, "vulncheck": -0.4318, "blocklist_de": 3.8234}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.157, "det": {"blocklist_de": {"mail": 1}}, "oid": "@aut-271503-LACNIC", "org": "PROVEDOR SUPERCELL NET", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "1-5Gbps", "pol": "Open", "web": "https://supercel.net.br"}, "pfx": 3, "reg": "2020-11-09", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271597, "h": "", "n": "NEW LINK CONNECT", "t": "Other", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.860, 0.011, 0, false], ["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": 7031.3, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.123, "det": null, "oid": "@aut-271597-LACNIC", "org": "NEW LINK CONNECT", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://newlinkconnect.com.br/"}, "pfx": 2, "reg": "2021-01-26", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271627, "h": "", "n": "ZAP TELECOM EIRELI", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271627-LACNIC", "org": "ZAP TELECOM LTDA", "pdb": null, "pfx": 5, "reg": "2021-02-12", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 271792, "h": "", "n": "ONRED SOLUCIONES DE CONECTIVIDAD S.A.S.", "t": "Other", "w": 2, "cc": "CO", "cf": null, "cs": {"c": {"mail_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1933, "hi": 4.68, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 16.911, 0.011, 1, false], ["2026-10-12", 0.781, 0.013, 0, false]], "sh": false, "uc": 4140.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.781, "se": 1.501, "ts": 1.000, "map": 9.522, "obs": 1, "own": 7.060, "comp": {"cins": -0.065, "dshield": -0.1544, "crowdsec": 4.3896, "vulncheck": -0.1829, "blocklist_de": -0.34}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.238, "det": {"blocklist_de": {"imap": 2, "mail": 2}}, "oid": "@aut-271792-LACNIC", "org": "ONRED SOLUCIONES DE CONECTIVIDAD S.A.S.", "pdb": null, "pfx": 2, "reg": "2020-09-11", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00016887765179}, {"a": 271814, "h": "", "n": "NEXTNET", "t": "Transit & backbone", "w": 3, "cc": "PE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 2, "p": 0.3338, "hi": 5.51, "lo": 0.72, "ips": 3, "mean": 2.62, "above": false}}, "h2": [["2026-10-12", 0.591, 0.011, 0, false]], "sh": false, "uc": 148.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.987, "ts": null, "map": 0.180, "obs": 0, "own": 1.779, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 2}, "lo": 0.591, "se": 0.897, "ts": 1.000, "map": 2.336, "obs": 2, "own": 7.585, "comp": {"cins": -0.3952, "dshield": -0.8186, "crowdsec": -3.2252, "vulncheck": -0.6003, "blocklist_de": 7.2811}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.158, "det": {"blocklist_de": {"ssh": 2, "bots": 1}}, "oid": "@aut-271814-LACNIC", "org": "NEXTNET SAC", "pdb": {"t": "NSP", "sc": "South America", "tr": "100-200Gbps", "pol": "Open", "web": "http://www.nextnet.pe"}, "pfx": 139, "reg": "2020-10-14", "rir": "lacnic", "s24": 134, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 68608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00590939631288}, {"a": 271867, "h": "", "n": "MARIO BENAVIDES SERVICIO DE TELEVISION POR CABLE E.I.R.L (CABLEVISION DEL SUR)", "t": "Broadband & mobile", "w": 0, "cc": "CL", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.173, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-271867-LACNIC", "org": "MARIO BENAVIDES SERVICIO DE TELEVISION POR CABLE E.I.R.L (CABLEVISION DEL SUR)", "pdb": null, "pfx": 4, "reg": "2021-02-26", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001271772531}, {"a": 271936, "h": "", "n": "SERVICIOS DE TELECOMUNICACIONES ATVCABLE", "t": "Broadband & mobile", "w": 17, "cc": "EC", "cf": null, "cs": {"c": {"ssh_bruteforce": 16}, "n": 16}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 16, "mean": 1.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 7, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 23.779, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 23.779, "se": 0.828, "ts": 0.667, "map": 82.907, "obs": 3, "own": 130.169, "comp": {"cins": -0.4165, "dshield": -0.8557, "crowdsec": 0.5847, "vulncheck": -0.6145, "blocklist_de": 7.1134}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.249, "det": {"blocklist_de": {"ssh": 6, "bots": 1}}, "oid": "@aut-271936-LACNIC", "org": "SERVICIOS DE TELECOMUNICACIONES ATVCABLE CIA. LTDA.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.atvcableltga.ec"}, "pfx": 4, "reg": "2021-07-07", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00025591794878}, {"a": 271957, "h": "", "n": "SOMOS NETWORKS COLOMBIA S.A.S. BIC", "t": "Hosting & VPS", "w": 9, "cc": "CO", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"dshield": {"n": 1, "p": 0.1817, "hi": 4.56, "lo": 0.34, "ips": 3, "mean": 1.92, "above": false}, "crowdsec": {"n": 1, "p": 0.1259, "hi": 3.96, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "blocklist_de": {"n": 4, "p": 0.7733, "hi": 8.47, "lo": 1.82, "ips": 6, "mean": 4.63, "above": false}}, "h2": [["2026-10-12", 6.452, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.022, "ts": null, "map": 0.187, "obs": 0, "own": 0.225, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 4}, "lo": 6.452, "se": 0.572, "ts": 0.667, "map": 13.875, "obs": 6, "own": 2.727, "comp": {"cins": -1.0899, "dshield": 0.8611, "crowdsec": -4.3497, "vulncheck": -0.8412, "blocklist_de": 9.4435}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.238, "det": {"blocklist_de": {"bots": 5, "imap": 1, "mail": 1}}, "oid": "@aut-271957-LACNIC", "org": "SOMOS NETWORKS COLOMBIA S.A.S. BIC", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.somosinternet.co/"}, "pfx": 56, "reg": "2021-08-13", "rir": "lacnic", "s24": 75, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 32768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00701738082966}, {"a": 272025, "h": "", "n": "NETV SPA", "t": "Hosting & VPS", "w": 4, "cc": "CL", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 5.238, 0.011, 0, false], ["2026-10-12", 4.887, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 4.887, "se": 1.042, "ts": 1.000, "map": 24.402, "obs": 2, "own": 5.321, "comp": {"cins": -0.1312, "dshield": -0.3028, "crowdsec": -1.1987, "vulncheck": 6.9048, "blocklist_de": -0.6838}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.360, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "@aut-272025-LACNIC", "org": "NETV SPA", "pdb": {"t": "Network Services", "sc": "South America", "tr": "50-100Gbps", "pol": "Open", "web": "https://netv.cl"}, "pfx": 1, "reg": "2021-12-14", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00056207837682}, {"a": 272056, "h": "", "n": "Palnets", "t": "Other", "w": 7, "cc": "HN", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 7, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 6.424, 0.011, 0, false], ["2026-10-12", 5.988, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 5.988, "se": 1.057, "ts": 1.000, "map": 30.890, "obs": 2, "own": 19.396, "comp": {"cins": -0.1248, "dshield": -0.2887, "crowdsec": -1.143, "vulncheck": 7.0311, "blocklist_de": -0.6504}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.175, "det": {"vulncheck": {"botnet_node": 7}}, "oid": "@aut-272056-LACNIC", "org": "PALNETS S. de R.L", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://palnets.com"}, "pfx": 3, "reg": "2022-01-19", "rir": "lacnic", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000116704045}, {"a": 272066, "h": "", "n": "FIBRAZUL INTERNET S.R.L.", "t": "Broadband & mobile", "w": 3, "cc": "AR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.325, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.325, "se": 1.304, "ts": 1.000, "map": 2.774, "obs": 1, "own": 4.965, "comp": {"cins": -0.1196, "dshield": 4.5513, "crowdsec": -1.0987, "vulncheck": -0.2951, "blocklist_de": -0.6239}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.353, "det": {"blocklist_de": {"ssh": 1, "imap": 1, "mail": 1}}, "oid": "@aut-272066-LACNIC", "org": "FIBRAZUL INTERNET S.R.L.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "500-1000Gbps", "pol": "Open", "web": "http://www.fibrazul.com.ar"}, "pfx": 3, "reg": "2022-02-07", "rir": "lacnic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8448, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00069822022998}, {"a": 272547, "h": "", "n": "Servicos de Infraestrutura e Datacenter", "t": "Hosting & VPS", "w": 4, "cc": "BR", "cf": null, "cs": null, "ev": {"threatfox": {"n": 2, "p": 0.4211, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}, "vulncheck": {"n": 2, "p": 0.4162, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 7.548, 3.608, 0, false], ["2026-10-12", 1.476, 3.615, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 3.615, "se": 1.185, "ts": 1.000, "map": 18.608, "obs": 2, "own": 6.974, "comp": {"urlhaus": -0.2395, "threatfox": 5.2387, "phishing_db": -0.4495}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 1.476, "se": 0.970, "ts": 1.000, "map": 6.383, "obs": 2, "own": 1.375, "comp": {"cins": -0.1701, "dshield": -0.386, "crowdsec": -1.5268, "vulncheck": 6.2142, "blocklist_de": -0.8841}, "mass": 0.8, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:PureRAT": 1, "family:AdaptixC2": 1}, "vulncheck": {"botnet_node": 2}, "blocklist_de": {"ssh": 1}}, "oid": "@aut-272547-LACNIC", "org": "Servicos de Infraestrutura e Datacenter", "pdb": null, "pfx": 26, "reg": "2021-12-08", "rir": "lacnic", "s24": 20, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 272696, "h": "", "n": "Hosting Now", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.440, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.319, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.175, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.909, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-272696-LACNIC", "org": "HOSTING NOW NET LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "100-200Gbps", "pol": "Selective", "web": "https://hostingnow.com.br"}, "pfx": 12, "reg": "2022-05-23", "rir": "lacnic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 272786, "h": "", "n": "x99.cloud AS272786", "t": "Hosting & VPS", "w": 4, "cc": "BR", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1971, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 3, "p": 0.6276, "hi": 7.53, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}, "blocklist_de": {"n": 2, "p": 0.4153, "hi": 6.22, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-12", 36.343, 0.012, 1, false]], "sh": false, "uc": 4326.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 0.323, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 36.343, "se": 0.582, "ts": 0.500, "map": 80.116, "obs": 6, "own": 15.713, "comp": {"cins": 3.1524, "dshield": -1.6297, "crowdsec": 2.0704, "vulncheck": -0.8157, "blocklist_de": 2.9997}, "mass": 4.9, "listed": false}}, "abq": false, "bot": 0.413, "det": {"blocklist_de": {"mail": 2}}, "oid": "@aut-272786-LACNIC", "org": "X99 INTERNET", "pdb": {"t": "NSP", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.x99.cloud"}, "pfx": 17, "reg": "2022-08-17", "rir": "lacnic", "s24": 11, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 272809, "h": "", "n": "THUNDERNET C.A.", "t": "Broadband & mobile", "w": 6, "cc": "VE", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1485, "hi": 4.20, "lo": 0.31, "ips": 1, "mean": 1.77, "above": false}, "blocklist_de": {"n": 4, "p": 0.6333, "hi": 6.90, "lo": 1.49, "ips": 5, "mean": 3.77, "above": false}}, "h2": [["2026-10-12", 1.508, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.929, "ts": null, "map": 0.165, "obs": 0, "own": 0.980, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.508, "se": 0.604, "ts": 0.800, "map": 3.450, "obs": 5, "own": 5.343, "comp": {"cins": 2.8539, "dshield": -1.7853, "crowdsec": -6.9747, "vulncheck": -0.8423, "blocklist_de": 9.3804}, "mass": 5.8, "listed": false}}, "abq": false, "bot": 0.278, "det": {"blocklist_de": {"ssh": 1, "bots": 4}}, "oid": "@aut-272809-LACNIC", "org": "THUNDERNET, C.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Open", "web": "http://www.thundernet.com.ve"}, "pfx": 399, "reg": "2022-06-22", "rir": "lacnic", "s24": 304, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 154880, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00738492262636}, {"a": 272839, "h": "", "n": "NETCALLS SOCIEDAD DE RESPONSABILIDAD LIMITADA", "t": "Other", "w": 0, "cc": "AR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.201, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-272839-LACNIC", "org": "NETCALLS SOCIEDAD DE RESPONSABILIDAD LIMITADA", "pdb": null, "pfx": 1, "reg": "2022-08-10", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 272871, "h": "", "n": "DAT - COM SERVICES, C.A.", "t": "Broadband & mobile", "w": 0, "cc": "VE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.374, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-272871-LACNIC", "org": "DAT-COM SERVICES, C.A.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.dat-com.com.ve"}, "pfx": 2, "reg": "2022-10-07", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00033091039795}, {"a": 272928, "h": "", "n": "P&C ON LINE S.R.L.", "t": "Hosting & VPS", "w": 3, "cc": "AR", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1979, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.782, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.354, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.782, "se": 1.502, "ts": 1.000, "map": 9.549, "obs": 1, "own": 2.467, "comp": {"cins": -0.0652, "dshield": 4.853, "crowdsec": -0.6135, "vulncheck": -0.1833, "blocklist_de": -0.341}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.330, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "@aut-272928-LACNIC", "org": "P&C ON LINE S.R.L. (NETWAY INTERNET)", "pdb": {"t": "Network Services", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.netway.com.ar"}, "pfx": 6, "reg": "2022-12-27", "rir": "lacnic", "s24": 5, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00048469166529}, {"a": 273063, "h": "", "n": "DAHMER MARIANO ROBERTO ADRIANO", "t": "Broadband & mobile", "w": 1, "cc": "PY", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 24023.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 35.919, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.281, "det": null, "oid": "@aut-273063-LACNIC", "org": "DAHMER MARIANO ROBERTO ADRIANO", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.tes.com.py/"}, "pfx": 1, "reg": "2023-08-22", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001083533437}, {"a": 273103, "h": "", "n": "TV&MAS S.A.S", "t": "Broadband & mobile", "w": 3, "cc": "CO", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1, "cve:CVE-2024-28000": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1831, "hi": 4.57, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "blocklist_de": {"n": 2, "p": 0.4132, "hi": 6.20, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 2.097, 0.011, 0, false], ["2026-10-12", 7.831, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 1.997, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 7.831, "se": 0.793, "ts": 0.667, "map": 25.569, "obs": 3, "own": 40.094, "comp": {"cins": -0.4748, "dshield": -0.954, "crowdsec": 0.055, "vulncheck": -0.6492, "blocklist_de": 6.6581}, "mass": 2.2, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 2}}, "oid": "@aut-273103-LACNIC", "org": "TV&MÁS S.A.S", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://tvymas.co/"}, "pfx": 14, "reg": "2023-10-06", "rir": "lacnic", "s24": 14, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00104453845314}, {"a": 273187, "h": "", "n": "FIESTA TELECOMUNICACIONES SAS", "t": "Broadband & mobile", "w": 5, "cc": "CO", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 4, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 1.007, 0.011, 0, false], ["2026-10-12", 13.766, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 13.766, "se": 1.106, "ts": 0.500, "map": 80.972, "obs": 2, "own": 134.320, "comp": {"cins": 4.77, "dshield": -0.476, "crowdsec": -1.881, "vulncheck": -0.4344, "blocklist_de": 3.8091}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.185, "det": {"blocklist_de": {"bots": 1}}, "oid": "@aut-273187-LACNIC", "org": "FIESTA TELECOMUNICACIONES SAS", "pdb": null, "pfx": 2, "reg": "2024-02-22", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00072161391588}, {"a": 273309, "h": "", "n": "ISPRO TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.216, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 1.510, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.619, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.126, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-273309-LACNIC", "org": "UNI TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "100-200Gbps", "pol": "Open", "web": "https://souuni.com/"}, "pfx": 66, "reg": "2023-07-26", "rir": "lacnic", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00312173350293}, {"a": 273438, "h": "", "n": "Olah Connect", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-273438-LACNIC", "org": "Olah Connect", "pdb": null, "pfx": 1, "reg": "2024-01-15", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 273490, "h": "", "n": "FIBRION INTERNET LTDA", "t": "Broadband & mobile", "w": 1, "cc": "BR", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "home_connection": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1146, "hi": 3.83, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-12", 0.178, 0.012, 0, false]], "sh": false, "uc": 434, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.012, "ts": null, "map": 0.185, "obs": 0, "own": 1.390, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.178, "se": 1.212, "ts": 1.000, "map": 1.284, "obs": 1, "own": 2.216, "comp": {"cins": -0.1545, "dshield": -0.3529, "crowdsec": 3.3076, "vulncheck": -0.3531, "blocklist_de": -0.8037}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.194, "det": null, "oid": "@aut-273490-LACNIC", "org": "FIBRION INTERNET LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://fibrion.com.br/"}, "pfx": 105, "reg": "2024-04-03", "rir": "lacnic", "s24": 90, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 46080, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 273508, "h": "", "n": "Visão Datacenter LTDA", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.120, "ts": null, "map": 0.238, "obs": 0, "own": 0.228, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.940, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-273508-LACNIC", "org": "Visão Datacenter LTDA", "pdb": {"t": "NSP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://visaodatacenter.com.br/"}, "pfx": 6, "reg": "2024-04-25", "rir": "lacnic", "s24": 6, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 273683, "h": "", "n": "Brasil TecPar (Allrede)", "t": "Broadband & mobile", "w": 3, "cc": "BR", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0856, "hi": 3.48, "lo": 0.26, "ips": 1, "mean": 1.47, "above": false}, "blocklist_de": {"n": 2, "p": 0.3326, "hi": 5.49, "lo": 0.71, "ips": 2, "mean": 2.62, "above": false}}, "h2": [["2026-10-12", 1.182, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.986, "ts": null, "map": 0.180, "obs": 0, "own": 1.246, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 1.182, "se": 0.748, "ts": 0.667, "map": 3.519, "obs": 3, "own": 5.519, "comp": {"cins": -0.5773, "dshield": -1.1168, "crowdsec": -0.82, "vulncheck": -0.6994, "blocklist_de": 5.8654}, "mass": 2.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 2}}, "oid": "@aut-262324-LACNIC", "org": "ALLREDE TELECOM LTDA", "pdb": {"t": "Cable/DSL/ISP", "sc": "South America", "tr": "300-500Gbps", "pol": "Selective", "web": "https://www.allrede.com.br"}, "pfx": 98, "reg": "2023-02-06", "rir": "lacnic", "s24": 136, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 61184, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00961450354935}, {"a": 273697, "h": "", "n": "TO HOST DATACENTERS LTDA", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.276, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-273697-LACNIC", "org": "TO HOST DATACENTERS S/A", "pdb": null, "pfx": 3, "reg": "2023-02-24", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 274033, "h": "", "n": "DEVEL SECURITY, S.A.", "t": "Other", "w": 0, "cc": "GT", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": {"shodan": {"doublepulsar": 1}}, "oid": "@aut-274033-LACNIC", "org": "DEVEL SECURITY, S.A.", "pdb": null, "pfx": 1, "reg": "2025-01-23", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 274370, "h": "", "n": "IPB NET LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 33, "p": 1.0000, "hi": 44.03, "lo": 24.96, "ips": 33, "mean": 33.93, "above": true}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.147, "det": {"shodan": {"compromised": 33}}, "oid": "@aut-274370-LACNIC", "org": "IPB NET LTDA", "pdb": null, "pfx": 1, "reg": "2025-12-01", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 256, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 274406, "h": "", "n": "JUAN CARLOS CRUZ MUÑOZ", "t": "Other", "w": 3, "cc": "MX", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1989, "hi": 4.74, "lo": 0.36, "ips": 3, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 1.351, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.351, "se": 1.705, "ts": 1.000, "map": 21.964, "obs": 1, "own": 20.517, "comp": {"cins": -0.0302, "dshield": 5.0543, "crowdsec": -0.2892, "vulncheck": -0.0934, "blocklist_de": -0.1585}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.158, "det": null, "oid": "@aut-274406-LACNIC", "org": "JUAN CARLOS CRUZ MUÑOZ", "pdb": null, "pfx": 1, "reg": "2026-03-17", "rir": "lacnic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000984533248}, {"a": 274512, "h": "", "n": "V MIX DESENVOLVIMENTO DE SOFTWARE LTDA", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-274512-LACNIC", "org": "V MIX DESENVOLVIMENTO DE SOFTWARE LTDA", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://site.chatmix.com.br/"}, "pfx": 2, "reg": "2025-08-14", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 274765, "h": "", "n": "NETLIFE TECNOLOGIA EIRELI", "t": "Other", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.112, "det": {"shodan": {"compromised": 1}}, "oid": "@aut-274765-LACNIC", "org": "NETLIFE TECNOLOGIA EIRELI", "pdb": null, "pfx": 2, "reg": "2025-02-25", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 274795, "h": "", "n": "Verteron Datacenter LTDA", "t": "Hosting & VPS", "w": 0, "cc": "BR", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.954, "det": {"shodan": {"compromised": 2}}, "oid": "@aut-274795-LACNIC", "org": "Verteron Datacenter LTDA", "pdb": null, "pfx": 2, "reg": "2025-04-15", "rir": "lacnic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 275046, "h": "", "n": "AETHEN COMMUNICATIONS C.A", "t": "Other", "w": 4, "cc": "VE", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 4, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.889, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.889, "se": 1.541, "ts": 1.000, "map": 11.463, "obs": 1, "own": 8.823, "comp": {"cins": -0.0626, "dshield": -0.1489, "crowdsec": -0.5903, "vulncheck": -0.1773, "blocklist_de": 4.812}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.496, "det": {"blocklist_de": {"ssh": 4}}, "oid": "@aut-275046-LACNIC", "org": "AETHEN COMMUNICATIONS C.A", "pdb": null, "pfx": 4, "reg": "2026-09-11", "rir": "lacnic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000415159386}, {"a": 275714, "h": "", "n": "E-Consulters Enterprise", "t": "Hosting & VPS", "w": 2, "cc": "BR", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}, "crowdsec": {"n": 1, "p": 0.1602, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1825, "hi": 4.57, "lo": 0.34, "ips": 2, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 1.545, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.264, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.545, "se": 0.943, "ts": 0.500, "map": 6.677, "obs": 2, "own": 1.367, "comp": {"cins": -0.3099, "dshield": -0.6638, "crowdsec": 1.6209, "vulncheck": -0.5343, "blocklist_de": 3.1795}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.903, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2}}, "oid": "@aut-275714-LACNIC", "org": "E-Consulters Enterprise LTDA", "pdb": {"t": "Content", "sc": "South America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.e-consulters.com.br"}, "pfx": 35, "reg": "2026-03-26", "rir": "lacnic", "s24": 36, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 327706, "h": "Power-and-Network-Backup", "n": "Power and Network, Backup Company Ltd", "t": "Other", "w": 1, "cc": "TZ", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.951, 0.013, 0, false]], "sh": false, "uc": 24609.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.951, "se": 1.563, "ts": 1.000, "map": 12.787, "obs": 1, "own": 10.031, "comp": {"cins": -0.0525, "dshield": -0.1254, "crowdsec": 4.5477, "vulncheck": -0.1527, "blocklist_de": -0.275}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.445, "det": null, "oid": "ORG-PANB1-AFRINIC", "org": "Power and Network, Backup Company Ltd", "pdb": null, "pfx": 3, "reg": "2014-08-12", "rir": "afrinic", "s24": 3, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000496219262}, {"a": 327714, "h": "ComNet-TZ", "n": "Zanzibar Connections Company", "t": "Broadband & mobile", "w": 1, "cc": "TZ", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1898, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.588, 0.011, 0, false], ["2026-10-12", 4.789, 0.012, 0, false]], "sh": false, "uc": 7763.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.789, "se": 1.015, "ts": 0.500, "map": 23.787, "obs": 2, "own": 38.610, "comp": {"cins": -0.2489, "dshield": -0.5466, "crowdsec": 2.2559, "vulncheck": -0.4749, "blocklist_de": 3.5773}, "mass": 1.1, "listed": false}}, "abq": false, "bot": 0.137, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-ZCCL1-AFRINIC", "org": "Zanzibar Connections Company Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "No", "web": "http://www.comnet.africa"}, "pfx": 7, "reg": "2013-12-06", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007778556511}, {"a": 327724, "h": "NITA", "n": "National Information Technology Authority Uganda", "t": "Enterprise, edu & gov", "w": 1, "cc": "UG", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1924, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "shodan": {"n": 2, "p": 0.3735, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 0.285, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 2.887, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.305, "ts": 1.000, "map": 2.755, "obs": 1, "own": 18.001, "comp": {"cins": 4.9443, "dshield": -0.3073, "crowdsec": -1.2164, "vulncheck": -0.3189, "blocklist_de": -0.6944}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.353, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-NITA1-AFRINIC", "org": "National Information Technology Authority Uganda", "pdb": {"t": "Enterprise", "sc": "Africa", "tr": null, "pol": "Open", "web": "https://www.nita.go.ug"}, "pfx": 10, "reg": "2014-01-29", "rir": "afrinic", "s24": 36, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030182392101}, {"a": 327728, "h": "CTV", "n": "Cable Television Network (CTV) Limited", "t": "Broadband & mobile", "w": 0, "cc": "TZ", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4175, "hi": 6.24, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.251, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-CTN1-AFRINIC", "org": "Cable Television Network (CTV) Limited", "pdb": null, "pfx": 4, "reg": "2014-02-12", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004018615371}, {"a": 327750, "h": "JENNY-INTERNET", "n": "JENNY", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0753, "hi": 3.35, "lo": 0.25, "ips": 1, "mean": 1.41, "above": false}}, "h2": [["2026-10-12", 0.127, 0.011, 0, false]], "sh": false, "uc": 565.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.178, "obs": 0, "own": 1.199, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.127, "se": 1.169, "ts": 1.000, "map": 0.840, "obs": 1, "own": 1.430, "comp": {"cins": -0.1744, "dshield": -0.3952, "crowdsec": 3.0781, "vulncheck": -0.3827, "blocklist_de": -0.9064}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.267, "det": null, "oid": "ORG-JIC1-AFRINIC", "org": "JENNY INTERNET (PTY) LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "Selective", "web": "http://www.jenny.africa"}, "pfx": 16, "reg": "2014-04-15", "rir": "afrinic", "s24": 156, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 40192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00194574732237}, {"a": 327782, "h": "METROFIBRE-NETWORX", "n": "Metrofibre Networx (PTY) Ltd", "t": "Broadband & mobile", "w": 13, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 9, "bad_crawling": 6, "proxy_or_vpn": 1, "web_bruteforce": 9, "cve:CVE-2013-3827": 6, "cve:CVE-2014-2383": 7, "cve:CVE-2014-8739": 1, "cve:CVE-2015-9415": 1, "cve:CVE-2022-26134": 3}, "n": 10}, "ev": {"crowdsec": {"n": 3, "p": 0.0455, "hi": 2.95, "lo": 0.52, "ips": 10, "mean": 1.52, "above": false}, "vulncheck": {"n": 1, "p": 0.0941, "hi": 3.59, "lo": 0.27, "ips": 1, "mean": 1.51, "above": false}, "blocklist_de": {"n": 2, "p": 0.1269, "hi": 3.80, "lo": 0.49, "ips": 2, "mean": 1.81, "above": false}}, "h2": [["2026-10-12", 0.705, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.146, "obs": 0, "own": 0.774, "comp": null, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 2}, "lo": 0.705, "se": 0.577, "ts": 0.500, "map": 1.520, "obs": 6, "own": 2.368, "comp": {"cins": -1.0025, "dshield": -1.6806, "crowdsec": 1.6517, "vulncheck": 0.163, "blocklist_de": 2.6804}, "mass": 5.2, "listed": false}}, "abq": false, "bot": 0.167, "det": {"vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"bots": 2}}, "oid": "ORG-MN2-AFRINIC", "org": "Metro Fibre Networx (Pty) Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.metrofibre.co.za"}, "pfx": 29, "reg": "2014-08-18", "rir": "afrinic", "s24": 614, "sib": 2, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 200960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.009680443891}, {"a": 327795, "h": "Tanzania-e-Government-Agency", "n": "Tanzania e-Government Agency (eGA)", "t": "Broadband & mobile", "w": 1, "cc": "TZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3788, "hi": 5.89, "lo": 0.77, "ips": 2, "mean": 2.81, "above": false}, "crowdsec": {"n": 1, "p": 0.1641, "hi": 4.37, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.304, 0.011, 0, false], ["2026-10-12", 0.324, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.192, "obs": 0, "own": 1.752, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.324, "se": 1.303, "ts": 1.000, "map": 2.765, "obs": 1, "own": 4.948, "comp": {"cins": -0.1193, "dshield": -0.2767, "crowdsec": 3.7228, "vulncheck": -0.2944, "blocklist_de": -0.6219}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.185, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-TEA1-AFRINIC", "org": "e-Government Authority", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "http://ega.go.tz"}, "pfx": 21, "reg": "2014-09-22", "rir": "afrinic", "s24": 32, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011559679674}, {"a": 327799, "h": "VIETTEL-BURUNDI", "n": "VIETTEL BURUNDI", "t": "Broadband & mobile", "w": 0, "cc": "BI", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1428, "hi": 4.14, "lo": 0.31, "ips": 1, "mean": 1.75, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.854, "ts": null, "map": 0.174, "obs": 0, "own": 0.599, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.136, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-VBS1-AFRINIC", "org": "VIETTEL BURUNDI SA", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": null}, "pfx": 59, "reg": "2014-10-01", "rir": "afrinic", "s24": 68, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41472, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00177908972934}, {"a": 327813, "h": "HA-VPS-NET", "n": "Web4Africa", "t": "Hosting & VPS", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.868, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CTML1-AFRINIC", "org": "Host Africa (Pty) Ltd", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Gbps", "pol": "Open", "web": "https://web4africa.com"}, "pfx": 10, "reg": "2014-10-30", "rir": "afrinic", "s24": 10, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008361122324}, {"a": 327820, "h": "SWECOM", "n": "SWECOM", "t": "Broadband & mobile", "w": 2, "cc": "CM", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1776, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "vulncheck": {"n": 1, "p": 0.1947, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 1.882, 0.012, 0, false]], "sh": false, "uc": 9457.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.086, "ts": null, "map": 0.194, "obs": 0, "own": 1.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 0}, "lo": 1.882, "se": 0.974, "ts": 0.500, "map": 8.350, "obs": 2, "own": 13.852, "comp": {"cins": -0.2094, "dshield": -0.4675, "crowdsec": 2.6848, "vulncheck": 2.5941, "blocklist_de": -1.086}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.361, "det": {"vulncheck": {"botnet_node": 1}}, "oid": "ORG-SP3-AFRINIC", "org": "SWECOM PLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.swecom.cm"}, "pfx": 10, "reg": "2014-11-13", "rir": "afrinic", "s24": 19, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4864, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004761179271}, {"a": 327829, "h": "SKYTIC-TELECOM", "n": "SKYTIC TELECOM", "t": "Broadband & mobile", "w": 0, "cc": "CG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 20410.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.201, "det": null, "oid": "ORG-ST5-AFRINIC", "org": "SKYTIC TELECOM", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://rofa-network.com"}, "pfx": 10, "reg": "2014-12-30", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000548112862}, {"a": 327832, "h": "Safcor-Freight", "n": "Safcor Freight (Pty) Ltd", "t": "Other", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.213, "det": {"shodan": {"malware": 1}}, "oid": "ORG-SF1-AFRINIC", "org": "Safcor Freight (Pty) Ltd", "pdb": null, "pfx": 1, "reg": "2015-01-27", "rir": "afrinic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 327839, "h": "Woolworths", "n": "Woolworths(Proprietary) Ltd", "t": "Other", "w": 13, "cc": "ZA", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 4, "p": 0.7428, "hi": 8.06, "lo": 1.73, "ips": 13, "mean": 4.40, "above": false}}, "h2": [["2026-10-05", 0.007, 1.860, 0, false], ["2026-10-12", 0.007, 1.883, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 4}, "lo": 1.883, "se": 0.944, "ts": 1.000, "map": 5.527, "obs": 4, "own": 5.544, "comp": {"urlhaus": -0.802, "threatfox": -0.4384, "phishing_db": 4.5762}, "mass": 2.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.670, "ts": null, "map": 0.106, "obs": 0, "own": 0.096, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.282, "det": null, "oid": "ORG-WL5-AFRINIC", "org": "Woolworths(Proprietary) Ltd", "pdb": null, "pfx": 22, "reg": "2015-02-04", "rir": "afrinic", "s24": 278, "sib": 0, "tor": 0, "w24": 4, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 104960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 327862, "h": "NOSi", "n": "NOSi EPE", "t": "Enterprise, edu & gov", "w": 0, "cc": "CV", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4118, "hi": 6.19, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 3.670, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 5.847, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.233, "det": {"shodan": {"c2": 2}}, "oid": "ORG-NE1-AFRINIC", "org": "NOSi EPE", "pdb": {"t": "Government", "sc": "Africa", "tr": "1-5Gbps", "pol": "Selective", "web": "https://nosi.cv/"}, "pfx": 3, "reg": "2015-03-16", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00005513217323}, {"a": 327885, "h": "Viettel-Tanzania", "n": "Viettel Tanzania PLC", "t": "Broadband & mobile", "w": 4, "cc": "TZ", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "web_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1315, "hi": 4.02, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "blocklist_de": {"n": 2, "p": 0.3760, "hi": 5.87, "lo": 0.76, "ips": 3, "mean": 2.80, "above": false}}, "h2": [["2026-10-12", 2.143, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 2}, "lo": 2.143, "se": 0.761, "ts": 0.667, "map": 6.581, "obs": 3, "own": 10.318, "comp": {"cins": -0.5443, "dshield": -1.0659, "crowdsec": -0.5463, "vulncheck": -0.6846, "blocklist_de": 6.1189}, "mass": 2.5, "listed": false}}, "abq": false, "bot": 0.060, "det": {"blocklist_de": {"imap": 2, "mail": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-VT2-AFRINIC", "org": "Viettel Tanzania PLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "100-200Gbps", "pol": "Open", "web": "http://halotel.co.tz"}, "pfx": 67, "reg": "2015-05-21", "rir": "afrinic", "s24": 68, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 34048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00879013703374}, {"a": 327901, "h": "Level7-AS", "n": "Level-7 Internet", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1340, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.847, 0.010, 0, false], ["2026-10-12", 0.132, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.974, "ts": null, "map": 0.178, "obs": 0, "own": 1.188, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.132, "se": 1.176, "ts": 1.000, "map": 0.885, "obs": 1, "own": 1.513, "comp": {"cins": -0.189, "dshield": -0.4255, "crowdsec": -1.6824, "vulncheck": -0.4029, "blocklist_de": 3.9712}, "mass": 0.9, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TTSI1-AFRINIC", "org": "Level 7 Wireless (Pty) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://www.level-7.co.za"}, "pfx": 278, "reg": "2015-06-25", "rir": "afrinic", "s24": 161, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 205568, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0023915049748}, {"a": 327934, "h": "Tunisie-Telecom", "n": "SOCIETE NATIONALE DES TELECOMMUNICATIONS (Tunisie Telecom)", "t": "Broadband & mobile", "w": 11, "cc": "TN", "cf": null, "cs": {"c": {"ssh_bruteforce": 3}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.0009, "hi": 1.52, "lo": 0.11, "ips": 2, "mean": 0.64, "above": false}, "dshield": {"n": 5, "p": 0.0352, "hi": 2.84, "lo": 0.71, "ips": 5, "mean": 1.62, "above": false}, "crowdsec": {"n": 1, "p": 0.0000, "hi": 0.33, "lo": 0.02, "ips": 3, "mean": 0.14, "above": false}, "threatfox": {"n": 1, "p": 0.0313, "hi": 2.68, "lo": 0.20, "ips": 1, "mean": 1.13, "above": false}, "blocklist_de": {"n": 1, "p": 0.0000, "hi": 0.75, "lo": 0.06, "ips": 3, "mean": 0.31, "above": false}}, "h2": [["2026-10-05", 0.064, 0.034, 0, false], ["2026-10-12", 0.156, 0.036, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.036, "se": 1.333, "ts": 1.000, "map": 0.194, "obs": 1, "own": 0.678, "comp": {"urlhaus": -0.5576, "threatfox": 1.2804, "phishing_db": -0.738}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 5, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.156, "se": 0.518, "ts": 0.625, "map": 0.302, "obs": 8, "own": 0.470, "comp": {"cins": 2.1365, "dshield": 8.6617, "crowdsec": -6.1079, "vulncheck": -0.8891, "blocklist_de": -3.6044}, "mass": 8.5, "listed": false}}, "abq": false, "bot": 0.191, "det": {"threatfox": {"family:Unknown malware": 1}, "blocklist_de": {"ssh": 3}}, "oid": "ORG-SNDT3-AFRINIC", "org": "SOCIETE NATIONALE DES TELECOMMUNICATIONS (Tunisie Telecom)", "pdb": null, "pfx": 128, "reg": "2015-09-22", "rir": "afrinic", "s24": 5008, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2086656, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01232660870784}, {"a": 327979, "h": "DIAMATRIX", "n": "DIAMATRIX", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {"home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3842, "hi": 5.94, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.327, 0.011, 0, false], ["2026-10-12", 0.347, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 1.797, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.347, "se": 1.316, "ts": 1.000, "map": 3.042, "obs": 1, "own": 5.477, "comp": {"cins": -0.115, "dshield": -0.2672, "crowdsec": 3.7746, "vulncheck": -0.2866, "blocklist_de": -0.5996}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.953, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-DC1-AFRINIC", "org": "DIAMATRIX C.C", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.domains.co.za"}, "pfx": 34, "reg": "2016-03-03", "rir": "afrinic", "s24": 28, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019061059525}, {"a": 327991, "h": "MEGASURF-WIRELESS-INTERNET", "n": "Megasurf Wireless Internet", "t": "Broadband & mobile", "w": 127, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "home_connection": 3, "mail_bruteforce": 4}, "n": 4}, "ev": {"dshield": {"n": 4, "p": 0.8043, "hi": 8.96, "lo": 1.93, "ips": 4, "mean": 4.89, "above": true}, "crowdsec": {"n": 3, "p": 0.5762, "hi": 7.01, "lo": 1.24, "ips": 4, "mean": 3.62, "above": false}, "blocklist_de": {"n": 27, "p": 1.0000, "hi": 35.70, "lo": 19.08, "ips": 119, "mean": 26.85, "above": true}}, "h2": [["2026-10-05", 90.084, 0.011, 1, false], ["2026-10-12", 119.438, 0.012, 1, false]], "sh": false, "uc": 33584, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 1.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 27}, "lo": 119.438, "se": 0.381, "ts": 0.794, "map": 188.465, "obs": 34, "own": 286.535, "comp": {"cins": -3.1305, "dshield": -0.5678, "crowdsec": -10.2642, "vulncheck": -0.9882, "blocklist_de": 21.5832}, "mass": 41.2, "listed": false}}, "abq": false, "bot": 0.198, "det": {"blocklist_de": {"bots": 1, "imap": 118, "mail": 118}}, "oid": "ORG-MWIC1-AFRINIC", "org": "Megasurf Wireless Internet CC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Selective", "web": "http://www.megasurf.co.za"}, "pfx": 12, "reg": "2016-03-22", "rir": "afrinic", "s24": 40, "sib": 0, "tor": 0, "w24": 27, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 20480, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["dshield", "blocklist_de"], "traffic": 0.00072416656955}, {"a": 328098, "h": "JENY-SAS-AS", "n": "JENY SAS", "t": "Broadband & mobile", "w": 0, "cc": "BJ", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 14306.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.376, "det": null, "oid": "ORG-JS2-AFRINIC", "org": "JENY SAS", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.jenysas.bj"}, "pfx": 6, "reg": "2016-11-09", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000112926661}, {"a": 328114, "h": "Comsol-Networks-AS", "n": "Comsol Networks", "t": "Transit & backbone", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1243, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "blocklist_de": {"n": 1, "p": 0.1651, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 0.804, 0.011, 0, false], ["2026-10-12", 0.857, 0.012, 0, false]], "sh": false, "uc": 740.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.021, "ts": null, "map": 0.187, "obs": 0, "own": 2.055, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.857, "se": 0.913, "ts": 0.500, "map": 3.475, "obs": 2, "own": 11.300, "comp": {"cins": -0.3422, "dshield": -0.7238, "crowdsec": 1.297, "vulncheck": -0.5613, "blocklist_de": 2.9696}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.260, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CNL1-AFRINIC", "org": "Comsol Networks (PTY) Ltd", "pdb": {"t": "NSP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.comsol.co.za"}, "pfx": 64, "reg": "2016-12-16", "rir": "afrinic", "s24": 77, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50944, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000263070158}, {"a": 328214, "h": "Bioniq-Ltd-AS", "n": "Bioniq", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 65722.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.283, "det": null, "oid": "ORG-BL24-AFRINIC", "org": "Bioniq (Pty) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": null, "pol": "Open", "web": "https://www.bioniq.co.za"}, "pfx": 5, "reg": "2017-08-23", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 328218, "h": "WASP-AS", "n": "WASP", "t": "Transit & backbone", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": 2880.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 2.812, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 2.469, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.193, "det": null, "oid": "ORG-WASP1-AFRINIC", "org": "Wireless Associate Service Providers CC", "pdb": {"t": "NSP", "sc": "Africa", "tr": "5-10Gbps", "pol": "No", "web": "http://www.wasp-sa.co.za/"}, "pfx": 3, "reg": "2017-08-29", "rir": "afrinic", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 8192, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001133609527}, {"a": 328228, "h": "SBIN-AS", "n": "SOCIETE BENINOISE D'INFRASTRUCTURES NUMERIQUES", "t": "Other", "w": 2, "cc": "BJ", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1555, "hi": 4.28, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "shodan": {"n": 1, "p": 0.0541, "hi": 3.06, "lo": 0.23, "ips": 1, "mean": 1.29, "above": false}, "blocklist_de": {"n": 1, "p": 0.1052, "hi": 3.72, "lo": 0.28, "ips": 1, "mean": 1.57, "above": false}}, "h2": [["2026-10-05", 0.099, 0.010, 0, false], ["2026-10-12", 0.355, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.941, "ts": null, "map": 0.169, "obs": 0, "own": 0.417, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.355, "se": 0.876, "ts": 0.500, "map": 1.347, "obs": 2, "own": 0.787, "comp": {"cins": 4.294, "dshield": -0.8838, "crowdsec": -3.4802, "vulncheck": -0.6248, "blocklist_de": 2.3859}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.126, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-SBDN1-AFRINIC", "org": "SOCIETE BENINOISE D'INFRASTRUCTURES NUMERIQUES", "pdb": null, "pfx": 59, "reg": "2017-09-29", "rir": "afrinic", "s24": 257, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 68096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0050232157991}, {"a": 328257, "h": "ASK-Internet-Technologies", "n": "ASK Internet Technologies CC", "t": "Other", "w": 1, "cc": "ZA", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.557, 0.012, 0, false]], "sh": false, "uc": 7096.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.557, "se": 1.414, "ts": 1.000, "map": 5.818, "obs": 1, "own": 4.057, "comp": {"cins": -0.0946, "dshield": -0.2219, "crowdsec": -0.8791, "vulncheck": -0.2474, "blocklist_de": 4.5976}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.242, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-AITC1-AFRINIC", "org": "ASK Internet Technologies CC", "pdb": null, "pfx": 2, "reg": "2017-12-13", "rir": "afrinic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00010651523705}, {"a": 328284, "h": "SMDT1-AS", "n": "ORG-SMDT1-AFRINIC", "t": "Enterprise, edu & gov", "w": 0, "cc": "ML", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4160, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 0.713, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 3.865, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 6.918, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.362, "det": {"shodan": {"compromised": 2}}, "oid": "ORG-SMDT1-AFRINIC", "org": "Société Malienne de Transmission et de Diffusion", "pdb": {"t": "Government", "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.smtd.ml"}, "pfx": 5, "reg": "2018-02-26", "rir": "afrinic", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001073992272}, {"a": 328306, "h": "Avanti-AS", "n": "Avanti Communications South Africa", "t": "Transit & backbone", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.016, "ts": null, "map": 0.186, "obs": 0, "own": 2.011, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.827, "ts": null, "map": 0.165, "obs": 0, "own": 1.084, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.524, "det": null, "oid": "ORG-ACSA1-AFRINIC", "org": "Avanti Communications South Africa (Pty) Ltd", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "http://www.avantiplc.com"}, "pfx": 12, "reg": "2018-04-13", "rir": "afrinic", "s24": 84, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 31488, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000019743692}, {"a": 328323, "h": "Brilliant-Telco-AS", "n": "Brilliant Telecommunications", "t": "Broadband & mobile", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 4882.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.249, "det": null, "oid": "ORG-BTL5-AFRINIC", "org": "Brilliant Telecommunications (Pty) Ltd", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.brilliantel.co.za/"}, "pfx": 1, "reg": "2018-06-04", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000818283953}, {"a": 328364, "h": "Host-Africa-AS", "n": "Host Africa", "t": "Hosting & VPS", "w": 3, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 2, "proxy_or_vpn": 3, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 1, "mail_bruteforce": 2, "cve:CVE-2015-9406": 1, "cve:CVE-2017-12149": 1, "cve:CVE-2018-20062": 2, "cve:CVE-2021-41773": 1, "cve:CVE-2025-55182": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1739, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}, "crowdsec": {"n": 3, "p": 0.5973, "hi": 7.22, "lo": 1.27, "ips": 3, "mean": 3.72, "above": false}}, "h2": [["2026-10-05", 6.366, 0.011, 0, false], ["2026-10-12", 4.033, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.033, "se": 0.773, "ts": 1.000, "map": 12.610, "obs": 3, "own": 2.516, "comp": {"cins": -0.4408, "dshield": -0.8972, "crowdsec": 8.1483, "vulncheck": -0.6296, "blocklist_de": -2.2525}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.828, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-CTML1-AFRINIC", "org": "Host Africa (Pty) Ltd", "pdb": {"t": "Content", "sc": "Africa", "tr": "1-5Gbps", "pol": "Selective", "web": "https://hostafrica.co.za"}, "pfx": 28, "reg": "2018-08-31", "rir": "afrinic", "s24": 28, "sib": 2, "tor": 3, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00011445601105}, {"a": 328397, "h": "Lucky-Connect", "n": "LUCKY CONNECT TECHNOLOGIES", "t": "Other", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 3710.9, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.282, "det": null, "oid": "ORG-LCTL1-AFRINIC", "org": "LUCKY CONNECT TECHNOLOGIES (PTY) LTD", "pdb": {"t": null, "sc": "Africa", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.luckyconnect.co.za"}, "pfx": 3, "reg": "2018-11-05", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008681699445}, {"a": 328451, "h": "IP-Express-Ltd-AS", "n": "IP Express Ltd", "t": "Other", "w": 2, "cc": "NG", "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 4.980, 0.013, 0, false]], "sh": false, "uc": 38895.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.980, "se": 1.016, "ts": 1.000, "map": 24.735, "obs": 2, "own": 14.667, "comp": {"cins": -0.2276, "dshield": -0.5042, "crowdsec": 6.9636, "vulncheck": -0.4511, "blocklist_de": -1.1787}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.244, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-IEL1-AFRINIC", "org": "IP Express Ltd", "pdb": null, "pfx": 7, "reg": "2019-03-18", "rir": "afrinic", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009436549692}, {"a": 328459, "h": "VBN-Services", "n": "VBN Services", "t": "Other", "w": 15, "cc": "BW", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 8, "p": 0.9950, "hi": 13.84, "lo": 4.50, "ips": 15, "mean": 8.63, "above": true}}, "h2": [["2026-10-05", 25.667, 0.011, 1, false], ["2026-10-12", 20.486, 0.012, 1, false]], "sh": false, "uc": 5488.3, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 8}, "lo": 20.486, "se": 0.518, "ts": 1.000, "map": 40.843, "obs": 8, "own": 22.874, "comp": {"cins": -1.5024, "dshield": -2.1769, "crowdsec": -8.4754, "vulncheck": -0.8974, "blocklist_de": 18.1555}, "mass": 9.0, "listed": false}}, "abq": false, "bot": 0.573, "det": {"blocklist_de": {"imap": 15, "mail": 15}}, "oid": "ORG-VS1-AFRINIC", "org": "VBN Services", "pdb": null, "pfx": 12, "reg": "2019-04-03", "rir": "afrinic", "s24": 40, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10496, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": 0.00015132709017}, {"a": 328465, "h": "Integrated-Payment-Services-AS", "n": "ORG-IPSL1-AFRINIC", "t": "Other", "w": 0, "cc": "KE", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.998, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-IPSL1-AFRINIC", "org": "INTEGRATED PAYMENT SERVICES LIMITED", "pdb": null, "pfx": 1, "reg": "2019-04-12", "rir": "afrinic", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000486908232}, {"a": 328471, "h": "Hero-Telecoms", "n": "HERO TELECOMS", "t": "Broadband & mobile", "w": 12, "cc": "ZA", "cf": null, "cs": {"c": {"web_exploit": 3, "proxy_or_vpn": 1, "web_bruteforce": 3, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 3}, "ev": {"dshield": {"n": 4, "p": 0.6253, "hi": 6.83, "lo": 1.47, "ips": 4, "mean": 3.73, "above": false}, "crowdsec": {"n": 2, "p": 0.0136, "hi": 2.36, "lo": 0.31, "ips": 3, "mean": 1.12, "above": false}, "phishing_db": {"n": 1, "p": 0.0975, "hi": 3.63, "lo": 0.27, "ips": 1, "mean": 1.53, "above": false}, "blocklist_de": {"n": 4, "p": 0.4366, "hi": 5.47, "lo": 1.18, "ips": 4, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.986, 0.119, 0, false], ["2026-10-12", 1.542, 0.125, 0, false]], "sh": false, "uc": 269.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.125, "se": 1.369, "ts": 1.000, "map": 0.812, "obs": 1, "own": 2.475, "comp": {"urlhaus": -0.3198, "threatfox": -0.287, "phishing_db": 2.0247}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 4, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 4}, "lo": 1.542, "se": 0.488, "ts": 0.400, "map": 2.876, "obs": 10, "own": 4.438, "comp": {"cins": -1.6057, "dshield": 5.4658, "crowdsec": -5.0164, "vulncheck": -0.9077, "blocklist_de": 4.514}, "mass": 10.0, "listed": false}}, "abq": false, "bot": 0.211, "det": {"blocklist_de": {"bots": 4}}, "oid": "ORG-HP1-AFRINIC", "org": "HERO TELECOMS (PTY) LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.herotel.com"}, "pfx": 197, "reg": "2019-04-19", "rir": "afrinic", "s24": 629, "sib": 13, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 227584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.01825793348495}, {"a": 328490, "h": "Unwired-Communications", "n": "Unwired Communications", "t": "Broadband & mobile", "w": 8, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 7, "bad_crawling": 4, "proxy_or_vpn": 4, "ssh_bruteforce": 3, "web_bruteforce": 7, "home_connection": 4, "mail_bruteforce": 1, "router_or_botnet": 7, "cve:CVE-2025-4396": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 8}, "ev": {"crowdsec": {"n": 5, "p": 0.9095, "hi": 10.29, "lo": 2.56, "ips": 8, "mean": 5.88, "above": true}}, "h2": [["2026-10-05", 28.576, 0.011, 1, false], ["2026-10-12", 30.214, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 5, "vulncheck": 0, "blocklist_de": 0}, "lo": 30.214, "se": 0.624, "ts": 1.000, "map": 72.194, "obs": 5, "own": 111.220, "comp": {"cins": -0.6785, "dshield": -1.2663, "crowdsec": 11.7734, "vulncheck": -0.7389, "blocklist_de": -3.4166}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.289, "det": null, "oid": "ORG-UCL1-AFRINIC", "org": "Unwired Communications Limited", "pdb": {"t": "NSP", "sc": "Regional", "tr": "1-5Tbps", "pol": "Selective", "web": "http://www.unwired.co.ke"}, "pfx": 6, "reg": "2019-05-22", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0033241244514}, {"a": 328527, "h": "PDS-NETWORKS", "n": "PDS Networks Nigeria Limited", "t": "Other", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 5078.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.251, "det": null, "oid": "ORG-PNNL1-AFRINIC", "org": "PDS Networks Nigeria Limited", "pdb": null, "pfx": 4, "reg": "2019-08-21", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001657934742}, {"a": 328539, "h": "Giga-Communication", "n": "Giga for Telecommunication and Technology", "t": "Broadband & mobile", "w": 2, "cc": "LY", "cf": null, "cs": {"c": {"ssh_bruteforce": 2, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1235, "hi": 3.93, "lo": 0.29, "ips": 2, "mean": 1.66, "above": false}, "blocklist_de": {"n": 1, "p": 0.1647, "hi": 4.38, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-05", 1.653, 0.011, 0, false], ["2026-10-12", 0.847, 0.012, 0, false]], "sh": false, "uc": 1056.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.020, "ts": null, "map": 0.187, "obs": 0, "own": 1.440, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.847, "se": 0.912, "ts": 0.500, "map": 3.436, "obs": 2, "own": 5.500, "comp": {"cins": -0.3428, "dshield": -0.7248, "crowdsec": 1.2914, "vulncheck": -0.5618, "blocklist_de": 2.966}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.250, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-GCAT1-AFRINIC", "org": "Giga for Telecommunication and Technology Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Open", "web": "https://giga.ly/en/"}, "pfx": 78, "reg": "2019-09-13", "rir": "afrinic", "s24": 78, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 19968, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00385102715088}, {"a": 328555, "h": "Timeless-Network-Services-AS", "n": "Timeless Network Services Ltd", "t": "Other", "w": 4, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 2, "router_or_botnet": 2}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4108, "hi": 6.18, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 4.588, 0.011, 0, false], ["2026-10-12", 13.979, 0.013, 1, false]], "sh": false, "uc": 10323.7, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 13.979, "se": 0.809, "ts": 0.667, "map": 46.821, "obs": 3, "own": 26.865, "comp": {"cins": -0.4121, "dshield": -0.8481, "crowdsec": 4.5925, "vulncheck": -0.6116, "blocklist_de": 2.5193}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.090, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TNSL3-AFRINIC", "org": "Timeless Network Services Ltd", "pdb": null, "pfx": 8, "reg": "2019-10-15", "rir": "afrinic", "s24": 7, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00081104800689}, {"a": 328556, "h": "SYSCODES-COMMUNICATIONS-AS", "n": "SYSCODES COMMUNICATIONS", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 4980.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.483, "det": null, "oid": "ORG-SCL10-AFRINIC", "org": "SYSCODES COMMUNICATIONS LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://www.syscodescomms.com/"}, "pfx": 1, "reg": "2019-10-15", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00007705811223}, {"a": 328578, "h": "KEMNET-TECHNOLOGIES-AS", "n": "KEMNET TECHNOLOGIES", "t": "Transit & backbone", "w": 3, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2024-6387": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 5.536, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 3.197, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 5.536, "se": 1.025, "ts": 1.000, "map": 28.120, "obs": 2, "own": 92.707, "comp": {"cins": -0.2221, "dshield": -0.4931, "crowdsec": 7.0405, "vulncheck": -0.4446, "blocklist_de": -1.1505}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.199, "det": null, "oid": "ORG-KTL4-AFRINIC", "org": "KEMNET TECHNOLOGIES LIMITED", "pdb": {"t": "NSP", "sc": "Africa", "tr": null, "pol": "Open", "web": "https://www.kemnet.co.ke"}, "pfx": 3, "reg": "2019-11-20", "rir": "afrinic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00027060973944}, {"a": 328583, "h": "crazyweb-Tech", "n": "Crazyweb Tech", "t": "Broadband & mobile", "w": 1, "cc": "ZA", "cf": null, "cs": {"c": {"web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1853, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 3.259, 0.011, 0, false], ["2026-10-12", 3.544, 0.012, 0, false]], "sh": false, "uc": 2018.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.544, "se": 0.994, "ts": 0.500, "map": 16.944, "obs": 2, "own": 27.406, "comp": {"cins": -0.2649, "dshield": -0.578, "crowdsec": 2.0858, "vulncheck": -0.4917, "blocklist_de": 3.4724}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.233, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-CTC2-AFRINIC", "org": "CRAZYWEB TECH (PTY) LTD", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.crazyweb.co.za"}, "pfx": 21, "reg": "2019-11-26", "rir": "afrinic", "s24": 12, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014653929955}, {"a": 328608, "h": "Africa-on-Cloud-AS", "n": "Africa on Cloud", "t": "Hosting & VPS", "w": 1, "cc": "ZA", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1275, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}}, "h2": [["2026-10-05", 0.006, 0.142, 0, false], ["2026-10-12", 0.006, 0.159, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.159, "se": 1.387, "ts": 1.000, "map": 1.094, "obs": 1, "own": 0.506, "comp": {"urlhaus": -0.2761, "threatfox": -0.263, "phishing_db": 2.2551}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.623, "ts": null, "map": 0.089, "obs": 0, "own": 0.027, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.264, "det": null, "oid": "ORG-AOC1-AFRINIC", "org": "Africa on Cloud", "pdb": {"t": null, "sc": "Africa", "tr": "1-5Gbps", "pol": "Open", "web": "https://africaoncloud.net"}, "pfx": 258, "reg": "2020-01-28", "rir": "afrinic", "s24": 397, "sib": 0, "tor": 0, "w24": 1, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 170752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 328611, "h": "Libyan-Elite", "n": "Libyan Elite LTD", "t": "Broadband & mobile", "w": 1, "cc": "LY", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1488, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}, "blocklist_de": {"n": 1, "p": 0.1773, "hi": 4.51, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 1.154, 0.011, 0, false], ["2026-10-12", 1.234, 0.012, 0, false]], "sh": false, "uc": 1212.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 1.612, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.234, "se": 0.931, "ts": 0.500, "map": 5.219, "obs": 2, "own": 8.371, "comp": {"cins": -0.322, "dshield": -0.6865, "crowdsec": 1.4985, "vulncheck": -0.5447, "blocklist_de": 3.1007}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.242, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-LE2-AFRINIC", "org": "Libyan Elite Company for Technical Solutions", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "50-100Gbps", "pol": "Open", "web": "https://LibyanElite.com"}, "pfx": 49, "reg": "2020-02-05", "rir": "afrinic", "s24": 48, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13312, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00050021040888}, {"a": 328658, "h": "De-Choicetech-Integrated", "n": "Choice2mobile Technology Ltd", "t": "Broadband & mobile", "w": 3, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 1, "cve:CVE-2017-9841": 2, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 3, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 16.974, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.219, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-DCIL1-AFRINIC", "org": "De Choicetech Integrated Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.choice2mobiletech.com"}, "pfx": 6, "reg": "2020-05-12", "rir": "afrinic", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039681207524}, {"a": 328668, "h": "Nkponani-AS", "n": "Nkponani", "t": "Other", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1880, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 0.832, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.057, "ts": null, "map": 0.229, "obs": 0, "own": 0.502, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.834, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-NL11-AFRINIC", "org": "Nkponani Limited", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.nkponani.com"}, "pfx": 13, "reg": "2020-06-08", "rir": "afrinic", "s24": 12, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00001640398412}, {"a": 328676, "h": "ZICTIA", "n": "Zanzibar Information Communication Technology Infrastructure Agency (ZICTIA)", "t": "Other", "w": 1, "cc": "TZ", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1910, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.622, 0.011, 0, false], ["2026-10-12", 0.682, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.682, "se": 1.462, "ts": 1.000, "map": 7.744, "obs": 1, "own": 5.568, "comp": {"cins": -0.0738, "dshield": -0.1747, "crowdsec": 4.2785, "vulncheck": -0.2032, "blocklist_de": -0.3862}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ORG-ZICT1-AFRINIC", "org": "Zanzibar Information Communication Technology Infrastructure Agency (ZICTIA)", "pdb": null, "pfx": 7, "reg": "2020-06-17", "rir": "afrinic", "s24": 7, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00008487177056}, {"a": 328847, "h": "KoTDA", "n": "THE KONZA TECHNOPOLIS DEVELOPMENT AUTHORITY", "t": "Other", "w": 3, "cc": "KE", "cf": null, "cs": {"c": {"ssh_bruteforce": 3, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 3}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 3, "mean": 2.95, "above": false}, "blocklist_de": {"n": 2, "p": 0.4189, "hi": 6.26, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}}, "h2": [["2026-10-05", 41.582, 0.011, 1, false], ["2026-10-12", 30.181, 0.013, 1, false]], "sh": false, "uc": 10546.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.906, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 30.181, "se": 0.701, "ts": 0.500, "map": 82.871, "obs": 4, "own": 47.006, "comp": {"cins": -0.5968, "dshield": -1.1465, "crowdsec": 2.5462, "vulncheck": -0.7077, "blocklist_de": 5.7157}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.596, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 2, "imap": 1, "mail": 1}}, "oid": "ORG-TKTD1-AFRINIC", "org": "THE KONZA TECHNOPOLIS DEVELOPMENT AUTHORITY", "pdb": null, "pfx": 6, "reg": "2021-05-05", "rir": "afrinic", "s24": 6, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000072694716}, {"a": 328856, "h": "VIJIJI-CONNECT-LIMITED", "n": "VIJIJI CONNECT", "t": "Broadband & mobile", "w": 8, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 7, "bad_crawling": 3, "proxy_or_vpn": 6, "ssh_bruteforce": 3, "web_bruteforce": 6, "mail_bruteforce": 4, "router_or_botnet": 7, "cve:CVE-2025-4396": 2, "cve:CVE-2022-44877": 1, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 3}, "n": 7}, "ev": {"crowdsec": {"n": 4, "p": 0.7989, "hi": 8.87, "lo": 1.91, "ips": 7, "mean": 4.85, "above": true}, "blocklist_de": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 19.543, 0.011, 1, false], ["2026-10-12", 22.227, 0.012, 1, false]], "sh": false, "uc": 1953.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.100, "ts": null, "map": 0.195, "obs": 0, "own": 2.064, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 22.227, "se": 0.623, "ts": 0.800, "map": 52.717, "obs": 5, "own": 81.331, "comp": {"cins": -0.7326, "dshield": -1.3419, "crowdsec": 7.6871, "vulncheck": -0.7569, "blocklist_de": 0.5029}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.227, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-VCL7-AFRINIC", "org": "VIJIJI CONNECT LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Open", "web": "https://vggconnect.ke"}, "pfx": 3, "reg": "2021-05-21", "rir": "afrinic", "s24": 12, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00345582223208}, {"a": 328858, "h": "EDN-AS", "n": "Express Data Networks", "t": "Broadband & mobile", "w": 0, "cc": "KE", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": 2539.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 1.610, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.323, "det": null, "oid": "ORG-EDNL1-AFRINIC", "org": "Express Data Networks Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.expressdata.co.ke"}, "pfx": 9, "reg": "2021-05-28", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00042229124876}, {"a": 328880, "h": "STE-INTERNET-SMART-SOLUTIONS-AS", "n": "STE INTERNET SMART SOLUTIONS", "t": "Other", "w": 0, "cc": "TN", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.007, 0.010, 0, false], ["2026-10-12", 0.007, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.953, "ts": null, "map": 0.172, "obs": 0, "own": 0.438, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.701, "ts": null, "map": 0.117, "obs": 0, "own": 0.111, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.266, "det": null, "oid": "ORG-SISS1-AFRINIC", "org": "STE INTERNET SMART SOLUTIONS", "pdb": null, "pfx": 40, "reg": "2021-06-25", "rir": "afrinic", "s24": 219, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 59392, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008838379872}, {"a": 329007, "h": "ELENDE", "n": "ELENDE", "t": "Hosting & VPS", "w": 0, "cc": "AO", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.930, "det": null, "oid": "ORG-ETDI1-AFRINIC", "org": "ELENDE - TECNOLOGIAS DE INFORMACAO - COMERCIO E SERVICOS, LDA", "pdb": {"t": "Content", "sc": "Regional", "tr": "100-1000Mbps", "pol": "Open", "web": "https://elende.ao"}, "pfx": 5, "reg": "2022-01-31", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0000101538694}, {"a": 329028, "h": "RNL1-AS", "n": "Rapid Networks", "t": "Broadband & mobile", "w": 0, "cc": "ZA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 2.050, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.239, "det": {"shodan": {"compromised": 1}}, "oid": "ORG-RNL1-AFRINIC", "org": "Rapid Networks (Pty) Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.rapidnetworks.co.za"}, "pfx": 3, "reg": "2022-03-18", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00046148064255}, {"a": 329062, "h": "BCT2-AS", "n": "Baremetal Computer Traders", "t": "Broadband & mobile", "w": 3, "cc": "ZA", "cf": null, "cs": {"c": {"web_exploit": 2, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 2, "router_or_botnet": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.220, "det": null, "oid": "ORG-BCT2-AFRINIC", "org": "Baremetal Computer Traders", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://baremetal.co.za"}, "pfx": 7, "reg": "2022-05-17", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003596786391}, {"a": 329099, "h": "MITL1-AS", "n": "MANGONET INTEGRATED", "t": "Broadband & mobile", "w": 0, "cc": "NG", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 41015.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 2.510, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.162, "det": {"blocklist_de": {"mail": 1}}, "oid": "ORG-MITL1-AFRINIC", "org": "MANGONET INTEGRATED TECHNOLOGIES LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.mangonet.com.ng"}, "pfx": 1, "reg": "2022-07-11", "rir": "afrinic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0001674719515}, {"a": 329126, "h": "IIP-AS", "n": "fibertime™", "t": "Broadband & mobile", "w": 3, "cc": "ZA", "cf": null, "cs": null, "ev": {"dshield": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1953, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 12.826, 0.011, 1, false], ["2026-10-12", 12.467, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 2.176, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.467, "se": 0.806, "ts": 0.667, "map": 41.845, "obs": 3, "own": 65.589, "comp": {"cins": -0.4201, "dshield": 7.0909, "crowdsec": -3.3945, "vulncheck": -0.6168, "blocklist_de": 2.468}, "mass": 1.9, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "ORG-IPL6-AFRINIC", "org": "IIP1 Pty Ltd", "pdb": {"t": "Cable/DSL/ISP", "sc": null, "tr": null, "pol": "Open", "web": "https://fibertime.com"}, "pfx": 9, "reg": "2022-09-06", "rir": "afrinic", "s24": 8, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0089704362338}, {"a": 329129, "h": "LNETLICT", "n": "Libyan International Company for Technology", "t": "Other", "w": 0, "cc": "LY", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": 452.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.662, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.909, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.209, "det": null, "oid": "ORG-LICF1-AFRINIC", "org": "Libyan International Company for Technology", "pdb": null, "pfx": 10, "reg": "2022-09-09", "rir": "afrinic", "s24": 44, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00071834996376}, {"a": 329167, "h": "SPRINKVILLE-NETWORKS", "n": "SPRINKVILLE NETWORKS LIMITED", "t": "Other", "w": 2, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 22.308, 0.013, 1, false]], "sh": false, "uc": 5273.4, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 22.308, "se": 0.824, "ts": 0.667, "map": 76.981, "obs": 3, "own": 44.196, "comp": {"cins": -0.3893, "dshield": -0.8083, "crowdsec": 4.8657, "vulncheck": -0.5963, "blocklist_de": 2.6655}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.244, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-SNL10-AFRINIC", "org": "SPRINKVILLE NETWORKS LIMITED", "pdb": null, "pfx": 1, "reg": "2022-10-19", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038857195924}, {"a": 329184, "h": "Host-Africa-AS2", "n": "Host Africa DPA", "t": "Hosting & VPS", "w": 8, "cc": "ZA", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 1, "proxy_or_vpn": 2, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2024-28000": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"shodan": {"n": 6, "p": 0.9585, "hi": 11.29, "lo": 3.13, "ips": 6, "mean": 6.67, "above": true}, "crowdsec": {"n": 3, "p": 0.6062, "hi": 7.31, "lo": 1.29, "ips": 6, "mean": 3.77, "above": false}, "vulncheck": {"n": 1, "p": 0.1938, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 1, "p": 0.1942, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 10.375, 0.514, 1, false], ["2026-10-12", 10.519, 0.536, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.536, "se": 1.578, "ts": 1.000, "map": 5.832, "obs": 1, "own": 2.708, "comp": {"urlhaus": -0.0906, "threatfox": -0.117, "phishing_db": 3.5972}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 10.519, "se": 0.633, "ts": 0.600, "map": 25.187, "obs": 5, "own": 4.998, "comp": {"cins": -0.6803, "dshield": -1.2688, "crowdsec": 5.0555, "vulncheck": 0.6868, "blocklist_de": 0.8267}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.642, "det": {"shodan": {"c2": 4, "compromised": 2}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "ORG-CTML1-AFRINIC", "org": "Host Africa (Pty) Ltd", "pdb": {"t": "Content", "sc": "Africa", "tr": "1-5Gbps", "pol": "Selective", "web": "https://hostafrica.co.za"}, "pfx": 23, "reg": "2022-12-08", "rir": "afrinic", "s24": 23, "sib": 2, "tor": 2, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 5888, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.0009116905091}, {"a": 329235, "h": "REXIFI-TECHNOLOGIES-AS", "n": "REXIFI TECHNOLOGIES LIMITED", "t": "Other", "w": 1, "cc": "NG", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 20.459, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-RTL1-AFRINIC", "org": "REXIFI TECHNOLOGIES LIMITED", "pdb": null, "pfx": 1, "reg": "2023-03-29", "rir": "afrinic", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00020185818944}, {"a": 329244, "h": "Connect-Surf-and-Smile-Limited", "n": "Connect, Surf and Smile Limited", "t": "Other", "w": 2, "cc": "NG", "cf": null, "cs": {"c": {"web_exploit": 2, "router_or_botnet": 1, "cve:CVE-2024-12847": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 8.243, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ORG-CSAS1-AFRINIC", "org": "Connect, Surf and Smile Limited", "pdb": null, "pfx": 1, "reg": "2023-04-07", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00018977315288}, {"a": 329255, "h": "TSL13-AS", "n": "Telcoptics", "t": "Hosting & VPS", "w": 3, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 1, "web_bruteforce": 2, "home_connection": 1, "mail_bruteforce": 1, "router_or_botnet": 2, "cve:CVE-2025-4396": 1}, "n": 2}, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.4126, "hi": 6.20, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-12", 14.841, 0.013, 1, false]], "sh": false, "uc": 3841.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 14.841, "se": 0.810, "ts": 0.667, "map": 50.206, "obs": 3, "own": 10.020, "comp": {"cins": -0.3816, "dshield": 3.2797, "crowdsec": 4.9598, "vulncheck": -0.5909, "blocklist_de": -1.9573}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.204, "det": {"blocklist_de": {"bots": 1}}, "oid": "ORG-TSL13-AFRINIC", "org": "Telcoptics Solutions Ltd", "pdb": {"t": "Network Services", "sc": "Not Disclosed", "tr": "20-50Gbps", "pol": "Open", "web": "http://www.telcopticssolutions.com"}, "pfx": 6, "reg": "2023-04-25", "rir": "afrinic", "s24": 6, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00035531128068}, {"a": 329268, "h": "SS7-AS", "n": "STE SAFOZI", "t": "Other", "w": 0, "cc": "TN", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.651, "det": {"shodan": {"c2": 1}}, "oid": "ORG-SS7-AFRINIC", "org": "STE SAFOZI", "pdb": null, "pfx": 3, "reg": "2023-05-30", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000003658032}, {"a": 329325, "h": "Maxko-for-Gaming-Development", "n": "MAXKO (Africa)", "t": "Transit & backbone", "w": 1, "cc": "EG", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2022-40684": 1, "cve:CVE-2022-47501": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 45.760, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.653, "det": null, "oid": "ORG-MFGD1-AFRINIC", "org": "Maxko for Gaming Development LLC", "pdb": {"t": "NSP", "sc": "Africa", "tr": "10-20Gbps", "pol": "Open", "web": "https://company.maxko.org"}, "pfx": 1, "reg": "2023-09-07", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 1, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 329373, "h": "TECHNOBIZ", "n": "TECHNOBIZ BUSINESS SOLUTIONS LIMITED", "t": "Broadband & mobile", "w": 2, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 2, "bad_crawling": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "router_or_botnet": 2}, "n": 2}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 2, "mean": 1.98, "above": false}}, "h2": [["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 15136.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.184, "det": null, "oid": "ORG-TBSL2-AFRINIC", "org": "TECHNOBIZ BUSINESS SOLUTIONS LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://technobizsolution.com"}, "pfx": 3, "reg": "2023-11-30", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00014551302928}, {"a": 329422, "h": "SAFHOME-FIBRE-LIMITED", "n": "Safhome Fibre", "t": "Broadband & mobile", "w": 3, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "proxy_or_vpn": 3, "web_bruteforce": 3, "mail_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.322, "det": null, "oid": "ORG-SFL4-AFRINIC", "org": "SAFHOME FIBRE LIMITED", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://safhomefibre.com"}, "pfx": 5, "reg": "2024-04-15", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00064731148096}, {"a": 329427, "h": "Electricity-Supply-Corporation-of-Malawi", "n": "Electricity Supply Corporation of Malawi Ltd", "t": "Other", "w": 0, "cc": "MW", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 7714.8, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.214, "det": null, "oid": "ORG-ESCO1-AFRINIC", "org": "Electricity Supply Corporation of Malawi Ltd", "pdb": null, "pfx": 4, "reg": "2024-04-29", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00004154630912}, {"a": 329437, "h": "Veenet-Africa", "n": "VENNET", "t": "Broadband & mobile", "w": 5, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 4, "bad_crawling": 3, "proxy_or_vpn": 2, "web_bruteforce": 4, "home_connection": 2, "mail_bruteforce": 1, "router_or_botnet": 5, "cve:CVE-2025-4396": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 5}, "ev": {"crowdsec": {"n": 3, "p": 0.6383, "hi": 7.65, "lo": 1.35, "ips": 5, "mean": 3.95, "above": false}}, "h2": [["2026-10-05", 16.063, 0.011, 1, false], ["2026-10-12", 17.361, 0.013, 1, false]], "sh": false, "uc": 4453.1, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 2.291, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 17.361, "se": 0.815, "ts": 1.000, "map": 58.864, "obs": 3, "own": 92.192, "comp": {"cins": -0.3736, "dshield": -0.7804, "crowdsec": 9.125, "vulncheck": -0.5851, "blocklist_de": -1.917}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.295, "det": null, "oid": "ORG-VSL3-AFRINIC", "org": "VENNET SOLUTIONS LIMITED", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "200-300Gbps", "pol": "Open", "web": "https://vennet.co.ke"}, "pfx": 6, "reg": "2024-05-28", "rir": "afrinic", "s24": 5, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00155560349748}, {"a": 329489, "h": "Castor-Networks", "n": "Castor Networks RDC SA", "t": "Other", "w": 0, "cc": "CD", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 10351.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.197, "det": null, "oid": "ORG-CNR1-AFRINIC", "org": "Castor Networks RDC SA", "pdb": null, "pfx": 2, "reg": "2024-09-16", "rir": "afrinic", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00000540398636}, {"a": 329658, "h": "NetPoint-Solutions", "n": "Netpoint Solutions", "t": "Broadband & mobile", "w": 3, "cc": "KE", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 1, "proxy_or_vpn": 2, "ssh_bruteforce": 1, "web_bruteforce": 2, "router_or_botnet": 3, "cve:CVE-2025-4396": 1, "cve:CVE-2026-60137": 2, "cve:CVE-2026-63030": 2}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 7.119, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.257, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "ORG-NSL8-AFRINIC", "org": "Net Point Solutions Limited", "pdb": {"t": "Cable/DSL/ISP", "sc": "Africa", "tr": "20-50Gbps", "pol": "Open", "web": "https://netpoint.pro"}, "pfx": 7, "reg": "2025-11-11", "rir": "afrinic", "s24": 4, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3072, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00049063729204}, {"a": 393398, "h": "ASN-DIS", "n": "DIS", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1242, "hi": 3.94, "lo": 0.29, "ips": 1, "mean": 1.66, "above": false}, "threatfox": {"n": 1, "p": 0.1926, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 1.416, 0.285, 0, false], ["2026-10-12", 0.009, 0.296, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.296, "se": 1.461, "ts": 1.000, "map": 2.484, "obs": 1, "own": 2.942, "comp": {"urlhaus": -0.1577, "threatfox": 3.0252, "phishing_db": -0.3316}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.810, "ts": null, "map": 0.158, "obs": 0, "own": 0.181, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.859, "det": {"shodan": {"compromised": 1}, "threatfox": {"family:PureRAT": 1}}, "oid": "RDPL-2-ARIN", "org": "1515 ROUNDTABLE DR PROPERTY, LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.vpls.com"}, "pfx": 40, "reg": "2014-04-01", "rir": "arin", "s24": 96, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 26368, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393406, "h": "DIGITALOCEAN-AS393406", "n": "DigitalOcean AS393406", "t": "Hosting & VPS", "w": 41, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 10, "ssh_bruteforce": 17, "cve:CVE-2024-6387": 18}, "n": 18}, "ev": {"crowdsec": {"n": 1, "p": 0.1682, "hi": 4.42, "lo": 0.33, "ips": 18, "mean": 1.86, "above": false}, "blocklist_de": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 23, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.327, 0.011, 0, false], ["2026-10-12", 1.885, 0.012, 0, false]], "sh": false, "uc": 1841.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.885, "se": 0.954, "ts": 0.500, "map": 8.274, "obs": 2, "own": 1.696, "comp": {"cins": -0.2994, "dshield": -0.6441, "crowdsec": 1.7277, "vulncheck": -0.5249, "blocklist_de": 3.2476}, "mass": 1.3, "listed": false}}, "abq": false, "bot": 0.913, "det": {"blocklist_de": {"ssh": 20, "apache": 3, "bruteforcelogin": 2}}, "oid": "DO-13-ARIN", "org": "DigitalOcean, LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "https://www.digitalocean.com/"}, "pfx": 28, "reg": "2014-04-09", "rir": "arin", "s24": 28, "sib": 4, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0126607365989}, {"a": 393447, "h": "AS-VIRTUALSTACKS", "n": "Virtual Stacks LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.448, "det": {"shodan": {"compromised": 1}}, "oid": "VSL-55-ARIN", "org": "Virtual Stacks LLC", "pdb": null, "pfx": 3, "reg": "2014-05-16", "rir": "arin", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393499, "h": "ONLINE-TECH-LLC3", "n": "Otava, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.677, "det": {"shodan": {"compromised": 1}}, "oid": "OTL-22-ARIN", "org": "Otava, LLC", "pdb": null, "pfx": 4, "reg": "2014-06-24", "rir": "arin", "s24": 3, "sib": 7, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393670, "h": "SFC-GA", "n": "Southern Fibernet", "t": "Broadband & mobile", "w": 23, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 23, "mean": 3.00, "above": false}}, "h2": [["2026-10-05", 6.424, 0.011, 0, false], ["2026-10-12", 5.988, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 2.398, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 5.988, "se": 1.057, "ts": 1.000, "map": 30.890, "obs": 2, "own": 53.004, "comp": {"cins": -0.1248, "dshield": -0.2887, "crowdsec": -1.143, "vulncheck": 7.0311, "blocklist_de": -0.6504}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.152, "det": {"vulncheck": {"botnet_node": 23}}, "oid": "SFC-101-ARIN", "org": "Southern Fibernet Corporation", "pdb": {"t": "NSP", "sc": "Regional", "tr": null, "pol": "Selective", "web": "https://southernfibernet.com"}, "pfx": 2, "reg": "2014-10-22", "rir": "arin", "s24": 3, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393706, "h": "NELSONCABLE", "n": "Nelson Cable, Inc", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 2, "p": 0.4193, "hi": 6.26, "lo": 0.81, "ips": 4, "mean": 2.98, "above": false}}, "h2": [["2026-10-12", 2.319, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.102, "ts": null, "map": 0.195, "obs": 0, "own": 2.089, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 2, "blocklist_de": 0}, "lo": 2.319, "se": 0.994, "ts": 1.000, "map": 10.546, "obs": 2, "own": 17.896, "comp": {"cins": -0.1551, "dshield": -0.3543, "crowdsec": -1.4016, "vulncheck": 6.4673, "blocklist_de": -0.8069}, "mass": 0.7, "listed": false}}, "abq": false, "bot": 0.135, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "NC-92-ARIN", "org": "Nelson Cable, Inc", "pdb": null, "pfx": 5, "reg": "2014-11-14", "rir": "arin", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2816, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393713, "h": "ALL-POINTS-BROADBAND-5", "n": "All Points Broadband", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1359, "hi": 4.07, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.020, "ts": null, "map": 0.187, "obs": 0, "own": 1.440, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.837, "ts": null, "map": 0.168, "obs": 0, "own": 0.556, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.163, "det": {"shodan": {"compromised": 1}}, "oid": "VEL-16-ARIN", "org": "All Points Broadband", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "https://www.allpointsbroadband.com"}, "pfx": 20, "reg": "2014-11-19", "rir": "arin", "s24": 78, "sib": 3, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 24832, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393746, "h": "MAXHOST-IO", "n": "MaxHost.io", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.320, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.990, "det": {"shodan": {"doublepulsar": 1}}, "oid": "ACML-60-ARIN", "org": "Amazing Creations and More LLC", "pdb": {"t": "Educational/Research", "sc": "North America", "tr": "20-100Mbps", "pol": "Open", "web": "https://maxhost.io"}, "pfx": 2, "reg": "2024-02-28", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393886, "h": "LEASEWEB-USA-MIA", "n": "LeaseWeb USA / MIA-01", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1140, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}, "crowdsec": {"n": 1, "p": 0.0991, "hi": 3.65, "lo": 0.27, "ips": 1, "mean": 1.54, "above": false}, "phishing_db": {"n": 1, "p": 0.1757, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}}, "h2": [["2026-10-05", 0.149, 0.275, 0, false], ["2026-10-12", 0.156, 0.288, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.288, "se": 1.455, "ts": 1.000, "map": 2.399, "obs": 1, "own": 1.080, "comp": {"urlhaus": -0.178, "threatfox": -0.1969, "phishing_db": 2.876}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.156, "se": 1.194, "ts": 1.000, "map": 1.078, "obs": 1, "own": 0.236, "comp": {"cins": -0.1626, "dshield": -0.3703, "crowdsec": 3.2133, "vulncheck": -0.3655, "blocklist_de": -0.8457}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.885, "det": {"shodan": {"compromised": 1}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 36, "reg": "2018-11-15", "rir": "arin", "s24": 113, "sib": 9, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 28928, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00451229747928}, {"a": 393950, "h": "XIBER-LLC", "n": "Xiber LLC", "t": "Broadband & mobile", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1837, "hi": 4.58, "lo": 0.34, "ips": 2, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 0.633, 0.011, 0, false], ["2026-10-12", 0.169, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.028, "ts": null, "map": 0.188, "obs": 0, "own": 1.489, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.169, "se": 1.223, "ts": 1.000, "map": 1.197, "obs": 1, "own": 2.159, "comp": {"cins": -0.11, "dshield": -0.2562, "crowdsec": -1.0145, "vulncheck": 3.5285, "blocklist_de": -0.5739}, "mass": 0.5, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "FL-369-ARIN", "org": "Xiber", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "500-1000Gbps", "pol": "Open", "web": "https://xiber.net"}, "pfx": 27, "reg": "2015-05-04", "rir": "arin", "s24": 68, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 18176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 393960, "h": "HOST4GEEKS-LLC", "n": "HOST4GEEKS-LLC", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6420, "hi": 7.69, "lo": 1.36, "ips": 3, "mean": 3.97, "above": false}}, "h2": [["2026-10-05", 0.011, 11.503, 1, false], ["2026-10-12", 0.011, 11.568, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 11.568, "se": 1.003, "ts": 1.000, "map": 42.268, "obs": 3, "own": 14.794, "comp": {"urlhaus": -0.4103, "threatfox": -0.3286, "phishing_db": 6.109}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.672, "det": null, "oid": "HOSTG-6-ARIN", "org": "Host4Geeks LLC", "pdb": {"t": null, "sc": "Global", "tr": "1-5Gbps", "pol": "Selective", "web": "https://host4geeks.com"}, "pfx": 10, "reg": "2015-05-06", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394089, "h": "GCP-ENTERPRISE-USER-TRAFFIC", "n": "Google LLC", "t": "Other", "w": 1, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.59, "waf": 0.52}, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.0188, "hi": 2.41, "lo": 0.18, "ips": 1, "mean": 1.02, "above": false}}, "h2": [["2026-10-05", 0.004, 0.008, 0, false], ["2026-10-12", 0.024, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.792, "ts": null, "map": 0.110, "obs": 0, "own": 0.209, "comp": null, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.024, "se": 1.017, "ts": 1.000, "map": 0.117, "obs": 1, "own": 0.070, "comp": {"cins": -0.273, "dshield": 3.7738, "crowdsec": -2.344, "vulncheck": -0.4999, "blocklist_de": -1.41}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.415, "det": null, "oid": "GOOGL-2-ARIN", "org": "Google LLC", "pdb": null, "pfx": 106, "reg": "2023-10-27", "rir": "arin", "s24": 1797, "sib": 10, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 460288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.124151}, {"a": 394094, "h": "INTELLECTICA-US", "n": "Intellectica Systems Inc.", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 1, "p": 0.1876, "hi": 4.62, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.579, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.853, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.579, "se": 1.422, "ts": 1.000, "map": 6.161, "obs": 1, "own": 4.308, "comp": {"cins": -0.0837, "dshield": -0.1973, "crowdsec": 4.1555, "vulncheck": -0.2248, "blocklist_de": -0.4377}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.967, "det": {"shodan": {"compromised": 1}}, "oid": "IS-1-ARIN", "org": "Intellectica Systems Inc.", "pdb": null, "pfx": 10, "reg": "2015-06-10", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394109, "h": "CFH", "n": "CFH CABLE INC", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"dshield": {"n": 1, "p": 0.1977, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.727, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 2.249, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.727, "se": 1.480, "ts": 1.000, "map": 8.547, "obs": 1, "own": 17.028, "comp": {"cins": -0.0699, "dshield": 4.8261, "crowdsec": -0.6569, "vulncheck": -0.1943, "blocklist_de": -0.3657}, "mass": 0.4, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "CC-1433-ARIN", "org": "CFH CABLE INC", "pdb": {"t": null, "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://cfhcable.com"}, "pfx": 6, "reg": "2015-06-15", "rir": "arin", "s24": 6, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394256, "h": "CLOUDSINGULARITY", "n": "Tech Futures Interactive Inc.", "t": "Hosting & VPS", "w": 6, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 4, "proxy_or_vpn": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2025-4396": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2025-29927": 1}, "n": 4}, "ev": {"dshield": {"n": 2, "p": 0.4135, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}, "crowdsec": {"n": 3, "p": 0.5991, "hi": 7.23, "lo": 1.27, "ips": 4, "mean": 3.73, "above": false}}, "h2": [["2026-10-05", 6.803, 0.011, 0, false], ["2026-10-12", 9.913, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.072, "ts": null, "map": 0.193, "obs": 0, "own": 0.279, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 9.913, "se": 0.615, "ts": 0.600, "map": 23.346, "obs": 5, "own": 4.594, "comp": {"cins": -0.7304, "dshield": 5.2223, "crowdsec": 4.4746, "vulncheck": -0.7562, "blocklist_de": -3.6662}, "mass": 3.5, "listed": false}}, "abq": false, "bot": 0.776, "det": null, "oid": "TFI-10-ARIN", "org": "Tech Futures Interactive Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.techfutures.xyz"}, "pfx": 19, "reg": "2015-07-21", "rir": "arin", "s24": 27, "sib": 1, "tor": 0, "w24": 3, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0008510640614}, {"a": 394285, "h": "JBN-TEL", "n": "JBN Telephone Co", "t": "Transit & backbone", "w": 4, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1881, "hi": 4.63, "lo": 0.35, "ips": 4, "mean": 1.95, "above": false}}, "h2": [["2026-10-12", 0.208, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.046, "ts": null, "map": 0.190, "obs": 0, "own": 2.292, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.208, "se": 1.251, "ts": 1.000, "map": 1.554, "obs": 1, "own": 5.752, "comp": {"cins": -0.101, "dshield": -0.2362, "crowdsec": -0.9354, "vulncheck": 3.6347, "blocklist_de": -0.5273}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.173, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "JTC-13-ARIN", "org": "JBN telephone Co Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "10-20Gbps", "pol": "Restrictive", "web": "https://connect.jbntelco.com"}, "pfx": 18, "reg": "2015-07-30", "rir": "arin", "s24": 48, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 12288, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394380, "h": "LEASEWEB-USA-DAL", "n": "LeaseWeb USA / DAL-10", "t": "Hosting & VPS", "w": 773, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 5, "proxy_or_vpn": 3, "web_bruteforce": 3, "home_connection": 1}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.5247, "hi": 6.05, "lo": 1.30, "ips": 5, "mean": 3.30, "above": false}, "blocklist_de": {"n": 3, "p": 0.5109, "hi": 6.42, "lo": 1.13, "ips": 768, "mean": 3.31, "above": false}}, "h2": [["2026-10-05", 2.712, 0.010, 0, false], ["2026-10-12", 3.018, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.962, "ts": null, "map": 0.175, "obs": 0, "own": 0.174, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 3}, "lo": 3.018, "se": 0.541, "ts": 0.571, "map": 6.128, "obs": 7, "own": 1.206, "comp": {"cins": -1.1988, "dshield": -1.893, "crowdsec": 2.3363, "vulncheck": -0.859, "blocklist_de": 4.821}, "mass": 6.6, "listed": false}}, "abq": false, "bot": 0.917, "det": {"blocklist_de": {"mail": 768, "apache": 768}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 56, "reg": "2015-08-24", "rir": "arin", "s24": 193, "sib": 9, "tor": 0, "w24": 7, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 50176, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394474, "h": "WHITELABELCOLO393", "n": "WhiteLabelColo", "t": "Hosting & VPS", "w": 30, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 29, "bad_crawling": 3, "proxy_or_vpn": 25, "web_bruteforce": 4, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2021-3129": 2, "cve:CVE-2022-22947": 2, "cve:CVE-2025-55182": 2}, "n": 30}, "ev": {"crowdsec": {"n": 6, "p": 0.9249, "hi": 9.81, "lo": 2.72, "ips": 30, "mean": 5.80, "above": true}}, "h2": [["2026-10-05", 4.580, 0.011, 0, false], ["2026-10-12", 4.830, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.020, "ts": null, "map": 0.187, "obs": 0, "own": 0.223, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.830, "se": 0.569, "ts": 1.000, "map": 10.395, "obs": 6, "own": 2.045, "comp": {"cins": -0.8975, "dshield": -1.5559, "crowdsec": 11.4497, "vulncheck": -0.802, "blocklist_de": -4.4593}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.932, "det": null, "oid": "WS-393-ARIN", "org": "WhiteLabelColo", "pdb": null, "pfx": 12, "reg": "2015-09-22", "rir": "arin", "s24": 78, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.0046410723299}, {"a": 394489, "h": "LAMINAR-NETWORKS-01", "n": "Laminar Networks LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.914, "det": {"shodan": {"compromised": 1}}, "oid": "LNL-101-ARIN", "org": "Laminar Networks LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://laminar.network"}, "pfx": 1, "reg": "2023-12-27", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394503, "h": "PSEUDONYM-NET", "n": "Pseudonym.mx LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.730, "det": null, "oid": "PL-1270-ARIN", "org": "Pseudonym.mx LLC", "pdb": null, "pfx": 2, "reg": "2025-11-18", "rir": "arin", "s24": 2, "sib": 0, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394625, "h": "WHITELABELIT", "n": "WhiteLabel IT Solutions", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 5, "p": 0.8969, "hi": 9.92, "lo": 2.47, "ips": 5, "mean": 5.66, "above": true}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.724, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.964, "ts": null, "map": 0.208, "obs": 0, "own": 0.345, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.835, "det": {"shodan": {"compromised": 5}}, "oid": "WISC-5-ARIN", "org": "WhiteLabel IT Solutions Corp", "pdb": {"t": null, "sc": "Global", "tr": "20-50Gbps", "pol": "Open", "web": "http://whitelabelitsolutions.com/"}, "pfx": 18, "reg": "2015-11-02", "rir": "arin", "s24": 28, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 7424, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 394695, "h": "PUBLIC-DOMAIN-REGISTRY", "n": "Public Domain Registry", "t": "Hosting & VPS", "w": 13, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 2, "ssh_bruteforce": 6, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2026-8181": 1}, "n": 7}, "ev": {"cins": {"n": 1, "p": 0.1833, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 2, "p": 0.3103, "hi": 5.31, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}, "crowdsec": {"n": 6, "p": 0.9187, "hi": 9.62, "lo": 2.67, "ips": 7, "mean": 5.69, "above": true}, "phishing_db": {"n": 3, "p": 0.6187, "hi": 7.44, "lo": 1.31, "ips": 3, "mean": 3.84, "above": false}, "blocklist_de": {"n": 5, "p": 0.8853, "hi": 9.62, "lo": 2.39, "ips": 5, "mean": 5.49, "above": true}}, "h2": [["2026-10-05", 4.284, 3.093, 0, false], ["2026-10-12", 13.839, 3.128, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 3.128, "se": 1.003, "ts": 1.000, "map": 10.729, "obs": 3, "own": 4.002, "comp": {"urlhaus": -0.54, "threatfox": -0.3748, "phishing_db": 4.9139}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 5}, "lo": 13.839, "se": 0.466, "ts": 0.500, "map": 24.609, "obs": 12, "own": 4.809, "comp": {"cins": 1.3638, "dshield": -2.4006, "crowdsec": 0.8449, "vulncheck": -0.9231, "blocklist_de": 5.7117}, "mass": 11.8, "listed": false}}, "abq": false, "bot": 0.980, "det": {"shodan": {"compromised": 2}, "blocklist_de": {"ftp": 2, "ssh": 3}}, "oid": "PSUL-1-ARIN", "org": "PDR", "pdb": {"t": "Content", "sc": "Asia Pacific", "tr": "10-20Gbps", "pol": "Selective", "web": null}, "pfx": 37, "reg": "2015-11-24", "rir": "arin", "s24": 87, "sib": 0, "tor": 0, "w24": 12, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0719]], "ipv4": 41984, "abuse": null, "score": 0.0719, "groups": ["sensors"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.00000026323511}, {"a": 394727, "h": "NODISTO", "n": "Nodisto IT, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3683, "hi": 5.80, "lo": 0.75, "ips": 2, "mean": 2.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.055, "ts": null, "map": 0.191, "obs": 0, "own": 0.675, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.921, "ts": null, "map": 0.196, "obs": 0, "own": 0.289, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.970, "det": {"shodan": {"compromised": 2}}, "oid": "NIL-33-ARIN", "org": "Nodisto IT, LLC", "pdb": null, "pfx": 40, "reg": "2015-12-04", "rir": "arin", "s24": 40, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10240, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394738, "h": "COLOCROSSING", "n": "Silicon Valley Web Hosting", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1916, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.336, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.205, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.784, "det": {"shodan": {"compromised": 1}}, "oid": "HOSTP-7-ARIN", "org": "HostPapa", "pdb": {"t": "NSP", "sc": "Regional", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.svwh.net"}, "pfx": 4, "reg": "2015-12-10", "rir": "arin", "s24": 8, "sib": 11, "tor": 1, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394859, "h": "VBCS", "n": "Valparaiso Broadband Communication Systems", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.503, 0.011, 0, false], ["2026-10-12", 0.509, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 2.145, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.509, "se": 1.406, "ts": 1.000, "map": 5.081, "obs": 1, "own": 9.965, "comp": {"cins": -0.0625, "dshield": -0.1485, "crowdsec": -0.5888, "vulncheck": 4.1459, "blocklist_de": -0.3269}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.189, "det": {"vulncheck": {"botnet_node": 3}}, "oid": "VBCS-ARIN", "org": "Valparaiso Broadband Communication Systems", "pdb": null, "pfx": 9, "reg": "2016-01-27", "rir": "arin", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394881, "h": "EK-HOSTING", "n": "EK HOSTING INC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}}, "h2": [["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.341, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.216, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.996, "det": {"shodan": {"compromised": 1}}, "oid": "EH-195-ARIN", "org": "EK HOSTING INC", "pdb": null, "pfx": 4, "reg": "2016-02-02", "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 394996, "h": "PAPERSPACE", "n": "Paperspace", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1501, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.037, "ts": null, "map": 0.189, "obs": 0, "own": 0.623, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.875, "ts": null, "map": 0.181, "obs": 0, "own": 0.239, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.895, "det": {"shodan": {"compromised": 1}}, "oid": "PAPER-49-ARIN", "org": "47-2339071", "pdb": null, "pfx": 53, "reg": "2016-03-11", "rir": "arin", "s24": 58, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14848, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395092, "h": "SHOCK-1", "n": "Shock Hosting", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 12, "p": 0.9998, "hi": 15.17, "lo": 6.00, "ips": 12, "mean": 10.14, "above": true}, "crowdsec": {"n": 1, "p": 0.0878, "hi": 3.51, "lo": 0.26, "ips": 1, "mean": 1.48, "above": false}, "threatfox": {"n": 1, "p": 0.1903, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "phishing_db": {"n": 3, "p": 0.6040, "hi": 7.28, "lo": 1.28, "ips": 3, "mean": 3.76, "above": false}}, "h2": [["2026-10-05", 0.492, 5.553, 0, false], ["2026-10-12", 0.141, 3.359, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 3}, "lo": 3.359, "se": 0.933, "ts": 0.750, "map": 9.986, "obs": 4, "own": 3.717, "comp": {"urlhaus": -0.7133, "threatfox": 0.9306, "phishing_db": 3.71}, "mass": 1.8, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.141, "se": 1.182, "ts": 1.000, "map": 0.956, "obs": 1, "own": 0.208, "comp": {"cins": -0.1683, "dshield": -0.3822, "crowdsec": 3.1483, "vulncheck": -0.3739, "blocklist_de": -0.8748}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.880, "det": {"shodan": {"c2": 3, "malware": 1, "compromised": 8}, "threatfox": {"family:Evilginx": 1}}, "oid": "SH-335-ARIN", "org": "Shock Hosting LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://shockhosting.com"}, "pfx": 62, "reg": "2016-04-13", "rir": "arin", "s24": 132, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 34560, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00016691231139}, {"a": 395173, "h": "AS-TCCL-18", "n": "Tuckersmith Communications Co-Operative Limited", "t": "Other", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1546, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.042, "ts": null, "map": 0.190, "obs": 0, "own": 0.638, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.889, "ts": null, "map": 0.186, "obs": 0, "own": 0.253, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.173, "det": {"shodan": {"c2": 1}}, "oid": "TCCL-18-ARIN", "org": "Tuckersmith Communications Co-Operative Limited", "pdb": null, "pfx": 21, "reg": "2016-05-16", "rir": "arin", "s24": 52, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15360, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0003041237423}, {"a": 395195, "h": null, "n": "AS395195", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.429, "det": {"shodan": {"malware": 2}}, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": null, "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395336, "h": "MACST-ATL", "n": "MacStadium", "t": "Other", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 2, "ssh_bruteforce": 2, "web_bruteforce": 5, "mail_bruteforce": 5, "cve:CVE-2025-22457": 1}, "n": 5}, "ev": {"crowdsec": {"n": 4, "p": 0.6976, "hi": 7.53, "lo": 1.62, "ips": 5, "mean": 4.11, "above": false}, "blocklist_de": {"n": 1, "p": 0.1635, "hi": 4.36, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 4.836, 0.011, 0, false], ["2026-10-12", 3.852, 0.012, 0, false]], "sh": false, "uc": 1369.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.018, "ts": null, "map": 0.186, "obs": 0, "own": 0.575, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.852, "se": 0.610, "ts": 0.800, "map": 8.877, "obs": 5, "own": 5.030, "comp": {"cins": -0.8145, "dshield": -1.451, "crowdsec": 6.623, "vulncheck": -0.7809, "blocklist_de": 0.0006}, "mass": 4.0, "listed": false}}, "abq": false, "bot": 0.664, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "MACST-2-ARIN", "org": "MacStadium, Inc.", "pdb": null, "pfx": 44, "reg": "2016-07-01", "rir": "arin", "s24": 81, "sib": 4, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20736, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395337, "h": "MACST-VEGAS", "n": "MacStadium, Inc.", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 1, "web_bruteforce": 2, "mail_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3309, "hi": 5.48, "lo": 0.71, "ips": 2, "mean": 2.61, "above": false}, "blocklist_de": {"n": 1, "p": 0.1738, "hi": 4.48, "lo": 0.34, "ips": 1, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 2.200, 0.011, 0, false], ["2026-10-12", 2.387, 0.012, 0, false]], "sh": false, "uc": 962.6, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.039, "ts": null, "map": 0.189, "obs": 0, "own": 0.628, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.387, "se": 0.762, "ts": 0.667, "map": 7.263, "obs": 3, "own": 4.166, "comp": {"cins": -0.5003, "dshield": -0.9957, "crowdsec": 3.5788, "vulncheck": -0.6629, "blocklist_de": 1.9565}, "mass": 2.3, "listed": false}}, "abq": false, "bot": 0.728, "det": {"blocklist_de": {"mail": 1}}, "oid": "MACST-2-ARIN", "org": "MacStadium, Inc.", "pdb": null, "pfx": 11, "reg": "2016-07-01", "rir": "arin", "s24": 56, "sib": 4, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 14336, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395379, "h": "SCIREMC", "n": "SCIREMC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.176, "det": {"shodan": {"compromised": 1}}, "oid": "SCIREMC-ARIN", "org": "SCI REMC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "http://www.sciremc.com"}, "pfx": 3, "reg": "2018-04-02", "rir": "arin", "s24": 64, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395475, "h": "SCSALASKA", "n": "SCSALASKA", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1861, "hi": 4.61, "lo": 0.35, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.195, "obs": 0, "own": 0.813, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.041, "ts": null, "map": 0.226, "obs": 0, "own": 0.471, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.181, "det": {"shodan": {"compromised": 1}}, "oid": "SCSL-15-ARIN", "org": "SnowCloud Services LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.snowcloudservices.com"}, "pfx": 6, "reg": "2016-08-22", "rir": "arin", "s24": 14, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3584, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395572, "h": "CLEARWINDS", "n": "Clear Winds Technologies Incorporated", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.967, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.820, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.141, "det": null, "oid": "CWT-57-ARIN", "org": "Clear Winds Technologies Incorporated", "pdb": null, "pfx": 3, "reg": "2016-10-07", "rir": "arin", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395596, "h": "INFINIRC-LLC", "n": "Infinirc LLC", "t": "Enterprise, edu & gov", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4218, "hi": 6.28, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 4.322, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 10.754, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.750, "det": {"shodan": {"compromised": 2}}, "oid": "IL-915-ARIN", "org": "Infinirc LLC", "pdb": {"t": "Educational/Research", "sc": "Asia Pacific", "tr": "5-10Gbps", "pol": "Open", "web": "https://infinirc.com"}, "pfx": 1, "reg": "2025-09-05", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395719, "h": "EMERALD", "n": "Emerald Broadband", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"first_seen_30d": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1573, "hi": 4.30, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.273, 0.011, 0, false], ["2026-10-12", 0.289, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.056, "ts": null, "map": 0.191, "obs": 0, "own": 1.684, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.289, "se": 1.285, "ts": 1.000, "map": 2.395, "obs": 1, "own": 4.252, "comp": {"cins": -0.1258, "dshield": -0.2909, "crowdsec": 3.6453, "vulncheck": -0.3059, "blocklist_de": -0.6555}, "mass": 0.6, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "EBL-25-ARIN", "org": "Emerald Broadband, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "10-20Gbps", "pol": "Open", "web": "http://www.emeraldbroadband.com"}, "pfx": 9, "reg": "2016-11-21", "rir": "arin", "s24": 39, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395793, "h": "ARISK-COMMUNICATIONS-INC", "n": "Arisk Communications", "t": "Broadband & mobile", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.008, 0.010, 0, false], ["2026-10-12", 0.008, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.972, "ts": null, "map": 0.177, "obs": 0, "own": 1.176, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.008, "se": 1.737, "ts": null, "map": 0.131, "obs": 0, "own": 0.359, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.537, "det": null, "oid": "AC-5396-ARIN", "org": "Arisk Communications inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "50-100Gbps", "pol": "Open", "web": "https://ariskisp.com/"}, "pfx": 155, "reg": "2024-08-28", "rir": "arin", "s24": 167, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 44544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00019576773645}, {"a": 395839, "h": "HOSTKEY-USA", "n": "HOSTKEY-USA", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 12, "p": 1.0000, "hi": 17.57, "lo": 6.95, "ips": 12, "mean": 11.75, "above": true}, "crowdsec": {"n": 3, "p": 0.5586, "hi": 6.84, "lo": 1.21, "ips": 3, "mean": 3.53, "above": false}, "threatfox": {"n": 2, "p": 0.4181, "hi": 6.25, "lo": 0.81, "ips": 2, "mean": 2.98, "above": false}, "blocklist_de": {"n": 2, "p": 0.3882, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 2.407, 1.945, 0, false], ["2026-10-12", 6.407, 1.979, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 1.979, "se": 1.161, "ts": 1.000, "map": 9.392, "obs": 2, "own": 3.629, "comp": {"urlhaus": -0.2964, "threatfox": 4.6801, "phishing_db": -0.5176}, "mass": 0.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 2}, "lo": 6.407, "se": 0.614, "ts": 0.600, "map": 14.879, "obs": 5, "own": 2.934, "comp": {"cins": -0.8374, "dshield": -1.4806, "crowdsec": 3.3015, "vulncheck": -0.787, "blocklist_de": 3.8971}, "mass": 4.1, "listed": false}}, "abq": false, "bot": 0.868, "det": {"shodan": {"compromised": 11, "doublepulsar": 1}, "threatfox": {"family:PureRAT": 1, "family:Cobalt Strike": 1}, "blocklist_de": {"bots": 1, "apache": 1, "bruteforcelogin": 1}}, "oid": "HU-112-ARIN", "org": "HOSTKEY", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "5-10Gbps", "pol": "Open", "web": "http://www.hostkey.com"}, "pfx": 50, "reg": "2017-01-03", "rir": "arin", "s24": 50, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 12800, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 395931, "h": "ACECLOUD-01", "n": "Real Time Cloud Services LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 2}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 2, "mean": 2.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 22.308, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 22.308, "se": 0.824, "ts": 0.667, "map": 76.981, "obs": 3, "own": 15.394, "comp": {"cins": -0.3893, "dshield": -0.8083, "crowdsec": 4.8657, "vulncheck": -0.5963, "blocklist_de": 2.6655}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "RTCSL-ARIN", "org": "Real Time Cloud Services LLC", "pdb": null, "pfx": 1, "reg": "2025-05-02", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 395954, "h": "LEASEWEB-USA-LAX", "n": "LeaseWeb USA / LAX-12", "t": "Hosting & VPS", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 4, "bad_crawling": 1, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 2, "mail_bruteforce": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2025-55182": 1}, "n": 5}, "ev": {"shodan": {"n": 4, "p": 0.0002, "hi": 1.63, "lo": 0.35, "ips": 4, "mean": 0.89, "above": false}, "crowdsec": {"n": 4, "p": 0.0000, "hi": 1.36, "lo": 0.29, "ips": 5, "mean": 0.74, "above": false}, "phishing_db": {"n": 1, "p": 0.0151, "hi": 2.31, "lo": 0.17, "ips": 1, "mean": 0.97, "above": false}}, "h2": [["2026-10-05", 0.050, 0.059, 0, false], ["2026-10-12", 0.131, 0.062, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.062, "se": 1.337, "ts": 1.000, "map": 0.360, "obs": 1, "own": 0.181, "comp": {"urlhaus": -0.4624, "threatfox": -0.3488, "phishing_db": 1.416}, "mass": 1.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.131, "se": 0.635, "ts": 1.000, "map": 0.315, "obs": 4, "own": 0.063, "comp": {"cins": -0.7782, "dshield": -1.4034, "crowdsec": 7.0868, "vulncheck": -0.7707, "blocklist_de": -3.8947}, "mass": 3.8, "listed": false}}, "abq": false, "bot": 0.914, "det": {"shodan": {"compromised": 4}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "No", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 195, "reg": "2017-02-02", "rir": "arin", "s24": 2157, "sib": 9, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 642304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0073011222566}, {"a": 395965, "h": "CARRY-TELECOM", "n": "Carrytel", "t": "Broadband & mobile", "w": 5, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "proxy_or_vpn": 1, "ssh_bruteforce": 2, "web_bruteforce": 3, "mail_bruteforce": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1269, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.67, "above": false}, "dshield": {"n": 1, "p": 0.1116, "hi": 3.79, "lo": 0.28, "ips": 1, "mean": 1.60, "above": false}, "crowdsec": {"n": 3, "p": 0.0988, "hi": 3.47, "lo": 0.61, "ips": 3, "mean": 1.79, "above": false}}, "h2": [["2026-10-05", 1.224, 0.009, 0, false], ["2026-10-12", 0.774, 0.010, 0, false]], "sh": false, "uc": 168.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.897, "ts": null, "map": 0.155, "obs": 0, "own": 0.853, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.774, "se": 0.601, "ts": 0.600, "map": 1.765, "obs": 5, "own": 2.747, "comp": {"cins": 3.2694, "dshield": 1.3857, "crowdsec": 2.6047, "vulncheck": -0.8037, "blocklist_de": -4.4941}, "mass": 4.6, "listed": false}}, "abq": false, "bot": 0.148, "det": {"blocklist_de": {"mail": 1}}, "oid": "CT-960-ARIN", "org": "Carrytel", "pdb": null, "pfx": 62, "reg": "2017-02-06", "rir": "arin", "s24": 464, "sib": 0, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 118784, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0030615391401}, {"a": 396006, "h": "SPITWSPOTS-HOM", "n": "SPITwSPOTS", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 4, "p": 0.7600, "hi": 8.29, "lo": 1.78, "ips": 4, "mean": 4.53, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.045, "ts": null, "map": 0.190, "obs": 0, "own": 0.647, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.896, "ts": null, "map": 0.188, "obs": 0, "own": 0.261, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.174, "det": {"shodan": {"compromised": 4}}, "oid": "SPITW-ARIN", "org": "SPITwSPOTS", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://spitwspots.com"}, "pfx": 50, "reg": "2017-02-13", "rir": "arin", "s24": 49, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396052, "h": "NEAC", "n": "North Alabama Electric Cooperative", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1697, "hi": 4.43, "lo": 0.33, "ips": 1, "mean": 1.87, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.702, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.945, "ts": null, "map": 0.203, "obs": 0, "own": 0.318, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"compromised": 1}}, "oid": "NAEC-3-ARIN", "org": "North Alabama Electric Cooperative", "pdb": null, "pfx": 6, "reg": "2017-02-22", "rir": "arin", "s24": 33, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12544, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396073, "h": "MAJESTIC-HOSTING-01", "n": "Spin Servers", "t": "Hosting & VPS", "w": 22, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "web_exploit": 5, "bad_crawling": 4, "first_seen_30d": 2, "ssh_bruteforce": 1, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1, "cve:CVE-2026-60137": 1, "cve:CVE-2026-63030": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1822, "hi": 4.56, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "shodan": {"n": 2, "p": 0.3034, "hi": 5.25, "lo": 0.68, "ips": 2, "mean": 2.50, "above": false}, "crowdsec": {"n": 6, "p": 0.9145, "hi": 9.50, "lo": 2.63, "ips": 6, "mean": 5.61, "above": true}, "threatfox": {"n": 10, "p": 0.9997, "hi": 16.72, "lo": 6.08, "ips": 11, "mean": 10.85, "above": true}, "vulncheck": {"n": 1, "p": 0.1783, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "phishing_db": {"n": 3, "p": 0.6167, "hi": 7.42, "lo": 1.31, "ips": 3, "mean": 3.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1587, "hi": 4.31, "lo": 0.32, "ips": 1, "mean": 1.82, "above": false}}, "h2": [["2026-10-05", 6.052, 12.102, 1, false], ["2026-10-12", 7.063, 17.826, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 10, "phishing_db": 3}, "lo": 17.826, "se": 0.752, "ts": 0.769, "map": 38.395, "obs": 13, "own": 13.173, "comp": {"urlhaus": -1.4012, "threatfox": 5.6042, "phishing_db": 1.0712}, "mass": 4.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 6, "vulncheck": 1, "blocklist_de": 1}, "lo": 7.063, "se": 0.510, "ts": 0.667, "map": 13.762, "obs": 9, "own": 2.705, "comp": {"cins": 2.4784, "dshield": -1.9634, "crowdsec": 6.3133, "vulncheck": -0.1104, "blocklist_de": -2.7023}, "mass": 7.1, "listed": false}}, "abq": false, "bot": 0.916, "det": {"shodan": {"malware": 1, "compromised": 1}, "threatfox": {"family:Remcos": 2, "family:PureRAT": 8, "family:AsyncRAT": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "MHSL-5-ARIN", "org": "Majestic Hosting Solutions, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.spinservers.com"}, "pfx": 62, "reg": "2018-11-06", "rir": "arin", "s24": 93, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 28416, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00000004509342}, {"a": 396190, "h": "LEASEWEB-USA-SEA", "n": "LeaseWeb USA / SEA-11", "t": "Hosting & VPS", "w": 2048, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 8, "p": 0.9536, "hi": 9.36, "lo": 3.04, "ips": 2048, "mean": 5.84, "above": true}}, "h2": [["2026-10-05", 1.764, 0.009, 0, false], ["2026-10-12", 1.882, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.890, "ts": null, "map": 0.152, "obs": 0, "own": 0.128, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 8}, "lo": 1.882, "se": 0.515, "ts": 1.000, "map": 3.650, "obs": 8, "own": 0.716, "comp": {"cins": -1.627, "dshield": -2.2803, "crowdsec": -8.8699, "vulncheck": -0.9097, "blocklist_de": 16.3752}, "mass": 10.2, "listed": false}}, "abq": false, "bot": 0.889, "det": {"blocklist_de": {"mail": 2048, "apache": 2048}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 89, "reg": "2017-03-31", "rir": "arin", "s24": 506, "sib": 9, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 129536, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["blocklist_de"], "traffic": null}, {"a": 396310, "h": "SDSU-SCIENCE-NETWORK", "n": "San Diego State University", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.900, "det": {"shodan": {"c2": 1}}, "oid": "SDSU-2-ARIN", "org": "San Diego State University", "pdb": null, "pfx": 2, "reg": "2017-05-04", "rir": "arin", "s24": 2, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396356, "h": "LATITUDE-SH", "n": "Latitude.sh AS396356", "t": "Hosting & VPS", "w": 677, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 0.88, "waf": 1.46}, "cs": {"c": {"http_flood": 622, "web_exploit": 601, "bad_crawling": 158, "proxy_or_vpn": 193, "first_seen_30d": 1, "ssh_bruteforce": 16, "web_bruteforce": 644, "mail_bruteforce": 19, "cve:CVE-2017-9841": 392, "cve:CVE-2017-16894": 214, "cve:CVE-2019-17050": 214, "cve:CVE-2023-49103": 271, "cve:CVE-2024-28000": 82}, "n": 653}, "ev": {"cins": {"n": 2, "p": 0.2182, "hi": 4.56, "lo": 0.59, "ips": 2, "mean": 2.17, "above": false}, "shodan": {"n": 6, "p": 0.2287, "hi": 4.05, "lo": 1.12, "ips": 6, "mean": 2.39, "above": false}, "dshield": {"n": 5, "p": 0.7103, "hi": 7.08, "lo": 1.76, "ips": 6, "mean": 4.04, "above": false}, "crowdsec": {"n": 19, "p": 0.9958, "hi": 8.22, "lo": 3.91, "ips": 653, "mean": 5.90, "above": true}, "vulncheck": {"n": 1, "p": 0.0654, "hi": 3.22, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}, "phishing_db": {"n": 2, "p": 0.1949, "hi": 4.37, "lo": 0.57, "ips": 2, "mean": 2.08, "above": false}, "blocklist_de": {"n": 7, "p": 0.7585, "hi": 6.69, "lo": 2.03, "ips": 34, "mean": 4.07, "above": false}}, "h2": [["2026-10-05", 2.763, 0.275, 0, false], ["2026-10-12", 4.021, 0.285, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.285, "se": 1.137, "ts": 1.000, "map": 1.159, "obs": 2, "own": 0.508, "comp": {"urlhaus": -0.592, "threatfox": -0.39, "phishing_db": 2.756}, "mass": 1.7, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 5, "crowdsec": 19, "vulncheck": 1, "blocklist_de": 7}, "lo": 4.021, "se": 0.396, "ts": 0.559, "map": 6.328, "obs": 34, "own": 1.238, "comp": {"cins": 0.9331, "dshield": 1.0769, "crowdsec": 3.4874, "vulncheck": -0.7872, "blocklist_de": -1.4716}, "mass": 31.5, "listed": false}}, "abq": false, "bot": 0.626, "det": {"shodan": {"compromised": 6}, "vulncheck": {"botnet_node": 1}, "blocklist_de": {"bots": 1, "imap": 1, "mail": 2, "apache": 31, "bruteforcelogin": 30}}, "oid": "ML-1213-ARIN", "org": "Latitude.sh", "pdb": {"t": "Content", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://latitude.sh"}, "pfx": 756, "reg": "2019-04-16", "rir": "arin", "s24": 900, "sib": 0, "tor": 0, "w24": 26, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 233984, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.086633}, {"a": 396362, "h": "LEASEWEB-USA-NYC", "n": "LeaseWeb USA / NYC-01", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "web_exploit": 3, "proxy_or_vpn": 1, "first_seen_30d": 1, "web_bruteforce": 1, "cve:CVE-2022-39290": 1}, "n": 3}, "ev": {"shodan": {"n": 2, "p": 0.1557, "hi": 4.05, "lo": 0.53, "ips": 2, "mean": 1.93, "above": false}, "crowdsec": {"n": 2, "p": 0.1186, "hi": 3.72, "lo": 0.48, "ips": 3, "mean": 1.77, "above": false}, "phishing_db": {"n": 1, "p": 0.1490, "hi": 4.21, "lo": 0.32, "ips": 1, "mean": 1.77, "above": false}}, "h2": [["2026-10-05", 0.558, 0.187, 0, false], ["2026-10-12", 0.300, 0.197, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.197, "se": 1.407, "ts": 1.000, "map": 1.433, "obs": 1, "own": 0.654, "comp": {"urlhaus": -0.2397, "threatfox": -0.2408, "phishing_db": 2.4664}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.300, "se": 0.866, "ts": 1.000, "map": 1.116, "obs": 2, "own": 0.227, "comp": {"cins": -0.3687, "dshield": -0.7717, "crowdsec": 5.118, "vulncheck": -0.5816, "blocklist_de": -1.8926}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.991, "det": {"shodan": {"compromised": 2}}, "oid": "LU-ARIN", "org": "Leaseweb USA, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.leaseweb.com/contact#usa"}, "pfx": 67, "reg": "2017-05-18", "rir": "arin", "s24": 260, "sib": 9, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 66560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.03702901801608}, {"a": 396426, "h": null, "n": "AS396426", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.236, "obs": 0, "own": 0.619, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.586, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 7, "reg": null, "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396507, "h": "EMERALD-ONION", "n": "Emerald Onion", "t": "Broadband & mobile", "w": 97, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 97, "web_exploit": 97, "bad_crawling": 52, "proxy_or_vpn": 97, "ssh_bruteforce": 86, "web_bruteforce": 97, "home_connection": 91, "mail_bruteforce": 56, "cve:CVE-2017-3506": 4, "cve:CVE-2017-9841": 80, "cve:CVE-2018-13379": 84, "cve:CVE-2018-20062": 85, "cve:CVE-2021-26086": 14}, "n": 97}, "ev": {"crowdsec": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 97, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.774, 0.011, 0, false], ["2026-10-12", 0.856, 0.013, 0, false]], "sh": false, "uc": 5859.4, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 2.340, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.856, "se": 1.528, "ts": 1.000, "map": 10.863, "obs": 1, "own": 22.525, "comp": {"cins": -0.0594, "dshield": -0.1414, "crowdsec": 4.4603, "vulncheck": -0.1696, "blocklist_de": -0.3109}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.912, "det": {"blocklist_de": {"mail": 1}}, "oid": "EO-95-ARIN", "org": "Emerald Onion", "pdb": {"t": "NSP", "sc": "Global", "tr": "10-20Gbps", "pol": "Open", "web": "https://emeraldonion.org"}, "pfx": 4, "reg": "2017-06-30", "rir": "arin", "s24": 4, "sib": 0, "tor": 97, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396509, "h": "LETSCLOUD", "n": "LetsCloud Inc", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "dshield": {"n": 1, "p": 0.1967, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "phishing_db": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 0.580, 0.686, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.686, "se": 1.657, "ts": 1.000, "map": 8.588, "obs": 1, "own": 4.247, "comp": {"urlhaus": -0.0586, "threatfox": -0.0806, "phishing_db": 3.9158}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.580, "se": 1.423, "ts": 1.000, "map": 6.180, "obs": 1, "own": 1.505, "comp": {"cins": -0.084, "dshield": 4.7471, "crowdsec": -0.7839, "vulncheck": -0.2253, "blocklist_de": -0.4389}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.561, "det": {"shodan": {"compromised": 1}}, "oid": "LETSC-ARIN", "org": "LETSCLOUD", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://letscloud.io"}, "pfx": 4, "reg": "2018-11-07", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396904, "h": "QUALISPACE-ASN", "n": "QualiSpace", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 3, "p": 0.6357, "hi": 7.62, "lo": 1.34, "ips": 3, "mean": 3.93, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.110, "ts": null, "map": 0.196, "obs": 0, "own": 0.877, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.095, "ts": null, "map": 0.235, "obs": 0, "own": 0.589, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.908, "det": {"shodan": {"compromised": 3}}, "oid": "QUALI-161-ARIN", "org": "QualiSpace Inc", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.qualispace.com"}, "pfx": 8, "reg": "2018-06-12", "rir": "arin", "s24": 8, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396914, "h": "NET-38-127-93-1", "n": "Pacific Northwest Net", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": 23828.1, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 0.396, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 0.377, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.091, "det": null, "oid": "PNN-5-ARIN", "org": "Pacific Northwest Net, Inc.", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "100-1000Mbps", "pol": "Open", "web": "http://www.pnwnet.net"}, "pfx": 1, "reg": "2018-06-13", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396948, "h": "CLOUDWEBMANAGE-SC", "n": "Kamatera, Inc.", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3992, "hi": 6.08, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "phishing_db": {"n": 1, "p": 0.1955, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.565, 0, false], ["2026-10-12", 0.011, 0.587, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.587, "se": 1.606, "ts": 1.000, "map": 6.763, "obs": 1, "own": 3.198, "comp": {"urlhaus": -0.078, "threatfox": -0.1032, "phishing_db": 3.7188}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.020, "ts": null, "map": 0.222, "obs": 0, "own": 0.151, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.380, "det": {"shodan": {"compromised": 2}}, "oid": "KAMAT-ARIN", "org": "Kamatera, Inc.", "pdb": null, "pfx": 17, "reg": "2018-07-02", "rir": "arin", "s24": 17, "sib": 3, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 396982, "h": "GOOGLE-CLOUD-PLATFORM", "n": "Google Cloud", "t": "Hyperscale cloud", "w": 9017, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 1.08, "waf": 2.75}, "cs": {"c": {"http_flood": 6092, "data_centre": 6375, "web_exploit": 7247, "bad_crawling": 6579, "proxy_or_vpn": 94, "first_seen_30d": 3476, "ssh_bruteforce": 459, "web_bruteforce": 6234, "home_connection": 4, "mail_bruteforce": 27, "router_or_botnet": 1, "cve:CVE-2024-4577": 867, "cve:CVE-2021-41773": 2765, "cve:CVE-2021-43798": 2714, "cve:CVE-2024-56159": 1126, "cve:CVE-2025-55182": 2694}, "n": 7441}, "ev": {"cins": {"n": 95, "p": 0.0568, "hi": 3.02, "lo": 2.16, "ips": 547, "mean": 2.57, "above": false}, "shodan": {"n": 777, "p": 1.0000, "hi": 4.46, "lo": 3.97, "ips": 777, "mean": 4.21, "above": true}, "dshield": {"n": 289, "p": 1.0000, "hi": 6.72, "lo": 5.54, "ips": 295, "mean": 6.12, "above": true}, "urlhaus": {"n": 4, "p": 0.0000, "hi": 1.02, "lo": 0.22, "ips": 4, "mean": 0.56, "above": false}, "crowdsec": {"n": 6370, "p": 1.0000, "hi": 28.33, "lo": 27.18, "ips": 7441, "mean": 27.75, "above": true}, "threatfox": {"n": 12, "p": 0.0000, "hi": 1.37, "lo": 0.54, "ips": 12, "mean": 0.92, "above": false}, "vulncheck": {"n": 59, "p": 0.0000, "hi": 1.59, "lo": 1.04, "ips": 61, "mean": 1.30, "above": false}, "phishing_db": {"n": 284, "p": 1.0000, "hi": 7.28, "lo": 5.99, "ips": 285, "mean": 6.62, "above": true}, "blocklist_de": {"n": 766, "p": 1.0000, "hi": 8.73, "lo": 7.75, "ips": 777, "mean": 8.23, "above": true}}, "h2": [["2026-10-05", 8.329, 0.782, 0, false], ["2026-10-12", 8.489, 0.757, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 4, "threatfox": 12, "phishing_db": 284}, "lo": 0.757, "se": 0.819, "ts": 0.947, "map": 1.578, "obs": 300, "own": 1.217, "comp": {"urlhaus": -2.5041, "threatfox": -0.3704, "phishing_db": 4.9571}, "mass": 207.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 95, "dshield": 289, "crowdsec": 6370, "vulncheck": 59, "blocklist_de": 766}, "lo": 8.489, "se": 0.347, "ts": 0.840, "map": 12.279, "obs": 7579, "own": 5.028, "comp": {"cins": -2.942, "dshield": -2.069, "crowdsec": 18.5771, "vulncheck": -0.953, "blocklist_de": -8.7116}, "mass": 5818.8, "listed": false}}, "abq": false, "bot": 0.964, "det": {"shodan": {"c2": 132, "malware": 21, "compromised": 542, "doublepulsar": 82}, "threatfox": {"family:pupy": 1, "family:Chaos": 1, "family:Havoc": 2, "family:AsyncRAT": 2, "family:Unknown malware": 5}, "vulncheck": {"c2_server": 22, "botnet_node": 7, "attack_tooling": 20, "other_infrastructure": 12}, "blocklist_de": {"ftp": 46, "sip": 2, "ssh": 56, "bots": 146, "imap": 8, "mail": 25, "apache": 502, "bruteforcelogin": 202}}, "oid": "GOOGL-2-ARIN", "org": "Google LLC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Selective", "web": "http://www.google.com"}, "pfx": 3545, "reg": "2018-08-15", "rir": "arin", "s24": 85995, "sib": 10, "tor": 0, "w24": 7353, "drop": 0, "hist": [["2026-10-05", 0.9966], ["2026-10-12", 0.9969]], "ipv4": 51620608, "abuse": null, "score": 0.9969, "groups": ["sensors", "phishing", "shodan"], "sensors": ["crowdsec", "dshield", "blocklist_de"], "traffic": 2.660621}, {"a": 397031, "h": "GALAXYGATE", "n": "GALAXYGATE", "t": "Enterprise, edu & gov", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 1}, "n": 2}, "ev": {"cins": {"n": 1, "p": 0.1948, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "urlhaus": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 2, "p": 0.3834, "hi": 5.93, "lo": 0.77, "ips": 2, "mean": 2.83, "above": false}, "phishing_db": {"n": 1, "p": 0.1942, "hi": 4.69, "lo": 0.35, "ips": 3, "mean": 1.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1884, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 4.773, 4.924, 0, false], ["2026-10-12", 9.186, 5.127, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 1}, "lo": 5.127, "se": 1.229, "ts": 0.500, "map": 28.442, "obs": 2, "own": 118.910, "comp": {"urlhaus": 3.6322, "threatfox": -0.3237, "phishing_db": 1.6656}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 9.186, "se": 0.684, "ts": 0.500, "map": 24.517, "obs": 4, "own": 138.401, "comp": {"cins": 3.7905, "dshield": -1.2468, "crowdsec": 1.8609, "vulncheck": -0.7341, "blocklist_de": 0.9225}, "mass": 3.2, "listed": false}}, "abq": false, "bot": 0.950, "det": {"blocklist_de": {"ssh": 1}}, "oid": "GL-700-ARIN", "org": "GALAXYGATE, LLC", "pdb": {"t": "Enterprise", "sc": "North America", "tr": "50-100Gbps", "pol": "Open", "web": "https://www.galaxygate.net/"}, "pfx": 15, "reg": "2018-09-04", "rir": "arin", "s24": 23, "sib": 1, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5888, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397081, "h": "VALKYRIE-HOSTING", "n": "AU Wireless", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 1.134, 0.013, 0, false]], "sh": false, "uc": 41992.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.134, "se": 1.627, "ts": 1.000, "map": 16.615, "obs": 1, "own": 4.883, "comp": {"cins": -0.0456, "dshield": -0.1092, "crowdsec": -0.4329, "vulncheck": -0.135, "blocklist_de": 4.9265}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 1.000, "det": {"blocklist_de": {"sip": 1}}, "oid": "VHL-193-ARIN", "org": "Valkyrie Hosting LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "1-5Gbps", "pol": "Selective", "web": "http://www.auwireless.net"}, "pfx": 2, "reg": "2025-07-14", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397162, "h": "SUMOFIBER-IDAHO", "n": "SUMOFIBER of Idaho", "t": "Broadband & mobile", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 1, "ssh_bruteforce": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 1}, "ev": {"cins": {"n": 1, "p": 0.1928, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1622, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "blocklist_de": {"n": 1, "p": 0.1834, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 3.597, 0.011, 0, false], ["2026-10-12", 3.983, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.063, "ts": null, "map": 0.192, "obs": 0, "own": 1.731, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 3.983, "se": 0.776, "ts": 0.333, "map": 12.467, "obs": 3, "own": 19.570, "comp": {"cins": 4.1072, "dshield": -1.0257, "crowdsec": -0.3305, "vulncheck": -0.6724, "blocklist_de": 1.8381}, "mass": 2.4, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"ssh": 1}}, "oid": "CL-64-ARIN", "org": "Sumofiber", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://sumofiber.com"}, "pfx": 16, "reg": "2019-02-01", "rir": "arin", "s24": 34, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 8704, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397270, "h": "NETINF-TRANSIT-AS", "n": "NetInformatik", "t": "Other", "w": 7, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1, "home_connection": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.7966, "hi": 8.83, "lo": 1.90, "ips": 4, "mean": 4.82, "above": true}, "crowdsec": {"n": 1, "p": 0.1798, "hi": 4.54, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "vulncheck": {"n": 1, "p": 0.1952, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "phishing_db": {"n": 2, "p": 0.4176, "hi": 6.24, "lo": 0.81, "ips": 5, "mean": 2.98, "above": false}, "blocklist_de": {"n": 1, "p": 0.1911, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 5.285, 4.283, 0, false], ["2026-10-12", 5.298, 4.345, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 4.345, "se": 1.191, "ts": 1.000, "map": 23.031, "obs": 2, "own": 22.184, "comp": {"urlhaus": -0.251, "threatfox": -0.2479, "phishing_db": 5.2619}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 5.298, "se": 0.804, "ts": 0.333, "map": 17.304, "obs": 3, "own": 10.142, "comp": {"cins": -0.3734, "dshield": -0.7801, "crowdsec": 0.9929, "vulncheck": 1.637, "blocklist_de": 2.7682}, "mass": 1.7, "listed": false}}, "abq": false, "bot": 0.452, "det": {"shodan": {"c2": 4}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "NETIN-22-ARIN", "org": "NetInformatik Inc.", "pdb": {"t": null, "sc": "North America", "tr": "100-200Gbps", "pol": "Open", "web": "https://www.netinformatik.com"}, "pfx": 12, "reg": "2019-01-29", "rir": "arin", "s24": 17, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 5376, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": null}, {"a": 397325, "h": "DATACANOPY", "n": "Data Canopy Colocation, LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.3978, "hi": 6.06, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 0.300, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.014, "ts": null, "map": 0.220, "obs": 0, "own": 0.147, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.413, "det": {"shodan": {"malware": 2}}, "oid": "DCCL-12-ARIN", "org": "Data Canopy Colocation, LLC", "pdb": null, "pfx": 18, "reg": "2019-02-14", "rir": "arin", "s24": 18, "sib": 2, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397373, "h": "H4Y-TECHNOLOGIES", "n": "H4Y Technologies LLC", "t": "Hosting & VPS", "w": 11, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 5, "web_exploit": 4, "bad_crawling": 4, "proxy_or_vpn": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "mail_bruteforce": 1, "cve:CVE-2014-8739": 1, "cve:CVE-2017-3506": 1, "cve:CVE-2026-8181": 1, "cve:CVE-2017-12149": 1, "cve:CVE-2017-16894": 1}, "n": 6}, "ev": {"cins": {"n": 1, "p": 0.1604, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 6, "p": 0.7916, "hi": 7.41, "lo": 2.06, "ips": 6, "mean": 4.38, "above": false}, "threatfox": {"n": 1, "p": 0.1842, "hi": 4.59, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "phishing_db": {"n": 2, "p": 0.3535, "hi": 5.67, "lo": 0.74, "ips": 2, "mean": 2.70, "above": false}, "blocklist_de": {"n": 1, "p": 0.1141, "hi": 3.82, "lo": 0.29, "ips": 1, "mean": 1.61, "above": false}}, "h2": [["2026-10-05", 3.325, 0.722, 0, false], ["2026-10-12", 2.908, 1.436, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 2}, "lo": 1.436, "se": 1.013, "ts": 0.667, "map": 4.820, "obs": 3, "own": 1.887, "comp": {"urlhaus": -0.6109, "threatfox": 1.1488, "phishing_db": 2.6611}, "mass": 1.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 6, "vulncheck": 0, "blocklist_de": 1}, "lo": 2.908, "se": 0.520, "ts": 0.750, "map": 5.723, "obs": 8, "own": 1.126, "comp": {"cins": 2.4663, "dshield": -1.9689, "crowdsec": 6.2452, "vulncheck": -0.87, "blocklist_de": -2.7344}, "mass": 7.2, "listed": false}}, "abq": false, "bot": 0.725, "det": {"threatfox": {"family:Remcos": 1}, "blocklist_de": {"bots": 1}}, "oid": "HTL-33-ARIN", "org": "H4Y Technologies LLC", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Open", "web": "https://h4y.us"}, "pfx": 193, "reg": "2019-03-08", "rir": "arin", "s24": 225, "sib": 0, "tor": 0, "w24": 10, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 58624, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397423, "h": "TIER-NET", "n": "Tier.Net Technologies LLC", "t": "Hosting & VPS", "w": 20, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 5, "bad_crawling": 5, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 4, "web_bruteforce": 4, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2017-9841": 1}, "n": 7}, "ev": {"shodan": {"n": 3, "p": 0.2114, "hi": 4.29, "lo": 0.76, "ips": 3, "mean": 2.22, "above": false}, "dshield": {"n": 2, "p": 0.3009, "hi": 5.23, "lo": 0.68, "ips": 2, "mean": 2.49, "above": false}, "crowdsec": {"n": 7, "p": 0.7431, "hi": 6.57, "lo": 1.99, "ips": 7, "mean": 4.00, "above": false}, "threatfox": {"n": 8, "p": 0.9946, "hi": 13.65, "lo": 4.44, "ips": 9, "mean": 8.51, "above": true}, "phishing_db": {"n": 2, "p": 0.3112, "hi": 5.32, "lo": 0.69, "ips": 2, "mean": 2.53, "above": false}}, "h2": [["2026-10-05", 2.402, 4.014, 0, false], ["2026-10-12", 1.848, 3.816, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 8, "phishing_db": 2}, "lo": 3.816, "se": 0.818, "ts": 0.800, "map": 8.835, "obs": 10, "own": 3.269, "comp": {"urlhaus": -1.3465, "threatfox": 4.6879, "phishing_db": 0.4635}, "mass": 4.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 7, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.848, "se": 0.500, "ts": 0.778, "map": 3.472, "obs": 9, "own": 0.683, "comp": {"cins": -1.2899, "dshield": 2.6973, "crowdsec": 8.3628, "vulncheck": -0.872, "blocklist_de": -6.2597}, "mass": 7.3, "listed": false}}, "abq": false, "bot": 0.858, "det": {"shodan": {"compromised": 3}, "threatfox": {"family:DCRat": 1, "family:PureRAT": 7, "family:AsyncRAT": 1}, "blocklist_de": {"imap": 1, "mail": 1}}, "oid": "TTL-100-ARIN", "org": "Tier.Net Technologies LLC", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Open", "web": "https://www.tier.net"}, "pfx": 329, "reg": "2019-03-26", "rir": "arin", "s24": 377, "sib": 0, "tor": 0, "w24": 19, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 98560, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": 0.00787506024415}, {"a": 397455, "h": "HANCOCKTEL", "n": "The Hancock Telephone Company", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 2, "web_exploit": 1, "web_bruteforce": 3, "mail_bruteforce": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1887, "hi": 4.63, "lo": 0.35, "ips": 3, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.560, 0.011, 0, false], ["2026-10-12", 0.607, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.607, "se": 1.434, "ts": 1.000, "map": 6.598, "obs": 1, "own": 4.650, "comp": {"cins": -0.0808, "dshield": -0.1905, "crowdsec": 4.1923, "vulncheck": -0.2184, "blocklist_de": -0.4222}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.144, "det": null, "oid": "HT-452-ARIN", "org": "The Hancock Telephone Company", "pdb": null, "pfx": 2, "reg": "2019-04-03", "rir": "arin", "s24": 9, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397630, "h": "AS-BLAZINGSEO", "n": "Blazing SEO, LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"data_centre": 1, "proxy_or_vpn": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.0715, "hi": 3.30, "lo": 0.25, "ips": 1, "mean": 1.39, "above": false}, "blocklist_de": {"n": 1, "p": 0.1330, "hi": 4.03, "lo": 0.30, "ips": 1, "mean": 1.70, "above": false}}, "h2": [["2026-10-05", 0.420, 0.010, 0, false], ["2026-10-12", 0.464, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.973, "ts": null, "map": 0.177, "obs": 0, "own": 0.182, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.464, "se": 0.885, "ts": 0.500, "map": 1.795, "obs": 2, "own": 0.365, "comp": {"cins": -0.3757, "dshield": -0.7841, "crowdsec": 0.9712, "vulncheck": -0.5866, "blocklist_de": 2.7536}, "mass": 1.7, "listed": false}}, "abq": false, "bot": null, "det": {"blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "BSL-159-ARIN", "org": "Blazing SEO, LLC", "pdb": null, "pfx": 164, "reg": "2019-06-10", "rir": "arin", "s24": 164, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 41984, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397731, "h": "ELITEWORK-01", "n": "EliteWork LLC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"first_seen_30d": 1, "ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 4, "p": 0.6464, "hi": 7.02, "lo": 1.51, "ips": 4, "mean": 3.84, "above": false}, "crowdsec": {"n": 1, "p": 0.0824, "hi": 3.44, "lo": 0.26, "ips": 1, "mean": 1.45, "above": false}}, "h2": [["2026-10-05", 0.466, 0.010, 0, false], ["2026-10-12", 0.134, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.983, "ts": null, "map": 0.180, "obs": 0, "own": 0.496, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.134, "se": 1.176, "ts": 1.000, "map": 0.904, "obs": 1, "own": 0.564, "comp": {"cins": -0.171, "dshield": -0.3879, "crowdsec": 3.1177, "vulncheck": -0.3778, "blocklist_de": -0.8886}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.680, "det": {"shodan": {"compromised": 4}}, "oid": "EL-965-ARIN", "org": "EliteWork LLC", "pdb": null, "pfx": 11, "reg": "2019-07-12", "rir": "arin", "s24": 142, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 36352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397778, "h": "FIBRESTREAMBC", "n": "FibreStream Canada", "t": "Broadband & mobile", "w": 1, "cc": "CA", "cf": null, "cs": {"c": {"web_exploit": 1, "web_bruteforce": 1, "home_connection": 1, "mail_bruteforce": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1809, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}}, "h2": [["2026-10-05", 2.631, 0.011, 0, false], ["2026-10-12", 0.462, 0.012, 0, false]], "sh": false, "uc": 2270.5, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 1.977, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.462, "se": 1.372, "ts": 1.000, "map": 4.499, "obs": 1, "own": 8.338, "comp": {"cins": -0.0975, "dshield": -0.2284, "crowdsec": 3.9859, "vulncheck": -0.2532, "blocklist_de": -0.5093}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.153, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "BNFD-ARIN", "org": "Beanfield Technologies Inc.", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://www.fibrestream.ca"}, "pfx": 1, "reg": "2019-07-26", "rir": "arin", "s24": 16, "sib": 10, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 397881, "h": "STINGERS", "n": "Stingers", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 3.643, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 6.015, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 1.000, "det": null, "oid": "STING-6-ARIN", "org": "Stingers Inc.", "pdb": {"t": "NSP", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "http://Stingers.io"}, "pfx": 1, "reg": "2019-08-27", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398019, "h": "DYNU", "n": "Dynu Systems Incorporated", "t": "Other", "w": 12, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "data_centre": 1, "web_exploit": 4, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 1, "web_bruteforce": 3, "home_connection": 3, "cve:CVE-2017-16894": 2, "cve:CVE-2019-17050": 2, "cve:CVE-2021-41714": 2, "cve:CVE-2024-20767": 1}, "n": 4}, "ev": {"cins": {"n": 4, "p": 0.8093, "hi": 9.05, "lo": 1.95, "ips": 4, "mean": 4.94, "above": true}, "dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 3, "p": 0.5973, "hi": 7.22, "lo": 1.27, "ips": 4, "mean": 3.72, "above": false}, "threatfox": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 2, "mean": 2.99, "above": false}, "phishing_db": {"n": 2, "p": 0.4141, "hi": 6.21, "lo": 0.81, "ips": 2, "mean": 2.96, "above": false}}, "h2": [["2026-10-05", 6.746, 11.828, 1, false], ["2026-10-12", 24.241, 11.769, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 2}, "lo": 11.769, "se": 0.914, "ts": 0.500, "map": 35.486, "obs": 4, "own": 32.459, "comp": {"urlhaus": -0.5687, "threatfox": 2.8869, "phishing_db": 2.8771}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 1, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 24.241, "se": 0.525, "ts": 0.500, "map": 48.554, "obs": 8, "own": 27.319, "comp": {"cins": 13.4059, "dshield": 0.2745, "crowdsec": -1.1107, "vulncheck": -0.8767, "blocklist_de": -6.4166}, "mass": 7.5, "listed": false}}, "abq": false, "bot": 0.463, "det": {"threatfox": {"family:PureRAT": 2}}, "oid": "DS-589-ARIN", "org": "Dynu Systems Incorporated", "pdb": null, "pfx": 28, "reg": "2019-10-07", "rir": "arin", "s24": 28, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["cins"], "traffic": null}, {"a": 398101, "h": "GO-DADDY-COM-LLC", "n": "GoDaddy.com, LLC", "t": "Hosting & VPS", "w": 93, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 22, "data_centre": 48, "web_exploit": 24, "bad_crawling": 5, "proxy_or_vpn": 7, "first_seen_30d": 5, "ssh_bruteforce": 37, "web_bruteforce": 25, "home_connection": 1, "mail_bruteforce": 13, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9194": 1, "cve:CVE-2021-23394": 1, "cve:CVE-2026-41940": 4, "cve:CVE-2026-63030": 1}, "n": 54}, "ev": {"cins": {"n": 7, "p": 0.8521, "hi": 7.68, "lo": 2.33, "ips": 7, "mean": 4.67, "above": true}, "shodan": {"n": 28, "p": 0.9998, "hi": 8.35, "lo": 4.51, "ips": 28, "mean": 6.30, "above": true}, "dshield": {"n": 5, "p": 0.4904, "hi": 5.51, "lo": 1.37, "ips": 5, "mean": 3.14, "above": false}, "urlhaus": {"n": 1, "p": 0.1394, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "crowdsec": {"n": 46, "p": 1.0000, "hi": 10.74, "lo": 6.63, "ips": 54, "mean": 8.58, "above": true}, "threatfox": {"n": 3, "p": 0.4785, "hi": 6.16, "lo": 1.09, "ips": 3, "mean": 3.18, "above": false}, "vulncheck": {"n": 5, "p": 0.5031, "hi": 5.58, "lo": 1.39, "ips": 5, "mean": 3.18, "above": false}, "phishing_db": {"n": 20, "p": 1.0000, "hi": 15.94, "lo": 7.72, "ips": 20, "mean": 11.52, "above": true}, "blocklist_de": {"n": 18, "p": 0.9988, "hi": 9.51, "lo": 4.43, "ips": 20, "mean": 6.77, "above": true}}, "h2": [["2026-10-05", 4.670, 3.305, 0, false], ["2026-10-12", 5.437, 2.893, 0, false]], "sh": false, "uc": 68.1, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 20}, "lo": 2.893, "se": 0.790, "ts": 0.833, "map": 6.236, "obs": 24, "own": 2.344, "comp": {"urlhaus": -0.8269, "threatfox": 0.1187, "phishing_db": 4.1646}, "mass": 14.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 7, "dshield": 5, "crowdsec": 46, "vulncheck": 5, "blocklist_de": 18}, "lo": 5.437, "se": 0.369, "ts": 0.568, "map": 8.317, "obs": 81, "own": 1.625, "comp": {"cins": 3.2254, "dshield": -1.4974, "crowdsec": 3.567, "vulncheck": -0.602, "blocklist_de": -1.1811}, "mass": 77.3, "listed": false}}, "abq": false, "bot": 0.953, "det": {"shodan": {"c2": 9, "compromised": 19}, "threatfox": {"family:Havoc": 3}, "vulncheck": {"c2_server": 5}, "blocklist_de": {"ftp": 1, "ssh": 16, "imap": 3, "mail": 3}}, "oid": "GODAD-ARIN", "org": "GoDaddy.com, LLC", "pdb": null, "pfx": 283, "reg": "2019-10-30", "rir": "arin", "s24": 1685, "sib": 42, "tor": 0, "w24": 82, "drop": 0, "hist": [["2026-10-05", 0.9966], ["2026-10-12", 0.9969]], "ipv4": 440576, "abuse": null, "score": 0.9969, "groups": ["sensors", "phishing", "shodan"], "sensors": ["crowdsec", "blocklist_de", "cins"], "traffic": 0.00421660666254}, {"a": 398256, "h": "AS-ULTAHOST", "n": "Ultahost, Inc.", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.4020, "hi": 6.10, "lo": 0.79, "ips": 2, "mean": 2.91, "above": false}}, "h2": [["2026-10-05", 0.459, 0.572, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.093, "ts": null, "map": 0.195, "obs": 0, "own": 0.309, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.034, "ts": null, "map": 0.224, "obs": 0, "own": 0.159, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.760, "det": {"shodan": {"compromised": 2}}, "oid": "ULTAH-ARIN", "org": "Ultahost, Inc.", "pdb": null, "pfx": 15, "reg": "2025-03-18", "rir": "arin", "s24": 15, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3840, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398298, "h": "NETSTRATUM", "n": "Netstratum", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.856, "det": {"shodan": {"compromised": 1}}, "oid": "NETST-16-ARIN", "org": "Netstratum", "pdb": null, "pfx": 2, "reg": "2020-04-16", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398324, "h": "CENSYS-ARIN-01", "n": "Censys", "t": "Broadband & mobile", "w": 131, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 11, "web_exploit": 13, "ssh_bruteforce": 17, "home_connection": 20, "mail_bruteforce": 1}, "n": 33}, "ev": {"cins": {"n": 4, "p": 0.8116, "hi": 9.09, "lo": 1.96, "ips": 89, "mean": 4.96, "above": false}, "dshield": {"n": 3, "p": 0.6411, "hi": 7.68, "lo": 1.35, "ips": 30, "mean": 3.96, "above": false}, "crowdsec": {"n": 2, "p": 0.3935, "hi": 6.02, "lo": 0.78, "ips": 33, "mean": 2.87, "above": false}, "blocklist_de": {"n": 2, "p": 0.4111, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.95, "above": false}}, "h2": [["2026-10-05", 30.464, 0.011, 1, false], ["2026-10-12", 62.762, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.089, "ts": null, "map": 0.194, "obs": 0, "own": 1.959, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 4, "dshield": 3, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 2}, "lo": 62.762, "se": 0.477, "ts": 0.364, "map": 114.651, "obs": 11, "own": 175.349, "comp": {"cins": 11.3701, "dshield": 3.202, "crowdsec": -5.4298, "vulncheck": -0.9148, "blocklist_de": -2.092}, "mass": 10.7, "listed": false}}, "abq": false, "bot": 0.999, "det": {"blocklist_de": {"ssh": 2}}, "oid": "CENSY-ARIN", "org": "Censys, Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://censys.io"}, "pfx": 17, "reg": "2020-04-27", "rir": "arin", "s24": 17, "sib": 2, "tor": 0, "w24": 5, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4352, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398343, "h": "BAXET-GROUP", "n": "Baxet Group Inc.", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 3, "p": 0.6295, "hi": 7.55, "lo": 1.33, "ips": 3, "mean": 3.90, "above": false}}, "h2": [["2026-10-05", 0.010, 4.456, 0, false], ["2026-10-12", 0.010, 4.505, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 3}, "lo": 4.505, "se": 1.001, "ts": 1.000, "map": 15.780, "obs": 3, "own": 15.062, "comp": {"urlhaus": -0.5003, "threatfox": -0.362, "phishing_db": 5.2473}, "mass": 1.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.884, "ts": null, "map": 0.184, "obs": 0, "own": 0.248, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.597, "det": null, "oid": "BG-556-ARIN", "org": "Baxet Group Inc.", "pdb": null, "pfx": 47, "reg": "2020-07-10", "rir": "arin", "s24": 54, "sib": 1, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 13824, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398406, "h": "ASPHALT-MATERIALS-INC", "n": "ASPHALT MATERIALS, INC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1972, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.232, "det": {"shodan": {"malware": 1}}, "oid": "AM-2846-ARIN", "org": "ASPHALT MATERIALS, INC", "pdb": null, "pfx": 2, "reg": "2020-05-19", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398465, "h": "RACKDOG-LLC", "n": "Rackdog", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": {"rb": "hi", "wb": "hi", "rep": 0.67, "waf": 0.58}, "cs": null, "ev": {"vulncheck": {"n": 3, "p": 0.5830, "hi": 7.07, "lo": 1.25, "ips": 4, "mean": 3.65, "above": false}}, "h2": [["2026-10-05", 0.516, 0.010, 0, false], ["2026-10-12", 0.445, 0.011, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.966, "ts": null, "map": 0.176, "obs": 0, "own": 1.145, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 3, "blocklist_de": 0}, "lo": 0.445, "se": 0.769, "ts": 1.000, "map": 1.322, "obs": 3, "own": 2.174, "comp": {"cins": -0.3117, "dshield": -0.6672, "crowdsec": -2.6324, "vulncheck": 6.8895, "blocklist_de": -1.6056}, "mass": 1.4, "listed": false}}, "abq": false, "bot": 0.705, "det": {"vulncheck": {"botnet_node": 4}}, "oid": "RL-859-ARIN", "org": "Rackdog, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "10-20Tbps", "pol": "Open", "web": "https://rackdog.com"}, "pfx": 178, "reg": "2020-06-15", "rir": "arin", "s24": 183, "sib": 2, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 204800, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.109944}, {"a": 398478, "h": "PEG-HK", "n": "Peg Tech Hong Kong", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0095, "hi": 2.12, "lo": 0.16, "ips": 1, "mean": 0.90, "above": false}, "phishing_db": {"n": 2, "p": 0.2616, "hi": 4.91, "lo": 0.64, "ips": 3, "mean": 2.34, "above": false}}, "h2": [["2026-10-05", 0.005, 0.381, 0, false], ["2026-10-12", 0.005, 0.393, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 2}, "lo": 0.393, "se": 1.135, "ts": 1.000, "map": 1.622, "obs": 2, "own": 1.806, "comp": {"urlhaus": -0.5413, "threatfox": -0.3752, "phishing_db": 3.0265}, "mass": 1.5, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.575, "ts": null, "map": 0.074, "obs": 0, "own": 0.060, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.799, "det": {"shodan": {"c2": 1}}, "oid": "PT-82-ARIN", "org": "PEG TECH INC", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.raksmart.com"}, "pfx": 79, "reg": "2020-06-18", "rir": "arin", "s24": 577, "sib": 7, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 148992, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00034544578734}, {"a": 398493, "h": "SYSTEMINPLACE", "n": "System In Place", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1765, "hi": 4.50, "lo": 0.34, "ips": 1, "mean": 1.90, "above": false}, "phishing_db": {"n": 1, "p": 0.1937, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.011, 0.499, 0, false], ["2026-10-12", 0.011, 0.520, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.520, "se": 1.571, "ts": 1.000, "map": 5.591, "obs": 1, "own": 2.585, "comp": {"urlhaus": -0.0943, "threatfox": -0.1209, "phishing_db": 3.5625}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.977, "ts": null, "map": 0.212, "obs": 0, "own": 0.127, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.541, "det": {"shodan": {"compromised": 1}}, "oid": "MS-1790-ARIN", "org": "System In Place", "pdb": {"t": "Content", "sc": "North America", "tr": null, "pol": "Open", "web": "http://www.systeminplace.net"}, "pfx": 17, "reg": "2020-07-01", "rir": "arin", "s24": 25, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 6912, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398638, "h": "JELLYDIGITAL", "n": "Jelly Digital, LLC.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.184, "det": null, "oid": "JDL-20-ARIN", "org": "Jelly Digital, LLC.", "pdb": null, "pfx": 3, "reg": "2020-07-15", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398721, "h": "OXIO-ASN-01", "n": "oxio", "t": "Broadband & mobile", "w": 4, "cc": "CA", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.0439, "hi": 2.90, "lo": 0.22, "ips": 1, "mean": 1.22, "above": false}, "dshield": {"n": 1, "p": 0.0282, "hi": 2.62, "lo": 0.20, "ips": 1, "mean": 1.11, "above": false}, "threatfox": {"n": 1, "p": 0.1170, "hi": 3.86, "lo": 0.29, "ips": 1, "mean": 1.63, "above": false}, "phishing_db": {"n": 1, "p": 0.0342, "hi": 2.74, "lo": 0.21, "ips": 1, "mean": 1.15, "above": false}}, "h2": [["2026-10-12", 0.077, 0.190, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 1}, "lo": 0.190, "se": 1.145, "ts": 0.500, "map": 0.756, "obs": 2, "own": 2.233, "comp": {"urlhaus": -0.6337, "threatfox": 1.0966, "phishing_db": 0.8838}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.077, "se": 0.822, "ts": 0.500, "map": 0.263, "obs": 2, "own": 0.419, "comp": {"cins": 4.1779, "dshield": 2.841, "crowdsec": -3.8288, "vulncheck": -0.6556, "blocklist_de": -2.4784}, "mass": 2.3, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:Cobalt Strike": 1}}, "oid": "CC-4458-ARIN", "org": "OXIO", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "100-200Gbps", "pol": "Open", "web": "https://oxio.ca/"}, "pfx": 61, "reg": "2020-08-18", "rir": "arin", "s24": 1501, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 433664, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00969073319739}, {"a": 398741, "h": "AS-VERTEXLINK-01", "n": "VertexLink Inc", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.000, "det": null, "oid": "VERTE-45-ARIN", "org": "VertexLink Inc", "pdb": null, "pfx": 1, "reg": "2024-02-29", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398766, "h": "TRICOLINK", "n": "TriCoLink, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1345, "hi": 4.05, "lo": 0.30, "ips": 1, "mean": 1.71, "above": false}}, "h2": [["2026-10-05", 0.009, 0.011, 0, false], ["2026-10-12", 0.009, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.019, "ts": null, "map": 0.186, "obs": 0, "own": 0.577, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.833, "ts": null, "map": 0.167, "obs": 0, "own": 0.201, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.182, "det": {"shodan": {"compromised": 1}}, "oid": "TRICO-68-ARIN", "org": "TriCoLink, Inc.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://tricolinksc.com"}, "pfx": 24, "reg": "2020-08-28", "rir": "arin", "s24": 80, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 33280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398781, "h": "OSL-188", "n": "OCULUS NETWORKS INC", "t": "Other", "w": 0, "cc": "US", "cf": {"rb": "lo", "wb": "lo", "rep": 3.85, "waf": 3.54}, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.022, 0.007, 0, false], ["2026-10-12", 0.003, 0.008, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.008, "se": 1.781, "ts": null, "map": 0.105, "obs": 0, "own": 0.197, "comp": null, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.003, "se": 1.420, "ts": null, "map": 0.034, "obs": 0, "own": 0.025, "comp": null, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.702, "det": null, "oid": "ON-71-ARIN", "org": "OCULUS NETWORKS INC", "pdb": null, "pfx": 2075, "reg": "2020-09-02", "rir": "arin", "s24": 2089, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0274], ["2026-10-12", 0.0355]], "ipv4": 534784, "abuse": null, "score": 0.0355, "groups": ["cloudflare"], "sensors": [], "traffic": 0.04097964007218}, {"a": 398823, "h": "PEG-LA", "n": "Peg Tech Los Angeles", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 2, "p": 0.0119, "hi": 2.31, "lo": 0.30, "ips": 2, "mean": 1.10, "above": false}, "threatfox": {"n": 1, "p": 0.1500, "hi": 4.22, "lo": 0.32, "ips": 1, "mean": 1.78, "above": false}}, "h2": [["2026-10-05", 0.005, 0.098, 0, false], ["2026-10-12", 0.005, 0.103, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.103, "se": 1.361, "ts": 1.000, "map": 0.646, "obs": 1, "own": 0.312, "comp": {"urlhaus": -0.3263, "threatfox": 2.0648, "phishing_db": -0.5498}, "mass": 0.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.005, "se": 1.533, "ts": null, "map": 0.061, "obs": 0, "own": 0.017, "comp": null, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.611, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Cobalt Strike": 1}}, "oid": "PT-82-ARIN", "org": "PEG TECH INC", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Open", "web": "https://www.raksmart.com"}, "pfx": 86, "reg": "2020-09-15", "rir": "arin", "s24": 809, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 221696, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398991, "h": "X99-US", "n": "x99.cloud", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 1, "ssh_bruteforce": 3, "web_bruteforce": 2, "home_connection": 3, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1906, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "crowdsec": {"n": 3, "p": 0.5656, "hi": 6.91, "lo": 1.22, "ips": 3, "mean": 3.56, "above": false}, "vulncheck": {"n": 1, "p": 0.1886, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1781, "hi": 4.52, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 8.768, 0.011, 0, false], ["2026-10-12", 7.909, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.049, "ts": null, "map": 0.191, "obs": 0, "own": 0.251, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 7.909, "se": 0.588, "ts": 0.500, "map": 17.566, "obs": 6, "own": 3.475, "comp": {"cins": 3.2908, "dshield": -1.5529, "crowdsec": 2.7043, "vulncheck": 0.3067, "blocklist_de": -0.4893}, "mass": 4.5, "listed": false}}, "abq": false, "bot": 0.637, "det": {"vulncheck": {"botnet_node": 1}, "blocklist_de": {"ftp": 1}}, "oid": "XIL-3-ARIN", "org": "X99", "pdb": {"t": "NSP", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://x99.cloud"}, "pfx": 60, "reg": "2024-02-22", "rir": "arin", "s24": 46, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 20224, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 398993, "h": "PEG-TY", "n": "PEG TECH INC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.0661, "hi": 3.23, "lo": 0.24, "ips": 1, "mean": 1.36, "above": false}, "phishing_db": {"n": 1, "p": 0.1561, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-12", 0.007, 0.212, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.212, "se": 1.416, "ts": 1.000, "map": 1.596, "obs": 1, "own": 1.894, "comp": {"urlhaus": -0.226, "threatfox": -0.2317, "phishing_db": 2.5517}, "mass": 0.6, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.007, "se": 1.701, "ts": null, "map": 0.117, "obs": 0, "own": 0.111, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.584, "det": {"shodan": {"c2": 1}}, "oid": "PT-82-ARIN", "org": "PEG TECH INC", "pdb": null, "pfx": 50, "reg": "2020-10-30", "rir": "arin", "s24": 219, "sib": 7, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 65536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.0009624359678}, {"a": 399073, "h": "TBB-ASN", "n": "BUNNY TECHNOLOGY LLC", "t": "Other", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 3}, "n": 8}, "ev": {"crowdsec": {"n": 1, "p": 0.0322, "hi": 2.70, "lo": 0.20, "ips": 8, "mean": 1.14, "above": false}}, "h2": [["2026-10-05", 0.083, 0.010, 0, false], ["2026-10-12", 0.086, 0.011, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.011, "se": 1.934, "ts": null, "map": 0.167, "obs": 0, "own": 0.403, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.086, "se": 1.126, "ts": 1.000, "map": 0.523, "obs": 1, "own": 0.322, "comp": {"cins": -0.1972, "dshield": -0.4424, "crowdsec": 2.8212, "vulncheck": -0.4137, "blocklist_de": -1.0231}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.737, "det": null, "oid": "BTL-272-ARIN", "org": "BUNNY TECHNOLOGY LLC", "pdb": null, "pfx": 284, "reg": "2020-12-02", "rir": "arin", "s24": 285, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 72960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00097091489787}, {"a": 399077, "h": "TERAEXCH", "n": "Tcloudnet", "t": "Hosting & VPS", "w": 9, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 6, "p": 0.5694, "hi": 5.70, "lo": 1.58, "ips": 6, "mean": 3.37, "above": false}, "urlhaus": {"n": 1, "p": 0.1792, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}, "phishing_db": {"n": 8, "p": 0.9854, "hi": 11.58, "lo": 3.77, "ips": 8, "mean": 7.22, "above": true}}, "h2": [["2026-10-05", 0.059, 5.206, 0, false], ["2026-10-12", 0.006, 3.618, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 1, "threatfox": 0, "phishing_db": 8}, "lo": 3.618, "se": 0.841, "ts": 0.889, "map": 8.855, "obs": 9, "own": 3.283, "comp": {"urlhaus": 0.7623, "threatfox": -0.5297, "phishing_db": 3.5746}, "mass": 6.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.592, "ts": null, "map": 0.079, "obs": 0, "own": 0.023, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.854, "det": {"shodan": {"c2": 4, "compromised": 2}, "threatfox": {"family:ValleyRAT": 1}}, "oid": "TCLOU-ARIN", "org": "Tcloudnet", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "300-500Gbps", "pol": "Open", "web": null}, "pfx": 505, "reg": "2020-12-02", "rir": "arin", "s24": 504, "sib": 1, "tor": 0, "w24": 9, "drop": 0, "hist": [["2026-10-05", 0.8809], ["2026-10-12", 0.0810]], "ipv4": 130048, "abuse": null, "score": 0.0810, "groups": ["phishing"], "sensors": [], "traffic": 0.00046110639522}, {"a": 399244, "h": "BLOOM-HOST", "n": "AME Hosting LLC", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1608, "hi": 4.34, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "dshield": {"n": 1, "p": 0.1888, "hi": 4.63, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.271, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.051, "ts": null, "map": 0.191, "obs": 0, "own": 0.254, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.271, "se": 1.274, "ts": 1.000, "map": 2.201, "obs": 1, "own": 0.496, "comp": {"cins": -0.1302, "dshield": 4.4945, "crowdsec": -1.1899, "vulncheck": -0.3136, "blocklist_de": -0.6785}, "mass": 0.6, "listed": false}}, "abq": false, "bot": 0.847, "det": {"shodan": {"compromised": 1}}, "oid": "AHL-760-ARIN", "org": "AME Hosting LLC", "pdb": null, "pfx": 23, "reg": "2021-01-15", "rir": "arin", "s24": 44, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399250, "h": "NAMEHERO-KCDC", "n": "Name Hero, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1907, "hi": 4.65, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.107, "ts": null, "map": 0.195, "obs": 0, "own": 0.864, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.233, "obs": 0, "own": 0.563, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.966, "det": {"shodan": {"compromised": 1}}, "oid": "NHL-150-ARIN", "org": "Name Hero, LLC", "pdb": null, "pfx": 9, "reg": "2021-01-19", "rir": "arin", "s24": 9, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399275, "h": "SOLID", "n": "Solid Systems LLC", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 3, "bad_crawling": 3, "proxy_or_vpn": 2, "web_bruteforce": 4, "home_connection": 5, "cve:CVE-2022-39290": 1}, "n": 5}, "ev": {"shodan": {"n": 1, "p": 0.1616, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}, "crowdsec": {"n": 4, "p": 0.7547, "hi": 8.21, "lo": 1.77, "ips": 5, "mean": 4.49, "above": false}}, "h2": [["2026-10-05", 6.709, 0.011, 0, false], ["2026-10-12", 4.533, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 1.650, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.533, "se": 0.671, "ts": 1.000, "map": 11.825, "obs": 4, "own": 18.355, "comp": {"cins": -0.6084, "dshield": -1.164, "crowdsec": 9.4254, "vulncheck": -0.7125, "blocklist_de": -3.0767}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.954, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "SSL-1126-ARIN", "org": "Solid Systems LLC", "pdb": null, "pfx": 43, "reg": "2021-01-22", "rir": "arin", "s24": 43, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11008, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000025877247}, {"a": 399334, "h": "SKYSILK-02", "n": "Skysilk", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1944, "hi": 4.69, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.479, "det": {"shodan": {"compromised": 1}}, "oid": "SKYSI-ARIN", "org": "Skysilk", "pdb": null, "pfx": 3, "reg": "2021-02-08", "rir": "arin", "s24": 5, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399382, "h": null, "n": "MULTI", "t": "Other", "w": 1, "cc": null, "cf": null, "cs": {"c": {"proxy_or_vpn": 1, "web_bruteforce": 1, "mail_bruteforce": 1, "router_or_botnet": 1}, "n": 1}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": 15429.7, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 13.144, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.153, "det": null, "oid": null, "org": null, "pdb": null, "pfx": 2, "reg": null, "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00038655049032}, {"a": 399392, "h": "FIREDOG-AS399392", "n": "FIRE DOG SSC", "t": "Broadband & mobile", "w": 11, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 11, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.907, 0.011, 0, false], ["2026-10-12", 0.955, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 2.468, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.955, "se": 1.575, "ts": 1.000, "map": 12.747, "obs": 1, "own": 28.487, "comp": {"cins": -0.035, "dshield": -0.0844, "crowdsec": -0.3346, "vulncheck": 4.5766, "blocklist_de": -0.1837}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.124, "det": {"vulncheck": {"botnet_node": 11}}, "oid": "FDSL-13-ARIN", "org": "FIRE DOG SSC, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": "20-50Gbps", "pol": "Open", "web": "https://firedogssc.com/"}, "pfx": 2, "reg": "2021-02-25", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399486, "h": "VIRTUO", "n": "Virtuo.Host", "t": "Hosting & VPS", "w": 66, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 17, "data_centre": 6, "web_exploit": 19, "bad_crawling": 10, "proxy_or_vpn": 4, "first_seen_30d": 12, "ssh_bruteforce": 4, "web_bruteforce": 15, "home_connection": 1, "mail_bruteforce": 3, "cve:CVE-2017-9841": 6, "cve:CVE-2017-16894": 3, "cve:CVE-2019-17050": 3, "cve:CVE-2023-49103": 3, "cve:CVE-2024-38475": 2}, "n": 28}, "ev": {"cins": {"n": 1, "p": 0.1835, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}, "shodan": {"n": 1, "p": 0.1306, "hi": 4.01, "lo": 0.30, "ips": 1, "mean": 1.69, "above": false}, "urlhaus": {"n": 1, "p": 0.1956, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 13, "p": 1.0000, "hi": 16.82, "lo": 6.89, "ips": 28, "mean": 11.40, "above": true}, "threatfox": {"n": 13, "p": 1.0000, "hi": 20.40, "lo": 8.35, "ips": 23, "mean": 13.82, "above": true}, "vulncheck": {"n": 2, "p": 0.3936, "hi": 6.02, "lo": 0.78, "ips": 2, "mean": 2.87, "above": false}, "phishing_db": {"n": 2, "p": 0.3955, "hi": 6.04, "lo": 0.78, "ips": 2, "mean": 2.88, "above": false}, "blocklist_de": {"n": 3, "p": 0.5855, "hi": 7.10, "lo": 1.25, "ips": 15, "mean": 3.66, "above": false}}, "h2": [["2026-10-05", 15.434, 29.531, 1, false], ["2026-10-12", 18.643, 27.481, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 13, "phishing_db": 2}, "lo": 27.481, "se": 0.741, "ts": 0.813, "map": 59.301, "obs": 16, "own": 20.029, "comp": {"urlhaus": 0.5017, "threatfox": 5.2647, "phishing_db": -0.0575}, "mass": 6.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 13, "vulncheck": 2, "blocklist_de": 3}, "lo": 18.643, "se": 0.428, "ts": 0.684, "map": 31.467, "obs": 19, "own": 6.142, "comp": {"cins": 0.8081, "dshield": -2.5788, "crowdsec": 8.6986, "vulncheck": -0.164, "blocklist_de": -1.9213}, "mass": 14.9, "listed": false}}, "abq": false, "bot": 0.583, "det": {"shodan": {"c2": 1}, "threatfox": {"family:Mirai": 1, "family:PureRAT": 17, "family:AsyncRAT": 1, "family:Evilginx": 2, "family:Quasar RAT": 1}, "vulncheck": {"c2_server": 2}, "blocklist_de": {"ftp": 14, "apache": 1, "bruteforcelogin": 1}}, "oid": "CANAD-114-ARIN", "org": "12651980 CANADA INC.", "pdb": {"t": "Content", "sc": "Global", "tr": "500-1000Gbps", "pol": "Open", "web": "https://www.virtuo.host/"}, "pfx": 71, "reg": "2021-03-24", "rir": "arin", "s24": 86, "sib": 0, "tor": 0, "w24": 24, "drop": 1, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 22016, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": ["crowdsec"], "traffic": 0.00107417314758}, {"a": 399541, "h": "WRC-AS", "n": "Western Reserve Communications", "t": "Broadband & mobile", "w": 6, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "ssh_bruteforce": 4, "web_bruteforce": 6, "mail_bruteforce": 5}, "n": 6}, "ev": {"crowdsec": {"n": 2, "p": 0.3734, "hi": 5.85, "lo": 0.76, "ips": 6, "mean": 2.79, "above": false}, "blocklist_de": {"n": 1, "p": 0.1856, "hi": 4.60, "lo": 0.34, "ips": 1, "mean": 1.94, "above": false}}, "h2": [["2026-10-05", 9.542, 0.011, 0, false], ["2026-10-12", 4.165, 0.012, 0, false]], "sh": false, "uc": 2357.2, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 1.785, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 1}, "lo": 4.165, "se": 0.776, "ts": 0.667, "map": 13.131, "obs": 3, "own": 20.579, "comp": {"cins": -0.4717, "dshield": -0.949, "crowdsec": 3.8991, "vulncheck": -0.6475, "blocklist_de": 2.1379}, "mass": 2.1, "listed": false}}, "abq": false, "bot": 0.143, "det": {"blocklist_de": {"imap": 1, "mail": 1}}, "oid": "WRCL-9-ARIN", "org": "Western Reserve Communications, LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Regional", "tr": null, "pol": "Open", "web": "http://www.wrcfiber.com"}, "pfx": 8, "reg": "2021-04-09", "rir": "arin", "s24": 29, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399565, "h": null, "n": "Shaw University", "t": "Other", "w": 0, "cc": null, "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1457, "hi": 4.17, "lo": 0.31, "ips": 1, "mean": 1.76, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.031, "ts": null, "map": 0.188, "obs": 0, "own": 0.609, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.862, "ts": null, "map": 0.177, "obs": 0, "own": 0.227, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.111, "det": {"shodan": {"malware": 1}}, "oid": null, "org": null, "pdb": null, "pfx": 1, "reg": null, "rir": "arin", "s24": 64, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 16384, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399628, "h": "IMR-AS-01", "n": "Internet Measurement Research", "t": "Other", "w": 152, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 6, "p": 0.9660, "hi": 11.81, "lo": 3.28, "ips": 152, "mean": 6.98, "above": true}}, "h2": [["2026-10-05", 61.343, 0.011, 1, false], ["2026-10-12", 71.749, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 6, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 0}, "lo": 71.749, "se": 0.587, "ts": 1.000, "map": 161.589, "obs": 6, "own": 90.754, "comp": {"cins": 22.0937, "dshield": -1.8531, "crowdsec": -7.2353, "vulncheck": -0.853, "blocklist_de": -5.6737}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.956, "det": null, "oid": "SIXMA-ARIN", "org": "Internet Measurement Research", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://internetmeasurementresearch.com"}, "pfx": 7, "reg": "2021-04-30", "rir": "arin", "s24": 7, "sib": 0, "tor": 0, "w24": 6, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["cins"], "traffic": null}, {"a": 399629, "h": "BLNWX", "n": "BL Networks", "t": "Other", "w": 34, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 2, "bad_crawling": 1, "proxy_or_vpn": 1, "first_seen_30d": 1, "ssh_bruteforce": 2, "web_bruteforce": 1, "mail_bruteforce": 1, "cve:CVE-2015-9406": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2018-13379": 1}, "n": 2}, "ev": {"cins": {"n": 3, "p": 0.6279, "hi": 7.54, "lo": 1.33, "ips": 3, "mean": 3.89, "above": false}, "shodan": {"n": 6, "p": 0.9395, "hi": 10.34, "lo": 2.87, "ips": 6, "mean": 6.11, "above": true}, "dshield": {"n": 2, "p": 0.3990, "hi": 6.07, "lo": 0.79, "ips": 2, "mean": 2.89, "above": false}, "urlhaus": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "crowdsec": {"n": 2, "p": 0.3131, "hi": 5.33, "lo": 0.69, "ips": 2, "mean": 2.54, "above": false}, "threatfox": {"n": 8, "p": 0.9959, "hi": 14.29, "lo": 4.65, "ips": 8, "mean": 8.91, "above": true}, "vulncheck": {"n": 4, "p": 0.7970, "hi": 8.84, "lo": 1.90, "ips": 5, "mean": 4.83, "above": true}, "phishing_db": {"n": 7, "p": 0.9858, "hi": 12.73, "lo": 3.85, "ips": 13, "mean": 7.74, "above": true}, "blocklist_de": {"n": 2, "p": 0.3760, "hi": 5.87, "lo": 0.76, "ips": 2, "mean": 2.80, "above": false}}, "h2": [["2026-10-05", 17.058, 30.551, 1, false], ["2026-10-12", 14.540, 35.452, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 8, "phishing_db": 7}, "lo": 35.452, "se": 0.732, "ts": 0.500, "map": 75.922, "obs": 16, "own": 66.207, "comp": {"urlhaus": 0.4778, "threatfox": 2.9933, "phishing_db": 2.4847}, "mass": 6.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 3, "dshield": 2, "crowdsec": 2, "vulncheck": 4, "blocklist_de": 2}, "lo": 14.540, "se": 0.480, "ts": 0.308, "map": 26.754, "obs": 13, "own": 15.074, "comp": {"cins": 8.4302, "dshield": 1.5828, "crowdsec": -5.0482, "vulncheck": 1.323, "blocklist_de": -1.6073}, "mass": 10.1, "listed": false}}, "abq": false, "bot": 0.839, "det": {"shodan": {"c2": 5, "compromised": 1}, "threatfox": {"family:Havoc": 1, "family:PureRAT": 1, "family:Evilginx": 1, "family:AdaptixC2": 3, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 3, "attack_tooling": 2}, "blocklist_de": {"ftp": 2}}, "oid": "BNL-77-ARIN", "org": "BL Networks", "pdb": null, "pfx": 68, "reg": "2021-04-30", "rir": "arin", "s24": 68, "sib": 0, "tor": 1, "w24": 24, "drop": 0, "hist": [["2026-10-05", 1.0000], ["2026-10-12", 1.0000]], "ipv4": 17408, "abuse": null, "score": 1.0000, "groups": ["vulncheck", "abusech", "phishing", "shodan"], "sensors": [], "traffic": 0.00099171807598}, {"a": 399646, "h": "DARTNODE", "n": "DartNode.com", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1616, "hi": 4.34, "lo": 0.33, "ips": 1, "mean": 1.83, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.052, "ts": null, "map": 0.191, "obs": 0, "own": 0.255, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.912, "ts": null, "map": 0.194, "obs": 0, "own": 0.097, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.777, "det": {"shodan": {"compromised": 1}}, "oid": "SNAJU-1-ARIN", "org": "Snaju Development", "pdb": {"t": "Content", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://snaju.com"}, "pfx": 31, "reg": "2023-10-27", "rir": "arin", "s24": 43, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 11264, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399784, "h": "INTERNET-ARCHIVE-CANADA", "n": "Internet Archive Canada", "t": "Other", "w": 4, "cc": "CA", "cf": null, "cs": {"c": {"http_flood": 4, "data_centre": 4, "web_exploit": 4, "bad_crawling": 4, "proxy_or_vpn": 1, "cve:CVE-2024-34351": 2}, "n": 4}, "ev": {"crowdsec": {"n": 2, "p": 0.4161, "hi": 6.23, "lo": 0.81, "ips": 4, "mean": 2.97, "above": false}}, "h2": [["2026-10-05", 6.829, 0.011, 0, false], ["2026-10-12", 7.398, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 7.398, "se": 1.048, "ts": 1.000, "map": 39.323, "obs": 2, "own": 23.453, "comp": {"cins": -0.2077, "dshield": -0.4641, "crowdsec": 7.2416, "vulncheck": -0.4272, "blocklist_de": -1.0772}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.995, "det": null, "oid": "IAC-109-ARIN", "org": "Internet Archive Canada", "pdb": null, "pfx": 2, "reg": "2021-06-16", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00030255588692}, {"a": 399804, "h": "HOSTODO", "n": "HOSTODO", "t": "Hosting & VPS", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "bad_crawling": 3, "web_bruteforce": 3, "home_connection": 2, "cve:CVE-2024-0012": 1}, "n": 3}, "ev": {"crowdsec": {"n": 3, "p": 0.6312, "hi": 7.57, "lo": 1.33, "ips": 3, "mean": 3.91, "above": false}, "threatfox": {"n": 1, "p": 0.1985, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.467, 0.011, 1, false], ["2026-10-12", 10.607, 0.686, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.686, "se": 1.658, "ts": 1.000, "map": 8.575, "obs": 1, "own": 4.264, "comp": {"urlhaus": -0.0528, "threatfox": 3.9591, "phishing_db": -0.1313}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.607, "se": 0.800, "ts": 1.000, "map": 34.864, "obs": 3, "own": 6.957, "comp": {"cins": -0.3961, "dshield": -0.8202, "crowdsec": 8.7921, "vulncheck": -0.601, "blocklist_de": -2.0297}, "mass": 1.8, "listed": false}}, "abq": false, "bot": 0.926, "det": {"threatfox": {"family:Mirai": 1}}, "oid": "HL-658-ARIN", "org": "Hostodo", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://hostodo.com"}, "pfx": 9, "reg": "2021-06-25", "rir": "arin", "s24": 9, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2304, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399820, "h": "ATOMIC-NETWORKS-1", "n": "Atomic Networks LLC", "t": "Broadband & mobile", "w": 5, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "web_exploit": 5, "bad_crawling": 3, "proxy_or_vpn": 5, "ssh_bruteforce": 4, "web_bruteforce": 5, "home_connection": 5, "mail_bruteforce": 1, "cve:CVE-2015-9406": 2, "cve:CVE-2017-9841": 2, "cve:CVE-2018-13379": 4, "cve:CVE-2018-20062": 5, "cve:CVE-2021-26086": 2}, "n": 5}, "ev": {"crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 5, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 1.191, 0.012, 0, false], ["2026-10-12", 1.349, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 2.562, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.349, "se": 1.704, "ts": 1.000, "map": 21.922, "obs": 1, "own": 55.908, "comp": {"cins": -0.0302, "dshield": -0.0728, "crowdsec": 4.8355, "vulncheck": -0.0933, "blocklist_de": -0.1582}, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.704, "det": null, "oid": "SHL-1146-ARIN", "org": "SPARKED HOST LLC", "pdb": {"t": "Enterprise", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://atomicnetworks.co"}, "pfx": 1, "reg": "2021-06-29", "rir": "arin", "s24": 1, "sib": 2, "tor": 5, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 399979, "h": "AS-493NETWORKING", "n": "49.3 Networking LLC", "t": "Other", "w": 17, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 7, "web_exploit": 8, "bad_crawling": 7, "ssh_bruteforce": 3, "web_bruteforce": 7, "cve:CVE-2024-0012": 3, "cve:CVE-2017-16894": 1, "cve:CVE-2019-17050": 1, "cve:CVE-2021-41714": 1, "cve:CVE-2022-22947": 1}, "n": 8}, "ev": {"dshield": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 8, "mean": 1.99, "above": false}, "threatfox": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 9, "mean": 2.00, "above": false}, "vulncheck": {"n": 1, "p": 0.1987, "hi": 4.74, "lo": 0.35, "ips": 4, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 15.043, 0.999, 1, false], ["2026-10-12", 62.117, 0.938, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.938, "se": 1.811, "ts": 1.000, "map": 14.132, "obs": 1, "own": 23.079, "comp": {"urlhaus": -0.0195, "threatfox": 4.3458, "phishing_db": -0.0516}, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 62.117, "se": 0.731, "ts": 0.250, "map": 177.841, "obs": 4, "own": 102.288, "comp": {"cins": -0.4437, "dshield": 3.0154, "crowdsec": 0.3343, "vulncheck": 1.352, "blocklist_de": 2.3166}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.989, "det": {"threatfox": {"family:PureRAT": 9}, "vulncheck": {"c2_server": 4}, "blocklist_de": {"apache": 1, "bruteforcelogin": 1}}, "oid": "NL-828-ARIN", "org": "49.3 Networking LLC", "pdb": null, "pfx": 2, "reg": "2023-12-01", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 2, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00142708816278}, {"a": 400018, "h": "CLOUD", "n": "Africa cloud limited", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.091, "ts": null, "map": 0.194, "obs": 0, "own": 0.305, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.027, "ts": null, "map": 0.223, "obs": 0, "own": 0.155, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "ACL-1407-ARIN", "org": "Africa cloud limited", "pdb": null, "pfx": 2, "reg": "2021-09-07", "rir": "arin", "s24": 16, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 4096, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400175, "h": "MICROTRONIX-ESOLUTIONS", "n": "Microtronix ESolutions, LLC", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1722, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}}, "h2": [["2026-10-05", 0.328, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.068, "ts": null, "map": 0.193, "obs": 0, "own": 0.274, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 0.116, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.314, "det": {"shodan": {"compromised": 1}}, "oid": "MEL-128-ARIN", "org": "Microtronix ESolutions, LLC", "pdb": {"t": "Content", "sc": "North America", "tr": "200-300Gbps", "pol": "Open", "web": "https://www.microtronixdc.com"}, "pfx": 21, "reg": "2021-11-01", "rir": "arin", "s24": 30, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400212, "h": "VERGETEL-GROUP-LLC", "n": "VergeTel Group LLC", "t": "Transit & backbone", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 3.328, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 4.164, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.662, "det": {"shodan": {"compromised": 1}}, "oid": "VGL-154-ARIN", "org": "VergeTel Group LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.vergetelgroup.com"}, "pfx": 5, "reg": "2021-11-10", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2048, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400226, "h": "STORMYCLOUDINC", "n": "STORMYCLOUDINC", "t": "Hosting & VPS", "w": 17, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 17, "data_centre": 15, "web_exploit": 17, "bad_crawling": 17, "proxy_or_vpn": 17, "ssh_bruteforce": 17, "web_bruteforce": 17, "mail_bruteforce": 7, "cve:CVE-2015-9406": 8, "cve:CVE-2017-9841": 10, "cve:CVE-2018-20062": 16, "cve:CVE-2021-26086": 3, "cve:CVE-2021-41773": 3}, "n": 17}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 17, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 11.412, 0.011, 1, false], ["2026-10-12", 1.097, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.097, "se": 1.614, "ts": 1.000, "map": 15.860, "obs": 1, "own": 4.578, "comp": {"cins": -0.0435, "dshield": -0.1044, "crowdsec": 4.6629, "vulncheck": -0.1296, "blocklist_de": -0.228}, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.728, "det": {"blocklist_de": {"bots": 2, "apache": 1, "bruteforcelogin": 1}}, "oid": "STORM-17-ARIN", "org": "StormyCloud Inc", "pdb": {"t": "Non-Profit", "sc": "Not Disclosed", "tr": "1-5Gbps", "pol": "Open", "web": "https://stormycloud.org"}, "pfx": 2, "reg": "2021-11-15", "rir": "arin", "s24": 2, "sib": 0, "tor": 17, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400303, "h": "SYLVESTER-1", "n": "TruVista Communications", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"vulncheck": {"n": 1, "p": 0.1975, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.562, 0.011, 0, false], ["2026-10-12", 0.571, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.113, "ts": null, "map": 0.196, "obs": 0, "own": 0.891, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 0, "vulncheck": 1, "blocklist_de": 0}, "lo": 0.571, "se": 1.432, "ts": 1.000, "map": 5.994, "obs": 1, "own": 4.372, "comp": {"cins": -0.0574, "dshield": -0.1368, "crowdsec": -0.5421, "vulncheck": 4.221, "blocklist_de": -0.3003}, "mass": 0.3, "listed": false}}, "abq": false, "bot": null, "det": {"vulncheck": {"botnet_node": 2}}, "oid": "TRUVI-ARIN", "org": "TruVista Communications", "pdb": null, "pfx": 4, "reg": "2021-12-14", "rir": "arin", "s24": 7, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1792, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400304, "h": "SYNTEQ", "n": "Synteq", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1672, "hi": 4.41, "lo": 0.33, "ips": 1, "mean": 1.86, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.060, "ts": null, "map": 0.192, "obs": 0, "own": 0.264, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.934, "ts": null, "map": 0.200, "obs": 0, "own": 0.106, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.139, "det": {"shodan": {"compromised": 1}}, "oid": "RNL-50-ARIN", "org": "Redoubt Networks", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Selective", "web": "https://synteq.com"}, "pfx": 26, "reg": "2021-12-14", "rir": "arin", "s24": 36, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 9216, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400384, "h": "HOSTINGS-HOUSE-US", "n": "Hostings House", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.997, "det": null, "oid": "HHSL-3-ARIN", "org": "Hostings House", "pdb": null, "pfx": 7, "reg": "2022-01-19", "rir": "arin", "s24": 10, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400402, "h": "HOSTING-BOT", "n": "Hosting Bot", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1624, "hi": 4.35, "lo": 0.33, "ips": 1, "mean": 1.84, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.053, "ts": null, "map": 0.191, "obs": 0, "own": 0.256, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.915, "ts": null, "map": 0.194, "obs": 0, "own": 0.098, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.797, "det": {"shodan": {"compromised": 1}}, "oid": "HBL-93-ARIN", "org": "Hosting Bot, LLC", "pdb": {"t": "NSP", "sc": "Global", "tr": null, "pol": "Open", "web": "https://hostingbot.net"}, "pfx": 35, "reg": "2022-01-26", "rir": "arin", "s24": 42, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 10752, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400464, "h": "VMISS", "n": "VMISS", "t": "Transit & backbone", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.011, 0.011, 0, false], ["2026-10-12", 0.011, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 2.712, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 2.003, "ts": null, "map": 0.218, "obs": 0, "own": 2.237, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.578, "det": null, "oid": "VMISS-ARIN", "org": "VMISS Inc.", "pdb": {"t": "NSP", "sc": "Global", "tr": "5-10Gbps", "pol": "Open", "web": "https://www.vmiss.com/"}, "pfx": 21, "reg": "2022-02-16", "rir": "arin", "s24": 20, "sib": 1, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400506, "h": "BAIAS", "n": "Black Apple", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.012, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.119, "ts": null, "map": 0.196, "obs": 0, "own": 0.924, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.135, "ts": null, "map": 0.239, "obs": 0, "own": 0.697, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.861, "det": null, "oid": "BA-1161-ARIN", "org": "Black Apple", "pdb": null, "pfx": 5, "reg": "2022-03-03", "rir": "arin", "s24": 5, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1280, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400529, "h": "INFRALY-LLC", "n": "Infraly, LLC", "t": "Hosting & VPS", "w": 14, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 13, "data_centre": 6, "web_exploit": 13, "bad_crawling": 13, "web_bruteforce": 12, "cve:CVE-2024-0012": 8, "cve:CVE-2021-26294": 2, "cve:CVE-2021-43798": 3, "cve:CVE-2024-28000": 3, "cve:CVE-2026-21859": 3}, "n": 13}, "ev": {"dshield": {"n": 1, "p": 0.1925, "hi": 4.67, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 2, "p": 0.3751, "hi": 5.86, "lo": 0.76, "ips": 13, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 10.212, 0.011, 1, false], ["2026-10-12", 4.043, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.071, "ts": null, "map": 0.193, "obs": 0, "own": 0.278, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 4.043, "se": 0.773, "ts": 0.667, "map": 12.650, "obs": 3, "own": 2.524, "comp": {"cins": -0.4421, "dshield": 3.0224, "crowdsec": 4.2401, "vulncheck": -0.6304, "blocklist_de": -2.2588}, "mass": 2.0, "listed": false}}, "abq": false, "bot": 0.967, "det": null, "oid": "IL-860-ARIN", "org": "Infraly, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://infraly.co"}, "pfx": 28, "reg": "2022-03-16", "rir": "arin", "s24": 28, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400587, "h": "RYAMER", "n": "Ryamer", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 1, "bad_crawling": 1, "proxy_or_vpn": 2, "web_bruteforce": 2, "home_connection": 2, "cve:CVE-2024-28000": 1}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1935, "hi": 4.68, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "crowdsec": {"n": 1, "p": 0.1921, "hi": 4.67, "lo": 0.35, "ips": 2, "mean": 1.97, "above": false}}, "h2": [["2026-10-05", 0.664, 0.011, 0, false], ["2026-10-12", 0.725, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.116, "ts": null, "map": 0.196, "obs": 0, "own": 0.347, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.725, "se": 1.480, "ts": 1.000, "map": 8.523, "obs": 1, "own": 2.163, "comp": {"cins": -0.0697, "dshield": -0.1653, "crowdsec": 4.3301, "vulncheck": -0.1939, "blocklist_de": -0.3647}, "mass": 0.4, "listed": false}}, "abq": false, "bot": 0.331, "det": {"shodan": {"compromised": 1}}, "oid": "RL-877-ARIN", "org": "Ryamer, LLC", "pdb": {"t": "Network Services", "sc": "North America", "tr": "20-50Gbps", "pol": "Selective", "web": "https://ryamer.com"}, "pfx": 6, "reg": "2022-03-30", "rir": "arin", "s24": 6, "sib": 1, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1536, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00006188563632}, {"a": 400618, "h": "PRIME-SEC", "n": "PSC", "t": "Other", "w": 1, "cc": "US", "cf": null, "cs": {"c": {"ssh_bruteforce": 1}, "n": 1}, "ev": {"shodan": {"n": 1, "p": 0.1393, "hi": 4.10, "lo": 0.31, "ips": 1, "mean": 1.73, "above": false}, "crowdsec": {"n": 1, "p": 0.1275, "hi": 3.97, "lo": 0.30, "ips": 1, "mean": 1.68, "above": false}, "blocklist_de": {"n": 1, "p": 0.1667, "hi": 4.40, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}}, "h2": [["2026-10-12", 0.895, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.024, "ts": null, "map": 0.187, "obs": 0, "own": 0.590, "comp": null, "mass": 0.1, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 0.895, "se": 0.915, "ts": 0.500, "map": 3.639, "obs": 2, "own": 2.132, "comp": {"cins": -0.3399, "dshield": -0.7196, "crowdsec": 1.3197, "vulncheck": -0.5595, "blocklist_de": 2.9845}, "mass": 1.5, "listed": false}}, "abq": false, "bot": 0.463, "det": {"shodan": {"compromised": 1}, "blocklist_de": {"ssh": 1}}, "oid": "PSC-594-ARIN", "org": "Prime Security Corp.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://primesecuritycorp.com"}, "pfx": 86, "reg": "2022-04-11", "rir": "arin", "s24": 73, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 27904, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00406356366923}, {"a": 400619, "h": "AROSS-AS", "n": "AROSSCLOUD", "t": "Hosting & VPS", "w": 17, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 7, "bad_crawling": 2, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 5, "web_bruteforce": 7, "mail_bruteforce": 1, "cve:CVE-2020-5902": 1, "cve:CVE-2018-13379": 2, "cve:CVE-2018-20062": 3, "cve:CVE-2021-43798": 3, "cve:CVE-2026-63030": 4}, "n": 9}, "ev": {"cins": {"n": 1, "p": 0.0925, "hi": 3.57, "lo": 0.27, "ips": 1, "mean": 1.50, "above": false}, "shodan": {"n": 10, "p": 0.8166, "hi": 6.37, "lo": 2.32, "ips": 10, "mean": 4.13, "above": true}, "crowdsec": {"n": 8, "p": 0.4281, "hi": 4.70, "lo": 1.53, "ips": 9, "mean": 2.93, "above": false}, "threatfox": {"n": 4, "p": 0.7518, "hi": 8.18, "lo": 1.76, "ips": 5, "mean": 4.47, "above": false}, "phishing_db": {"n": 2, "p": 0.2180, "hi": 4.56, "lo": 0.59, "ips": 2, "mean": 2.17, "above": false}, "blocklist_de": {"n": 1, "p": 0.0265, "hi": 2.59, "lo": 0.19, "ips": 1, "mean": 1.09, "above": false}}, "h2": [["2026-10-05", 1.509, 1.201, 0, false], ["2026-10-12", 1.155, 1.187, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 2}, "lo": 1.187, "se": 0.904, "ts": 0.667, "map": 3.113, "obs": 6, "own": 1.238, "comp": {"urlhaus": -1.1064, "threatfox": 2.9058, "phishing_db": 0.9625}, "mass": 3.6, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 8, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.155, "se": 0.489, "ts": 0.800, "map": 2.135, "obs": 10, "own": 0.421, "comp": {"cins": 1.9339, "dshield": -2.1921, "crowdsec": 7.4408, "vulncheck": -0.8993, "blocklist_de": -4.1311}, "mass": 9.3, "listed": false}}, "abq": false, "bot": 0.904, "det": {"shodan": {"compromised": 10}, "threatfox": {"family:DCRat": 2, "family:AdaptixC2": 1, "family:Cobalt Strike": 2}, "blocklist_de": {"ssh": 1}}, "oid": "AROSS-1-ARIN", "org": "AROSSCLOUD INC.", "pdb": {"t": null, "sc": "Not Disclosed", "tr": null, "pol": null, "web": "https://www.arosscloud.com/"}, "pfx": 352, "reg": "2022-04-11", "rir": "arin", "s24": 779, "sib": 0, "tor": 0, "w24": 14, "drop": 1, "hist": [["2026-10-05", 0.0549], ["2026-10-12", 0.0690]], "ipv4": 199680, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00072798984318}, {"a": 400754, "h": "GO-DADDY-COM-LLC", "n": "GoDaddy.com, LLC", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"phishing_db": {"n": 1, "p": 0.1787, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 0.009, 2.792, 0, false], ["2026-10-12", 0.011, 0.487, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 0, "phishing_db": 1}, "lo": 0.487, "se": 1.555, "ts": 1.000, "map": 5.088, "obs": 1, "own": 2.333, "comp": {"urlhaus": -0.1027, "threatfox": -0.1296, "phishing_db": 3.4853}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.956, "ts": null, "map": 0.206, "obs": 0, "own": 0.116, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": null, "oid": "GODAD-ARIN", "org": "GoDaddy.com, LLC", "pdb": null, "pfx": 13, "reg": "2022-05-27", "rir": "arin", "s24": 98, "sib": 42, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 25088, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 400810, "h": "BREEZETECH", "n": "BreezeHost.io", "t": "Hosting & VPS", "w": 8, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 5, "data_centre": 4, "web_exploit": 6, "bad_crawling": 6, "ssh_bruteforce": 1, "web_bruteforce": 6, "cve:CVE-2024-0012": 2, "cve:CVE-2021-43798": 3, "cve:CVE-2024-28000": 2}, "n": 7}, "ev": {"shodan": {"n": 5, "p": 0.8933, "hi": 9.82, "lo": 2.44, "ips": 5, "mean": 5.60, "above": true}, "crowdsec": {"n": 3, "p": 0.5885, "hi": 7.13, "lo": 1.26, "ips": 7, "mean": 3.68, "above": false}, "vulncheck": {"n": 1, "p": 0.1915, "hi": 4.66, "lo": 0.35, "ips": 1, "mean": 1.97, "above": false}, "blocklist_de": {"n": 1, "p": 0.1839, "hi": 4.58, "lo": 0.34, "ips": 1, "mean": 1.93, "above": false}}, "h2": [["2026-10-05", 10.037, 0.011, 1, false], ["2026-10-12", 7.480, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.064, "ts": null, "map": 0.192, "obs": 0, "own": 0.269, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 1, "blocklist_de": 1}, "lo": 7.480, "se": 0.630, "ts": 0.600, "map": 18.011, "obs": 5, "own": 3.576, "comp": {"cins": -0.6952, "dshield": -1.2899, "crowdsec": 4.8804, "vulncheck": 0.6552, "blocklist_de": 0.7341}, "mass": 3.3, "listed": false}}, "abq": false, "bot": 0.847, "det": {"shodan": {"c2": 4, "compromised": 1}, "vulncheck": {"attack_tooling": 1}, "blocklist_de": {"ssh": 1}}, "oid": "BREEZ-7-ARIN", "org": "BreezeHost", "pdb": {"t": "Enterprise", "sc": "North America", "tr": null, "pol": "Open", "web": "https://breezehost.io"}, "pfx": 31, "reg": "2022-11-14", "rir": "arin", "s24": 33, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0690]], "ipv4": 8704, "abuse": null, "score": 0.0690, "groups": ["shodan"], "sensors": [], "traffic": 0.00001278950579}, {"a": 400897, "h": "PETROSKY", "n": "PETROSKY CLOUD LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"threatfox": {"n": 2, "p": 0.4221, "hi": 6.29, "lo": 0.82, "ips": 2, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 0.458, 14.151, 1, false], ["2026-10-12", 0.012, 5.295, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 2, "phishing_db": 0}, "lo": 5.295, "se": 1.206, "ts": 1.000, "map": 28.914, "obs": 2, "own": 10.665, "comp": {"urlhaus": -0.2069, "threatfox": 5.6032, "phishing_db": -0.4057}, "mass": 0.4, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.065, "ts": null, "map": 0.230, "obs": 0, "own": 0.181, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:PureRAT": 1, "family:AsyncRAT": 1}}, "oid": "PCL-365-ARIN", "org": "PETROSKY CLOUD LLC", "pdb": null, "pfx": 7, "reg": "2023-09-29", "rir": "arin", "s24": 11, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 3328, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00039492449659}, {"a": 400940, "h": "RAILWAY", "n": "Railway", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": {"rb": "hi", "wb": "", "rep": 0.87, "waf": 2.04}, "cs": {"c": {"http_flood": 1, "bad_crawling": 2, "web_bruteforce": 1}, "n": 2}, "ev": {"crowdsec": {"n": 2, "p": 0.3734, "hi": 5.85, "lo": 0.76, "ips": 2, "mean": 2.79, "above": false}}, "h2": [["2026-10-05", 3.676, 0.011, 0, false], ["2026-10-12", 1.706, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.069, "ts": null, "map": 0.193, "obs": 0, "own": 0.276, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 1.706, "se": 0.948, "ts": 1.000, "map": 7.451, "obs": 2, "own": 1.524, "comp": {"cins": -0.2805, "dshield": -0.6081, "crowdsec": 6.2457, "vulncheck": -0.5072, "blocklist_de": -1.4479}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.614, "det": null, "oid": "RC-1550-ARIN", "org": "Railway", "pdb": {"t": "Content", "sc": "Global", "tr": null, "pol": "Open", "web": "https://railway.com"}, "pfx": 12, "reg": "2024-02-17", "rir": "arin", "s24": 29, "sib": 1, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7680, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.08402}, {"a": 400992, "h": "ZHOUYISAT-COMMUNICATIONS", "n": "ZhouyiSat Communications", "t": "Broadband & mobile", "w": 4, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "data_centre": 1, "web_exploit": 1, "bad_crawling": 1}, "n": 1}, "ev": {"shodan": {"n": 2, "p": 0.3644, "hi": 5.77, "lo": 0.75, "ips": 2, "mean": 2.75, "above": false}, "crowdsec": {"n": 1, "p": 0.1535, "hi": 4.26, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "threatfox": {"n": 1, "p": 0.1962, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "vulncheck": {"n": 1, "p": 0.1893, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}, "blocklist_de": {"n": 1, "p": 0.1794, "hi": 4.53, "lo": 0.34, "ips": 1, "mean": 1.91, "above": false}}, "h2": [["2026-10-05", 5.025, 0.011, 0, false], ["2026-10-12", 2.418, 0.413, 0, false]], "sh": true, "uc": 451.4, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.413, "se": 1.519, "ts": 1.000, "map": 3.952, "obs": 1, "own": 11.663, "comp": {"urlhaus": -0.114, "threatfox": 3.3706, "phishing_db": -0.2562}, "mass": 0.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 1, "blocklist_de": 1}, "lo": 2.418, "se": 0.785, "ts": 0.333, "map": 7.568, "obs": 3, "own": 12.104, "comp": {"cins": -0.4095, "dshield": -0.8435, "crowdsec": 0.6505, "vulncheck": 1.484, "blocklist_de": 2.5361}, "mass": 1.9, "listed": false}}, "abq": false, "bot": 0.535, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"mail": 1}}, "oid": "ZCRI-ARIN", "org": "ZhouyiSat Communications", "pdb": {"t": "Cable/DSL/ISP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "http://zhouyitelecom.org"}, "pfx": 44, "reg": "2024-04-15", "rir": "arin", "s24": 43, "sib": 0, "tor": 0, "w24": 4, "drop": 6, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 12032, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00009871122921}, {"a": 401142, "h": "ACERDP", "n": "AceRDP LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.731, "det": null, "oid": "AL-3160-ARIN", "org": "AceRDP LLC", "pdb": null, "pfx": 2, "reg": "2026-09-22", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 2, "hist": [["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401307, "h": "MISEN-ASN-1", "n": "Michigan Statewide Educational Network", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1561, "hi": 4.29, "lo": 0.32, "ips": 1, "mean": 1.81, "above": false}}, "h2": [["2026-10-05", 0.010, 0.011, 0, false], ["2026-10-12", 0.010, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.044, "ts": null, "map": 0.190, "obs": 0, "own": 0.644, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.010, "se": 1.893, "ts": null, "map": 0.188, "obs": 0, "own": 0.258, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.258, "det": {"shodan": {"malware": 1}}, "oid": "MSEN-1-ARIN", "org": "Michigan Statewide Educational Network", "pdb": null, "pfx": 40, "reg": "2021-06-14", "rir": "arin", "s24": 50, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 15104, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401322, "h": "LUCK-NETO-01", "n": "NetO Corp", "t": "Hosting & VPS", "w": 1, "cc": "US", "cf": null, "cs": null, "ev": {"threatfox": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.011, 0.449, 0, false], ["2026-10-12", 0.011, 0.464, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.464, "se": 1.545, "ts": 1.000, "map": 4.724, "obs": 1, "own": 2.172, "comp": {"urlhaus": -0.0987, "threatfox": 3.5048, "phishing_db": -0.2273}, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.952, "ts": null, "map": 0.205, "obs": 0, "own": 0.114, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": null, "det": {"threatfox": {"family:DanaBot": 1}}, "oid": "NC-1197-ARIN", "org": "NetO Corp", "pdb": {"t": "Content", "sc": "Global", "tr": "10-20Tbps", "pol": "Open", "web": "https://www.neto-x.com/"}, "pfx": 30, "reg": "2024-08-15", "rir": "arin", "s24": 31, "sib": 2, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7936, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00245121031831}, {"a": 401362, "h": "HOST4NERD", "n": "Host4nerd", "t": "Hosting & VPS", "w": 5, "cc": "US", "cf": null, "cs": null, "ev": {"threatfox": {"n": 4, "p": 0.8128, "hi": 9.11, "lo": 1.96, "ips": 5, "mean": 4.98, "above": true}}, "h2": [["2026-10-05", 0.009, 14.047, 1, false], ["2026-10-12", 0.011, 9.972, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 4, "phishing_db": 0}, "lo": 9.972, "se": 0.918, "ts": 1.000, "map": 29.964, "obs": 4, "own": 10.615, "comp": {"urlhaus": -0.5522, "threatfox": 6.3129, "phishing_db": -0.7345}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.011, "se": 1.948, "ts": null, "map": 0.204, "obs": 0, "own": 0.113, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.460, "det": {"threatfox": {"family:DanaBot": 5}}, "oid": "HL-723-ARIN", "org": "HOST4NERD LLC", "pdb": {"t": "Content", "sc": "Not Disclosed", "tr": "10-20Gbps", "pol": "Open", "web": "https://host4nerd.com"}, "pfx": 32, "reg": "2024-10-01", "rir": "arin", "s24": 32, "sib": 0, "tor": 0, "w24": 4, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 8192, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": null}, {"a": 401401, "h": "UNREDACTED-NOISENET", "n": "Unredacted Inc (NoiseNet)", "t": "Transit & backbone", "w": 123, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 114, "web_exploit": 120, "bad_crawling": 87, "proxy_or_vpn": 123, "web_bruteforce": 123, "mail_bruteforce": 15, "cve:CVE-2018-20062": 84, "cve:CVE-2021-41773": 37, "cve:CVE-2021-43798": 23, "cve:CVE-2021-44228": 25, "cve:CVE-2024-28000": 36}, "n": 123}, "ev": {"crowdsec": {"n": 1, "p": 0.1968, "hi": 4.72, "lo": 0.35, "ips": 123, "mean": 1.99, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 17.951, 0.012, 1, false], ["2026-10-12", 12.714, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 3.510, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 1}, "lo": 12.714, "se": 1.097, "ts": 0.500, "map": 74.193, "obs": 2, "own": 248.836, "comp": {"cins": -0.1965, "dshield": -0.441, "crowdsec": 2.8289, "vulncheck": -0.4128, "blocklist_de": 3.9217}, "mass": 0.9, "listed": false}}, "abq": false, "bot": 0.663, "det": {"blocklist_de": {"bots": 2}}, "oid": "UNRED-ARIN", "org": "Unredacted Inc", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://unredacted.org/"}, "pfx": 2, "reg": "2024-10-10", "rir": "arin", "s24": 2, "sib": 1, "tor": 123, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401418, "h": "GLOBAL-PEERING-ALLIANCE", "n": "GLOBAL PEERING ALLIANCE", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1898, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.96, "above": false}}, "h2": [["2026-10-12", 0.012, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.105, "ts": null, "map": 0.195, "obs": 0, "own": 0.327, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.012, "se": 2.074, "ts": null, "map": 0.231, "obs": 0, "own": 0.188, "comp": null, "mass": 0.1, "listed": false}}, "abq": false, "bot": 0.535, "det": {"shodan": {"compromised": 1}}, "oid": "IM-641-ARIN", "org": "Red Team LTD", "pdb": {"t": "Network Services", "sc": "Global", "tr": null, "pol": "Open", "web": "https://redteam.net/"}, "pfx": 10, "reg": "2024-10-21", "rir": "arin", "s24": 10, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 2560, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.000586844931}, {"a": 401443, "h": "WAP-AC", "n": "WAP.AC LLC", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 3, "data_centre": 1, "web_exploit": 3, "bad_crawling": 2, "ssh_bruteforce": 3, "web_bruteforce": 3, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-20062": 3}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1958, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "crowdsec": {"n": 3, "p": 0.6151, "hi": 7.40, "lo": 1.30, "ips": 3, "mean": 3.82, "above": false}}, "h2": [["2026-10-12", 10.814, 0.012, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.012, "se": 2.087, "ts": null, "map": 0.194, "obs": 0, "own": 1.941, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 0}, "lo": 10.814, "se": 0.685, "ts": 0.750, "map": 28.598, "obs": 4, "own": 44.424, "comp": {"cins": 3.8989, "dshield": -1.1737, "crowdsec": 5.8453, "vulncheck": -0.7151, "blocklist_de": -3.1084}, "mass": 2.9, "listed": false}}, "abq": false, "bot": 0.379, "det": null, "oid": "WL-758-ARIN", "org": "WAP.AC LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "Global", "tr": "300-500Gbps", "pol": "Open", "web": "https://wap.ac"}, "pfx": 16, "reg": "2024-10-24", "rir": "arin", "s24": 18, "sib": 0, "tor": 0, "w24": 3, "drop": 0, "hist": [["2026-10-12", 0.0012]], "ipv4": 4608, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00299924378183}, {"a": 401479, "h": "DBM-ASN-KC", "n": "Database Mart LLC", "t": "Other", "w": 2, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 2, "web_exploit": 2, "bad_crawling": 2}, "n": 2}, "ev": {"shodan": {"n": 1, "p": 0.1808, "hi": 4.55, "lo": 0.34, "ips": 1, "mean": 1.92, "above": false}, "crowdsec": {"n": 2, "p": 0.3884, "hi": 5.98, "lo": 0.78, "ips": 2, "mean": 2.85, "above": false}}, "h2": [["2026-10-05", 2.124, 0.011, 0, false], ["2026-10-12", 2.271, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.084, "ts": null, "map": 0.194, "obs": 0, "own": 0.769, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 2, "vulncheck": 0, "blocklist_de": 0}, "lo": 2.271, "se": 0.964, "ts": 1.000, "map": 10.224, "obs": 2, "own": 6.015, "comp": {"cins": -0.2663, "dshield": -0.5807, "crowdsec": 6.4347, "vulncheck": -0.4932, "blocklist_de": -1.376}, "mass": 1.2, "listed": false}}, "abq": false, "bot": 0.945, "det": {"shodan": {"compromised": 1}}, "oid": "DML-132-ARIN", "org": "Database Mart LLC", "pdb": null, "pfx": 10, "reg": "2024-11-07", "rir": "arin", "s24": 20, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 7168, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401560, "h": "ONECABLE", "n": "ONECABLE", "t": "Broadband & mobile", "w": 3, "cc": "US", "cf": {"rb": "", "wb": "", "rep": 6.36, "waf": 3.62}, "cs": {"c": {"http_flood": 3}, "n": 3}, "ev": {"crowdsec": {"n": 1, "p": 0.1755, "hi": 4.49, "lo": 0.34, "ips": 3, "mean": 1.89, "above": false}}, "h2": [["2026-10-05", 5.275, 0.011, 0, false], ["2026-10-12", 0.404, 0.012, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.012, "se": 2.082, "ts": null, "map": 0.194, "obs": 0, "own": 1.892, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 0.404, "se": 1.344, "ts": 1.000, "map": 3.728, "obs": 1, "own": 6.806, "comp": {"cins": -0.1059, "dshield": -0.247, "crowdsec": 3.8844, "vulncheck": -0.2695, "blocklist_de": -0.5525}, "mass": 0.5, "listed": false}}, "abq": false, "bot": 0.525, "det": null, "oid": "ONL-40-ARIN", "org": "OneCable Network LLC", "pdb": {"t": "Cable/DSL/ISP", "sc": "North America", "tr": "20-50Gbps", "pol": "Open", "web": "https://www.onecablenetwork.com"}, "pfx": 21, "reg": "2025-01-03", "rir": "arin", "s24": 21, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 5376, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.068254}, {"a": 401626, "h": "NETIFACE-TORONTO", "n": "Netiface America, Inc.", "t": "Other", "w": 97, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 36, "web_exploit": 40, "bad_crawling": 29, "proxy_or_vpn": 2, "first_seen_30d": 9, "ssh_bruteforce": 6, "web_bruteforce": 28, "mail_bruteforce": 8, "cve:CVE-2017-9841": 5, "cve:CVE-2017-16894": 5, "cve:CVE-2019-17050": 5, "cve:CVE-2021-41714": 3, "cve:CVE-2026-63030": 6}, "n": 81}, "ev": {"cins": {"n": 1, "p": 0.1984, "hi": 4.74, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}, "dshield": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 2, "mean": 2.00, "above": false}, "urlhaus": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 1, "mean": 2.00, "above": false}, "crowdsec": {"n": 4, "p": 0.8099, "hi": 9.06, "lo": 1.95, "ips": 81, "mean": 4.95, "above": true}, "threatfox": {"n": 3, "p": 0.6468, "hi": 7.75, "lo": 1.37, "ips": 7, "mean": 4.00, "above": false}, "blocklist_de": {"n": 2, "p": 0.4203, "hi": 6.27, "lo": 0.81, "ips": 8, "mean": 2.99, "above": false}}, "h2": [["2026-10-05", 104.405, 402.900, 1, false], ["2026-10-12", 138.754, 74.217, 1, false]], "sh": true, "uc": 19726.6, "v2": {"band": 1, "host": {"n": {"urlhaus": 1, "threatfox": 3, "phishing_db": 0}, "lo": 74.217, "se": 0.936, "ts": 0.750, "map": 242.171, "obs": 4, "own": 213.145, "comp": {"urlhaus": 3.2472, "threatfox": 4.6062, "phishing_db": -0.7375}, "mass": 1.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 4, "vulncheck": 0, "blocklist_de": 2}, "lo": 138.754, "se": 0.526, "ts": 0.500, "map": 279.462, "obs": 8, "own": 156.470, "comp": {"cins": 2.7375, "dshield": 0.7032, "crowdsec": 2.8241, "vulncheck": -0.8513, "blocklist_de": 1.6131}, "mass": 6.2, "listed": false}}, "abq": false, "bot": 0.963, "det": {"shodan": {"malware": 1}, "threatfox": {"family:Remcos": 3, "family:AsyncRAT": 4}, "blocklist_de": {"ssh": 4, "imap": 1, "mail": 1, "apache": 3, "bruteforcelogin": 3}}, "oid": "NA-520-ARIN", "org": "Netiface America, Inc.", "pdb": null, "pfx": 4, "reg": "2025-01-17", "rir": "arin", "s24": 4, "sib": 0, "tor": 0, "w24": 4, "drop": 3, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": ["crowdsec"], "traffic": 0.00098255196097}, {"a": 401650, "h": "VL", "n": "888 Ventures LLC", "t": "Other", "w": 23, "cc": "US", "cf": null, "cs": null, "ev": {"threatfox": {"n": 8, "p": 0.9958, "hi": 14.21, "lo": 4.62, "ips": 23, "mean": 8.86, "above": true}}, "h2": [["2026-10-05", 0.009, 12.651, 1, false], ["2026-10-12", 0.009, 9.000, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 8, "phishing_db": 0}, "lo": 9.000, "se": 0.811, "ts": 1.000, "map": 21.512, "obs": 8, "own": 19.907, "comp": {"urlhaus": -1.0553, "threatfox": 6.7058, "phishing_db": -0.9557}, "mass": 2.9, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.009, "se": 1.798, "ts": null, "map": 0.154, "obs": 0, "own": 0.172, "comp": null, "mass": 0.2, "listed": false}}, "abq": false, "bot": 0.656, "det": {"threatfox": {"family:DanaBot": 23}}, "oid": "VL-455-ARIN", "org": "888 Ventures LLC", "pdb": null, "pfx": 105, "reg": "2025-04-10", "rir": "arin", "s24": 105, "sib": 0, "tor": 0, "w24": 8, "drop": 0, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.1060]], "ipv4": 26880, "abuse": null, "score": 0.1060, "groups": ["abusech"], "sensors": [], "traffic": null}, {"a": 401661, "h": "EMBNEX-AS", "n": "EMBNEX, LLC", "t": "Hosting & VPS", "w": 2, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1988, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "blocklist_de": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.889, 0.011, 0, false], ["2026-10-12", 13.766, 0.013, 1, false]], "sh": false, "uc": 13085.9, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.381, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 13.766, "se": 1.106, "ts": 0.500, "map": 80.972, "obs": 2, "own": 17.120, "comp": {"cins": 4.77, "dshield": -0.476, "crowdsec": -1.881, "vulncheck": -0.4344, "blocklist_de": 3.8091}, "mass": 1.0, "listed": false}}, "abq": false, "bot": 0.804, "det": {"blocklist_de": {"ssh": 1}}, "oid": "EL-1179-ARIN", "org": "EMBNEX, LLC", "pdb": {"t": "Content", "sc": "Global", "tr": "1-5Tbps", "pol": "Open", "web": "https://www.embnex.com/"}, "pfx": 2, "reg": "2025-04-14", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401665, "h": "HOSTBILBY", "n": "HostBilby Inc.", "t": "Hosting & VPS", "w": 0, "cc": "CA", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1954, "hi": 4.70, "lo": 0.35, "ips": 1, "mean": 1.98, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.362, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.261, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.959, "det": {"shodan": {"compromised": 1}}, "oid": "HOSTB-7-ARIN", "org": "HostBilby Inc.", "pdb": {"t": "NSP", "sc": "Not Disclosed", "tr": null, "pol": "Open", "web": "https://www.hostbilby.com"}, "pfx": 4, "reg": "2025-04-14", "rir": "arin", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401696, "h": "COGNETCLOUD", "n": "cognetcloud INC", "t": "Hosting & VPS", "w": 45, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 8, "web_exploit": 10, "bad_crawling": 6, "proxy_or_vpn": 2, "first_seen_30d": 3, "ssh_bruteforce": 6, "web_bruteforce": 8, "mail_bruteforce": 7, "cve:CVE-2018-20062": 1, "cve:CVE-2021-44228": 1, "cve:CVE-2022-22965": 1, "cve:CVE-2025-22457": 1, "cve:CVE-2026-75650": 1}, "n": 21}, "ev": {"cins": {"n": 2, "p": 0.3728, "hi": 5.84, "lo": 0.76, "ips": 2, "mean": 2.78, "above": false}, "shodan": {"n": 21, "p": 1.0000, "hi": 21.67, "lo": 10.67, "ips": 21, "mean": 15.77, "above": true}, "crowdsec": {"n": 17, "p": 1.0000, "hi": 17.09, "lo": 7.80, "ips": 21, "mean": 12.07, "above": true}, "threatfox": {"n": 10, "p": 0.9996, "hi": 16.49, "lo": 6.00, "ips": 11, "mean": 10.70, "above": true}, "vulncheck": {"n": 6, "p": 0.9496, "hi": 10.79, "lo": 2.99, "ips": 6, "mean": 6.38, "above": true}, "phishing_db": {"n": 4, "p": 0.7678, "hi": 8.39, "lo": 1.81, "ips": 4, "mean": 4.59, "above": false}, "blocklist_de": {"n": 4, "p": 0.7074, "hi": 7.64, "lo": 1.64, "ips": 4, "mean": 4.17, "above": false}}, "h2": [["2026-10-05", 11.120, 13.842, 1, false], ["2026-10-12", 13.199, 10.351, 1, false]], "sh": true, "uc": null, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 10, "phishing_db": 4}, "lo": 10.351, "se": 0.763, "ts": 0.714, "map": 22.418, "obs": 14, "own": 7.876, "comp": {"urlhaus": -1.5205, "threatfox": 4.8429, "phishing_db": 1.4137}, "mass": 5.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 2, "dshield": 0, "crowdsec": 17, "vulncheck": 6, "blocklist_de": 4}, "lo": 13.199, "se": 0.406, "ts": 0.586, "map": 21.346, "obs": 29, "own": 4.167, "comp": {"cins": 2.2479, "dshield": -2.8292, "crowdsec": 7.3957, "vulncheck": 0.6723, "blocklist_de": -3.0321}, "mass": 21.8, "listed": false}}, "abq": false, "bot": 0.908, "det": {"shodan": {"c2": 2, "compromised": 19}, "threatfox": {"family:PureRAT": 2, "family:AdaptixC2": 3, "family:Cobalt Strike": 5, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 4, "attack_tooling": 2}, "blocklist_de": {"ftp": 1, "ssh": 2, "imap": 1, "mail": 1}}, "oid": "COGNE-7-ARIN", "org": "cognetcloud INC", "pdb": null, "pfx": 46, "reg": "2025-04-18", "rir": "arin", "s24": 185, "sib": 1, "tor": 0, "w24": 35, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.9980]], "ipv4": 50944, "abuse": null, "score": 0.9980, "groups": ["vulncheck", "abusech", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00248265304172}, {"a": 401701, "h": "COGNETCLOUD-2", "n": "cognetcloud INC", "t": "Hosting & VPS", "w": 30, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 4, "web_exploit": 8, "bad_crawling": 2, "proxy_or_vpn": 1, "first_seen_30d": 5, "ssh_bruteforce": 9, "web_bruteforce": 7, "mail_bruteforce": 4, "cve:CVE-2014-8739": 1, "cve:CVE-2017-9841": 3, "cve:CVE-2019-9082": 3, "cve:CVE-2018-20062": 4, "cve:CVE-2024-28000": 1}, "n": 15}, "ev": {"cins": {"n": 1, "p": 0.1603, "hi": 4.33, "lo": 0.32, "ips": 1, "mean": 1.83, "above": false}, "shodan": {"n": 40, "p": 1.0000, "hi": 35.11, "lo": 20.95, "ips": 40, "mean": 27.65, "above": true}, "crowdsec": {"n": 15, "p": 1.0000, "hi": 14.43, "lo": 6.27, "ips": 15, "mean": 10.00, "above": true}, "threatfox": {"n": 10, "p": 0.9996, "hi": 16.39, "lo": 5.96, "ips": 12, "mean": 10.63, "above": true}, "vulncheck": {"n": 1, "p": 0.1520, "hi": 4.24, "lo": 0.32, "ips": 1, "mean": 1.79, "above": false}, "phishing_db": {"n": 1, "p": 0.1548, "hi": 4.27, "lo": 0.32, "ips": 1, "mean": 1.80, "above": false}, "blocklist_de": {"n": 4, "p": 0.6821, "hi": 7.37, "lo": 1.59, "ips": 4, "mean": 4.03, "above": false}}, "h2": [["2026-10-05", 7.640, 14.354, 1, false], ["2026-10-12", 8.715, 6.586, 0, false]], "sh": true, "uc": 85.9, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 10, "phishing_db": 1}, "lo": 6.586, "se": 0.793, "ts": 0.909, "map": 14.813, "obs": 11, "own": 5.327, "comp": {"urlhaus": -1.3505, "threatfox": 5.959, "phishing_db": -0.2869}, "mass": 4.4, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 15, "vulncheck": 1, "blocklist_de": 4}, "lo": 8.715, "se": 0.420, "ts": 0.714, "map": 14.445, "obs": 21, "own": 2.823, "comp": {"cins": 0.354, "dshield": -2.7091, "crowdsec": 8.2734, "vulncheck": -0.627, "blocklist_de": -1.2273}, "mass": 18.0, "listed": false}}, "abq": false, "bot": 0.915, "det": {"shodan": {"c2": 16, "compromised": 24}, "threatfox": {"family:VShell": 1, "family:AsyncRAT": 1, "family:AdaptixC2": 4, "family:Cobalt Strike": 5, "family:Unknown malware": 1}, "vulncheck": {"c2_server": 1}, "blocklist_de": {"ssh": 3, "imap": 1, "mail": 1}}, "oid": "COGNE-7-ARIN", "org": "cognetcloud INC", "pdb": null, "pfx": 139, "reg": "2025-04-21", "rir": "arin", "s24": 226, "sib": 1, "tor": 0, "w24": 28, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 120576, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": ["crowdsec"], "traffic": 0.00333597227914}, {"a": 401707, "h": "ARPHOST", "n": "ARPHOST", "t": "Hosting & VPS", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1963, "hi": 4.71, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.126, "ts": null, "map": 0.196, "obs": 0, "own": 0.370, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.171, "ts": null, "map": 0.243, "obs": 0, "own": 0.286, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.970, "det": {"shodan": {"compromised": 1}}, "oid": "AL-3115-ARIN", "org": "ARPHost, LLC", "pdb": {"t": "NSP", "sc": "North America", "tr": "1-5Gbps", "pol": "Open", "web": "https://arphost.com"}, "pfx": 3, "reg": "2025-05-14", "rir": "arin", "s24": 3, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 768, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401739, "h": "REDLUFF-NET01", "n": "RedLuff, LLC", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.013, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.131, "ts": null, "map": 0.196, "obs": 0, "own": 0.995, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.195, "ts": null, "map": 0.245, "obs": 0, "own": 0.919, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.886, "det": null, "oid": "RL-925-ARIN", "org": "RedLuff, LLC", "pdb": null, "pfx": 2, "reg": "2025-05-21", "rir": "arin", "s24": 2, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 512, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 401783, "h": "TOKALA-COMMUNICATIONS", "n": "TOKALA COMMUNICATIONS INC.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.006, 0.009, 0, false], ["2026-10-12", 0.006, 0.010, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.010, "se": 1.886, "ts": null, "map": 0.151, "obs": 0, "own": 0.327, "comp": null, "mass": 0.2, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.006, "se": 1.585, "ts": null, "map": 0.077, "obs": 0, "own": 0.063, "comp": null, "mass": 0.3, "listed": false}}, "abq": false, "bot": 0.396, "det": null, "oid": "TC-2348-ARIN", "org": "TOKALA COMMUNICATIONS INC.", "pdb": null, "pfx": 422, "reg": "2025-06-27", "rir": "arin", "s24": 535, "sib": 0, "tor": 0, "w24": 0, "drop": 1, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 136960, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": 0.00059163532716}, {"a": 402075, "h": "PEEKABO", "n": "Peekabo Networks", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {}, "h2": [["2026-10-05", 0.012, 0.011, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": true, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.123, "ts": null, "map": 0.196, "obs": 0, "own": 0.943, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.151, "ts": null, "map": 0.241, "obs": 0, "own": 0.750, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.855, "det": null, "oid": "SGL-201-ARIN", "org": "Peekabo Networks", "pdb": null, "pfx": 4, "reg": "2025-10-08", "rir": "arin", "s24": 4, "sib": 1, "tor": 0, "w24": 0, "drop": 4, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 1024, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 402169, "h": "USCLOUD INC", "n": "Uscloud Inc", "t": "Hosting & VPS", "w": 3, "cc": "US", "cf": null, "cs": null, "ev": {"cins": {"n": 1, "p": 0.1725, "hi": 4.46, "lo": 0.33, "ips": 1, "mean": 1.88, "above": false}, "shodan": {"n": 2, "p": 0.2438, "hi": 4.77, "lo": 0.62, "ips": 2, "mean": 2.27, "above": false}, "dshield": {"n": 1, "p": 0.1657, "hi": 4.39, "lo": 0.33, "ips": 1, "mean": 1.85, "above": false}, "threatfox": {"n": 1, "p": 0.1891, "hi": 4.64, "lo": 0.35, "ips": 1, "mean": 1.95, "above": false}, "blocklist_de": {"n": 1, "p": 0.1378, "hi": 4.09, "lo": 0.31, "ips": 1, "mean": 1.72, "above": false}}, "h2": [["2026-10-05", 0.108, 0.233, 0, false], ["2026-10-12", 1.110, 0.243, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 1, "phishing_db": 0}, "lo": 0.243, "se": 1.434, "ts": 1.000, "map": 1.894, "obs": 1, "own": 0.864, "comp": {"urlhaus": -0.1861, "threatfox": 2.8266, "phishing_db": -0.3757}, "mass": 0.5, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 1, "crowdsec": 0, "vulncheck": 0, "blocklist_de": 1}, "lo": 1.110, "se": 0.747, "ts": 0.333, "map": 3.283, "obs": 3, "own": 0.657, "comp": {"cins": 3.9493, "dshield": 2.4335, "crowdsec": -4.4744, "vulncheck": -0.7056, "blocklist_de": 1.3795}, "mass": 2.8, "listed": false}}, "abq": false, "bot": 0.865, "det": {"shodan": {"compromised": 2}, "threatfox": {"family:AdaptixC2": 1}, "blocklist_de": {"ssh": 1}}, "oid": "USCLO-ARIN", "org": "Uscloud Inc", "pdb": null, "pfx": 24, "reg": "2026-01-30", "rir": "arin", "s24": 150, "sib": 0, "tor": 0, "w24": 2, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 39424, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 402226, "h": "ONLYSCANS", "n": "OnlyScans LLC", "t": "Other", "w": 3, "cc": "US", "cf": null, "cs": {"c": {"http_flood": 1, "web_exploit": 3, "bad_crawling": 3, "ssh_bruteforce": 3, "web_bruteforce": 1, "home_connection": 2}, "n": 3}, "ev": {"cins": {"n": 1, "p": 0.1990, "hi": 4.74, "lo": 0.36, "ips": 2, "mean": 2.00, "above": false}, "crowdsec": {"n": 1, "p": 0.1980, "hi": 4.73, "lo": 0.35, "ips": 3, "mean": 1.99, "above": false}}, "h2": [["2026-10-05", 18.137, 0.012, 1, false], ["2026-10-12", 20.312, 0.013, 1, false]], "sh": false, "uc": null, "v2": {"band": 1, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": {"cins": 1, "dshield": 0, "crowdsec": 1, "vulncheck": 0, "blocklist_de": 0}, "lo": 20.312, "se": 1.147, "ts": 0.500, "map": 130.482, "obs": 2, "own": 79.978, "comp": {"cins": 4.8566, "dshield": -0.3936, "crowdsec": 3.0863, "vulncheck": -0.3817, "blocklist_de": -0.9027}, "mass": 0.8, "listed": false}}, "abq": false, "bot": 0.776, "det": null, "oid": "OL-440-ARIN", "org": "OnlyScans LLC", "pdb": null, "pfx": 1, "reg": "2026-02-25", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 1, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 402253, "h": "SKN-NETWORK-1", "n": "SKN Subnet & Telecom", "t": "Broadband & mobile", "w": 44, "cc": "KN", "cf": null, "cs": {"c": {"http_flood": 13, "web_exploit": 19, "bad_crawling": 9, "proxy_or_vpn": 1, "first_seen_30d": 3, "ssh_bruteforce": 23, "web_bruteforce": 18, "mail_bruteforce": 6, "cve:CVE-2017-9841": 5, "cve:CVE-2019-9082": 3, "cve:CVE-2026-4020": 2, "cve:CVE-2018-20062": 5, "cve:CVE-2025-54236": 1}, "n": 35}, "ev": {"dshield": {"n": 2, "p": 0.4185, "hi": 6.25, "lo": 0.81, "ips": 3, "mean": 2.98, "above": false}, "crowdsec": {"n": 9, "p": 0.9986, "hi": 15.18, "lo": 5.24, "ips": 35, "mean": 9.67, "above": true}, "threatfox": {"n": 5, "p": 0.9155, "hi": 10.49, "lo": 2.61, "ips": 5, "mean": 5.99, "above": true}, "blocklist_de": {"n": 4, "p": 0.8082, "hi": 9.03, "lo": 1.94, "ips": 9, "mean": 4.93, "above": true}}, "h2": [["2026-10-05", 58.823, 21.364, 1, false], ["2026-10-12", 98.019, 30.204, 1, false]], "sh": true, "uc": 3155, "v2": {"band": 1, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 0}, "lo": 30.204, "se": 0.852, "ts": 1.000, "map": 82.179, "obs": 5, "own": 179.736, "comp": {"urlhaus": -0.6035, "threatfox": 7.4046, "phishing_db": -0.7661}, "mass": 1.3, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 2, "crowdsec": 9, "vulncheck": 0, "blocklist_de": 4}, "lo": 98.019, "se": 0.439, "ts": 0.600, "map": 168.693, "obs": 15, "own": 257.282, "comp": {"cins": -1.8087, "dshield": 0.9886, "crowdsec": 5.6127, "vulncheck": -0.9251, "blocklist_de": 2.6542}, "mass": 12.0, "listed": false}}, "abq": false, "bot": 0.967, "det": {"threatfox": {"family:DCRat": 1, "family:Remcos": 1, "family:Tsundere": 1, "family:AdaptixC2": 1, "family:Cobalt Strike": 1}, "blocklist_de": {"ftp": 1, "ssh": 6, "bots": 1, "imap": 1, "mail": 1}}, "oid": "SSTL-49-ARIN", "org": "SKN Subnet & Telecom Ltd", "pdb": {"t": "Network Services", "sc": "Global", "tr": "100-200Gbps", "pol": "Open", "web": "https://skntelecom.com"}, "pfx": 3, "reg": "2026-03-04", "rir": "arin", "s24": 13, "sib": 0, "tor": 1, "w24": 9, "drop": 3, "hist": [["2026-10-05", 0.0976], ["2026-10-12", 0.8803]], "ipv4": 3328, "abuse": null, "score": 0.8803, "groups": ["sensors", "abusech"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0006024907083}, {"a": 402320, "h": "WELCHCO-DC1", "n": "Welch & Company, Inc.", "t": "Other", "w": 0, "cc": "US", "cf": null, "cs": null, "ev": {"shodan": {"n": 1, "p": 0.1982, "hi": 4.73, "lo": 0.35, "ips": 1, "mean": 2.00, "above": false}}, "h2": [["2026-10-05", 0.013, 0.012, 0, false], ["2026-10-12", 0.013, 0.013, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": null, "lo": 0.013, "se": 2.135, "ts": null, "map": 0.197, "obs": 0, "own": 1.033, "comp": null, "mass": 0.0, "listed": false}, "prov": false, "attack": {"n": null, "lo": 0.013, "se": 2.227, "ts": null, "map": 0.246, "obs": 0, "own": 1.083, "comp": null, "mass": 0.0, "listed": false}}, "abq": false, "bot": 0.200, "det": {"shodan": {"compromised": 1}}, "oid": "WELCH-20-ARIN", "org": "Welch & Company, Inc.", "pdb": null, "pfx": 1, "reg": "2026-03-24", "rir": "arin", "s24": 1, "sib": 0, "tor": 0, "w24": 0, "drop": 0, "hist": [["2026-10-05", 0.0013], ["2026-10-12", 0.0012]], "ipv4": 256, "abuse": null, "score": 0.0012, "groups": [], "sensors": [], "traffic": null}, {"a": 402506, "h": "ZENIX", "n": "Zenixcloud Inc", "t": "Hosting & VPS", "w": 13, "cc": "US", "cf": null, "cs": {"c": {"web_exploit": 1, "first_seen_30d": 2, "ssh_bruteforce": 3, "web_bruteforce": 1, "cve:CVE-2017-9841": 1, "cve:CVE-2019-9082": 1, "cve:CVE-2018-20062": 1}, "n": 3}, "ev": {"shodan": {"n": 22, "p": 1.0000, "hi": 26.78, "lo": 13.40, "ips": 22, "mean": 19.61, "above": true}, "crowdsec": {"n": 3, "p": 0.5055, "hi": 6.38, "lo": 1.12, "ips": 3, "mean": 3.29, "above": false}, "threatfox": {"n": 5, "p": 0.9123, "hi": 10.38, "lo": 2.58, "ips": 7, "mean": 5.93, "above": true}, "blocklist_de": {"n": 5, "p": 0.8876, "hi": 9.67, "lo": 2.40, "ips": 5, "mean": 5.52, "above": true}}, "h2": [["2026-10-05", 5.885, 6.461, 0, false], ["2026-10-12", 8.890, 6.355, 0, false]], "sh": false, "uc": null, "v2": {"band": 0, "host": {"n": {"urlhaus": 0, "threatfox": 5, "phishing_db": 0}, "lo": 6.355, "se": 0.881, "ts": 1.000, "map": 17.227, "obs": 5, "own": 6.230, "comp": {"urlhaus": -0.7454, "threatfox": 6.0583, "phishing_db": -0.8402}, "mass": 1.9, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 0, "crowdsec": 3, "vulncheck": 0, "blocklist_de": 5}, "lo": 8.890, "se": 0.520, "ts": 0.625, "map": 17.639, "obs": 8, "own": 3.456, "comp": {"cins": -1.3717, "dshield": -2.0607, "crowdsec": -1.4687, "vulncheck": -0.8826, "blocklist_de": 10.0474}, "mass": 7.9, "listed": false}}, "abq": false, "bot": 0.836, "det": {"shodan": {"c2": 1, "compromised": 21}, "threatfox": {"family:Cobalt Strike": 6, "family:Unknown malware": 1}, "blocklist_de": {"ssh": 4, "imap": 1, "mail": 1}}, "oid": "ZENIX-ARIN", "org": "Zenixcloud Inc", "pdb": null, "pfx": 43, "reg": "2026-05-12", "rir": "arin", "s24": 81, "sib": 0, "tor": 0, "w24": 11, "drop": 0, "hist": [["2026-10-05", 0.8305], ["2026-10-12", 0.8755]], "ipv4": 22016, "abuse": null, "score": 0.8755, "groups": ["abusech", "shodan"], "sensors": ["blocklist_de"], "traffic": null}, {"a": 403005, "h": "BLATANTHOST", "n": "Blatant Technologies, LLC", "t": "Hosting & VPS", "w": 184, "cc": "SC", "cf": null, "cs": {"c": {"http_flood": 60, "web_exploit": 66, "bad_crawling": 52, "proxy_or_vpn": 18, "first_seen_30d": 6, "ssh_bruteforce": 37, "web_bruteforce": 54, "home_connection": 1, "mail_bruteforce": 38, "cve:CVE-2017-9841": 9, "cve:CVE-2017-16894": 8, "cve:CVE-2019-17050": 7, "cve:CVE-2026-60137": 3, "cve:CVE-2026-63030": 10}, "n": 117}, "ev": {"shodan": {"n": 2, "p": 0.4104, "hi": 6.18, "lo": 0.80, "ips": 2, "mean": 2.94, "above": false}, "dshield": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "urlhaus": {"n": 4, "p": 0.8148, "hi": 9.15, "lo": 1.97, "ips": 10, "mean": 5.00, "above": true}, "crowdsec": {"n": 7, "p": 0.9865, "hi": 12.84, "lo": 3.89, "ips": 117, "mean": 7.81, "above": true}, "threatfox": {"n": 7, "p": 0.9880, "hi": 13.13, "lo": 3.98, "ips": 40, "mean": 7.99, "above": true}, "vulncheck": {"n": 1, "p": 0.1970, "hi": 4.72, "lo": 0.35, "ips": 1, "mean": 1.99, "above": false}, "blocklist_de": {"n": 7, "p": 0.9875, "hi": 13.02, "lo": 3.94, "ips": 57, "mean": 7.92, "above": true}}, "h2": [["2026-10-05", 128.416, 382.617, 1, false], ["2026-10-12", 159.653, 260.929, 1, false]], "sh": true, "uc": 96224, "v2": {"band": 1, "host": {"n": {"urlhaus": 4, "threatfox": 7, "phishing_db": 0}, "lo": 260.929, "se": 0.730, "ts": 0.636, "map": 604.209, "obs": 11, "own": 186.143, "comp": {"urlhaus": 6.7212, "threatfox": 2.4073, "phishing_db": -1.0984}, "mass": 6.2, "listed": false}, "prov": false, "attack": {"n": {"cins": 0, "dshield": 1, "crowdsec": 7, "vulncheck": 1, "blocklist_de": 7}, "lo": 159.653, "se": 0.436, "ts": 0.438, "map": 274.499, "obs": 16, "own": 53.289, "comp": {"cins": -1.9383, "dshield": -0.9413, "crowdsec": 1.0008, "vulncheck": -0.5119, "blocklist_de": 9.3993}, "mass": 13.5, "listed": false}}, "abq": false, "bot": 0.980, "det": {"shodan": {"c2": 2}, "threatfox": {"family:DCRat": 4, "family:Remcos": 4, "family:PureRAT": 4, "family:AsyncRAT": 6, "family:Potassium": 13}, "vulncheck": {"other_infrastructure": 1}, "blocklist_de": {"sip": 1, "ssh": 14, "bots": 1, "imap": 30, "mail": 31, "apache": 10, "bruteforcelogin": 10}}, "oid": "BTL-293-ARIN", "org": "Blatant Technologies, LLC", "pdb": null, "pfx": 9, "reg": "2026-09-25", "rir": "arin", "s24": 9, "sib": 0, "tor": 1, "w24": 7, "drop": 9, "hist": [["2026-10-05", 0.8884], ["2026-10-12", 0.8803]], "ipv4": 2304, "abuse": null, "score": 0.8803, "groups": ["sensors", "abusech"], "sensors": ["crowdsec", "blocklist_de"], "traffic": 0.0002052823602}], "cs_avg": {"http_flood": 0.4993, "data_centre": 0.3493, "web_exploit": 0.6777, "bad_crawling": 0.3324, "proxy_or_vpn": 0.2135, "first_seen_30d": 0.1170, "ssh_bruteforce": 0.2882, "web_bruteforce": 0.5856, "home_connection": 0.1277, "mail_bruteforce": 0.1480, "router_or_botnet": 0.0802}, "method": {"metric": "network_threat_score", "version": "v1", "parameters": {"bfdr": 0.05, "window": "ISO week, native source windows", "cf_ratio": 2, "min_count": 3, "cf_windows": ["12w", "52w"], "prior_rate": 1, "prior_shape": 1, "scored_groups": ["sensors", "cloudflare", "vulncheck", "abusech", "phishing", "shodan"], "sensor_quorum": 2, "lca_iterations": 400, "excess_threshold": 3}}, "routing": {"file": "2026/10/routeviews-rv2-20261019-1200.pfx2as.gz", "size_hist": {"1": 20453, "2": 16229, "4": 17881, "8": 8038, "16": 5614, "32": 3762, "64": 2262, "128": 1401, "256": 1828, "512": 703, "1024": 353, "2048": 198, "4096": 151, "8192": 70, "16384": 68, "32768": 25, "65536": 14, "131072": 5, "262144": 4, "524288": 2}, "routed_24s": 12217631}, "sources": [{"id": "blocklist_de", "org": "blocklist.de", "name": "blocklist.de attack sources", "unit": "occupied /24", "group": "sensors", "notes": "Per-service lists (ssh, mail, apache, ...) are stored as categories.", "family": "attack", "scored": true, "window": "48 hours", "licence": "Free; terms not stated."}, {"id": "cins", "org": "Sentinel IPS", "name": "CINS Army bad guys", "unit": "occupied /24", "group": "sensors", "notes": "Capped at 15,000 lines, so it is a truncated sample, not a census.", "family": "attack", "scored": true, "window": "rolling", "licence": "Free; terms not stated."}, {"id": "cloudflare", "org": "Cloudflare", "name": "Cloudflare Radar Layer 7 attack origins", "unit": "share of blocked requests", "group": "cloudflare", "notes": "Flags only when customers' WAF blocks and Cloudflare reputation blocks are both >=2x the network's share of requests, in both windows.", "family": "attack", "scored": true, "window": "12 and 52 weeks; 7 days for the weekly series", "licence": "CC BY-NC 4.0."}, {"id": "crowdsec", "org": "CrowdSec", "name": "CrowdSec CTI malicious feed", "unit": "occupied /24", "group": "sensors", "notes": "The fire feed is CrowdSec's curated blocklist and favours persistent addresses.", "family": "attack", "scored": true, "window": "7 days (fire since=7d)", "licence": "Enterprise CTI key. Aggregates only; IP addresses are not redistributed."}, {"id": "dshield", "org": "SANS Internet Storm Center", "name": "SANS ISC DShield top sources", "unit": "occupied /24", "group": "sensors", "notes": "Research scanners (isc.sans.edu/api/threatcategory/research) are removed before counting. On 2026-10-09 the table's scale changed (10,000th source fell from 281 targets to 1); the eval records the scale every week.", "family": "attack", "scored": true, "window": "30-day summary table", "licence": "CC BY-NC-SA 4.0. ISC: \"not a blocklist\"."}, {"id": "phishing_db", "org": "Phishing.Database", "name": "Phishing.Database active IPs", "unit": "occupied /24", "group": "phishing", "notes": null, "family": "infra", "scored": true, "window": "active at fetch time", "licence": "MIT."}, {"id": "shadowserver_country", "org": "Shadowserver Foundation", "name": "Shadowserver dashboard, per country", "unit": "unique IPs per day, per country", "group": "country", "notes": "Country context only (sinkhole infected devices, honeypot attackers, DDoS amplifiers), normalised per internet user as Shadowserver publishes it.", "family": "country", "scored": false, "window": "7 days", "licence": "Shadowserver dashboard terms."}, {"id": "shodan", "org": "Shodan", "name": "Shodan compromised, C2, malware and DoublePulsar hosts", "unit": "hosts", "group": "shodan", "notes": "Capped facets are split by country, so every network is counted, not only the top 1,000. Unit is hosts, not /24s. Hosts Shodan cannot place in a network (about 1%) are not counted.", "family": "compromised", "scored": true, "window": "current index", "licence": "Shodan API terms; restricted redistribution."}, {"id": "spamhaus_asndrop", "org": "Spamhaus", "name": "Spamhaus ASN-DROP", "unit": "listing", "group": "listing", "notes": "Shown as a \"criminal network\" badge, not scored: it lists small networks the other sources cannot see.", "family": "listing", "scored": false, "window": "current", "licence": "Free; may not be named in commercial material."}, {"id": "spamhaus_drop", "org": "Spamhaus", "name": "Spamhaus DROP ranges", "unit": "listed range", "group": "listing", "notes": "Hijacked or leased space; counted against the network that announces it today, which may not be its owner.", "family": "listing", "scored": false, "window": "current", "licence": "Free; may not be named in commercial material."}, {"id": "threatfox", "org": "abuse.ch", "name": "abuse.ch ThreatFox C2 IPs", "unit": "occupied /24", "group": "abusech", "notes": "Malware families stored as categories.", "family": "infra", "scored": true, "window": "recent export (about 7 days)", "licence": "Free for non-profit use; commercial use via Spamhaus."}, {"id": "tor_exits", "org": "Tor Project", "name": "Tor exit list", "unit": "exit IPs", "group": "listing", "notes": "Context only: traffic from a Tor exit was relayed for someone else.", "family": "listing", "scored": false, "window": "current", "licence": "Public."}, {"id": "uceprotect_l3", "org": "UCEPROTECT", "name": "UCEPROTECT level 3", "unit": "listing with spam score", "group": "listing", "notes": "Off by default in the atlas.", "family": "spam", "scored": false, "window": "current", "licence": "Free zone file; aggressive by design; pay-to-expedite delisting."}, {"id": "urlhaus", "org": "abuse.ch", "name": "abuse.ch URLhaus malware hosts", "unit": "occupied /24", "group": "abusech", "notes": "Only URLs whose host is an IPv4 literal are counted; hostnames are not resolved.", "family": "infra", "scored": true, "window": "URLs online at fetch time", "licence": "Free for non-profit use; commercial use via Spamhaus."}, {"id": "vulncheck", "org": "VulnCheck", "name": "VulnCheck attacker infrastructure", "unit": "occupied /24", "group": "vulncheck", "notes": "C2 servers, phishing kits, botnet nodes and attack tooling, stored as categories. cdn:* records are dropped.", "family": "infra", "scored": true, "window": "last seen within the scored week", "licence": "VulnCheck commercial licence."}], "countries": {"AD": {"honeypot": [27, 379.428571428571, 3.51], "sinkhole": [104, 1469, 1.83], "honeypot_ddos_amp": [1, 14, 0.68]}, "AE": {"honeypot": [598, 60.1428571428571, 0.56], "sinkhole": [8461, 851.142857142857, 1.06], "honeypot_ddos_amp": [14, 1.28571428571429, 0.06]}, "AF": {"honeypot": [17, 2.14285714285714, 0.02], "sinkhole": [2221, 256.857142857143, 0.32]}, "AG": {"honeypot": [11, 145.285714285714, 1.35], "sinkhole": [116, 1554.71428571429, 1.94]}, "AI": {"honeypot": [2, 162.666666666667, 1.51], "sinkhole": [13, 1091.85714285714, 1.36]}, "AL": {"honeypot": [405, 202.571428571429, 1.88], "sinkhole": [8885, 4442.28571428571, 5.54], "honeypot_ddos_amp": [37, 18.6666666666667, 0.91]}, "AM": {"honeypot": [162, 80.5714285714286, 0.75], "sinkhole": [2707, 1340, 1.67], "honeypot_ddos_amp": [1, 0.495049504950495, 0.02]}, "AO": {"honeypot": [147, 14.1428571428571, 0.13], "sinkhole": [9774, 943.428571428571, 1.18]}, "AQ": {"sinkhole": [7, 1623.14285714286, 2.02]}, "AR": {"honeypot": [6403, 176.285714285714, 1.63], "sinkhole": [52568, 1447.42857142857, 1.80], "honeypot_ddos_amp": [27, 0.755034612964128, 0.04]}, "AS": {"honeypot": [1, 45, 0.42], "sinkhole": [4, 160.714285714286, 0.20]}, "AT": {"honeypot": [159, 19.7142857142857, 0.18], "sinkhole": [2145, 267.142857142857, 0.33], "honeypot_ddos_amp": [2, 0.290577039092201, 0.01]}, "AU": {"honeypot": [532, 23.2857142857143, 0.22], "sinkhole": [5276, 231.142857142857, 0.29], "honeypot_ddos_amp": [12, 0.513334168023038, 0.03]}, "AW": {"honeypot": [3, 27.5714285714286, 0.26], "sinkhole": [90, 866.857142857143, 1.08]}, "AX": {"sinkhole": [1, null, null]}, "AZ": {"honeypot": [626, 75.8571428571429, 0.70], "sinkhole": [12988, 1572.28571428571, 1.96]}, "BA": {"honeypot": [109, 47.2857142857143, 0.44], "sinkhole": [5746, 2476.85714285714, 3.09], "honeypot_ddos_amp": [2, 0.646551724137931, 0.03]}, "BB": {"honeypot": [21, 88.8571428571429, 0.82], "sinkhole": [287, 1221.42857142857, 1.52]}, "BD": {"honeypot": [2666, 55.8571428571429, 0.52], "sinkhole": [50541, 1061.71428571429, 1.32], "honeypot_ddos_amp": [117, 2.48192156509737, 0.12]}, "BE": {"honeypot": [624, 58.8571428571429, 0.55], "sinkhole": [5255, 497.142857142857, 0.62], "honeypot_ddos_amp": [7, 0.621705635896743, 0.03]}, "BF": {"honeypot": [123, 22.4285714285714, 0.21], "sinkhole": [4769, 873.428571428571, 1.09]}, "BG": {"honeypot": [250, 50.8571428571429, 0.47], "sinkhole": [4402, 896.714285714286, 1.12], "honeypot_ddos_amp": [4, 0.902749490835031, 0.04]}, "BH": {"honeypot": [171, 100, 0.93], "sinkhole": [5993, 3504.57142857143, 4.37], "honeypot_ddos_amp": [3, 2.11695906432749, 0.10]}, "BI": {"honeypot": [6, 3.6, 0.03], "sinkhole": [480, 297.714285714286, 0.37]}, "BJ": {"honeypot": [31, 8.85714285714286, 0.08], "sinkhole": [1412, 403.428571428571, 0.50]}, "BM": {"honeypot": [3, 42.6, 0.39], "sinkhole": [50, 817.142857142857, 1.02]}, "BN": {"honeypot": [20, 48.8571428571429, 0.45], "sinkhole": [653, 1564.85714285714, 1.95]}, "BO": {"honeypot": [574, 103, 0.95], "sinkhole": [15525, 2782, 3.47], "honeypot_ddos_amp": [1, 0.17921146953405, 0.01]}, "BQ": {"honeypot": [3, null, null], "sinkhole": [25, null, null]}, "BR": {"honeypot": [15349, 96, 0.89], "sinkhole": [771219, 4820, 6.01], "honeypot_ddos_amp": [245, 1.47589285714286, 0.07]}, "BS": {"honeypot": [12, 37.2857142857143, 0.35], "sinkhole": [182, 541.714285714286, 0.68], "honeypot_ddos_amp": [1, 3, 0.15]}, "BT": {"honeypot": [6, 15.2857142857143, 0.14], "sinkhole": [183, 491, 0.61]}, "BW": {"honeypot": [36, 32.2857142857143, 0.30], "sinkhole": [909, 812.142857142857, 1.01]}, "BY": {"honeypot": [315, 40.4285714285714, 0.37], "sinkhole": [7138, 913, 1.14], "honeypot_ddos_amp": [2, 0.191815856777493, 0.01]}, "BZ": {"honeypot": [15, 76.8571428571429, 0.71], "sinkhole": [157, 831.857142857143, 1.04], "honeypot_ddos_amp": [2, 11, 0.54]}, "CA": {"honeypot": [3016, 84.5714285714286, 0.78], "sinkhole": [19095, 536, 0.67], "honeypot_ddos_amp": [31, 0.806944388757468, 0.04]}, "CD": {"honeypot": [37, 1.85714285714286, 0.02], "sinkhole": [6502, 307.571428571429, 0.38]}, "CF": {"honeypot": [1, 2.4, 0.02], "sinkhole": [163, 292.428571428571, 0.36]}, "CG": {"honeypot": [101, 128.428571428571, 1.19], "sinkhole": [2180, 2759.14285714286, 3.44]}, "CH": {"honeypot": [241, 28.7142857142857, 0.27], "sinkhole": [1982, 235.428571428571, 0.29], "honeypot_ddos_amp": [5, 0.617916525279946, 0.03]}, "CI": {"honeypot": [227, 18.1428571428571, 0.17], "sinkhole": [6823, 545.857142857143, 0.68]}, "CK": {"honeypot": [1, 105, 0.97], "sinkhole": [20, 2108.14285714286, 2.63]}, "CL": {"honeypot": [1805, 114.285714285714, 1.06], "sinkhole": [36647, 2322.42857142857, 2.89], "honeypot_ddos_amp": [5, 0.307803729856962, 0.02]}, "CM": {"honeypot": [48, 5.28571428571429, 0.05], "sinkhole": [2898, 316.714285714286, 0.39]}, "CN": {"honeypot": [220299, 234.428571428571, 2.17], "sinkhole": [293286, 312.142857142857, 0.39], "honeypot_ddos_amp": [244, 0.259629708448606, 0.01]}, "CO": {"honeypot": [2501, 72, 0.67], "sinkhole": [71101, 2047.42857142857, 2.55], "honeypot_ddos_amp": [3, 0.0978980708321336, 0.00]}, "CR": {"honeypot": [290, 69.8571428571429, 0.65], "sinkhole": [2723, 656.285714285714, 0.82], "honeypot_ddos_amp": [3, 0.640963855421687, 0.03]}, "CU": {"honeypot": [14, 1.88126159554731, 0.02], "sinkhole": [943, 122.428571428571, 0.15], "honeypot_ddos_amp": [1, 0.12987012987013, 0.01]}, "CV": {"honeypot": [20, 59, 0.55], "sinkhole": [316, 912.571428571429, 1.14]}, "CW": {"honeypot": [13, 113.428571428571, 1.05], "sinkhole": [225, 2005, 2.50]}, "CY": {"honeypot": [43, 41.8571428571429, 0.39], "sinkhole": [828, 795.857142857143, 0.99], "honeypot_ddos_amp": [8, 7.55494505494505, 0.37]}, "CZ": {"honeypot": [107, 11.2857142857143, 0.10], "sinkhole": [2725, 288.857142857143, 0.36], "honeypot_ddos_amp": [3, 0.300459526334394, 0.01]}, "DE": {"honeypot": [4887, 62, 0.57], "sinkhole": [20988, 266.285714285714, 0.33], "honeypot_ddos_amp": [1008, 13, 0.63]}, "DJ": {"honeypot": [3, 5, 0.05], "sinkhole": [94, 169.285714285714, 0.21]}, "DK": {"honeypot": [95, 16.7142857142857, 0.15], "sinkhole": [948, 166.571428571429, 0.21], "honeypot_ddos_amp": [2, 0.351493848857645, 0.02]}, "DM": {"honeypot": [8, 165.142857142857, 1.53], "sinkhole": [44, 879.285714285714, 1.10]}, "DO": {"honeypot": [439, 53.7142857142857, 0.50], "sinkhole": [17217, 2109.85714285714, 2.63], "honeypot_ddos_amp": [2, 0.210084033613445, 0.01]}, "DZ": {"honeypot": [852, 32.5714285714286, 0.30], "sinkhole": [64098, 2432.57142857143, 3.03], "honeypot_ddos_amp": [2, 0.0683111954459203, 0.00]}, "EC": {"honeypot": [1361, 133.714285714286, 1.24], "sinkhole": [39241, 3858.42857142857, 4.81], "honeypot_ddos_amp": [1, 0.131104555883317, 0.01]}, "EE": {"honeypot": [53, 44.1428571428571, 0.41], "sinkhole": [1109, 916.571428571429, 1.14], "honeypot_ddos_amp": [2, 2, 0.10]}, "EG": {"honeypot": [640, 11, 0.10], "sinkhole": [37756, 637.857142857143, 0.80], "honeypot_ddos_amp": [4, 0.0591316100692685, 0.00]}, "ER": {"sinkhole": [19, 75, 0.09]}, "ES": {"honeypot": [2366, 55.8571428571429, 0.52], "sinkhole": [34635, 814, 1.01], "honeypot_ddos_amp": [10, 0.231714688696353, 0.01]}, "ET": {"honeypot": [423, 17.5714285714286, 0.16], "sinkhole": [15852, 661.571428571429, 0.82]}, "EU": {"honeypot": [2, null, null], "sinkhole": [13, null, null], "honeypot_ddos_amp": [3, null, null]}, "FI": {"honeypot": [256, 48.5714285714286, 0.45], "sinkhole": [982, 186.428571428571, 0.23], "honeypot_ddos_amp": [23, 4.14285714285714, 0.20]}, "FJ": {"honeypot": [6, 10.2857142857143, 0.10], "sinkhole": [200, 315.857142857143, 0.39]}, "FK": {"sinkhole": [1, 412.8, 0.51]}, "FM": {"honeypot": [2, 37, 0.34], "sinkhole": [7, 171.714285714286, 0.21]}, "FO": {"honeypot": [1, 21, 0.19], "sinkhole": [6, 119.714285714286, 0.15]}, "FR": {"honeypot": [3524, 59.2857142857143, 0.55], "sinkhole": [53707, 903.142857142857, 1.13], "honeypot_ddos_amp": [60, 0.937831799947152, 0.05]}, "GA": {"honeypot": [60, 42.5714285714286, 0.39], "sinkhole": [1794, 1281.71428571429, 1.60]}, "GB": {"honeypot": [7629, 116.857142857143, 1.08], "sinkhole": [26172, 400.714285714286, 0.50], "honeypot_ddos_amp": [53, 0.807016021452874, 0.04]}, "GD": {"honeypot": [12, 186.428571428571, 1.73], "sinkhole": [42, 637.428571428571, 0.79]}, "GE": {"honeypot": [248, 90.5714285714286, 0.84], "sinkhole": [2431, 887.428571428571, 1.11], "honeypot_ddos_amp": [3, 1.09197080291971, 0.05]}, "GF": {"honeypot": [9, null, null], "sinkhole": [121, null, null]}, "GG": {"honeypot": [3, 49.7142857142857, 0.46], "sinkhole": [19, 350.714285714286, 0.44]}, "GH": {"honeypot": [104, 6.85714285714286, 0.06], "sinkhole": [19831, 1263.14285714286, 1.57]}, "GI": {"honeypot": [1, 36.3333333333333, 0.34], "sinkhole": [13, 404.285714285714, 0.50]}, "GL": {"honeypot": [2, 38, 0.35], "sinkhole": [10, 242.285714285714, 0.30]}, "GM": {"honeypot": [14, 24.5714285714286, 0.23], "sinkhole": [638, 1099.28571428571, 1.37]}, "GN": {"honeypot": [10, 3.14285714285714, 0.03], "sinkhole": [1440, 494.714285714286, 0.62]}, "GP": {"honeypot": [29, null, null], "sinkhole": [222, null, null], "honeypot_ddos_amp": [1, null, null]}, "GQ": {"honeypot": [6, 16, 0.15], "sinkhole": [109, 292.571428571429, 0.36]}, "GR": {"honeypot": [154, 18.2857142857143, 0.17], "sinkhole": [5888, 701.714285714286, 0.87], "honeypot_ddos_amp": [2, 0.218514104092173, 0.01]}, "GT": {"honeypot": [103, 8.71428571428571, 0.08], "sinkhole": [4455, 379.285714285714, 0.47], "honeypot_ddos_amp": [2, 0.127659574468085, 0.01]}, "GU": {"honeypot": [2, 16.8571428571429, 0.16], "sinkhole": [99, 727.571428571429, 0.91]}, "GW": {"honeypot": [3, 10.4, 0.10], "sinkhole": [172, 688, 0.86]}, "GY": {"honeypot": [48, 163.714285714286, 1.52], "sinkhole": [310, 1052.42857142857, 1.31]}, "HK": {"honeypot": [69116, 9987.71428571429, 92.51], "sinkhole": [5360, 774.571428571429, 0.97], "honeypot_ddos_amp": [67415, 9742, 475.28]}, "HN": {"honeypot": [120, 31.4285714285714, 0.29], "sinkhole": [5918, 1553.28571428571, 1.94], "honeypot_ddos_amp": [1, 0.26246719160105, 0.01]}, "HR": {"honeypot": [77, 23.7142857142857, 0.22], "sinkhole": [2082, 636.714285714286, 0.79], "honeypot_ddos_amp": [2, 0.489296636085627, 0.02]}, "HT": {"honeypot": [13, 2.85714285714286, 0.03], "sinkhole": [1394, 325.714285714286, 0.41]}, "HU": {"honeypot": [263, 32.8571428571429, 0.30], "sinkhole": [2811, 350.857142857143, 0.44], "honeypot_ddos_amp": [3, 0.374531835205992, 0.02]}, "ID": {"honeypot": [2018, 9.71428571428571, 0.09], "sinkhole": [211418, 1043.42857142857, 1.30], "honeypot_ddos_amp": [4, 0.0176279791284727, 0.00]}, "IE": {"honeypot": [251, 55.7142857142857, 0.52], "sinkhole": [3983, 883.285714285714, 1.10], "honeypot_ddos_amp": [5, 1.04719670573329, 0.05]}, "IL": {"honeypot": [455, 59.1428571428571, 0.55], "sinkhole": [14341, 1867.42857142857, 2.33], "honeypot_ddos_amp": [15, 2.05580357142857, 0.10]}, "IM": {"honeypot": [3, 47, 0.44], "sinkhole": [33, 512.857142857143, 0.64]}, "IN": {"honeypot": [4404, 7, 0.06], "sinkhole": [319105, 511.285714285714, 0.64], "honeypot_ddos_amp": [45, 0.0716575091575092, 0.00]}, "IO": {"honeypot": [1, null, null], "sinkhole": [2, null, null]}, "IQ": {"honeypot": [1074, 35.2857142857143, 0.33], "sinkhole": [54422, 1783.14285714286, 2.22], "honeypot_ddos_amp": [5, 0.159146227298259, 0.01]}, "IR": {"honeypot": [2141, 36.1428571428571, 0.33], "sinkhole": [59739, 1009.71428571429, 1.26], "honeypot_ddos_amp": [871, 14.5714285714286, 0.71]}, "IS": {"honeypot": [28, 83.5714285714286, 0.77], "sinkhole": [150, 443.714285714286, 0.55], "honeypot_ddos_amp": [1, 3, 0.15]}, "IT": {"honeypot": [1974, 39.1428571428571, 0.36], "sinkhole": [29596, 585.428571428571, 0.73], "honeypot_ddos_amp": [11, 0.214822771213749, 0.01]}, "JE": {"honeypot": [4, 38.5714285714286, 0.36], "sinkhole": [38, 383.285714285714, 0.48]}, "JM": {"honeypot": [253, 155.285714285714, 1.44], "sinkhole": [2544, 1561, 1.95]}, "JO": {"honeypot": [414, 60.5714285714286, 0.56], "sinkhole": [7135, 1043.14285714286, 1.30], "honeypot_ddos_amp": [4, 0.532163742690058, 0.03]}, "JP": {"honeypot": [2226, 19, 0.18], "sinkhole": [15419, 131.428571428571, 0.16], "honeypot_ddos_amp": [108, 0.943781942078365, 0.05]}, "KE": {"honeypot": [861, 39.5714285714286, 0.37], "sinkhole": [11797, 542.428571428571, 0.68]}, "KG": {"honeypot": [180, 54.2857142857143, 0.50], "sinkhole": [3858, 1162.14285714286, 1.45], "honeypot_ddos_amp": [4, 1, 0.05]}, "KH": {"honeypot": [145, 16.5714285714286, 0.15], "sinkhole": [2751, 310.285714285714, 0.39], "honeypot_ddos_amp": [1, 0.112866817155756, 0.01]}, "KI": {"honeypot": [1, 57, 0.53], "sinkhole": [68, 3888, 4.85]}, "KM": {"honeypot": [2, 24.3333333333333, 0.23], "sinkhole": [73, 976.142857142857, 1.22]}, "KN": {"honeypot": [26, 609.857142857143, 5.65], "sinkhole": [45, 1040.71428571429, 1.30], "honeypot_ddos_amp": [1, 23, 1.12]}, "KR": {"honeypot": [2935, 58.8571428571429, 0.55], "sinkhole": [13769, 276.571428571429, 0.34], "honeypot_ddos_amp": [17, 0.341708542713568, 0.02]}, "KW": {"honeypot": [205, 48, 0.44], "sinkhole": [4412, 1035.71428571429, 1.29], "honeypot_ddos_amp": [6, 1.34406438631791, 0.07]}, "KY": {"honeypot": [1, 24.1428571428571, 0.22], "sinkhole": [49, 906.285714285714, 1.13], "honeypot_ddos_amp": [1, 19, 0.93]}, "KZ": {"honeypot": [611, 39.5714285714286, 0.37], "sinkhole": [15398, 995.428571428571, 1.24], "honeypot_ddos_amp": [1, 0.0646412411118293, 0.00]}, "LA": {"honeypot": [34, 9.71428571428571, 0.09], "sinkhole": [2164, 609.714285714286, 0.76]}, "LB": {"honeypot": [174, 32.5714285714286, 0.30], "sinkhole": [7441, 1401.42857142857, 1.75], "honeypot_ddos_amp": [1, 0.188323917137476, 0.01]}, "LC": {"honeypot": [6, 59.1666666666667, 0.55], "sinkhole": [138, 1322, 1.65]}, "LI": {"honeypot": [1, 31.4, 0.29], "sinkhole": [9, 238.142857142857, 0.30]}, "LK": {"honeypot": [37, 3.28571428571429, 0.03], "sinkhole": [6217, 570.428571428571, 0.71], "honeypot_ddos_amp": [1, 0.0917431192660551, 0.00]}, "LR": {"honeypot": [8, 11, 0.10], "sinkhole": [366, 480.571428571429, 0.60]}, "LS": {"honeypot": [13, 12.5714285714286, 0.12], "sinkhole": [349, 339, 0.42]}, "LT": {"honeypot": [225, 101.428571428571, 0.94], "sinkhole": [3220, 1450.42857142857, 1.81], "honeypot_ddos_amp": [2, 0.842342342342342, 0.04]}, "LU": {"honeypot": [43, 69.8571428571429, 0.65], "sinkhole": [503, 821.571428571429, 1.02], "honeypot_ddos_amp": [2, 3.28571428571429, 0.16]}, "LV": {"honeypot": [140, 83.5714285714286, 0.77], "sinkhole": [2814, 1685.14285714286, 2.10], "honeypot_ddos_amp": [4, 2.29940119760479, 0.11]}, "LY": {"honeypot": [116, 36.1428571428571, 0.33], "sinkhole": [7939, 2488.57142857143, 3.10], "honeypot_ddos_amp": [1, 0.313479623824451, 0.02]}, "MA": {"honeypot": [1501, 54.2857142857143, 0.50], "sinkhole": [76759, 2779.14285714286, 3.46], "honeypot_ddos_amp": [5, 0.162925416364953, 0.01]}, "MC": {"honeypot": [6, 164.571428571429, 1.52], "sinkhole": [10, 265.428571428571, 0.33]}, "MD": {"honeypot": [177, 57.5714285714286, 0.53], "sinkhole": [1839, 599.285714285714, 0.75], "honeypot_ddos_amp": [3, 0.850628199162401, 0.04]}, "ME": {"honeypot": [14, 29.7142857142857, 0.28], "sinkhole": [298, 624.857142857143, 0.78], "honeypot_ddos_amp": [1, 2, 0.10]}, "MF": {"honeypot": [6, 778.714285714286, 7.21], "sinkhole": [14, 1927, 2.40]}, "MG": {"honeypot": [17, 3.14285714285714, 0.03], "sinkhole": [1138, 208.714285714286, 0.26]}, "MH": {"sinkhole": [15, 633.714285714286, 0.79]}, "MK": {"honeypot": [87, 51.1428571428571, 0.47], "sinkhole": [2807, 1641.71428571429, 2.05], "honeypot_ddos_amp": [1, 0.584795321637427, 0.03]}, "ML": {"honeypot": [60, 10.4285714285714, 0.10], "sinkhole": [3308, 576.428571428571, 0.72]}, "MM": {"honeypot": [373, 15.8571428571429, 0.15], "sinkhole": [10118, 428, 0.53], "honeypot_ddos_amp": [1, 0.0422832980972516, 0.00]}, "MN": {"honeypot": [79, 39, 0.36], "sinkhole": [1901, 945.714285714286, 1.18], "honeypot_ddos_amp": [1, 0.497512685329694, 0.02]}, "MO": {"honeypot": [32, 56.4285714285714, 0.52], "sinkhole": [168, 297.142857142857, 0.37], "honeypot_ddos_amp": [1, 2, 0.10]}, "MP": {"sinkhole": [6, 384.428571428571, 0.48]}, "MQ": {"honeypot": [34, null, null], "sinkhole": [383, null, null]}, "MR": {"honeypot": [18, 11.5714285714286, 0.11], "sinkhole": [3871, 2481.28571428571, 3.09]}, "MS": {"honeypot": [1, 356, 3.30], "sinkhole": [1, 356, 0.44]}, "MT": {"honeypot": [43, 114.142857142857, 1.06], "sinkhole": [995, 2617.42857142857, 3.26]}, "MU": {"honeypot": [36, 44.4285714285714, 0.41], "sinkhole": [836, 1026.14285714286, 1.28]}, "MV": {"honeypot": [11, 31.5714285714286, 0.29], "sinkhole": [305, 889.571428571429, 1.11]}, "MW": {"honeypot": [22, 6.14285714285714, 0.06], "sinkhole": [1004, 291, 0.36]}, "MX": {"honeypot": [3135, 34, 0.31], "sinkhole": [110373, 1199.57142857143, 1.50], "honeypot_ddos_amp": [11, 0.121104848851833, 0.01]}, "MY": {"honeypot": [1494, 54.4285714285714, 0.50], "sinkhole": [39673, 1446.42857142857, 1.80], "honeypot_ddos_amp": [2, 0.08020415603354, 0.00]}, "MZ": {"honeypot": [66, 9.85714285714286, 0.09], "sinkhole": [1332, 198.142857142857, 0.25]}, "NA": {"honeypot": [15, 11.4285714285714, 0.11], "sinkhole": [549, 419.428571428571, 0.52]}, "NC": {"honeypot": [3, 13.5714285714286, 0.13], "sinkhole": [28, 121, 0.15]}, "NE": {"honeypot": [10, 2.85714285714286, 0.03], "sinkhole": [1424, 423.714285714286, 0.53]}, "NF": {"sinkhole": [1, 1241, 1.55]}, "NG": {"honeypot": [489, 4.57142857142857, 0.04], "sinkhole": [27216, 260.714285714286, 0.32], "honeypot_ddos_amp": [1, 0.00957854406130268, 0.00]}, "NI": {"honeypot": [103, 37.2857142857143, 0.35], "sinkhole": [2303, 828.714285714286, 1.03], "honeypot_ddos_amp": [1, 0.359712230215827, 0.02]}, "NL": {"honeypot": [2478, 150.428571428571, 1.39], "sinkhole": [9843, 597.571428571429, 0.74], "honeypot_ddos_amp": [177, 10.8571428571429, 0.53]}, "NO": {"honeypot": [79, 14.7142857142857, 0.14], "sinkhole": [870, 161.285714285714, 0.20], "honeypot_ddos_amp": [1, 0.247371675943104, 0.01]}, "NP": {"honeypot": [442, 41.1428571428571, 0.38], "sinkhole": [10879, 1009.14285714286, 1.26]}, "NR": {"sinkhole": [7, 1097.14285714286, 1.37]}, "NU": {"sinkhole": [1, 1000, 1.25]}, "NZ": {"honeypot": [29, 6.28571428571429, 0.06], "sinkhole": [1519, 333.857142857143, 0.42], "honeypot_ddos_amp": [2, 0.496336996336996, 0.02]}, "OM": {"honeypot": [323, 65.5714285714286, 0.61], "sinkhole": [7985, 1623, 2.02], "honeypot_ddos_amp": [2, 0.474254742547426, 0.02]}, "PA": {"honeypot": [284, 100.428571428571, 0.93], "sinkhole": [2943, 1043.57142857143, 1.30], "honeypot_ddos_amp": [1, 0.472813238770685, 0.02]}, "PE": {"honeypot": [594, 29.7142857142857, 0.28], "sinkhole": [19367, 973.142857142857, 1.21], "honeypot_ddos_amp": [3, 0.138190954773869, 0.01]}, "PF": {"honeypot": [9, 45.2857142857143, 0.42], "sinkhole": [27, 132, 0.16]}, "PG": {"honeypot": [16, 11.5714285714286, 0.11], "sinkhole": [468, 341.285714285714, 0.43]}, "PH": {"honeypot": [1387, 18.7142857142857, 0.17], "sinkhole": [48352, 654.285714285714, 0.82], "honeypot_ddos_amp": [2, 0.0243539439859288, 0.00]}, "PK": {"honeypot": [11690, 190.857142857143, 1.77], "sinkhole": [80585, 1313.57142857143, 1.64], "honeypot_ddos_amp": [3, 0.0434735354852733, 0.00]}, "PL": {"honeypot": [1108, 34.8571428571429, 0.32], "sinkhole": [7499, 234.571428571429, 0.29], "honeypot_ddos_amp": [139, 4.28571428571429, 0.21]}, "PM": {"honeypot": [1, 260.6, 2.41], "sinkhole": [2, 347.6, 0.43]}, "PR": {"honeypot": [117, 53.1428571428571, 0.49], "sinkhole": [1471, 665.571428571429, 0.83], "honeypot_ddos_amp": [5, 2.09049773755656, 0.10]}, "PS": {"honeypot": [235, 88, 0.82], "sinkhole": [11322, 4235.57142857143, 5.28], "honeypot_ddos_amp": [2, 0.561167227833894, 0.03]}, "PT": {"honeypot": [435, 50.5714285714286, 0.47], "sinkhole": [11502, 1340.57142857143, 1.67], "honeypot_ddos_amp": [6, 0.694250194250194, 0.03]}, "PW": {"sinkhole": [21, 3046.85714285714, 3.80]}, "PY": {"honeypot": [602, 122.428571428571, 1.13], "sinkhole": [6757, 1373.42857142857, 1.71], "honeypot_ddos_amp": [1, 0.203252032520325, 0.01]}, "QA": {"honeypot": [200, 69.5714285714286, 0.64], "sinkhole": [2445, 848.857142857143, 1.06], "honeypot_ddos_amp": [99, 34.4285714285714, 1.68]}, "RE": {"honeypot": [39, null, null], "sinkhole": [254, null, null], "honeypot_ddos_amp": [1, null, null]}, "RO": {"honeypot": [301, 19.4285714285714, 0.18], "sinkhole": [3529, 227.857142857143, 0.28], "honeypot_ddos_amp": [8, 0.507239693811676, 0.02]}, "RS": {"honeypot": [178, 25.8571428571429, 0.24], "sinkhole": [6479, 940.285714285714, 1.17], "honeypot_ddos_amp": [2, 0.352477710968277, 0.02]}, "RU": {"honeypot": [6352, 51.1428571428571, 0.47], "sinkhole": [130717, 1054.28571428571, 1.31], "honeypot_ddos_amp": [775, 6.16129032258065, 0.30]}, "RW": {"honeypot": [13, 3, 0.03], "sinkhole": [1097, 266.142857142857, 0.33]}, "SA": {"honeypot": [965, 28.7142857142857, 0.27], "sinkhole": [35055, 1044, 1.30], "honeypot_ddos_amp": [143, 4.42857142857143, 0.22]}, "SB": {"honeypot": [3, 12.5, 0.12], "sinkhole": [61, 306.857142857143, 0.38]}, "SC": {"honeypot": [52, 896.714285714286, 8.31], "sinkhole": [370, 6379.28571428571, 7.95], "honeypot_ddos_amp": [1, 17, 0.83]}, "SD": {"honeypot": [6, 0.437956204379562, 0.00], "sinkhole": [2313, 168.714285714286, 0.21]}, "SE": {"honeypot": [909, 91.5714285714286, 0.85], "sinkhole": [3920, 394.857142857143, 0.49], "honeypot_ddos_amp": [81, 7.98964177816142, 0.39]}, "SG": {"honeypot": [2075, 392.285714285714, 3.63], "sinkhole": [6623, 1252.14285714286, 1.56], "honeypot_ddos_amp": [38, 7, 0.34]}, "SH": {"sinkhole": [1, 500.714285714286, 0.62]}, "SI": {"honeypot": [95, 54.4285714285714, 0.50], "sinkhole": [794, 453.857142857143, 0.57], "honeypot_ddos_amp": [2, 0.785714285714285, 0.04]}, "SK": {"honeypot": [79, 16.8571428571429, 0.16], "sinkhole": [2208, 475.714285714286, 0.59], "honeypot_ddos_amp": [1, 0.21551724137931, 0.01]}, "SL": {"honeypot": [14, 5.85714285714286, 0.05], "sinkhole": [1134, 474.571428571429, 0.59]}, "SM": {"honeypot": [1, 49, 0.45], "sinkhole": [7, 329, 0.41]}, "SN": {"honeypot": [222, 28.5714285714286, 0.26], "sinkhole": [6017, 770.571428571429, 0.96]}, "SO": {"honeypot": [18, 9.14285714285714, 0.08], "sinkhole": [844, 432.857142857143, 0.54]}, "SR": {"honeypot": [59, 167.857142857143, 1.55], "sinkhole": [291, 826.571428571429, 1.03], "honeypot_ddos_amp": [1, 3, 0.15]}, "SS": {"honeypot": [2, 2.2, 0.02], "sinkhole": [160, 178.142857142857, 0.22]}, "ST": {"honeypot": [5, 70.5714285714286, 0.65], "sinkhole": [179, 2756, 3.44]}, "SV": {"honeypot": [106, 32.5714285714286, 0.30], "sinkhole": [3067, 935, 1.17], "honeypot_ddos_amp": [1, 0.304878048780488, 0.01]}, "SX": {"honeypot": [7, null, null], "sinkhole": [50, null, null]}, "SY": {"honeypot": [207, 24.7142857142857, 0.23], "sinkhole": [13235, 1573.57142857143, 1.96], "honeypot_ddos_amp": [1, 0.118906064209275, 0.01]}, "SZ": {"honeypot": [14, 25, 0.23], "sinkhole": [273, 498.857142857143, 0.62]}, "TC": {"honeypot": [2, 48.25, 0.45], "sinkhole": [20, 631.285714285714, 0.79]}, "TD": {"honeypot": [4, 1.23310023310023, 0.01], "sinkhole": [993, 347, 0.43]}, "TG": {"honeypot": [112, 56, 0.52], "sinkhole": [1810, 909.428571428571, 1.13]}, "TH": {"honeypot": [706, 14.4285714285714, 0.13], "sinkhole": [37418, 769.857142857143, 0.96], "honeypot_ddos_amp": [29, 0.613794725546115, 0.03]}, "TJ": {"honeypot": [39, 11.4285714285714, 0.11], "sinkhole": [2015, 599.714285714286, 0.75], "honeypot_ddos_amp": [1, 0.297619047619048, 0.01]}, "TK": {"sinkhole": [1, 1222, 1.52]}, "TL": {"honeypot": [4, 6, 0.06], "sinkhole": [180, 300.285714285714, 0.37]}, "TM": {"honeypot": [9, 4.28571428571429, 0.04], "sinkhole": [58, 29, 0.04]}, "TN": {"honeypot": [1125, 142, 1.32], "sinkhole": [18826, 2377.14285714286, 2.96], "honeypot_ddos_amp": [5, 0.710437710437711, 0.03]}, "TO": {"honeypot": [1, 30.6666666666667, 0.28], "sinkhole": [9, 215.142857142857, 0.27]}, "TR": {"honeypot": [2296, 34.7142857142857, 0.32], "sinkhole": [15842, 240.857142857143, 0.30], "honeypot_ddos_amp": [41, 0.616587060356057, 0.03]}, "TT": {"honeypot": [72, 84.2857142857143, 0.78], "sinkhole": [1097, 1275.42857142857, 1.59], "honeypot_ddos_amp": [1, 1, 0.05]}, "TV": {"honeypot": [1, 171, 1.58]}, "TW": {"honeypot": [929, 43.2857142857143, 0.40], "sinkhole": [4306, 200.857142857143, 0.25], "honeypot_ddos_amp": [5, 0.226440226440226, 0.01]}, "TZ": {"honeypot": [101, 6.71428571428571, 0.06], "sinkhole": [5682, 374.857142857143, 0.47], "honeypot_ddos_amp": [1, 0.066006600660066, 0.00]}, "UA": {"honeypot": [4503, 153, 1.42], "sinkhole": [38559, 1308.57142857143, 1.63], "honeypot_ddos_amp": [5, 0.155121430995201, 0.01]}, "UG": {"honeypot": [61, 5, 0.05], "sinkhole": [2792, 229.571428571429, 0.29]}, "US": {"honeypot": [60938, 203.857142857143, 1.89], "sinkhole": [109342, 365.857142857143, 0.46], "honeypot_ddos_amp": [4157, 14, 0.68]}, "UY": {"honeypot": [316, 117.428571428571, 1.09], "sinkhole": [8101, 3011.85714285714, 3.75], "honeypot_ddos_amp": [2, 0.600371747211896, 0.03]}, "UZ": {"honeypot": [1181, 63.2857142857143, 0.59], "sinkhole": [9789, 526.428571428571, 0.66], "honeypot_ddos_amp": [3, 0.161290322580645, 0.01]}, "VA": {"sinkhole": [1, null, null]}, "VC": {"honeypot": [4, 64.2857142857143, 0.60], "sinkhole": [62, 929.714285714286, 1.16]}, "VE": {"honeypot": [1641, 79.8571428571429, 0.74], "sinkhole": [31668, 1539.42857142857, 1.92], "honeypot_ddos_amp": [1, 0.0486144871171609, 0.00]}, "VG": {"honeypot": [6, 254, 2.35], "sinkhole": [132, 5575.14285714286, 6.95], "honeypot_ddos_amp": [1, 42, 2.05]}, "VI": {"honeypot": [6, 85.1428571428571, 0.79], "sinkhole": [24, 359.285714285714, 0.45]}, "VN": {"honeypot": [1522, 22.4285714285714, 0.21], "sinkhole": [58152, 846.428571428571, 1.06], "honeypot_ddos_amp": [18, 0.255695992017296, 0.01]}, "VU": {"honeypot": [12, 116.714285714286, 1.08], "sinkhole": [17, 159.285714285714, 0.20]}, "WF": {"sinkhole": [2, 393.833333333333, 0.49]}, "WS": {"honeypot": [1, 15, 0.14], "sinkhole": [23, 349.857142857143, 0.44]}, "YE": {"honeypot": [8, 0.979085430698334, 0.01], "sinkhole": [1006, 124.714285714286, 0.16], "honeypot_ddos_amp": [1, 0.124069478908189, 0.01]}, "YT": {"honeypot": [2, null, null], "sinkhole": [25, null, null]}, "ZA": {"honeypot": [16309, 427, 3.96], "sinkhole": [53007, 1387.85714285714, 1.73], "honeypot_ddos_amp": [13779, 360.740470579434, 17.60]}, "ZM": {"honeypot": [35, 6.42857142857143, 0.06], "sinkhole": [2785, 508.142857142857, 0.63]}, "ZW": {"honeypot": [59, 11.8571428571429, 0.11], "sinkhole": [2515, 502, 0.63]}}, "censored_at": "2026-10-18"}